On March 28, 2024, the global money laundering and terrorist financing watchdog, Financial Action Task Force (FATF), published a table setting out the implementation status of FATF standards on virtual assets and virtual asset service providers (VASPs) — also known as Recommendation 15 — by its 38 FATF members and 20 additional jurisdictions with “materially important VASP activity”. Previous FATF reports have found, most recently in 2023, material delays in fully implementing R.15. This table aims to shine additional light on implementation efforts while supporting jurisdictions in regulating and supervising VASPs for AML/CFT purposes, and encouraging jurisdictions with materially important VASP activity to fully implement R.15 in a timely manner. Below we explore the purpose of this report, discuss the findings and conclude what the impact of it on countries and VASPs might be.
Chainalysis is honored to have actively contributed its expertise to the development of this report and is proud of its continued support of FATF’s important work to create a global level-playing field for AML/CFT obligations to reduce opportunities for criminals to abuse the crypto sector.
What is the purpose of this report and what does it cover?
As virtual assets are inherently borderless, regulatory efforts need to be coordinated globally to avoid gaps and loopholes in AML/CFT regulation and supervision of VASPs which can have negative implications across the globe.
In October 2018, FATF first strengthened Recommendation 15 (R.15) to establish AML/CFT rules addressing virtual assets and VASPs directly (including customer due diligence (CDD) and travel rule obligations). However, FATF Recommendations require adoption into national legislation and sa preceding FATF report in 2023 revealed that 75% of the 98 assessed jurisdictions either demonstrated only partial compliance or were non-compliant with R.15.
By issuing this report concerning the status of implementation of R.15, FATF reiterates its emphasis on how critical it is for governments to meet their commitments to implement the AML/CFT standard for the virtual asset sector in order to effectively tackle money laundering and terrorism financing nationally and globally. The report further aims to enable the FATF network to best support individual jurisdictions in regulating and supervising VASPs for AML/CFT purposes.
FATF explicitly clarifies that the list of 58 jurisdictions does not indicate any assessment on the current state of their implementation of R.15 nor the overall AML/CFT frameworks. The list is based on the 38 FATF members who are encouraged to take a leading position on AML/CFT frameworks in the virtual asset space, and additional 20 jurisdictions based on virtual asset trading volumes (hosting VASPs responsible for at least 0.25% of global virtual asset trading volume) and/or a virtual asset user bases exceeding 1 million.
In addition to the 38 FATF members, the report identifies a further 20 jurisdictions as having materially important virtual asset activity: Bahamas, Cayman Islands, Colombia, Cyprus, Egypt, Estonia, Gibraltar, Kazakhstan, Lithuania, Malta, Nigeria, Philippines, Poland, Seychelles, Thailand, Ukraine, United Arab Emirates, Venezuela, Vietnam, Virgin Islands (British).
Furthermore, the information in this FATF report does not replicate or replace a mutual evaluation or follow-up assessment of the jurisdiction’s compliance with R.15. It also only focuses on implementation of the AML standards, and does not consider any broader regulatory framework, for example covering prudential, market integrity or consumer protection requirements.
What are the report’s findings?
The report’s table represents the findings of 58 jurisdictions’ self-reported surveys and additional basic evidence submitted to support these responses (as of the time of the update from January to March 2024):
-
- 100% (58) have either conducted or are in the process of conducting a risk assessment covering virtual assets and VASPs activity (in progress: Australia, Finland, Greece, Malaysia, Portugal).
