Addendum: Thresholds and Levels of Due Diligence

This material is an addendum to the guide "How to Successfully Pass an AML Check on Crypto Transactions".

One of the biggest misconceptions when using financial institutions and crypto exchanges is that there is a "magic number" or threshold below which a person is completely invisible to AML checks. Although the law defines specific amounts, the modern regulatory framework is built around the Risk-Based Approach (RBA).

This means that the depth of the check does not depend only on the amount, but on the combination of the amount, the customer's profile and the nature of the transaction.

1. The Main Statutory Thresholds in the EU and Bulgaria

The regulatory framework for these thresholds is laid down at European level in the Anti-Money Laundering Directives (AMLD) and the Regulations (the Travel Rule), and in Bulgaria — in the Measures Against Money Laundering Act (ЗМИП) and the Rules for its implementation.

The EUR 1,000 Threshold (Crypto Transfers and the Travel Rule)

• Legal basis: Regulation (EU) 2023/1113 (the Travel Rule) and Art. 11(1)(5) of the Bulgarian Measures Against Money Laundering Act.
• What it means: For transfers of crypto assets with a value equal to or exceeding EUR 1,000 (or its equivalent), the providers (CASPs) are obliged to apply due diligence measures, including collecting and exchanging information about the originator and the beneficiary. For transfers to self-hosted wallets, the requirements for verifying ownership of the wallet are even stricter.

The EUR 15,000 Threshold (Occasional Transactions)

• Legal basis: Directive (EU) 2015/849 (AMLD4/5) and Art. 11(1)(2) of the Bulgarian Measures Against Money Laundering Act.
• What it means: Carrying out an occasional operation or concluding a transaction with a value equal to or exceeding EUR 15,000 (or its equivalent in another currency) mandatorily requires the application of due diligence measures, regardless of whether the operation is carried out through one or several linked transactions.

The EUR 10,000 Threshold (Cash Payments / Border Control)

• Legal basis: The Bulgarian Act on the Restriction of Cash Payments and EU customs legislation.
• What it means: In Bulgaria, cash payments above BGN 10,000 are prohibited. At EU level, carrying cash above EUR 10,000 across a border is subject to mandatory declaration. This threshold is often used by financial institutions as a psychological and algorithmic line for heightened attention to bank transfers to crypto exchanges.

2. Levels of Depth of the Check

Depending on which thresholds the user reaches and what their risk profile is, they fall into one of the following three levels of due diligence:

Level 1: Simplified Due Diligence (SDD)

• When it applies: For low-risk users (e.g. local citizens without political functions) and transactions below the main thresholds (e.g. crypto purchases of EUR 200–500).
• Depth of the check: Only basic identification (KYC) is required — an ID card, a selfie and sometimes proof of address. The system does not request documents on the origin of funds, since the amounts are within the usual profile of an average user.

Level 2: Customer Due Diligence (CDD)

• When it applies: When transactions begin to approach the thresholds (e.g. cumulative transfers of several thousand euros) or with more frequent trading that exceeds the profile initially declared by the customer.
• Depth of the check: Includes transaction monitoring. The exchange may request an update of your data (a KYC Refresh) and ask general questions through the app: "What is your main occupation?" or "What is the purpose of your transactions?". A single income document (e.g. a payslip) may be requested to justify the volume.

Level 3: Enhanced Due Diligence (EDD)

• When it applies: 1) Automatically when large thresholds are exceeded (e.g. single transactions above EUR 10,000/15,000). 2) In the presence of high-risk factors — for example, the customer is a Politically Exposed Person (PEP), receives funds from a high-risk country or uses cryptocurrency mixers, even if the amount is EUR 500.
• Depth of the check: This is the full AML check described in the main guide. Explicit and detailed documents on the Source of Funds and the Source of Wealth are required. The entire financial history is examined, along with tax returns, the transaction history on the blockchain and the logic of the movement of funds.

3. Where Does the Flexibility of the Thresholds Come From? (The Risk Profile)

Many users complain: "My friend transferred EUR 20,000 and was asked for nothing, while my EUR 2,000 transfer got blocked. Why?"

The answer lies in the Guidelines of the European Banking Authority (EBA) and the obligation to apply a Risk-Based Approach (Art. 16 of the Bulgarian Measures Against Money Laundering Act).

The law says that the institution must assess the risk of each individual customer based on their individual characteristics. The algorithms set "internal" Dynamic Thresholds for each account, which depend on:

• What is declared in the KYC profile: If customer A is an IT specialist and has declared a monthly income of EUR 5,000, the algorithm will expect larger transfers and will not be triggered at EUR 4,000. If customer B is a student with no declared income, a transfer of EUR 2,000 is an anomaly relative to the profile and will trigger Enhanced Due Diligence (EDD).
• Historical behaviour: If you make regular small transfers over the course of 2 years, you build trust in the system. A sudden large transfer on a new account is a red flag.
• Linked transactions and "smurfing": If the algorithm notices that you make 4 transfers of EUR 900 each (obviously below the EUR 1,000 Travel Rule threshold) within a few days, this is registered as an attempt to circumvent the threshold and automatically raises the Risk Score, triggering EDD.

Summary

The statutory thresholds (such as EUR 1,000 or EUR 15,000) are the absolute ceiling — above them, the institution is obliged to act. But because of the Risk-Based Approach, institutions have the freedom (and the obligation) to request evidence at any amount whatsoever, if the algorithms or the analysts detect a mismatch between the operation, the customer's profile and the economic logic.