Zcash and the EU's 2027 AML Rules: What Article 79 Bans, and What It Doesn't

From 10 July 2027, EU crypto-asset service providers (CASPs) are prohibited from keeping "any account otherwise allowing for the anonymisation of the customer account holder or the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins". That is Article 79(1) of the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624. The regulation defines anonymity-enhancing coins as crypto-assets with "built-in features designed to make crypto-asset transfer information anonymous, either systematically or optionally". Zcash's optional shielding fits that wording on a plain reading. The rule binds regulated firms, not individuals. Its recitals say the prohibition "does not apply to providers of hardware and software or providers of self-hosted wallets insofar as they do not possess access to or control over those crypto-asset wallets". Holding ZEC in your own wallet is not banned by this text. What is likely to change is whether EU exchanges and custodians will offer ZEC at all after mid-2027. A separate rule in MiCA has applied since 30 December 2024. It requires trading platforms to block admission of crypto-assets "that have an inbuilt anonymisation function unless the holders… and their transaction history can be identified".

This page sets out what each EU law says, word for word where it matters, what it does not say, the timeline, and practical options for holders. It is not legal advice. National supervisors and the firms themselves will decide how these rules are applied.

The three EU laws that matter

Sources: AMLR, MiCA, TFR, all read on EUR-Lex on 12 November 2026.

AMLR Article 79: the text

Article 79 sits in Chapter VIII, "Measures to mitigate risks deriving from anonymous instruments". Paragraph 1 reads in full:

"Credit institutions, financial institutions and crypto-asset service providers shall be prohibited from keeping anonymous bank and payment accounts, anonymous passbooks, anonymous safe-deposit boxes or anonymous crypto-asset accounts as well as any account otherwise allowing for the anonymisation of the customer account holder or the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins."

It continues: "Owners and beneficiaries of existing… crypto-asset accounts shall be subject to customer due diligence measures before those accounts… are used in any way."

The definition

Article 2(1), point (25):

"'anonymity-enhancing coins' means crypto-assets that have built-in features designed to make crypto-asset transfer information anonymous, either systematically or optionally"

Two words matter for Zcash:

• "built-in": Zcash's shielded pools are part of the protocol, not an add-on.
• "optionally": Zcash lets users choose transparent or shielded. The definition covers coins where anonymity is optional, not only those where it is mandatory.

So the argument sometimes heard, that Zcash is fine because it also has transparent addresses, does not fit the definition's wording. The regulation does not name any coin.

Why the EU says it is doing this

Recital 160 explains the reasoning:

"The anonymity of crypto-assets exposes them to risks of misuse for criminal purposes. Anonymous crypto-asset accounts, as well as other anonymising instruments, do not allow the traceability of crypto-asset transfers, and make it difficult to identify linked transactions that might raise suspicion or to apply an adequate level of customer due diligence."

It then sets the scope: "it is necessary to prohibit the provision and the custody of anonymous crypto-asset accounts or accounts allowing for the anonymisation or the increased obfuscation of transactions by crypto-asset service providers, including through anonymity-enhancing coins."

Who is covered

Article 3 lists the "obliged entities". Point (2) is "financial institutions", and Article 2(1)(6) defines a financial institution to include "a crypto-asset service provider". Article 2(1)(9) ties that term to MiCA's definition. In short: exchanges, brokers, custodial wallets and other MiCA-licensed crypto services.

Who is not covered

The same recital 160:

"That prohibition does not apply to providers of hardware and software or providers of self-hosted wallets insofar as they do not possess access to or control over those crypto-asset wallets."

So wallet makers whose software you run yourself, and hardware wallet vendors that never hold your keys, are outside the ban as the recital describes it. So are individuals holding their own coins: Article 79 prohibits firms from keeping accounts, and says nothing about people holding assets.

When

Article 90: "It shall apply from 10 July 2027, except in relation to obliged entities referred to in Article 3, points (3)(n) and (o), to which it shall apply from 10 July 2029." Points (3)(n) and (o) are football agents and professional football clubs. For crypto firms the date is 10 July 2027.

If you have seen a different date or article number in news coverage, check it against the Official Journal text. Headlines do not always quote it exactly.

What Article 79 does not say

Reading the text closely is as important as knowing what it bans. The AMLR text we read does not:

• ban individuals from owning, buying or using ZEC;
• ban self-custody wallets that do not hold your keys (recital 160);
• ban peer-to-peer transfers between self-hosted wallets;
• name Zcash or any other coin;
• say whether a coin's transparent mode alone could be offered, as opposed to the coin as a whole;
• say how viewing keys or similar disclosure tools would be treated.

