5 Key Observations: FATF’s Second 12-Month Virtual Assets & VASPs Review

The FATF recently released their second 12-month review of the implementation of its virtual asset and VASP guidelines. The goal of the 12-month review is for the FATF to identify gaps in implementation and denote subsequent actions to be taken and plan forward. Below are Notabene’s key takeaways that we believe cryptoasset businesses and compliance teams should keep at the top of mind. 

1. Less than half of surveyed jurisdictions have introduced the necessary legislation

While the FATF recognizes the ‘significant progress’ by jurisdictions in implementing a licensing or registration regime for virtual asset service providers, less than half of jurisdictions surveyed (58 of 128) have introduced the necessary legislation. Even fewer have enforced the regulations or introduced the Travel Rule.

Notabene Takeaway: The low number of reported compliance leads the FATF to believe that we are still far from a global AML/CFT regime for virtual assets, which, in turn, encourages jurisdictional arbitrage. Also, with national jurisdictions behind on implementing the Travel Rule, this disincentivizes the private sector to invest in technological solutions and build compliance infrastructure. 

Below are two charts; the first compares FATF and the FSRB (FATF-Style Regional Bodies, which are autonomous regional organizations that help FATF implement its global AML/CFT policy) and their approach and readiness to crypto regulation. The second chart details which activities jurisdictions allow after passing crypto regulation.

2. Most jurisdictions are not Travel Rule compliant, leading to a significant obstacle to effective global AML/CFT mitigation

Two years after the FATF revised its Standards, most jurisdictions and VASPs are not currently Travel Rule compliant. The FATF sees this as a significant obstacle to effective global AML/CFT mitigation and undermines the effectiveness and impact of the revised FATF Standards.

Ten jurisdictions reported that they had implemented Travel Rule requirements for VASPs and that these requirements were being enforced. In comparison, a further 14 jurisdictions said they had introduced Travel Rule requirements, but they were not yet enforced. 

Notabene Takeaway: There is a vicious circle happening; the lack of national implementation reduces the incentive for technical progress. The lack of technological progress is used to justify the lack of national implementation. In the near future, greater jurisdictional implementation will be a necessary prerequisite to kick off technical progress.  

“Rapid implementation by all jurisdictions will act as the catalyst to promote the development of technical solutions and compliance by VASPs.” - FATF Second 12-month review of the Revised FATF standards on VAs and VASPs (July 2021)

3. Jurisdictional arbitrage is a growing problem

There has been a significant increase in the value of virtual assets collected as ransomware payments and in the use of virtual assets to commit and launder the proceeds of fraud in the last year. The proceeds of such ransomware attacks are often moved via unhosted or privacy wallets and/or other anonymity-enhancing tools and methods to VASPs. Most identified ML/TF activity relates to activity that is native to virtual assets. It is much less clear the extent to which virtual assets are being used to launder proceeds of crime that originate in fiat currency.

Notabene Takeaway: Non-compliant VASPs and privacy-enhancing tools facilitate an atmosphere of jurisdictional arbitrage. This creates a great environment for ransomware transacted through virtual assets. VAs are increasingly used for collecting ransomware - uneven implementation of regulatory regimes leading to jurisdictional arbitrage, non-compliant VASPs, and privacy-enhancing tools facilitate it.

4. FATF found no need to amend standards to include P2P transactions

FATF noted:

"If P2P transactions were to increase to the point that were to occur almost entirely on a P2P basis and criminals were able to exist entirely in the virtual asset ecosystem, without ever interacting with VASPs and on- and off-ramps to the traditional fiat economy, the current FATF Standards might need revision to sufficiently mitigate the ML/TF risks."

FATF continues with:

"VASPs currently play an important role in the virtual asset ecosystem. While P2P transfers occur in the ecosystem, VASPs are needed for the exchange or withdrawal of virtual assets for fiat currency. In addition, investigators, blockchain analytic companies, and other parties can generally capture information on P2P transactions generated on public blockchains, which can be transparent and traceable. This information can provide greater visibility of virtual asset transfers than off-chain transfers or transfers on private blockchains, including those carried out by VASPs, and assist in AML/CFT risk mitigation."

Notabene Takeaway: Suppose P2P transactions were to increase to the point that criminals could exist entirely in the virtual asset ecosystem without ever interacting with VASPs and on-and-off-ramps to the traditional fiat economy. In that case, the current FATF Standards might need revision to mitigate the ML/TF risks sufficiently. Currently, the FAFT found no need to amend the revised FATF standards, due in part to reliance on other players such as blockchain analytic companies, investigators, and the inherent traceable nature of public blockchains.

For example, if the addresses that are used for P2P and peer-VASP transactions could be correctly linked, it will inform the development of risk profiles and identity attribution for unhosted wallets. This may grow over time as more transfers are recorded on public blockchains.

‍

5. All jurisdictions need to implement the revised FATF Standards, including Travel Rule requirements, as quickly as possible.

The report states:

"The FATF should focus on the effective implementation of the currentFATF Standards on virtual assets and VASPs across the GlobalNetwork. Members of the FATF and its broader Global Network should implement the revised FATF Standards (R.15/INR.15) as a matter of priority."

Notabene Takeaway: To accelerate the implementation of the Travel Rule by the private sector, FATF members, particularly those who are leaders in AML/CFT regulation of VASPs, are advised to work collaboratively with each other and the private sector to facilitate the implementation of the Travel Rule.