- 9% (5) have or are in the process of explicitly prohibiting virtual assets and VASP activity (China, Egypt, Saudi Arabia and in progress: Seychelles, Indonesia)
- 17% (10) have not yet established a regulatory framework to require VASPs to register or license and apply AML/CFT measures (Vietnam, New Zealand; in progress: Türkiye, Argentina, Colombia; alongside the five above jurisdiction which have or are in the process of explicitly prohibiting virtual assets and VASP activity)
- 22% (13) have not yet registered or licensed a VASP in practice (Argentina, Belgium, Brazil, Colombia, New Zealand, Türkiye, Ukraine, Vietnam, China, Egypt, Saudi Arabia, Seychelles; in progress: Nigeria)
- 15 % (9) have not yet conducted a supervisory inspection or included VASPs in their current inspection plan (Argentina, Colombia, China, Egypt, Saudi Arabia, Ukraine, Vietnam; in progress: the Netherlands, the Virgin Islands (British))
- 28% (16) have not yet taken enforcement action or other supervisory action against VASPs (Argentina, Brazil, China, Finland, Iceland, Ireland, Russian Federation, Saudi Arabia, South Africa, Spain, Ukraine, Vietnam; in progress: Canada, Indonesia, Virgin Islands (British))
- 33% (19) have not yet passed or enacted the travel rule for VASPs (Australia, China, Egypt, Iceland, Russian Federation, Saudi Arabia, South Africa, Ukraine, Vietnam; in progress: Argentina, Brazil, Colombia, Malta, Mexico, Norway, New Zealand, Türkiye, Thailand, Seychelles)
Additionally to the above findings on the current status of implementation of R.15, the report also identifies each jurisdiction’s rating for R.15 compliance, when this has already been assessed as part of a mutual evaluation prior to this updated report. These specific R.15 compliance ratings therefore reflect the status of the date of the mutual assessment (which is indicated in brackets, ranging from 2020 to 2024) rather than the date of this updated report.
It is noteworthy that Bahamas is the only jurisdiction in this list of 58 jurisdictions deemed fully compliant with R.15, based on its mutual evaluation in 2022. Please note that 13 jurisdictions have not yet been evaluated with regards to the revised R.15 in a mutual evaluation at all. .
What does this mean for the crypto sector?
FATF’s table is a very helpful reference guide for both policy makers in the public and companies in the private sector to quickly understand the status of R.15 implementation in individual jurisdictions. It can also act as a rough benchmarking tool, including on how effective individual frameworks in these 58 jurisdictions are.
The report highlights that still more work is required to implement FATF’s R.15 and achieve a global level-playing field in AML/CFT obligations for virtual assets and VASPs, particularly in the area of the travel rule implementation.
What does this mean for countries and the public sector?
FATF continues to encourage jurisdictions to prioritize the implementation of the FATF standards for virtual assets based on their individual risks as assessed in their National Risk Assessment. Governments should note that these assessments should incorporate quantitative as well as qualitative (on-chain) information.
For jurisdictions that are in the process of fully implementing R.15 , this table can act as an incentive to allocate further resources and ensure broader political support for national implementation efforts to tackle money laundering and terrorist financing The report also highlights the component elements of effective implementation, thereby highlighting the areas of improvement a jurisdiction should focus its efforts on.
Jurisdictions should also bear in mind that if appropriate steps towards regulating (or banning) VASPs -such as effectively implemented licensing or registration requirements – have not been taken, nationally established VASPs might be considered as higher risk by third country VASPs and financial institutions (subject to their own ML/TF risk assessment – see also FATF’s Updated 2021 Guidance). This could result in a significant disadvantage to a jurisdiction’s entire virtual asset sector in a global context and ultimately impact a jurisdiction’s assessment of compliance with FATF Recommendations and the effectiveness of its wider AML/CFT framework (as part of Mutual Evaluations).
What does this mean for companies?
FATF’s table is a welcome reference tool for private companies in this sector to quickly learn about a jurisdiction’s requirements regarding licensing and registration as well as travel rule obligations. It can also be part of the considerations regarding jurisdictional risk when VASPs formulate and calibrate their AML/CFT risk assessment.
As countries come under more pressure to quickly implement R.15, obligations on VASPs, like exchanges, brokers and custodians, will continue to rise. With the heightened attention on this sector and increasing regulatory obligations for VASPs globally, it might not be sufficient to simply have access to risk monitoring and mitigating tools (such as blockchain analytics tools), regulators and supervisors are more likely to ascertain that these tools are actively used to monitor and mitigate risk and appropriately inform a VASP’s decision making.
Lastly, VASPs located in non-compliant jurisdictions might face the issue of being regarded as higher risk counterparties, ultimately impacting their partnership and commercial abilities globally.
Chainalysis is here to support
Chainalysis supported multiple jurisdictions in assessing their individual level of AML/CFT risk from virtual assets and VASP activity as part of their National Risk Assessment. If you require assistance in planning and executing a National Risk Assessment please contact our team.
For private sector organizations, Chainalysis offers best-in-class solutions and appropriate training opportunities to effectively prepare VASPs for comprehensive AML/CFT risk assessments, mitigation strategies and ongoing compliance. Please reach out to us to learn more.