What Is FATF?
The Financial Action Task Force (FATF) is an inter-governmental body that sets international standards for combating money laundering, terrorist financing, and proliferation financing. Its 40 Recommendations form the backbone of AML/CFT (Countering the Financing of Terrorism) law in more than 200 jurisdictions worldwide.
While FATF has no direct enforcement power, its influence is enormous: countries that fail to implement FATF standards risk being placed on the FATF "grey list" or "black list," which triggers enhanced scrutiny from banks, correspondent banking restrictions, and reputational damage that can isolate a country's financial sector.
Recommendation 15: New Technologies
FATF Recommendation 15 originally addressed new technologies broadly. In 2019, following a period of extensive consultation, FATF updated Recommendation 15 and its Interpretive Note to explicitly bring virtual assets and VASPs within scope.
Key Requirements Under Recommendation 15
- Countries must identify and assess the ML/TF risks associated with virtual assets
- VASPs must be regulated, licensed, or registered in the jurisdiction where they are created
- VASPs must be subject to AML/CFT supervision by a competent authority
- Countries must apply sanctions and other enforcement tools to non-compliant VASPs
- The Travel Rule (see Recommendation 16) applies to VASPs for virtual asset transfers
Who Is a VASP Under FATF?
FATF defines a Virtual Asset Service Provider as any natural or legal person that conducts one or more of the following activities as a business:
- Exchange between virtual assets and fiat currencies
- Exchange between one or more forms of virtual assets
- Transfer of virtual assets
- Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets (i.e. custody)
- Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset (e.g. ICO/IEO activities)
Notably, DeFi protocols and NFT platforms may fall under this definition depending on how they operate — FATF's updated 2021 guidance makes clear that the definition should focus on the function performed, not the technology used.
Mutual Evaluations and What They Mean for VASPs
FATF regularly conducts Mutual Evaluations of member countries — detailed peer reviews that assess whether a jurisdiction's legal framework and practical implementation meet FATF standards. For virtual assets, evaluators look at:
- Whether the country has enacted legislation covering VASPs
- Whether a supervisory authority has been designated and is actively supervising VASPs
- Whether VASPs are subject to AML/CFT obligations in practice (technical compliance vs. effectiveness)
- Whether the country cooperates internationally on VASP-related matters
Countries with weak VASP frameworks receive poor ratings on Immediate Outcome 3 (Financial Intelligence) and Immediate Outcome 4 (Sanctions), which can contribute to grey-listing.
The Grey List and Its Impact
Countries on FATF's "Jurisdictions Under Increased Monitoring" list (the grey list) have strategic AML/CFT deficiencies and have committed to address them. For VASPs operating in or from grey-listed countries, the practical consequences include:
- Correspondent banks applying enhanced due diligence or restricting services
- Counterpart VASPs refusing to transact or imposing onerous requirements
- Difficulty obtaining banking licences or payment processing relationships
- Reputational damage that affects customer trust
FATF's 2021 Updated Guidance on Virtual Assets
In October 2021, FATF published updated guidance that clarified several key areas:
| Topic | FATF Position |
|---|---|
| DeFi | Owners/operators of DeFi platforms may be VASPs if they have control or sufficient influence |
| NFTs | NFTs used for payment or investment purposes may be virtual assets; platforms enabling this may be VASPs |
| Stablecoins | Higher ML/TF risk due to potential for wide adoption; enhanced controls recommended |
| Unhosted wallets | Countries should consider requiring VASPs to collect information on unhosted wallet transfers |
Practical Takeaways for VASPs
For compliance officers and legal teams, Recommendation 15 has direct operational implications:
- Ensure your business is licensed or registered in every jurisdiction where you actively serve customers
- Monitor FATF mutual evaluation schedules — upcoming reviews in your key markets may signal regulatory changes
- Conduct a VASP-specific ML/TF risk assessment aligned with FATF's risk-based approach
- Review your product offerings against FATF's evolving definitions — new features may bring new obligations