Ireland sets out first long-term AML roadmap, tightening oversight of crypto wallets through 2030
Ireland has unveiled its first national strategy to combat money laundering and terrorist financing through 2030, placing digital assets and crypto wallets at the center of its new controls. The plan mandates tougher checks on transfers involving self-hosted wallets and raises the bar for overseas crypto businesses that want to serve Irish customers.
According to the Department of Finance, the strategy is designed to align all national efforts against money laundering, terrorist financing, and proliferation financing under one coordinated framework for the rest of the decade. Crypto is treated as one of the highest-risk sectors and is therefore subject to some of the strictest new measures.
For the digital-asset industry, the strategy effectively completes Ireland’s rollout of the remaining requirements in the European Union’s Transfer of Funds Regulation as they apply to crypto. Under these rules, crypto-asset service providers must apply enhanced scrutiny to any transfer involving a self-hosted, or “private,” wallet and perform more stringent due diligence when dealing with non‑EU crypto firms.
In practical terms, this means that whenever a regulated crypto provider is involved in a transfer, detailed information about both the originator and the beneficiary must travel with the transaction. The required data can include the parties’ names, distributed-ledger addresses, crypto account identifiers, and unique transaction reference numbers, ensuring a clear audit trail for authorities.
The rules do not prohibit transactions with self-hosted wallets. Individuals remain free to hold and move assets using their own software or hardware wallets. However, when a regulated intermediary processes a transfer to or from such an address, it must collect identifying information on both sides of the transaction. For amounts above €1,000, the firm also has to take reasonable steps to determine whether its customer actually owns or controls the self-hosted address in question.
Receiving providers are expected to introduce internal systems for spotting incomplete or missing transfer data. If a firm detects gaps or inconsistencies, it must apply a risk-based response. Depending on the level of concern, it may ask for additional documentation, temporarily suspend the transfer, send the assets back, or refuse to execute the transaction altogether.
Crucially, the obligations fall on regulated intermediaries, not on the technology itself. Merely using a private wallet to hold or transfer tokens does not turn an individual into a regulated service provider. The focus of the law is on firms that offer exchange, custody, brokerage, or other crypto services as a business, and that are already under supervisory oversight.
Tánaiste and Minister for Finance Simon Harris framed the move as a response to the way criminal networks have adapted to new technology. He warned that organized crime groups are increasingly relying on crypto assets, sophisticated digital tools, and sprawling cross-border financial structures to disguise illegal proceeds. Harris stressed that the government’s objective is to ensure Ireland cannot be used as a haven for laundering criminal funds or evading sanctions.
He added that the long-term strategy is intended not only to reduce crime but also to protect Ireland’s economy and its standing as an international financial hub. By tightening standards and improving oversight, the authorities aim to facilitate cooperation between regulators, law-enforcement agencies, and responsible financial and technology companies operating in the country.
The new approach to crypto comes alongside the implementation of the Markets in Crypto-Assets Regulation, which brings in a harmonized licensing framework for crypto-asset service providers across the EU. MiCA sets out how firms must be authorized, how they should conduct business, and how they are supervised, while the Transfer of Funds rules govern what information must be gathered and transmitted when assets move between providers.
Although MiCA allowed member states to give existing, already registered crypto businesses up to 18 months to migrate into the new regime, Ireland opted for a stricter timeline. It chose a 12‑month grandfathering period, which, according to the European Securities and Markets Authority, ended on December 30, 2025. After that date, firms operating in Ireland could not simply rely on their previous registration status.
As a result, crypto companies that wanted to continue offering regulated services in Ireland had to obtain full MiCA authorization or exit the regulated Irish market before the final EU transition periods expired in July 2026. Licensed firms that secure authorization in one EU country can then “passport” those permissions across the bloc, using a single license to serve customers in multiple member states, provided they meet all MiCA requirements.
The distinction between MiCA and the Transfer of Funds Regulation is central to Ireland’s strategy. MiCA concerns who is allowed to operate, under what conditions, and how they are supervised. The transfer rules, by contrast, define the transparency obligations around individual transactions: what data needs to be collected, shared, and retained each time crypto moves between regulated entities or between a regulated entity and a private wallet.
