The Financial Action Task Force (FATF) has been instrumental in setting global standards for Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT). With the rapid growth of virtual assets (VAs) and virtual asset service providers (VASPs), ensuring these entities comply with stringent AML/CFT requirements has become a priority. In October 2018, FATF updated its Recommendation 15 to include VAs and VASPs, and in June 2019, an Interpretive Note was adopted to further clarify these requirements. This article examines the progress and challenges in implementing these standards across 130 jurisdictions, as highlighted in the FATF's targeted update released in July 2024.
In October 2018, FATF updated Recommendation 15 to address AML/CFT requirements specifically for VAs and VASPs. This was further clarified in June 2019 with an Interpretive Note, providing detailed guidance on the application of these requirements. Since these updates, FATF has been working diligently to identify and address implementation gaps, guide jurisdictions on compliance, and monitor emerging risks in the VA sector.
As of April 2024, the FATF and its Global Network assessed the compliance of 130 jurisdictions with the revised standards. The findings, released on July 9, 2024, reveal varying levels of compliance:
Despite some improvements since the 2023 Targeted Update, 75% of jurisdictions remain only partially or non-compliant, a situation that has not changed since April 2023.
FATF member countries generally show better adherence to Recommendation 15 standards, with more jurisdictions achieving largely compliant status and one jurisdiction fully compliant. In contrast, FATF-style regional bodies (FSRBs) like GABAC and ESAAMLG face significant challenges, with many jurisdictions remaining non-compliant. Other FSRBs, including APG, CFATF, and GIABA, show varied levels of partial and non-compliance, indicating ongoing difficulties in implementing FATF standards. These findings are in line with the FATF's report on the status of implementation of Recommendation 15 by FATF Members and Jurisdictions with Materially Important VASP Activity, available here.
A significant challenge for many jurisdictions is the effective assessment and mitigation of money laundering (ML) and terrorist financing (TF) risks associated with VAs and VASPs. Key statistics include:
Even when assessments are conducted, aligning national measures with identified risks remains difficult. The novelty and complexity of virtual assets, coupled with rapid technological advancements, require regulatory bodies to continuously update their knowledge and resources.
According to the FATF, as early as 2015, governments worldwide began to address the broad range of regulatory challenges posed by VAs and VASPs. In February 2023, the International Monetary Fund (IMF) published a report titled Elements of Effective Policies for Crypto Assets which highlighted the diverse approaches that policymakers around the world have been developing for crypto assets. Some countries have introduced outright bans on crypto assets, while others are considering more targeted restrictions based on their use cases. Many jurisdictions are experimenting with various degrees and combinations of regulation, supervision, oversight, and taxation. On the opposite end of the regulatory spectrum, some countries have opted to grant unbacked tokens legal tender status.
Global approaches to regulating VAs and VASPs can be categorized into several categories:
Restrictive Approach. This approach involves implementing outright bans or restrictions on VAs and VASPs. Countries that have adopted this approach include Bolivia, Bangladesh, China*, Kuwait, Jordan, Iraq, and Egypt. Interestingly, according to the FATF, prohibition is more prevalent in the MENAFATF (Middle East and North Africa) and APG (Asia Pacific) regions compared to other FATF-style regional bodies (FSRBs). However, some observers suggest that the increasing influence of the UAE as a regional hub within MENAFATF may pressure the region's authorities to reconsider their current stance.
Cautious Approach. Some regions adopt a cautious approach, taking careful and measured steps in regulating VAs and VASPs. An example of this approach can be seen in various countries in Latin America (LATAM).
Repositioning Economies. Certain countries are in the process of repositioning their economies with respect to VAs and VASPs These countries are transitioning from either a restrictive or a wait-and-see approach to a more proactive stance. Examples of such countries include China*, Oman, Saudi Arabia, Georgia, and Nigeria.
Proactive Approach. Certain countries have adopted a proactive approach towards VAs and VASPs from the outset. These countries have integrated virtual assets into their regulatory frameworks.
Countries that have adopted a proactive approach can be further categorized into several groups:
Jurisdictions Applying Existing Regulatory Frameworks. Some jurisdictions apply their existing regulatory frameworks to VAs and VASPs. An example of this proactive approach is the United States.
United States Case Study
In 2019, the Financial Crimes Enforcement Network (FinCEN) released interpretive guidance to clarify how existing regulations for money services businesses (MSBs) under the Bank Secrecy Act (BSA) apply to business models involving money transmission using value substitutes for currency, specifically convertible virtual currencies (CVCs).
This document does not introduce new regulatory expectations or requirements. Instead, it consolidates existing FinCEN regulations, administrative rulings, and previous guidance issued since 2011, applying these established rules and interpretations to various common business models involving CVCs that engage in similar fundamental activities.