The last two points are where interpretation will happen. A supervisor could read "any account otherwise allowing for… the anonymisation or increased obfuscation of transactions" as covering any account that lets a customer withdraw to a shielded address. It could also be read as covering any account in a coin that has the option at all. The text alone does not settle this. Expect firms to take the cautious reading.

MiCA Article 76(3): the rule already in force

MiCA's Title V on crypto-asset service providers has applied since 30 December 2024 (Article 149(2)). Article 76 covers trading platforms, and paragraph 3 reads:

"The operating rules of the trading platform for crypto-assets shall prevent the admission to trading of crypto-assets that have an inbuilt anonymisation function unless the holders of those crypto-assets and their transaction history can be identified by the crypto-asset service providers operating a trading platform for crypto-assets."

Differences from AMLR Article 79:

MiCA's exception is interesting for Zcash. Zcash has always offered ways to reveal transaction history to a chosen party: viewing keys. ZIP 316 describes unified viewing keys as allowing "observation of transaction activity across all pools, including transparent". Whether a platform could rely on viewing keys or transparent-only deposits to meet the "can be identified" condition is a legal question we cannot answer. Note too that the AMLR text contains no such exception.

The Transfer of Funds Regulation: the travel rule

The TFR (Regulation (EU) 2023/1113) has applied since 30 December 2024. It does not ban anything, but it shapes how exchanges handle withdrawals and deposits:

• It applies "to all transfers including transfers of crypto-assets to or from a self-hosted address, as long as there is a crypto-asset service provider involved" (recital 38).
• For a transfer to a self-hosted address, the sending CASP "shall obtain and hold the information" on originator and beneficiary and "ensure that the transfer of crypto-assets can be individually identified" (Article 14(5)).
• Above EUR 1,000, "the crypto-asset service provider of the originator shall take adequate measures to assess whether that address is owned or controlled by the originator". The receiving side has the same duty for transfers from a self-hosted address (Article 16(2)).

Recital 17 specifically mentions transfers "related to products, transactions or technologies designed to enhance anonymity, including privacy wallets, mixers or tumblers" as high-risk.

The TFR also asked the Commission, "by 1 July 2026", to report on "the risks posed by transfers to or from self-hosted addresses", including possible "limitation, control or prohibition of transfers involving self-hosted addresses" (Article 37(2) and the review list). We did not find or read that report, so we cannot say what it concluded.

In practice, you may already be asked to prove that a withdrawal address is yours, for example by a small test transfer or a signed message.

Timeline

What this probably means in practice

The law is clear about who it binds; how firms will respond is not yet public in the sources we read. A reasonable expectation, which you should check with your own provider:

Two caveats:

• Firms may act early. Nothing stops an exchange from dropping ZEC before 2027 for its own reasons. Delistings in different countries in the past have been business decisions as much as legal ones.
• Withdrawals usually come first. When a listing ends, exchanges normally give customers a window to withdraw. Make sure you have a self-custody wallet ready, and an address type the exchange can pay (often transparent).

Options for ZEC holders in the EU

1. Move to self-custody well before July 2027

If your ZEC sits on an exchange, consider withdrawing it to a wallet you control, ideally to a shielded address. See which exchanges support shielded withdrawals and best Zcash wallets. If the exchange only pays transparent addresses, withdraw to a transparent address you control and then shield it; how to shield Zcash covers the privacy side.

2. Expect travel-rule checks on the way out

For withdrawals above EUR 1,000 to your own wallet, the exchange must "assess whether that address is owned or controlled by" you (TFR Art. 14(5)). Have your wallet ready to receive a test amount or prove ownership.

3. Keep records

Self-custody does not remove tax obligations. Shielded wallets can export your own history; Zcash's viewing keys let you give read-only access to an accountant without spending rights (ZIP 316). See set up a view-only Zcash wallet.

4. Know which services are not CASPs

Article 79 applies to firms that keep accounts for customers. A wallet app that never holds your keys is, per recital 160, outside the prohibition. The same may not be true of every swap service or custodial on-ramp built into an app. Check whether a service takes custody or is a licensed CASP.

5. Don't confuse "regulated firms can't" with "you can't"

The AMLR's text targets accounts at obliged entities. If you read coverage saying "the EU bans Zcash", check whether it means the coin or the accounts. The text bans the accounts.

