FATF releases review of virtual asset and virtual asset service provider standards

On 5 July the Financial Action Task Force (FATF) released its Second 12-Month Review of the Revised FATF Standards on Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs) (Second Review).  This looked primarily at the implementation of standards set by the FATF by members of both the FATF and FATF-Style Regional Bodies (FSRBs), as well as changes within the VA sector.

According to the FATF’s International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation (Recommendations), a VA is “a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes”, while a VASP is a person that, as a business, conducts one or more of a range of prescribed activities related to VAs.

The Second Review, as well as the FATF’s Recommendations, Guidance for a Risk-Based Approach to VAs and VASPs (Guidance), and first 12-Month Review of the Revised FATF Standards on VAs and VASPs (First Review) can be found on the FATF’s website.

Our discussion of the Guidance and relevant updates to the Recommendations can be found on our website.

Who needs to read it?  Why?

VASPs and any others involved in the business of VAs should pay close attention.  This is a key area of development, both globally and in New Zealand, in the anti-money laundering and countering financing of terrorism (AML/CFT) sphere, and what the FATF says holds substantial weight there.

With the increasing digitisation of the economy and the spread of VAs, this will become increasingly relevant to a wider range of reporting entities.

What does it cover?

In 2019, the Recommendations were amended, and the Guidance was published, to clarify the application of FATF requirements to VAs and VASPs.  A year later, the First Review found that there was not a clear need to amend the Recommendations further in respect of VAs and VASPs but, while progress had been made in the public and private sectors on implementing them, there was still substantial work there to be done.

Following that, the scope for this Second Review was set at:

  • monitoring jurisdictions’ implementation of the revised Recommendations;
  • monitoring reporting entities’ (particularly VASPs, but also others generally) progress in developing and implementing their obligations under the revised Recommendations; and
  • monitoring the VA sector for potential changes in typologies, risks, and market structure.

Jurisdictions’ implementation

128 jurisdictions (comprising 38 FATF members and 90 FSRB members) responded to the FATF’s self-assessment questionnaire for the purpose of this review.  Of these:

  • 58 jurisdictions had relevant legislation in place (of which 35 had operational regimes), with 52 permitting and regulating VASPs (with a registration regime, licensing regime, or both) and 6 prohibiting them;
  • 26 jurisdictions were in the process of introducing relevant legislation, with all to permit and regulate them rather than prohibit them;
  • 12 jurisdictions had decided their approach to VASPs but were not yet in the process of introducing relevant legislation, with 6 to permit and regulate them and 6 to prohibit them; and
  • 32 jurisdictions had yet to decide what approach to take to VASPs.

Between the 36 jurisdictions with extant licensing or registration regimes, 2,374 VASPs were reporting as licensed or registered.  This is more than double the 1,133 reported between 20 jurisdictions in the First Review, although it is not clear how much this reflects actual growth in the sector rather than the larger number of jurisdictions involved.  Of these 36, 29 had been conducting on- and/or off-site inspections of VASPs (up from 15), and 18 had in place criminal, civil, and/or administrative sanctions for them (up from 8).

From the questionnaires, together with a review of completed Mutual Evaluation reports and follow-up reports, the FATF concluded that significant progress had been made but substantial gaps in global implementation remained.  Such gaps included:

  • a diversity of approach to regulating VASPs (with most currently-regulating jurisdictions covering VASPs created within them, some regulating VASPs incorporated overseas but offering products or services to customers within them, and some regulating VASPs conducting operations from within them, in some combination or another) presenting a challenge when identifying which VASPs are regulated by each jurisdiction;
  • some jurisdictions covering some but not all limbs of the FATF VASP definition;
  • at least 25 different terms being used to refer to VASPs in different jurisdictions; and
  • only 74% of FATF members and 33% of FSRB members having in place laws to regulate VASPs, with even fewer having those regimes in operation.

Reporting entities’ implementation

The primary focus of the Second Review in respect of private sector implementation is the so-called “travel rule”.  This is a key AML/CFT obligation around wire transfers, which applies to VASPs by requiring them to obtain, hold, and exchange information about the originators and beneficiaries of VA transfers.

