Italy -- AML/CFT Compliance Regulatory Overview

Crypto-asset service providers (CASPs) in Italy, including cryptocurrency/virtual asset service providers, must comply with AML/CFT requirements under Legislative Decree No. 231/2007 (as amended by Legislative Decrees No. 90/2017, No. 125/2019, No. 204/2024, and others), Legislative Decree No. 129/2024 (implementing EU MiCAR), and the EU Transfer of Funds Regulation (TFR) recast. These rules classify CASPs as equivalent to financial intermediaries, extending obligations like customer due diligence and reporting.[1][4][8][9]

Key AML/CFT Legislation

• Primary national law: Legislative Decree No. 231/2007, the core Italian AML/CFT framework, transposed from EU AML Directives (e.g., 2015/849 as amended by 2018/843), covering prevention of money laundering and terrorist financing via the financial system.[4][5][8]
• Crypto-specific updates:
  • Legislative Decree No. 129/2024 (effective September 2024), aligning with EU MiCAR for CASP authorization and operations.[1][4][6]
  • Legislative Decree No. 204/2024 (December 2024), amending AML Law to formally include CASPs.[4][9]
  • Ministerial Decree (January 17, 2022), requiring registration with OAM for virtual currency services (e.g., exchanges, e-wallets) operating in Italy, implementing EU rules on virtual assets.[2]
• EU alignments: 5th AMLD (2018/843) and TFR recast extend rules to virtual assets and wallet providers.[1][2]

Customer Due Diligence (CDD/KYC) Requirements

CASPs must conduct robust KYC processes, including customer identification, verification, and ongoing transaction monitoring to mitigate ML/TF risks.[1][4] This aligns with obligations for financial intermediaries under Legislative Decree 231/2007, requiring risk-based internal procedures for CDD.[4][8]

Suspicious Transaction Reporting

CASPs must report suspicious activities to the Financial Intelligence Unit (UIF) at the Bank of Italy, retaining transaction records for submission. This is mandated under Legislative Decree 231/2007 and applies fully to CASPs as "obliged entities."[4][8]

Record-Keeping Obligations

CASPs must retain transaction records and CDD data as required for financial intermediaries under Legislative Decree 231/2007, supporting UIF reporting and audits.[4]

Oversight Authorities

CASPs need formal authorization from Bank of Italy or CONSOB post-MiCAR; pre-existing OAM-registered entities have an interim regime until June 2026 or authorization decision.[1][6]