General information, not legal advice. Rules change; check the authorities in your country. Status 23 October 2026.
Privacy is a right, and so are the rules against money laundering
In the EU and Norway (through the EEA), the GDPR protects personal data; in Norway it applies through the Personal Data Act (personopplysningsloven). Exchanges must still identify customers under anti-money-laundering rules. Both hold at once.
Rules to know
- EU AMLR (2024/1624), from 10 July 2027: Article 79 forbids banks, financial institutions and crypto providers from keeping anonymous accounts, including accounts that obscure transactions "through anonymity-enhancing coins". It binds providers; it does not make it an offence for individuals to hold such assets. Recital 160 excludes providers of self-hosted wallet software that do not control the wallets.
- EU transfer rules (since 30 Dec 2024): providers must send sender and recipient data with crypto transfers. See travel rule.
- Data protection guidance: the European Data Protection Board adopted final guidelines on blockchain and the GDPR on 7 July 2026. It advises against storing personal data on a blockchain.
Enforcement against privacy services
In the US, Samourai Wallet's founders were sentenced in November 2025 to five and four years in prison for conspiracy to operate an unlicensed money transmitting business, after the prosecution said they knowingly handled criminal proceeds. Earlier, in June 2024, zkSNACKs shut down the coinjoin coordinator used by Wasabi, citing legal uncertainty.
Bitcoin's answer
Bitcoin itself needs no permission: you can hold it in your own wallet, run your own node and use good habits. What the law targets mainly is businesses that run services for others.