Jurisdictions Retrofitting Existing Regulatory Frameworks. Other countries adapt and modify their existing regulatory frameworks to better accommodate VAs and VASPs. Examples of this approach include the United Kingdom, Singapore, and Germany (prior to the EU’s Markets in Crypto-Assets Regulation - MiCAR).
United Kingdom Case Study
The UK has adapted its Money Laundering, Terrorist Financing, and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) to encompass activities involving crypto assets. This was done to align with the Fifth Anti-Money Laundering Directive (5AMLD) of the European Union.
The Financial Services and Markets Act 2000 (Financial Promotion) Order 2005 (FPO) governs the promotion of financial products and services in the UK. To address the growing market of crypto assets and the risks associated with their promotion, the UK government has proposed changes to the FPO to include certain types of qualifying crypto assets.
Jurisdictions establishing Bespoke Regulatory Frameworks. Certain regions have developed entirely new regulatory frameworks specifically designed for VAs and VASPs. Notable examples are the EU’s MiCAR and Malta’s Virtual Financial Assets (VFA) Framework.
EU MiCAR Case Study
The EU’s Markets in Crypto-Assets Regulation (MiCAR) is considered a bespoke regulatory framework because it was specifically designed to address the unique characteristics and challenges of crypto assets and their service providers, offering tailored regulatory requirements and protections not covered by existing financial regulations.
Jurisdictions accepting VAs as Legal Tender. Some regions have gone a step further by accepting virtual assets as legal tender, integrating them fully into their financial systems and legal frameworks. Examples include El Salvador and Próspera, a semi-autonomous city established under Honduran Zone.
El Salvador Case Study
El Salvador made history in 2021, when it became the first country in the world to adopt Bitcoin as legal tender, following the passage of the Bitcoin Law. The decision was part of a broader strategy to boost economic growth, encourage financial inclusion among the country's unbanked population, and capitalize on Bitcoin's potential as a remittance currency
Bitcoin was granted legal tender status alongside the US dollar, which has been El Salvador's official currency since 2001. This means businesses are required to accept Bitcoin for goods and services, though exceptions exist for those unable to technologically accommodate the currency.To facilitate the transition, the Salvadoran government launched a national digital wallet called "Chivo," offering incentives such as $30 in Bitcoin to citizens who sign up. This move aimed to promote widespread adoption of Bitcoin for everyday transactions.
In 2022, the IMF urged the authorities to narrow the scope of the Bitcoin law by removing Bitcoin’s legal tender status. Some officials also expressed concern over the risks associated with issuing Bitcoin-backed bonds. According to the IMF’s 2023 analysis, El Salvador’s experience with Bitcoin suggests there are risks to adopting unbacked crypto assets, those that rely on supply and demand rather than on any asset for value and that are subject to significant price volatility, even when explicitly supported by the government.
The Financial Stability Board (FSB) highlighted in a 2023 report that blanket bans on VAs are expensive and technically demanding to enforce, often resulting in activities migrating to other jurisdictions. Similarly, according to the International Monetary Fund (IMF), broad bans on crypto assets are unlikely to be effective in the long run. The IMF’s report argues that imposing comprehensive prohibitions on all activities related to crypto assets, such as trading and mining, might stifle innovation and push illicit activities into the shadows. Therefore, outright bans might inadvertently increase these risks. Furthermore, enforcing blanket bans can be resource-intensive and may encourage attempts to bypass regulations, especially given the inherently borderless nature of crypto assets. This could lead to heightened financial integrity risks and operational inefficiencies.
However, targeted restrictions could help address immediate challenges while regulatory capacity is being developed. It is important to note that the decisions to implement bans should be based on thorough evaluations of risks associated with money laundering and terrorist financing (ML/TF), potential significant capital outflows, and broader public policy objectives and even temporary restrictions should be part of a larger policy framework and should not replace robust macroeconomic policies and credible institutional frameworks, which are essential for managing the macroeconomic and financial risks posed by crypto assets.
In 2019, President Xi Jinping voiced strong support for blockchain technology, emphasizing its potential applications in various sectors such as business financing, mass transit, and poverty alleviation.
Despite this endorsement, China has been at the forefront of prohibiting or restricting the use of cryptocurrencies. In 2013, Chinese authorities instructed financial institutions not to provide services to cryptocurrency businesses. By 2017, following the rapid growth of blockchain startups, China declared ICO fundraising illegal and intensified its crackdown on crypto activities. In 2021, China further broadened its restrictions by declaring all cryptocurrency-related transactions illegal. Nonetheless, cryptocurrency trading has persisted as individuals find ways to circumvent these bans. Major cryptocurrency exchanges have suspended operations in China, relocating to jurisdictions with more favorable regulations such as Hong Kong or Singapore, while miners have moved their operations to the United States and Canada.
