FATF (Financial Action Task Force)

The Financial Action Task Force (FATF) is the global standard-setting body for anti-money laundering (AML) and counter-terrorist financing (CFT) measures. Established in 1989 by the G7 Summit in Paris, FATF has grown from a group of seven countries to an international body with 39 members comprising jurisdictions and regional organizations, plus over 200 jurisdictions committed to FATF’s standards through a global network of FATF-style regional bodies. FATF’s extension of its 40 Recommendations to virtual assets in 2019 transformed the global regulatory landscape for crypto service providers.

The 40 Recommendations and Their Authority

FATF’s regulatory framework consists of 40 Recommendations that set international standards for combating money laundering, terrorist financing, and the financing of proliferation of weapons of mass destruction. The Recommendations are not legally binding in international law but carry effective quasi-mandatory force: FATF conducts mutual evaluations of member jurisdictions’ compliance with the standards, publishes the results, and places jurisdictions with strategic AML/CFT deficiencies on grey lists (the “Jurisdictions under Increased Monitoring” list) or black lists (the “High-Risk Jurisdictions subject to a Call for Action”). Grey-listed and black-listed jurisdictions face consequences including enhanced due diligence by foreign financial institutions, reduced access to correspondent banking, and reputational damage affecting foreign investment and sovereign credit ratings.

The 2019 VASP Definition and Recommendation 15

In June 2019, FATF revised Recommendation 15 and its Interpretive Note to explicitly include virtual asset service providers (VASPs) within the AML/CFT framework. The 2019 revision defined “virtual asset” as a digital representation of value that can be digitally traded, transferred, or used for payment or investment purposes, excluding digital representations of fiat currencies and certain narrow categories of digital assets. “Virtual asset service provider” was defined to cover persons conducting as a business the exchange between virtual assets and fiat currencies, exchange between virtual assets, transfer of virtual assets, safekeeping and/or administration of virtual assets, and participation in and provision of financial services related to an issuer’s offer and/or sale of virtual assets.

Under FATF’s framework, VASPs must be licensed or registered in the jurisdictions in which they operate, are subject to the same customer due diligence (CDD) and suspicious transaction reporting requirements as other financial institutions, and must be monitored and supervised for compliance. FATF’s updated guidance published in 2021 further clarified the application of the VASP definition to DeFi protocols and non-fungible tokens, and addressed the specific risks associated with anonymity-enhancing technologies.

The Travel Rule: Recommendation 16 Applied to Crypto

Recommendation 16 — the “travel rule” — requires financial institutions to collect and transmit beneficiary and originator information alongside wire transfers. FATF’s 2019 amendments applied the travel rule to virtual asset transfers above a threshold of USD/EUR 1,000, requiring VASPs to obtain, hold, and transmit the name, account number or virtual asset wallet address, physical address or national identity number, and date of birth of both the originator and beneficiary of any covered transfer.

Implementation of the travel rule for crypto has proven technically challenging and has proceeded slower than FATF anticipated. The lack of standardized messaging protocols for blockchain transactions — in contrast to the SWIFT messaging system that underlies traditional wire transfer compliance — meant that the industry needed to develop or adopt new technical infrastructure for transmitting travel rule data. Industry solutions including the TRISA (Travel Rule Information Sharing Architecture) protocol and the OpenVASP standard emerged, but fragmented adoption across jurisdictions created compliance gaps. As of 2025, approximately 73% of jurisdictions were implementing or had implemented the travel rule for virtual assets, according to FATF’s monitoring data.

Grey-Listing: UAE Case Study

The UAE provides an instructive case study in FATF grey-listing consequences. In March 2022, FATF placed the UAE on the grey list based on findings that the UAE’s AML/CFT controls across its financial sector, including its rapidly growing crypto industry, had strategic deficiencies. The grey-listing triggered immediate market reactions: international banks increased scrutiny of UAE-related transactions, correspondent banking relationships became more difficult, and several multi-national firms reviewed their UAE office strategies. The UAE invested substantial resources in remediation, including strengthening financial institution supervision, enhancing beneficial ownership registries, and increasing prosecutions for money laundering. FATF removed the UAE from the grey list in February 2024.

The UAE case underscored that crypto-related AML deficiencies can trigger consequences affecting the entire financial system of a jurisdiction, creating powerful political incentives for governments to take FATF compliance seriously even where they might otherwise prefer lighter-touch crypto regulation.

FATF and DeFi

Applying FATF’s AML/CFT framework to decentralized finance presents conceptual and practical challenges. FATF guidance acknowledges that truly decentralized protocols with no controlling entity may not fit neatly within the VASP definition. However, FATF has emphasized that: many ostensibly decentralized protocols have identifiable owners, developers, or governance participants who exercise control; front-end interfaces to DeFi protocols often have identifiable operators; and the VASP definition is intended to capture functional equivalents of financial intermediaries regardless of technical architecture. Jurisdictions are expected to identify the responsible parties in DeFi arrangements and apply AML/CFT requirements to those parties where they exist, while FATF continues to develop guidance for genuinely novel DeFi structures.