Ministry of Finance Order No. 465 of 28 December 2022, Criteria of Money Laundering Risk, is the official list of risk criteria: registered with the Ministry of Justice on 9 February 2023 under No. 258/39314 and in force since 24 February 2023. It expressly describes the classic pattern of P2P operations, and virtual assets are mentioned separately.
And the main point first, because this is muddled almost everywhere: the order does not apply to banks. Clause 2 of section I lists who does use it, and banks are excluded in as many words. Banks work from a different document, National Bank Resolution No. 65. Order No. 465 binds, among others, providers of virtual asset services, which is to say exchange services.
Below: whom the order actually binds, how the banking rules differ from it, which criteria catch P2P specifically, and what to do when your ordinary life happens to match a criterion. We are an exchange service, not lawyers: we summarise what the documents say and do not undertake to predict any particular bank's decision.
What this document is and whom it binds
Order No. 465 is the official list of criteria of the risk of laundering criminally obtained income. The Ministry of Finance approved it on 28 December 2022, the Ministry of Justice registered it on 9 February 2023, and it took effect on 24 February 2023. It replaced the earlier Order No. 584 of 2016 and has not been amended once since.
The document is addressed not to clients but to primary financial monitoring entities, and not to all of them. Clause 2 of section I names them one by one, and the list opens with a caveat: professional participants of capital markets, other than banks. Then come professional participants of organised commodity markets and providers of virtual asset services.
Next come the specially designated entities: advocates and law offices, notaries, legal service providers, auditors, accountants, tax advisers, intermediaries in real estate transactions, cash dealers in precious metals and stones, operators of lotteries and gambling, and dealers in cultural property.
Banks do not appear on that list at all; their only mention is the caveat excluding them. Providers of virtual asset services, on the other hand, do appear. Order No. 465 binds exchange services in particular: in describing this document we are describing the rules of our own industry, not the banking one.
We checked the wording of the order against the state legislation register on 19 September 2026, where it is published under identifier z0258-23. What follows is a summary in our own words, with a pointer to the section and clause, rather than quotations.
What a bank actually works from: Resolution No. 65
Bank financial monitoring is set out in a separate document, National Bank Board Resolution No. 65 of 19 May 2020. It is in force, and its current version dates from 17 July 2026. It is its annexes, not the Ministry of Finance order, that set the risk criteria and suspicion indicators a bank builds into its systems.
The difference is not only the number. Resolution No. 65 has a clause under which a client engaged in virtual asset activity is assigned a high risk level automatically, by type of activity rather than by behaviour. Order No. 465 does not do that: there, crypto appears as a feature of a particular operation, not as a property of the client.
The second difference runs the other way. Annex 20 to Resolution No. 65, the list of suspicion indicators, does not contain the words virtual assets even once: banks have no separate crypto indicators. We will not retell the resolution in full here; that is a different document and a separate topic, and we stop at the boundary we have checked.
How a bank learns about your operation at all
Nobody reads your payments by hand. Operations pass through automated monitoring systems that check every transaction against a set of scenarios: amount, type, counterparty, frequency, balance, the account's usual behaviour.
A scenario firing does not mean suspicion. It means the operation has joined a review queue. A compliance officer then looks at it and decides whether it diverges from the client's profile and whether documents need to be requested.
Two practical points follow. First, the system's attention is drawn by a pattern over a period, not by a single payment. Second, an empty or odd payment description is no trifle: often it is the only explanation the bank sees at all.
Which criteria on the list catch P2P specifically
Four criteria in the order describe exactly the picture created by active crypto trading between individuals. The first is payments received from unrelated or unknown third parties (sub-clause 36 of section II). That is literally a description of a P2P deal, where the money is sent by a buyer you do not know.
The second is an account used as a pass-through: funds arrive and move straight on (the same sub-clause 36). The third is regular operations whose character gives grounds to believe their purpose is to avoid due diligence procedures; the order says due diligence, not mandatory financial monitoring. The fourth is the splitting of operations to circumvent thresholds (section IV).
