FATF July 2024 Update: Global VAs/VASPs Compliance Insights

The Financial Action Task Force (FATF) has been instrumental in setting global standards for Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT). With the rapid growth of virtual assets (VAs) and virtual asset service providers (VASPs), ensuring these entities comply with stringent AML/CFT requirements has become a priority. In October 2018, FATF updated its Recommendation 15 to include VAs and VASPs, and in June 2019, an Interpretive Note was adopted to further clarify these requirements. This article examines the progress and challenges in implementing these standards across 130 jurisdictions, as highlighted in the FATF's targeted update released in July 2024.

Background and Key Updates

In October 2018, FATF updated Recommendation 15 to address AML/CFT requirements specifically for VAs and VASPs. This was further clarified in June 2019 with an Interpretive Note, providing detailed guidance on the application of these requirements. Since these updates, FATF has been working diligently to identify and address implementation gaps, guide jurisdictions on compliance, and monitor emerging risks in the VA sector.

Global Compliance Status as of April 2024

As of April 2024, the FATF and its Global Network assessed the compliance of 130 jurisdictions with the revised standards. The findings, released on July 9, 2024, reveal varying levels of compliance:

• Fully Compliant (C): 1 jurisdiction
• Largely Compliant (LC): 32 jurisdictions (25%)
• Partially Compliant (PC): 65 jurisdictions (50%)
• Non-Compliant (NC): 32 jurisdictions (25%)

Despite some improvements since the 2023 Targeted Update, 75% of jurisdictions remain only partially or non-compliant, a situation that has not changed since April 2023.

FATF Members vs. Non-Members

FATF member countries generally show better adherence to Recommendation 15 standards, with more jurisdictions achieving largely compliant status and one jurisdiction fully compliant. In contrast, FATF-style regional bodies (FSRBs) like GABAC and ESAAMLG face significant challenges, with many jurisdictions remaining non-compliant. Other FSRBs, including APG, CFATF, and GIABA, show varied levels of partial and non-compliance, indicating ongoing difficulties in implementing FATF standards. These findings are in line with the FATF's report on the status of implementation of Recommendation 15 by FATF Members and Jurisdictions with Materially Important VASP Activity, available here.

Challenges in Risk Assessment

A significant challenge for many jurisdictions is the effective assessment and mitigation of money laundering (ML) and terrorist financing (TF) risks associated with VAs and VASPs. Key statistics include:

• Assessment Findings: 75% (98 jurisdictions out of 130) do not adequately implement risk assessments for VAs and VASPs.
• Survey Insights: 71% (105 out of 147 jurisdictions) have conducted risk assessments, while 29% (42 out of 147) have not.

Even when assessments are conducted, aligning national measures with identified risks remains difficult. The novelty and complexity of virtual assets, coupled with rapid technological advancements, require regulatory bodies to continuously update their knowledge and resources.

Global Regulatory Approaches to VAs and VASPs

According to the FATF, as early as 2015, governments worldwide began to address the broad range of regulatory challenges posed by VAs and VASPs. In February 2023, the International Monetary Fund (IMF) published a report titled Elements of Effective Policies for Crypto Assets which highlighted the diverse approaches that policymakers around the world have been developing for crypto assets. Some countries have introduced outright bans on crypto assets, while others are considering more targeted restrictions based on their use cases. Many jurisdictions are experimenting with various degrees and combinations of regulation, supervision, oversight, and taxation. On the opposite end of the regulatory spectrum, some countries have opted to grant unbacked tokens legal tender status. 

Regulatory Approaches to VAs and VASPs: 2024 Trends

Global approaches to regulating VAs and VASPs can be categorized into several categories:

Restrictive Approach. This approach involves implementing outright bans or restrictions on VAs and VASPs. Countries that have adopted this approach include Bolivia, Bangladesh, China*, Kuwait, Jordan, Iraq, and Egypt. Interestingly, according to the FATF, prohibition is more prevalent in the MENAFATF (Middle East and North Africa) and APG (Asia Pacific) regions compared to other FATF-style regional bodies (FSRBs). However, some observers suggest that the increasing influence of the UAE as a regional hub within MENAFATF may pressure the region's authorities to reconsider their current stance.

Cautious Approach. Some regions adopt a cautious approach, taking careful and measured steps in regulating VAs and VASPs. An example of this approach can be seen in various countries in Latin America (LATAM).

