Custodial wallet / SaaS in Greece

Law 4557/2018 (as amended), which transposed the EU's 5th Anti-Money Laundering Directive (AMLD5) and 6th Anti-Money Laundering Directive (AMLD6) into national law. This law defines "providers of services of virtual assets" and mandates their registration.

HCMC Decision No. 2/902/10.03.2021 (and subsequent amendments), which provides further details on the registration process and ongoing obligations.

Custody Providers: Providers that offer custodian wallet services, holding, storing, and transferring virtual assets or private cryptographic keys on behalf of customers.

Establish and implement robust AML/CFT policies, procedures, and internal controls in line with national and EU requirements.

Conduct customer due diligence (CDD) and enhanced due diligence (EDD) where necessary.

Monitor transactions for suspicious activities and report them to the Hellenic Financial Intelligence Unit (FIU).

Appoint an AML Compliance Officer and potentially a Deputy AML Compliance Officer.

Regular staff training on AML/CFT.

Fit & Proper Requirements:

Management and key personnel must demonstrate integrity, competence, and absence of criminal records.

While not explicitly always requiring a physical office, the VASP must be incorporated in Greece and have its management and operational base within the country to effectively comply with Greek AML/CFT laws and HCMC supervision.

The national AML regime does not impose specific initial capital requirements as stringent as a licensing regime. However, VASPs are expected to have adequate financial resources to operate responsibly and comply with their obligations. The HCMC will assess the financial soundness as part of the registration.

Hellenic Capital Market Commission (HCMC) - Virtual Assets Page:

Law 4557/2018 (Government Gazette A' 139/30.07.2018): This is the primary Greek AML/CFT law, transposing the Fourth AML Directive (EU 2015/849). It established the general framework for obliged entities.

Law 4734/2020 (Government Gazette A' 199/08.10.2020): This crucial law amended Law 4557/2018 to transpose the Fifth AML Directive (5AMLD) into Greek law. It explicitly expanded the scope of obliged entities to include:

Providers of custodial wallet services (holding, storing, and transferring virtual currencies on behalf of customers).

Law 4816/2021 (Government Gazette A' 118/09.07.2021): This law further amended Law 4557/2018, primarily to transpose aspects of the Sixth Anti-Money Laundering Directive (6AMLD) concerning the criminalization of money laundering offenses.

Law 4991/2022 (Government Gazette A' 214/11.11.2022): This law made further amendments to Law 4557/2018, primarily to incorporate the changes from the EU Regulation on information accompanying transfers of funds and certain crypto-assets (Travel Rule).

Identification and Verification of the Customer:

Legal Entities: Obtain and verify the entity's name, legal form, address of registered office, company registration number, and the names of the directors. Crucially, they must identify and verify the Beneficial Owner(s) (BOs) – any natural person who ultimately owns or controls more than 25% of the entity, directly or indirectly, or exercises control through other means.

Regularly review transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Screen customers against sanction lists (e.g., EU, UN).

Enhanced Due Diligence (EDD): Required for higher-risk situations, such as:

Entity Targeted: A large international organized crime group operating "boiler rooms" (call centers) that defrauded investors across Europe, including Greece, using fake cryptocurrency investments. Violation Type: Investment fraud, aggravated fraud, money laundering, participation in a criminal organization. Outcome: Multiple arrests (at least 15 in Greece, others internationally), dismantling of call centers, freezing of assets. Criminal proceedings are ongoing.

Entity Targeted: Individuals involved in a fraudulent scheme that lured victims into investing in fake cryptocurrency platforms. Violation Type: Fraud, money laundering, establishment/participation in a criminal organization. Outcome: Arrests, ongoing investigations and criminal proceedings.