How Zcash's design meets regulators' concerns

Recital 160's concern is traceability: "do not allow the traceability of crypto-asset transfers". Zcash has features that bear on this, though whether they matter legally is for regulators to decide:

• Transparent addresses work like Bitcoin's and are fully traceable.
• Viewing keys give a chosen party full read access to an account's history across pools (ZIP 316).
• TEX addresses (ZIP 320) were created at an exchange's request. In November 2023 Binance asked for "a mechanism by which Binance could refuse deposits from shielded addresses and return them to the depositor". A TEX address guarantees a deposit comes only from transparent funds.
• Turnstile accounting (ZIP 209) makes the total in each shielded pool publicly verifiable, though not individual balances.

TEX shows that exchanges and the Zcash community have already worked out ways for a firm to handle ZEC only in its transparent form. Whether an "account" that only ever touches transparent ZEC is still one "allowing for… anonymisation" under Article 79 is exactly the open question.

What we could not verify

• The Commission's July 2026 report on self-hosted addresses under the TFR. We did not find or read it.
• Guidance from the EU's new AML authority or national supervisors on how Article 79 applies to coins with optional privacy.
• Specific exchange announcements about ZEC and the EU 2027 deadline. We did not open primary announcements, so we name none here.
• Whether any EU-licensed platform currently lists ZEC under the MiCA 76(3) exception, and on what basis.

These gaps are why this page quotes the law itself rather than summarising news about it. We will update it as primary sources appear. Our exchanges page lists venues; check each one's own notices for EU customers.

Five common misreadings

"The EU is banning privacy coins." The AMLR bans obliged entities from keeping certain accounts. It does not make owning a coin illegal. Coverage that says "ban" usually means this.

"It starts in 2025." MiCA's trading-platform rule and the TFR applied from 30 December 2024. The AMLR's Article 79 applies from 10 July 2027. They are different rules with different scopes.

"Zcash is fine because it is optional privacy." The definition explicitly covers anonymity features that work "either systematically or optionally".

"Self-custody wallets will be illegal." Recital 160 says the prohibition "does not apply to providers of hardware and software or providers of self-hosted wallets insofar as they do not possess access to or control over those crypto-asset wallets". The TFR adds checks on transfers between exchanges and self-hosted addresses; it does not ban such addresses.

"Viewing keys make Zcash compliant." Possibly relevant to MiCA's exception, which mentions holders and transaction history being identifiable. The AMLR's Article 79 contains no comparable exception in its text. No regulator we found has said either way.

Why exchanges already handle ZEC cautiously

The 2027 rules are new, but exchanges have been asking Zcash for compliance tools for years, and the Zcash community has built some:

• TEX addresses (ZIP 320) came directly from an exchange request in November 2023. ZIP 320 says Binance "requires that funds sent to their deposit addresses come from source addresses that are readily identifiable using on-chain information, such that if necessary funds may be rejected by sending them back to one of the source addresses".
• Transparent-only withdrawals remain common. Zodl's support pages note that "most exchanges only support withdrawals to transparent addresses" (Zodl support).
• Some exchanges went the other way. Gemini announced support for withdrawals to unified addresses, calling itself "the first exchange in the world to support UAs and sending Zcash to a shielded receiver in one", while keeping "transparent deposit addresses" (Gemini blog). Gemini's post does not discuss EU rules.

So an exchange that wants to keep ZEC under strict rules already has tools to accept and pay only transparent ZEC. Whether EU supervisors would accept that under Article 79's "any account otherwise allowing for… anonymisation" is the open question.

The key clauses, side by side

Outside the EU

This page covers EU law only. Other jurisdictions have their own rules, and exchanges outside the EU may still serve EU residents only if they comply with MiCA. For exchange-by-exchange support for shielded ZEC, see which exchanges support shielded withdrawals.

A note on terms: CASP, custody and "account"

Much of the confusion in coverage comes from three words.

• CASP (crypto-asset service provider) is defined in MiCA and imported into the AMLR by Article 2(1)(9). It covers firms "performing one or more crypto-asset services", such as custody, running a trading platform, exchange and transfer services. It does not cover software you install and run yourself.
• Custody means the firm controls the keys. Recital 160's carve-out turns on exactly this: providers "insofar as they do not possess access to or control over those crypto-asset wallets".
• Account in Article 79 is what the firm keeps for a customer. The TFR defines a crypto-asset account as one "held by a crypto-asset service provider in the name of one or more natural or legal persons and that can be used for the execution of transfers of crypto-assets", and the AMLR points to that definition.