Repositioning Economies. Certain countries are in the process of repositioning their economies with respect to VAs and VASPs These countries are transitioning from either a restrictive or a wait-and-see approach to a more proactive stance. Examples of such countries include China*, Oman, Saudi Arabia, Georgia, and Nigeria. 

Proactive Approach. Certain countries have adopted a proactive approach towards VAs and VASPs from the outset. These countries have integrated virtual assets into their regulatory frameworks.

Global Regulatory Approaches: Case Studies

• Restrictive Approach: Bolivia completely outlawed cryptocurrencies. This decision was taken to safeguard its national currency and to prevent its citizens from engaging in the high-risk and volatile cryptocurrency market.  The prohibition of crypto currencies in Bolivia was first initiated by a directive from the Central Bank of Bolivia in May 2014. However, it wasn't until December 15, 2020, through the formal ratification of Resolucion de Directorio No. 144/2020, that the ban was officially confirmed.
• Cautious Approach: In Costa Rica, the Central Bank maintains its unchanged position, diligently monitoring industry developments and assessing associated risks before implementing a regulatory framework. This approach is referred to as "tolerancia vigilante". The Central Bank of Costa Rica in its report “Algunas consideraciones en torno a las monedas digitales y los cripto activos” explains what is “tolerancia vigilante”. 

• Repositioning Economies: In December 2023, the Central Bank of Nigeria (CBN) has issued new guidelines for banks regarding digital assets, indicating a shift in the country's regulatory approach towards a more lenient stance on cryptocurrencies. These guidelines elaborate on the regulator's recent decision to allow the opening of accounts for VASPs. This move represents a significant change in policy, reversing a longstanding prohibition that previously prevented financial institutions from engaging with cryptocurrency businesses.

Different Forms of Adoption

Countries that have adopted a proactive approach can be further categorized into several groups:

Jurisdictions Applying Existing Regulatory Frameworks. Some jurisdictions apply their existing regulatory frameworks to VAs and VASPs. An example of this proactive approach is the United States.

Jurisdictions Retrofitting Existing Regulatory Frameworks. Other countries adapt and modify their existing regulatory frameworks to better accommodate VAs and VASPs. Examples of this approach include the United Kingdom, Singapore, and Germany (prior to the EU’s Markets in Crypto-Assets Regulation - MiCAR).

Jurisdictions establishing Bespoke Regulatory Frameworks. Certain regions have developed entirely new regulatory frameworks specifically designed for VAs and VASPs. Notable examples are the EU’s MiCAR and Malta’s Virtual Financial Assets (VFA) Framework.

Jurisdictions accepting VAs as Legal Tender. Some regions have gone a step further by accepting virtual assets as legal tender, integrating them fully into their financial systems and legal frameworks. Examples include El Salvador and Próspera, a semi-autonomous city established under Honduran Zone.

Survey Results on Regulatory Approaches

• Most jurisdictions (60%; 88 of 147) have decided to permit the use of VAs and the operation of VASPs.
• 14% (20 of 147) have opted to prohibit VASPs, an increase from 7% in 2022 and 11% in 2023.
• Over a quarter of jurisdictions (27%; 39 of 147) have not yet decided if and how to regulate the VA sector.

(In)effectiveness of Prohibitions

The Financial Stability Board (FSB) highlighted in a 2023 report that blanket bans on VAs are expensive and technically demanding to enforce, often resulting in activities migrating to other jurisdictions. Similarly, according to the International Monetary Fund (IMF), broad bans on crypto assets are unlikely to be effective in the long run. The IMF’s report argues that imposing comprehensive prohibitions on all activities related to crypto assets, such as trading and mining, might stifle innovation and push illicit activities into the shadows. Therefore, outright bans might inadvertently increase these risks. Furthermore, enforcing blanket bans can be resource-intensive and may encourage attempts to bypass regulations, especially given the inherently borderless nature of crypto assets. This could lead to heightened financial integrity risks and operational inefficiencies.

However, targeted restrictions could help address immediate challenges while regulatory capacity is being developed. It is important to note that the decisions to implement bans should be based on thorough evaluations of risks associated with money laundering and terrorist financing (ML/TF), potential significant capital outflows, and broader public policy objectives and even temporary restrictions should be part of a larger policy framework and should not replace robust macroeconomic policies and credible institutional frameworks, which are essential for managing the macroeconomic and financial risks posed by crypto assets.

China's Regulatory Approach: A Case Study

In 2019, President Xi Jinping voiced strong support for blockchain technology, emphasizing its potential applications in various sectors such as business financing, mass transit, and poverty alleviation.