From the aforementioned questionnaires and FATF outreach to the private sector, the FATF came to the view that technological development had reduced the difficulties VASPs encountered in complying with the travel rule, but nothing sufficiently holistic and scalable had been established and widely adopted.  On the whole, most jurisdictions and most VASPs were still not complying with the travel rule, which the FATF saw as a major obstacle to global AML/CFT mitigation.

In addition to the travel rule, implementation by VASPs of other AML/CFT obligations was also examined.  Implementation of AML/CFT regimes more widely is still in its early stages, and for VASPs in particular it is complicated by a lack of history of regulatory oversight and familiarity with AML/CFT fundamentals, and the continuing trend of rapid evolution in technology and practices.

Changes in the sector

There has been significant growth and development in the VA sector since the First Review last year.  As this has substantially followed the FATF’s revisions to the Recommendations around VAs and VASPs, the FATF is of the view that these revisions have not stifled or hindered innovation and growth in that sphere.  Rather, its position is that regulatory certainty and strong international controls can act as a facilitator for business development, public adoption, and the creation of necessary national regulatory frameworks.

The value of VAs involved in detected money laundering or terrorist financing cases has tended to remain relatively low compared to where more traditional financial services and products are involved.  Where identified, they tend to relate to activity native to VAs rather than proceeds of crime originating in fiat currency.

Jurisdictional arbitrage remains a problem, given the significant gaps remaining in global implementation.  Further, tools and methods to increase anonymity in VA transfers continue to be developed, and their use remains a key concern.

Research commissioned by the FATF found no firm evidence of a trend towards peer-to-peer transactions or away from transactions involving a VASP, although a significant proportion took place without a VASP.  There was, however, an indication that a greater proportion of illicit transactions occur in VASP-less transactions than those with a VASP involved.

Our view

The FATF’s latest Mutual Evaluation of New Zealand (our discussion of which can be found on our website) in April this year singled out VAs and VASPs as a priority issue within the New Zealand AML/CFT regime.  Without specific and bespoke coverage in the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), only some types of VASP are covered, and the requirements those ones are subject to are not tailored to them.

This sits uncomfortably alongside the March 2020 Guideline: VASPs from the Department of Internal Affairs, which makes the statement that VASPs generally are captured by the AML/CFT Act as financial institutions.

With the impending statutory review of the AML/CFT Act, we would not be at all surprised if the Ministry of Justice was to include in that review contemplation of how to refine and improve New Zealand’s AML/CFT approach to VAs and VASPs.  In addition to the comments in our latest Mutual Evaluation and in the wider context of material published by the FATF in this space (such as this Second Review), VAs have already been recognised for their inherent risks in multiple New Zealand Sector and National Risk Assessments.

The Second Review also refers to the importance of financial inclusion, and ensuring excessive rigidity does not exclude legitimate consumers and businesses from the regulated financial system.  We agree with the FATF on that point, and are firmly of the view that the development of the AML/CFT regime must be carried out while fully cognisant of the balance that needs to be struck there.

What next?

The Second Review concluded by recommending that the FATF:

  • focus on the effective implementation of the existing Recommendations in respect of VAs and VASPs, including publishing a revision of the Guidance (which was consulted on in March/April 2021) by November 2021;
  • accelerate implementation of the travel rule by the private sector as a priority; and
  • monitor the VA and VASP sector for any material changes or developments necessitating further revision or clarification of the Recommendations.

No amendments were considered necessary to the Recommendations and their approach to VAs and VASPs at this stage, with that updated Guidance expected to provide sufficient clarity.  However, if there were to be significant changes in the market structure or risk profile of VAs and VASPs, the FATF acknowledged that some amendments to the Recommendations may be warranted.

As raised above, there is a statutory review of the AML/CFT Act coming up.  This will naturally be a matter of interest for all AML/CFT reporting entities, but those with a particular interest in the VA and VASP sphere should pay particular attention given its likely prominence within the review.

If you have any questions in relation to VAs or VASPs, or the AML/CFT regime more generally, please contact one of our experts.

Who can help