Meridian Digital: Ninety Transfers, Twelve Self-Hosted Wallets
Meridian Digital Pte Ltd, a Singapore-incorporated payment institution, opens a corporate account at Nordhaven Exchange, an EU-based crypto-asset service provider. Over six weeks Meridian receives 90 inbound transfers of BTC and ETH from 12 self-hosted wallets, each between EUR 18,000 and EUR 24,000, totalling EUR 2.4 million, described as 'software licensing receipts'. For 61 of the 90 transfers the sending side supplied only a wallet address and no originator information. Meridian's stated ultimate beneficial owner is a nominee director in the Seychelles; the actual signatory logs in from a jurisdiction Nordhaven rates high-risk. Meridian now asks to withdraw EUR 900,000 to a newly opened account at a Turkish bank. An analyst notes that 9 of the 12 wallets trace, two hops back, to a wallet Nordhaven reported to the FIU eighteen months ago.
1. What does the Travel Rule require here, given that the transfers come from self-hosted wallets rather than from another CASP?
Read the worked answer
Do not apply the CASP-to-CASP rule mechanically; the counterparty type changes the obligation.
CASP-to-CASP transfers. Under Regulation (EU) 2023/1113, which applies to crypto-asset transfers from 30 December 2024, transfers between CASPs require complete originator and beneficiary information with no de minimis threshold, and the receiving CASP must screen before making funds available. That is not this fact pattern.
Transfers to or from self-hosted addresses. Here the obligation is different. For transfers above EUR 1,000, the CASP must apply risk-based measures to verify that the customer owns or controls the address. The absence of an originator institution does not remove the obligation; it converts it into an ownership-verification and monitoring obligation.
What Nordhaven should actually do
- Obtain proof of control: a signed message from each of the 12 addresses, or a micro-transaction challenge, tied to Meridian's verified identity.
- Map each address to a documented business relationship and to a named counterparty in the licensing paperwork.
- Treat 'no originator information' as a risk factor in the customer risk score, not as a technical gap to be waived.
- Record the measures taken; supervisory expectation is that the file shows why the risk was acceptable or was escalated.
Nordhaven cannot claim the transfers were exempt because they were self-hosted. The correct answer is verified control plus enhanced monitoring, or refusal.
2. Should Nordhaven file a suspicious activity report, and can it refuse or delay the EUR 900,000 withdrawal without tipping off the customer?
Read the worked answer
Filing. The combination of structuring-range amounts (all just under EUR 25,000), 12 fresh self-hosted wallets, a nominee UBO, a high-risk login location, an unexplained change of banking destination, and a two-hop link to a previously reported wallet crosses the suspicion threshold comfortably. File promptly with the FIU, before the withdrawal is processed, not after.
Delay or refusal. Most regimes permit a CASP to delay or decline a transaction where a report has been made and to do so without prior notice to the customer, provided the delay is documented and time-limited by the applicable rules. Check the local implementation: some jurisdictions require prior consent from the FIU to hold beyond a set period, others allow a defined freeze window. Do not invent an indefinite freeze.
Tipping off. Prohibited. The customer should receive a neutral, templated response about routine review. Do not mention the report, the FIU, the traced wallet, or the analyst's name. Limit internal access to the case file and log every person who accessed it.
Exit decision. If the EDD cannot resolve the concerns, off-board and file; but sequence matters. Complete the investigation, file the report, then exit - exiting first destroys the audit trail and looks like risk transfer rather than risk management.
Documented reasoning is the defence. A file that says only 'declined, suspicious' is not.
3. Design the enhanced due diligence plan. What would actually resolve the risk, and what residual risk remains if Nordhaven keeps the relationship?
Read the worked answer
Identity and control
- Verify the Seychelles nominee arrangement: trust deed, powers of attorney, and the identity and source of wealth of the person behind the signatory.
- Confirm the signatory's location and why they operate from a high-risk jurisdiction; obtain corroboration, not just an explanation.
Source of funds and wealth
- Obtain the software licensing contracts, invoices, and bank statements showing the underlying commercial flow, and test that the amounts reconcile to the EUR 2.4 million.
- Trace each of the 12 wallets forward and backward; explain the two-hop link to the previously reported wallet in writing, with evidence.
- Verify who controls each address using signed messages; compare creation dates for clustering.
Destination
- Identify the Turkish bank account holder, screen against sanctions and adverse media, and confirm the commercial rationale for the new account.
Residual risk Even with clean documents, the following remains: wallet clustering indicates common control, so 61 undocumented transfers are not 61 isolated gaps; the two-hop link is a prior-report nexus; and the nominee UBO obstructs beneficial ownership transparency. If those cannot be resolved, the residual risk is not acceptable for a correspondent-style cash-out relationship.
Recommended decision: file, hold the withdrawal pending the outcome, complete the plan within a defined period, and exit if the two-hop explanation is not evidenced. Record the decision, the approver, and the date.