So frequent, uniform incoming payments from different senders are not one bank's whim. That picture is named as a criterion outright both by the Ministry of Finance order and by the banking rules: annex 20 to Resolution No. 65 has an indicator of its own for it. The person may be breaking nothing: the criterion describes the shape of operations, not guilt.
What the list says about virtual assets
Cryptocurrency is mentioned in the criteria directly, which is rare for a regulatory document of this level. A situation is treated as risky when a client, without proper justification, insists on settling exclusively or predominantly in virtual assets (sub-clause 25 of section II).
The second scenario is the use of virtual assets without evident legal, tax, commercial or other lawful reasons (section IV). The key phrase is without evident reasons: the criterion is triggered not by the fact of holding cryptocurrency but by the absence of a clear explanation.
For a reader this means one thing. Explanations and documents are not a formality or a gesture of goodwill, they are precisely what the criterion asks for in substance. We break down the documents behind crypto income in a separate article on source of funds.
Why the criteria are so broad
The criteria describe the shape of an operation, not the intent. You cannot tell a cryptocurrency sale from a front-man card scheme by the payment flow alone: from the outside they are identical incoming payments from different people onto one card.
So the list deliberately covers a wide range of situations. The state builds in redundancy on the assumption that checks and client explanations will clear the false positives. The price of that approach is that law-abiding people regularly land in the sample.
You cannot negotiate your way out of this, but you can work with it. A broad criterion filters by shape and distinguishes by explanation, and the explanation is the only part the client genuinely influences.
The criteria apply in combination, not one by one
A single match means almost nothing. Everyone gets a transfer from a third party: a friend repaying a debt, a relative sending money, a buyer paying for a classified ad. If every such payment were stopped, the banking system would seize up.
What matters is the combination. Incoming payments from various unrelated senders that move straight on, recur every week and do not match the declared income are no longer one criterion but four at once. It is the density of matches that moves an operation out of background noise and into the review queue.
So the question of whether you fall under a criterion is badly framed. The better question is how many criteria coincide in your case and whether each of them has a clear explanation.
What a client profile is and what it consists of
A profile is the bank's picture of how you normally use your account. It has two parts: what you declared when opening the account, and how the account has actually behaved during the relationship.
The declared part covers occupation, source of income, expected volume of operations and the purpose of opening the account. The factual part covers the amounts and frequency of incoming payments, the range of counterparties, payment descriptions, balances and the geography of operations.
Monitoring fires on discrepancies between those two parts. Someone stated a salary of forty thousand and three hundred arrives every month from twenty different senders: the question arises not because of the amount but because of the mismatch.
Hence the single most effective action available to a client: keep the declared part current. If your job changed or a new source of income appeared, update the questionnaire yourself rather than waiting for a request.
What the risk-based approach means in plain terms
The risk-based approach means that not everyone is checked equally, but in proportion to their assessed risk. The bank assigns the client a risk level, and that level determines how many questions and documents will be needed.
The level depends on the whole picture: declared income, occupation, the nature of operations, counterparties' countries, matches with risk criteria. At a bank that set is its own, drawn from the annexes to Resolution No. 65 rather than from the Ministry of Finance order. The assessment is dynamic: it moves with the account's behaviour rather than being assigned once and for all.
Hence the answer to why it goes through for a friend but not for you. Because you have different profiles and different risk levels at different banks. This is not a public rating: you will not see your level in the app, the bank does not disclose it.
What to do if your ordinary life matches a criterion
The situation is a common one. A freelancer receives payments from different clients, a tutor from different students, a marketplace seller from different buyers. Formally these are payments from unrelated third parties, even though there is no scheme at all.
There is one workable strategy: make the picture explainable in advance. Meaningful payment descriptions, saved correspondence or contracts with clients, declared income, an up-to-date questionnaire at the bank. It is not a guarantee, it is what turns a request into a short exchange of letters instead of a long review.
The second element is consistency. A profile that has looked the same for three years raises fewer questions than an account whose character changed abruptly. If the nature of your income really has changed, it makes sense to update the questionnaire yourself rather than wait for a request.
The third is separating flows. Keeping work income and personal operations on different accounts is not legally required, but it noticeably simplifies the explanation when the bank asks you to show the source of a particular amount.
