FATF Updates Regulatory Guidance For Crypto Industry

The Financial Action Task Force — the global anti-money laundering and counter-terrorist financing (AML/CTF) standards-setter — released this week its updated guidance on virtual assets and virtual assets service providers (VASPs) to guide how countries implement their crypto regulations.

FATF’s 109-page updated guidance touches on some of the crypto industry’s most pressing topics, including stablecoins, peer-to-peer transactions, non-fungible tokens (NFTs) and decentralized finance (DeFi). It follows a 12-month review published in July where FATF said that countries’ implementation of its standards was “far from sufficient.”

“The rapid development, increasing functionality, growing adoption, and global, cross-border nature of VAs therefore makes the urgent action by countries to mitigate the ML/TF risks presented by VA activities and VASPs a key priority,” wrote FATF in its updated guidance. “All countries should strive to ensure their domestic regimes contribute to even and efficient implementation globally in order to avoid jurisdictional and supervisory arbitrage.”

See related article: Key takeaways from FATF’s latest report on virtual assets

Greater clarity on virtual assets and VASPs

Crypto industry experts told Forkast.News the updated guidance provided more clarity to regulators and the industry. 

“The revised FATF guidance has been significantly updated to provide greater clarity to both countries seeking to regulate as well as for the industry in terms of what compliance would look like in a domestic crypto legislative regime,” Malcolm Wright, advisory council chair of Global Digital Finance, an industry group, told Forkast.News in an email.

“Clarifications have been provided on some fundamental concepts such as screening deposits and withdrawals for sanctions using not only blockchain analytics but screening of names against sanctions lists, as well as those elements of a DeFi ecosystem that should be regulated,” Wright said. “Whilst the definition of a VASP remains the same, the inclusion of proliferation financing brings the guidance into line with the broader FATF remit.”

The FATF’s updated guidance covers:

• Stablecoins: Countries are to take measures to manage the mitigate ML/TF risks of stablecoins, particularly those that could be adopted as mass and that can be used for peer-to-peer transactions, before launch, and on an ongoing and forward-looking basis.

• Peer-to-peer (P2P) transactions: Although not explicitly subject to AML/CFT controls, P2P transactions could be used to circumvent controls and could pose money laundering and terrorist financing risks. Countries will need to understand the risks, types and drivers associated with P2P transactions in their jurisdiction and consider implementing controls that facilitate visibility of P2P activity such as transaction reports.

• NFTs: NFTs are generally not considered to be virtual assets under the FATF’s definition. However, some NFTs could be considered as virtual assets if used for payment or investment purposes. NFTs that are digital representations of other financial assets covered by the FATF standards are not considered as virtual assets but covered by the FATF standards as that type of financial asset. Countries would need to consider the application of the FATF standards to NFTs on a case-by-case basis.

• DeFi: A DeFi application (or the software program) is not a VASP but creators, owners, operators or persons who hold control or sufficient influence over the DeFi arrangement would be considered a VASP and be subject to AML regulations.

“This suggests that where DeFi developers have the ability to restrict coin listings on a DEX, operate a domain that enables user access, or are otherwise able to intervene in the activities of a DeFi marketplace in a significant way — they could very well be captured by regulation,” David Carlisle, director of policy and regulatory affairs at Elliptic, a blockchain analysis provider, told Forkast.News in an email. “Helpfully, the guidance clarifies that individual governance token holders shouldn’t fall within the regulatory perimeter if they don’t exercise this type of influence over activities in a particular DeFi marketplace.”

But some say the FATF’s proposed approach for DeFi wouldn’t work given its permissionless nature. 

“Permissionless systems are here, and starting a global game of ‘whack-a-mole’ to nip any new permissionless system in the bud wouldn’t be practical or desirable,” said Miller Whitehouse-Levine, policy director at DeFi Education Fund, in a tweet. “We should think about developing new ways to vindicate core AML/CFT objectives in peer-to-peer markets instead of attempting to shape the development of novel technologies to fit existing regulatory structures.”

Urgency to implement travel rule

FATF’s latest guidance also reiterates its call for regulators to urgently implement the travel rule, which requires crypto companies to share identifying information on the originator and beneficiary of crypto transactions. 

Implementation of the travel rule has been uneven, giving rise to the “sunrise issue” with some VASPs having to comply with regulations while others don’t. “Countries may wish to take a staged approach to enforcement of travel rule requirements to ensure that their VASPs have sufficient time to implement the necessary systems, but should continue to ensure that VASPs have alternative measures in place to suitably mitigate the ML/TF risks arising from VA transfers in the interim,” FATF wrote.

Pelle Braendgaard, CEO of Notabene, a crypto compliance platform, told Forkast.News in an email that FATF had acknowledged the real-world issues that VASPs and travel rule service providers like Notabene had raised over the past year. “They are now recommending that regulators be flexible during the initial rollout.”

“Travel Rule compliance is growing rapidly every quarter,” Braendgaard added. “We are now facilitating transactions between over 50 VASPs and we expect most major VASPs to comply by Q1/Q2 of 2022.”  

See related article: How to avoid the pitfalls of FATF’s crypto travel rule

How will countries apply the FATF’s updated guidance?

With more regulation is coming to crypto — centralized or decentralized — how quickly countries implement the regulations will add another layer of complexity — and costs — for the industry, particularly for those that operate across multiple countries and will need to meet different local compliance requirements.

“Jurisdictions across Asia will move at very different speeds when it comes to implementing these new requirements from the FATF. Singapore, Japan, and Australia have been relatively early movers when it comes to crypto regulation — so we can expect to see them provide clarity before some others in the region,” Elliptic’s Carlisle said. “Hong Kong has announced that it will update its regulatory framework, but exact timelines remain unclear. Those across Asia that have not yet implemented regulations for crypto are going to come under increasing pressure from the FATF to do so, and quickly. For example, countries such as India and Vietnam still have yet to clarify their stance, so they’ll face expectations to do that.”

“Crypto businesses across APAC will face increasingly stringent licensing requirements as a result of the guidance,” Carlisle added. “Licensing processes in countries such as Singapore are already moving cautiously, so this new move from the FATF is likely to add additional layers of scrutiny to businesses across the region as they seek regulatory approval.”

As for the United States, implementation of the FATF’s updated guidance is unlikely in the near future. “Implementation of any of the guidance’s recommendations would require the United States’ enforcement agency for money laundering and terrorist financing, the Financial Crimes Enforcement Network (FinCEN), to go through a public rule-making process, which would take months,” wrote the U.S. Blockchain Association in a blog post. 

Global Digital Finance’s Wright says: “It should now be clear to established and new crypto firms operating both CeFI and DeFi models what will likely be regulated and how. This will differ from country to country, but core principles apply and as countries regulate for crypto we can expect more firms falling within the regulators’ perimeter.”

“It will pay for firms to begin preparing their businesses now, or if in the design stage then factoring in the likely impact of regulation will avoid unnecessary challenges later,” Wright added.