Despite this endorsement, China has been at the forefront of prohibiting or restricting the use of cryptocurrencies. In 2013, Chinese authorities instructed financial institutions not to provide services to cryptocurrency businesses. By 2017, following the rapid growth of blockchain startups, China declared ICO fundraising illegal and intensified its crackdown on crypto activities. In 2021, China further broadened its restrictions by declaring all cryptocurrency-related transactions illegal. Nonetheless, cryptocurrency trading has persisted as individuals find ways to circumvent these bans. Major cryptocurrency exchanges have suspended operations in China, relocating to jurisdictions with more favorable regulations such as Hong Kong or Singapore, while miners have moved their operations to the United States and Canada.

However, as of 2024, China is reportedly revising its AML rules to include crypto transactions, indicating a shift from its previous total ban to a more comprehensive regulatory approach. Hu Bing, a researcher at the Institute of Finance and Banking, believes that China’s ban is a temporary measure until an effective regulatory framework is established. Broad crypto bans are likely to fail over time due to the global and decentralized nature of crypto assets, as many service providers operate from abroad and users can conceal their locations using VPNs. Indeed, Chinese officials have observed that despite the bans, mainland users continue to access the crypto market, leading to increased risks of money laundering.

Assessment Findings on Prohibitions

• Only 2 jurisdictions that prohibit VAs and VASPs have been assessed as largely compliant with FATF standards. 
• Jurisdictions taking a prohibition approach still face difficulties in conducting comprehensive and effective risk assessments. 
• Jurisdictions have not made significant progress in supervising or enforcing actions against illegal VASP operations. 

Survey Results on Prohibitions

• The majority of jurisdictions that prohibit VASPs (70%; 14 of 20) explicitly prohibit all VASP activities. 
• Common partial prohibitions include banning VAs as a means of payment for goods and services while allowing trading and related services. Other partial prohibitions include restricting VAs for retail investment, transfers to decentralized systems (DeFi, DEX), and use for settlement purposes.

Key Findings on Licensing and Registration

According to the FATF, VASPs should be required to obtain a license or register with relevant authorities. This is considered a minimum standard for regulatory compliance. 

Types Of Authorizations

The global approaches to this requirement can be categorized as follows:

Registration. This represents the basic level of oversight, requiring VASPs to register with a relevant authority primarily for anti-money laundering (AML) purposes. 

Licensing. This involves a more stringent process than registration. Licensing requires VASPs to meet specific standards and criteria set by regulatory bodies. In some contexts, licensing can also be synonymous with registration.

Regulation. This is the most comprehensive model of oversight. Regulation entails continuous supervision of VASPs by regulatory authorities, including adherence to specific legal and operational standards, regular reporting, and compliance with AML, conduct and prudential requirements. 

Hybrid. The French authorities have established a dual framework by implementing a minimum standard as required by the EU AMLD, which establishes a registration regime, and offering VASPs the option to apply for an optional license.

Sandbox. This approach allows VASPs to operate in a controlled environment under relaxed regulatory conditions, designed to encourage innovation while still maintaining a level of oversight to ensure compliance with fundamental regulatory requirements.

Global Regulatory Approaches: Case Studies

• United Kingdom: A crypto asset business must register with the Financial Conduct Authority if it intends to provide crypto asset services that come within the scope of the money laundering regulations.
• United States: The 2011 MSB Final Rule made clear that crypto asset businesses are required to register with FinCEN as an MSB for AML purposes.
• Singapore: Digital Payment Token Service Providers are required to obtain a Standard Payment or Major Payment license to provide specified payment services under the Payment Services Act.
• EU: A person shall not provide crypto-asset services within the Union unless that person has been authorized as a crypto-asset service provider under MiCAR.
• Australia: Digital currency exchange providers (DCEs) must be registered with AUSTRAC for AML purposes.

Survey Results on Licensing and Registration

• 87% of jurisdictions (82 out of 94) require VASPs to be licensed or registered, excluding those that prohibit or plan to prohibit VASPs explicitly. 
• 69 of these 82 jurisdictions have actually licensed or registered a VASP, showing significant improvement from 2023, when only 44% (60 out of 135) had done so.
• Only 31% (40 of 130) of assessed jurisdictions satisfactorily require VASPs to be licensed or registered (criteria 15.4 rated met or mostly met). This is slightly up from 30% (29 of 98) in 2023.
• 78% (54 of 69) of jurisdictions that have licensed or registered VASPs reported conducting supervisory inspections. 
• 77% (53 of 69) have taken enforcement or other supervisory actions against VASPs, up from 61% in 2023.