Why an honest person falls under a criterion
A risk criterion is not an accusation. It describes a situation in which a question should be asked, and says nothing about what the answer will be. Falling under a criterion means exactly one thing: your operation will be looked at more closely.
The reason is simple. Laundering schemes deliberately mimic ordinary behaviour, so any criterion capable of catching them inevitably catches lawful operations of the same shape.
In practice this changes the tone of the conversation with the bank. Answering a request from the position of being under suspicion is counterproductive: more often it means the system has seen a shape it has no explanation for yet. Explanations and documents close that gap.
What an operation that does not conflict with the criteria looks like
The simplest description is an operation where all three answers are visible at once: who the sender is, what the payment is for and where they got the money. When those three things are clear from the transaction and the account history, there is nothing for the criteria to catch on.
The signs of such an operation: a clear payment description instead of an empty field, a counterparty your activity explains, an amount proportionate to your declared income, and funds that do not leave the account the same minute.
The flip side is worth seeing too. Pass-through movement is the main amplifier of any criterion: money that lingers on an account reads differently from money that passes through in a few minutes.
This is no guarantee, and we will not promise one. But an operation where all three answers are visible in advance usually needs no separate explanation at all.
What this means for an ordinary cryptocurrency exchange
Someone who sells cryptocurrency via P2P a few times a month matches several criteria at once: incoming payments from unrelated third parties, fast onward movement of funds through the account, regularity of uniform operations. There is no breach in this, but there is more to explain.
Here we state our own interest plainly: we are an exchange service, and in our case the counterparty is a company, not a stranger from a classified ad. That does not make the operation invisible to monitoring and does not exempt you from the bank's questions, it simply means the source of funds is described by one counterparty rather than a dozen random senders.
We will not promise that a transfer through an exchange service is certain to go through. The decision in each case rests with the bank, and no exchange method changes that.
And the other side of it, which we will name honestly: the criteria in Order No. 465 are what an exchange service uses to look at a client. The very list this article opens with is one we are obliged to take into account ourselves.
Why the advice to split the amount is harmful
Splitting operations is a risk criterion in its own right, from the very same Order No. 465, section IV. So it is not a way to avoid attention but a way to add one more reason for it: the question about the source of funds is joined by a question about the purpose of the splitting.
The same list holds another criterion: regular operations whose character gives grounds to believe their purpose is to avoid due diligence procedures. It covers even cases where no single operation breaches anything.
Automated systems spot series better than isolated payments: the total over a period and the number of transactions are basic parameters of any scenario. We do not give advice on avoiding checks as a matter of principle, and this particular piece of advice also worsens the position of anyone who believes it.
The National Bank's draft resolution of July 2026
On 21 July 2026 the National Bank published a draft resolution with 16 indicators of suspicious payments and three risk levels: low passes automatically, medium requires confirmation, high stops the operation. The indicators include more than 10 top-ups within 60 minutes, minimal balances alongside large turnover, fast onward movement of funds, and one-to-many and many-to-one transfers.
Public consultation ran until 31 July 2026, and 90 days are allowed for adaptation after adoption. As of 19 September 2026 the current version of Resolution No. 65 is still the one dated 17 July 2026, so these indicators have not entered the banking monitoring rules. They therefore cannot be called a rule in force: this is a draft.
And one point of precision that matters for our topic: the draft mentions neither P2P nor cryptocurrency. Texts that attribute such rules to it are adding something that is not there.
What the order does not contain: any ban
Order No. 465 contains no ban on P2P transfers or on cryptocurrency operations. It is a list of risk criteria, not a list of prohibited actions. Falling under a criterion means heightened attention, not a breach.
Nor is there any separate official warning from the National Bank or the State Financial Monitoring Service about P2P specifically. Banks' objections rest not on a rule saying P2P is prohibited, but on the general risk-based approach. The wording here should be careful: the absence of a ban is not a permission, only the absence of an explicit rule.
There is one practical conclusion from all of this. The list of criteria is public, and knowing it you can predict which questions will arise and prepare the answers in advance, even if your own bank is looking at you through the neighbouring document. What to do next, once an operation has already been stopped, is covered in the article on financial monitoring.