However, as of 2024, China is reportedly revising its AML rules to include crypto transactions, indicating a shift from its previous total ban to a more comprehensive regulatory approach. Hu Bing, a researcher at the Institute of Finance and Banking, believes that China’s ban is a temporary measure until an effective regulatory framework is established. Broad crypto bans are likely to fail over time due to the global and decentralized nature of crypto assets, as many service providers operate from abroad and users can conceal their locations using VPNs. Indeed, Chinese officials have observed that despite the bans, mainland users continue to access the crypto market, leading to increased risks of money laundering.
According to the FATF, VASPs should be required to obtain a license or register with relevant authorities. This is considered a minimum standard for regulatory compliance.
The global approaches to this requirement can be categorized as follows:
Registration. This represents the basic level of oversight, requiring VASPs to register with a relevant authority primarily for anti-money laundering (AML) purposes.
Licensing. This involves a more stringent process than registration. Licensing requires VASPs to meet specific standards and criteria set by regulatory bodies. In some contexts, licensing can also be synonymous with registration.
Regulation. This is the most comprehensive model of oversight. Regulation entails continuous supervision of VASPs by regulatory authorities, including adherence to specific legal and operational standards, regular reporting, and compliance with AML, conduct and prudential requirements.
Hybrid. The French authorities have established a dual framework by implementing a minimum standard as required by the EU AMLD, which establishes a registration regime, and offering VASPs the option to apply for an optional license.
Sandbox. This approach allows VASPs to operate in a controlled environment under relaxed regulatory conditions, designed to encourage innovation while still maintaining a level of oversight to ensure compliance with fundamental regulatory requirements.
Regulating offshore VASPs presents significant challenges. These entities often operate across borders, complicating licensing and supervision. Offshore VASPs may obscure user locations or change jurisdictions frequently, undermining the effectiveness of prohibitions and regulatory enforcement. Jurisdictions with lower regulatory capacities face additional difficulties due to deficiencies in general AML/CFT regulation and supervision. Support from FATF members, including technical assistance and information sharing, is crucial for these jurisdictions to address regulatory gaps effectively.
Jurisdictions face several specific challenges when dealing with offshore VASPs related to licensing and registration:
The presence of unlicensed or unregistered offshore VASPs in domestic markets poses significant challenges for licensed or registered VASPs:
Jurisdictions with lower regulatory capacities face additional difficulties:
The FATF is steadfast in its commitment to collaborating with jurisdictions to facilitate the implementation of Recommendation 15 (R.15). This involves ensuring effective supervision and enforcement while mitigating the risks associated with virtual assets and virtual asset service providers being exploited by illicit actors.
Blockchain analytics tools, such as those provided by Merkle Science, play a crucial role in this global effort. For instance, Merkle Science offers advanced solutions that enable regulatory authorities to conduct thorough national risk assessments of virtual assets and VASPs. Our tools generate regular reports and audits that keep regulators informed about compliance statuses and potential risks. Additionally, our on-chain analytics tools are essential for identifying non-compliant VASPs as our platform can accurately pinpoint VASPs operating without necessary authorization or those failing to meet AML/CFT regulations. Furthermore, detailed reporting and alert systems highlight unregistered or suspicious VASPs, enabling regulators to take prompt and appropriate enforcement actions.
Merkle Science also assists VASPs in ensuring regulatory alignment by providing tailored compliance solutions that conform to global regulatory standards. Our customizable rule engine allows VASPs to comply with varying regulatory requirements across different jurisdictions, facilitating seamless regulatory adherence.
Through these advanced tools and services, Merkle Science supports the FATF's mission to enhance global AML/CFT efforts, ensuring a secure and compliant virtual asset ecosystem.
The journey towards full compliance remains challenging. The findings indicate that while some jurisdictions, particularly FATF members, show higher levels of compliance, many others still struggle with weak national risk assessments, inadequate policies, and insufficient enforcement mechanisms. These gaps underscore the need for ongoing support, guidance, and technical assistance to enhance global AML/CFT efforts.
In this context, the role of advanced blockchain analytics tools becomes increasingly vital. By enabling comprehensive risk assessments, continuous monitoring, and effective tracing, these tools can significantly bolster regulatory supervision and ensure that VASPs operate within legal boundaries.
As jurisdictions continue to adapt and strengthen their regulatory approaches, the collective effort of international organizations, crypto asset businesses, technology providers, and regulatory authorities will be essential in fostering a secure and compliant virtual asset ecosystem. The progress made thus far is promising, but sustained commitment is required to fully realize the goals set by the FATF and protect the integrity of the global financial system.