Ireland’s tougher stance follows a comprehensive risk assessment published in June, which ranked crypto assets as a “very significant” threat in terms of potential money laundering and terrorist financing. That assessment highlighted a rise in digital-asset fraud, an increase in related investigations and prosecutions, the use of crypto to bypass international sanctions, and inconsistencies in regulatory frameworks from one jurisdiction to another.
Data from the Central Bank of Ireland used in the assessment shows that around 10% of the Irish population had invested in crypto by December. The authorities noted that this level of retail participation, combined with rapidly evolving products and services, raises concerns about tax evasion, corruption, and illicit flows through poorly regulated segments of decentralized finance.
Enforcement actions have already targeted major providers active in the Irish market. In November 2025, the Central Bank imposed a fine of approximately €21.5 million on Coinbase Europe, roughly $24 million at the time, for failings linked to its transaction-monitoring systems and delays in reporting those shortcomings. The case has been presented as an example of the regulator’s willingness to act against even large, well-known players when compliance falls short.
The June risk review was accompanied by a 30‑point implementation plan setting out concrete steps for regulators and other state bodies. Among other measures, the plan calls for expanded supervisory resources, more frequent inspections of high‑risk sectors, upgraded data analytics capabilities, and deeper information-sharing arrangements between domestic authorities and international partners.
For crypto firms, the new environment means that customer due diligence and ongoing monitoring processes will need to become far more sophisticated. Providers must be able to identify when transfers involve self-hosted wallets, assess the risk profiles of counterparties based outside the EU, and maintain robust systems for capturing and verifying originator and beneficiary information on every relevant transaction.
This is likely to drive growing investment in compliance technology, including blockchain analytics tools, automated screening of wallet addresses against sanctions and watchlists, and systems that can flag unusual transaction patterns in real time. Smaller providers may face particular pressure, as the costs of meeting these standards could be high relative to their revenues, potentially accelerating consolidation within the Irish and wider European crypto markets.
International firms serving Irish users from abroad will also feel the impact. Those based outside the EU will face more rigorous checks when transacting with EU-regulated providers, and may find that their access to the Irish market is constrained if they cannot meet local expectations on transparency and cooperation. Ireland’s stance aligns with a broader global trend: authorities in multiple regions are seeking to close gaps that have allowed cross-border arbitrage in AML standards.
At the same time, the government has signaled that it does not intend to stifle innovation. Officials have emphasized that clear, predictable rules can help credible firms plan for the long term and attract investment. By adopting MiCA and fully enforcing the Transfer of Funds Regulation, Ireland positions itself as part of a single, large market with uniform standards, which can be attractive to firms seeking regulatory certainty rather than fragmented rules.
The strategy also has implications for emerging areas such as decentralized finance and non‑custodial services. While many DeFi activities fall outside traditional licensing regimes, Irish authorities are closely monitoring the sector’s evolution and its links to regulated intermediaries. Over time, firms that provide interfaces, on‑ramps, or other gateways between DeFi and the formal financial system may face increasing expectations to capture and report transaction data similar to that required under the current rules.
Another sector under the spotlight is online gambling and betting. The strategy foresees the development of specific standards for gambling operators that accept crypto, focusing in particular on verifying the source of funds. These rules are expected to require stronger customer identification processes, more detailed checks on the origin of large or unusual deposits, and coordinated reporting of suspicious behavior across both the financial and gambling supervisory landscapes.
For individual users, the most visible change will be a thicker layer of questions and documentation around certain types of transfers. Moving funds between exchanges and self-hosted wallets, or transacting with platforms outside the EU, will likely involve more verification steps and occasional requests for proof of ownership or explanations of the transaction’s purpose. While this adds friction, the authorities argue it is necessary to prevent the abuse of crypto rails by criminals.
Looking toward 2030, Ireland’s AML roadmap sets a clear direction: greater transparency in crypto transactions, tighter oversight of service providers, and closer integration of digital-asset controls into the broader financial crime framework. As the decade progresses, firms operating in or targeting the Irish market will need to treat compliance not as an add‑on, but as a core part of their business models if they want to remain viable under the new regime.