# AMLR Art. 40 — Self-hosted address transactions > The AMLR applies from 10 July 2027, which is also the deadline for the AMLA guidelines under Art. 40(2). See [[Effective-dates timeline]]. - **Part of:** [[AMLR]] - **FATF keying:** [[FATF R.15 - New technologies|FATF R.15]] - **Swiss provisions:** [[GwV-FINMA Art. 51a - Virtual currency transactions|GwV-FINMA Art. 51a]], [[GwV-FINMA Art. 10 - Information in payment orders|GwV-FINMA Art. 10]] - **Detailed citation:** GwV-FINMA Art. 51a, 10 ## What it requires Crypto-asset service providers must identify and assess the risk of crypto-asset transfers to or from a self-hosted address, with internal policies, procedures and controls for that purpose, and apply commensurate mitigating measures, including one or more of: risk-based identity verification of the originator/beneficiary or beneficial owner (including via third parties); additional information on origin and destination; enhanced monitoring; or other measures against money laundering, terrorist financing and sanctions non-implementation/evasion risk (Art. 40(1)). AMLA must issue guidelines by 10 July 2027 on these measures and on verifying self-hosted-address ownership (Art. 40(2)). ## Swiss position GwV-FINMA Art. 51a (Title 5; see [[Scope note — GwV-FINMA Title 5 vs VSB 20]]) requires identifying the contracting party once one-off virtual-currency transactions (not money or value transfers, no ongoing business relationship) reach CHF 1,000, with a 30-day aggregation rule for cash/anonymous payments (Abs. 1-1bis), an exemption for already-identified repeat customers (Abs. 2), and mandatory identification on suspicion (Abs. 3). GwV-FINMA Art. 10 (Title 1, general provisions) governs payment-order information: the originator's intermediary must state accurate and complete originator data and complete beneficiary data (Abs. 1), with a domestic simplification to account/reference number plus a 3-working-day disclosure window on request (Abs. 2-3), and the beneficiary's intermediary must set a risk-based procedure for incomplete-information orders (Abs. 5). Neither provision addresses self-hosted or unhosted wallet addresses; no such term appears in the GwV-FINMA. ## Key divergences The AMLR keys its rule to the address itself — any transfer to or from a self-hosted address triggers a risk assessment plus a mitigating measure — while Swiss law has no dedicated self-hosted-wallet provision. The nearest texts, Art. 51a (transaction-threshold identification) and Art. 10 (payment-order data, presupposing an intermediary on each side), do not reach the address concept. The thresholds diverge: Art. 51a fixes CHF 1,000 with 30-day aggregation for cash/anonymous payments, while AMLR Art. 40 sets no monetary threshold and requires risk-commensurate measures in every case. Art. 10's domestic simplifications (Abs. 2-3), including the 3-working-day disclosure window, have no AMLR Art. 40 analogue. AMLR Art. 40(1)(d) extends mitigation to sanctions non-implementation/evasion risk; neither Swiss provision has a sanctions limb. AMLR Art. 40(1)(a) reaches the beneficial owner of the originator/beneficiary and permits third-party reliance; Art. 51a addresses only the contracting party. The AMLA guidelines due 10 July 2027 must cover verifying who owns or controls a self-hosted address, a question Swiss law does not pose. The two Swiss provisions also differ in reach: Art. 10 binds intermediaries generally, while Art. 51a binds only Title 5 addressees, so they do not apply to the same population. ## Effective dates The AMLR applies from 10 July 2027, which is also the deadline for the AMLA guidelines under Art. 40(2). See [[Effective-dates timeline]]. ## Authoritative text > [!quote]- Regulation (EU) 2024/1624 (AMLR), Article 40 — English text (EUR-Lex, CELEX 32024R1624) > **Article 40** > *Measures to mitigate risks in relation to transactions with a self-hosted address* > 1. Crypto-asset service providers shall identify and assess the risk of money laundering and financing of terrorism associated with transfers of crypto-assets directed to or originating from a self-hosted address. To that end, crypto-asset service providers shall have in place internal policies, procedures and controls. > Crypto-asset service providers shall apply mitigating measures commensurate with the risks identified. Those mitigating measures shall include one or more of the following: > (a) taking risk-based measures to identify, and verify the identity of, the originator or beneficiary of a transfer made from or to a self-hosted address or beneficial owner of such originator or beneficiary, including through reliance on third parties; > (b) requiring additional information on the origin and destination of the crypto-assets; > (c) conducting enhanced ongoing monitoring of transactions with a self-hosted address; > (d) any other measure to mitigate and manage the risks of money laundering and financing of terrorism as well as the risk of non-implementation and evasion of targeted financial sanctions. > 2. By 10 July 2027, AMLA shall issue guidelines to specify the mitigating measures referred to in paragraph 1, including: > (a) the criteria and means for identification and verification of the identity of the originator or beneficiary of a transfer made from or to a self-hosted address, including through reliance on third parties, taking into account the latest technological developments; > (b) criteria and means for the verification of whether or not the self-hosted address is owned or controlled by a customer. ## Sources - AMLR Art. 40 — CELEX 32024R1624 - AMLR Art. 2(14) — CELEX 32024R1624 - GwV-FINMA SR 955.033.0, Art. 51a - GwV-FINMA SR 955.033.0, Art. 10 - GwV-FINMA SR 955.033.0, Art. 35 - GwV-FINMA SR 955.033.0, Art. 43a