Challenges with Offshore VASPs

Regulating offshore VASPs presents significant challenges. These entities often operate across borders, complicating licensing and supervision. Offshore VASPs may obscure user locations or change jurisdictions frequently, undermining the effectiveness of prohibitions and regulatory enforcement. Jurisdictions with lower regulatory capacities face additional difficulties due to deficiencies in general AML/CFT regulation and supervision. Support from FATF members, including technical assistance and information sharing, is crucial for these jurisdictions to address regulatory gaps effectively.

Jurisdictions face several specific challenges when dealing with offshore VASPs related to licensing and registration:

• Absence of Appropriate Mechanisms: Many regions lack proper licensing or registration frameworks for VASPs. 
• Obscured User Information: Offshore VASPs often take measures to hide their users' locations and identifying information, further complicating regulatory assessments.
• Frequent Relocations: These VASPs frequently change their locations, moving from one jurisdiction to another, which adds to regulatory challenges and makes it difficult to maintain consistent oversight.
• Circumventing Regulations: Offshore VASPs may continue to operate in regions where they are prohibited by circumventing regulatory requirements through various methods, undermining the effectiveness of prohibitions and complicating enforcement efforts.

The presence of unlicensed or unregistered offshore VASPs in domestic markets poses significant challenges for licensed or registered VASPs:

• Uneven Playing Field: Licensed VASPs face difficulties competing with unregulated entities that operate with more flexibility and fewer constraints, undermining the effectiveness of domestic regulatory regimes.
• Complicated Enforcement: The competition from unregistered VASPs complicates regulatory enforcement.

Jurisdictions with lower regulatory capacities face additional difficulties:

• AML/CFT Regulation Deficiencies: These jurisdictions often have deficiencies in general AML/CFT regulation and supervision, reflecting similar issues with VASPs.
• Need for Support: Lower-capacity jurisdictions require more support to address these gaps effectively. This includes ongoing needs for information sharing, expertise, and technical assistance, particularly from FATF members.

FATF Efforts to Accelerate Global Implementation of R.15

The FATF is steadfast in its commitment to collaborating with jurisdictions to facilitate the implementation of Recommendation 15 (R.15). This involves ensuring effective supervision and enforcement while mitigating the risks associated with virtual assets  and virtual asset service providers being exploited by illicit actors.

Blockchain analytics tools, such as those provided by Merkle Science, play a crucial role in this global effort. For instance, Merkle Science offers advanced solutions that enable regulatory authorities to conduct thorough national risk assessments of virtual assets and VASPs. Our tools generate regular reports and audits that keep regulators informed about compliance statuses and potential risks. Additionally, our on-chain analytics tools are essential for identifying non-compliant VASPs as our platform can accurately pinpoint VASPs operating without necessary authorization or those failing to meet AML/CFT regulations. Furthermore, detailed reporting and alert systems highlight unregistered or suspicious VASPs, enabling regulators to take prompt and appropriate enforcement actions.

Merkle Science also assists VASPs in ensuring regulatory alignment by providing tailored compliance solutions that conform to global regulatory standards. Our customizable rule engine allows VASPs to comply with varying regulatory requirements across different jurisdictions, facilitating seamless regulatory adherence.

Through these advanced tools and services, Merkle Science supports the FATF's mission to enhance global AML/CFT efforts, ensuring a secure and compliant virtual asset ecosystem.

Conclusion

The journey towards full compliance remains challenging. The findings indicate that while some jurisdictions, particularly FATF members, show higher levels of compliance, many others still struggle with weak national risk assessments, inadequate policies, and insufficient enforcement mechanisms. These gaps underscore the need for ongoing support, guidance, and technical assistance to enhance global AML/CFT efforts.

In this context, the role of advanced blockchain analytics tools becomes increasingly vital. By enabling comprehensive risk assessments, continuous monitoring, and effective tracing, these tools can significantly bolster regulatory supervision and ensure that VASPs operate within legal boundaries.

As jurisdictions continue to adapt and strengthen their regulatory approaches, the collective effort of international organizations, crypto asset businesses, technology providers, and regulatory authorities will be essential in fostering a secure and compliant virtual asset ecosystem. The progress made thus far is promising, but sustained commitment is required to fully realize the goals set by the FATF and protect the integrity of the global financial system.