Put together: the prohibition attaches to a firm holding an account for you that allows anonymisation. It does not attach to the coin you hold in your own wallet, or to the software that wallet runs on.

Checklist for EU users before July 2027

1. List where your ZEC is: exchange, custodial app, or self-custody.
2. Install a current self-custody wallet and back up its seed on paper.
3. Find out which address types your exchange can pay (transparent only, Sapling, unified).
4. Withdraw in good time, before any withdraw-only window closes, and expect travel-rule ownership checks above EUR 1,000.
5. Shield funds that arrive transparently, one address per transaction.
6. Keep records for tax, using your wallet's export or a viewing key you control.
7. Watch your exchange's notices and your national supervisor's guidance.

Our recommendation: For regulatory news across the crypto market, the team's Telegram channels @Crypto_MarketWatcher and @BlackBlockMarkets follow exchange and policy announcements. Confirm anything that affects your funds against the exchange's own notice.

FAQ

Is Zcash banned in the EU from 2027?

Not for individuals, by the text we read. From 10 July 2027, regulated crypto firms may not keep accounts that allow anonymisation "including through anonymity-enhancing coins" (AMLR Art. 79). Holding ZEC in your own wallet is not prohibited by that article.

Does the definition of anonymity-enhancing coins include Zcash?

The definition covers crypto-assets with built-in anonymity features, "either systematically or optionally". Zcash's optional shielded pools match that wording, though the regulation names no coin.

Can I still use a Zcash wallet app in the EU after 2027?

Recital 160 says the prohibition "does not apply to providers of hardware and software or providers of self-hosted wallets insofar as they do not possess access to or control over those crypto-asset wallets".

Will EU exchanges delist ZEC?

The law makes it hard for them to keep offering ZEC accounts after 10 July 2027. Individual firms will announce their own plans. We have not verified any specific announcement.

What about MiCA?

MiCA Article 76(3) has applied since 30 December 2024. It requires trading platforms to block admission of crypto-assets with "an inbuilt anonymisation function" unless holders and their transaction history can be identified.

Do viewing keys solve the problem?

They let a chosen party see an account's full history. MiCA's exception refers to holders and history being identifiable; the AMLR text has no exception. Whether viewing keys satisfy either is a legal question that regulators have not answered in the sources we read.

Will I need to prove my wallet is mine when withdrawing?

Possibly. Under the TFR, for transfers above EUR 1,000 to a self-hosted address, the exchange must assess whether you own or control it.

Does this apply to Bitcoin or Ethereum?

Article 79's anonymity-enhancing coin wording targets coins with built-in anonymity features. The TFR's travel rule applies to all crypto transfers involving a CASP.

When exactly does Article 79 start to apply?

On 10 July 2027, per Article 90 of the AMLR. Football agents and clubs, which are also obliged entities, follow from 10 July 2029; that later date does not apply to crypto firms.

Does the travel rule apply to shielded withdrawals?

The TFR applies to transfers involving a CASP, whatever the address type. A shielded withdrawal from an exchange is still a transfer from a CASP to a self-hosted address.

Can an EU exchange support only transparent ZEC?

The regulation does not answer this directly. Tools like TEX addresses let an exchange handle only transparent ZEC, but whether that satisfies Article 79 is for supervisors to decide.

What should I do now?

Make sure you have a self-custody wallet you control, know how to withdraw from your exchange, and keep records. Do it well before July 2027.

Where can I read the regulations myself?

All three are free on EUR-Lex, the EU's official law website, in every EU language: the AMLR is Regulation (EU) 2024/1624, MiCA is 2023/1114 and the Transfer of Funds Regulation is 2023/1113. Search the AMLR for "anonymity-enhancing" to find both the definition and Article 79. Recitals, the numbered paragraphs before the articles, explain the intent but are not themselves the operative rules.

Is this legal advice?

No. It is a reading of the published regulations. Ask a qualified lawyer about your situation.

Sources

• Regulation (EU) 2024/1624 (AMLR), EUR-Lex
• Regulation (EU) 2023/1114 (MiCA), EUR-Lex
• Regulation (EU) 2023/1113 (Transfer of Funds Regulation), EUR-Lex
• ZIP 316: Unified Addresses and Unified Viewing Keys
• ZIP 320: TEX addresses
• ZIP 209: Prohibit Out-of-Range Chain Value Pool Balances
• Zodl support: Depositing from an exchange
• Gemini: Privacy Made Simple, Gemini Adds Zcash Unified Addresses