FATF Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (October 2021)

Summary

This is the FATF's October 2021 Updated Guidance for a Risk-Based Approach to Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs), made available by the BVI Financial Services Commission as guidance material for its AML/CFT framework. It explains how the FATF Recommendations, particularly Recommendation 15 and its Interpretive Note, apply to VAs and VASPs, and updates the 2019 version with additional guidance on stablecoins, peer-to-peer transactions, licensing/registration, the travel rule, and supervisory information-sharing.

• Scope and definitions: Clarifies the definitions of virtual asset and VASP, intended to be expansive so that any relevant financial asset is covered either as a VA or another financial asset already regulated.
• Licensing or registration: VASPs must be licensed or registered in the jurisdiction where they are created (or, for natural persons, where their business is located); countries may also require licensing/registration for VASPs operating in or from their jurisdiction.
• Supervision: Only competent authorities (not self-regulatory bodies) may supervise or monitor VASPs, using a risk-based approach, with powers to inspect, compel production of information, and impose sanctions including withdrawal, restriction or suspension of licences.
• Preventive measures: VASPs must apply Recommendations 10 to 21, including customer due diligence on occasional transactions above the USD/EUR 1,000 threshold (Recommendation 10).
• Travel rule: Under Recommendation 16, originating VASPs must obtain, hold and immediately and securely transmit required originator and beneficiary information to the beneficiary VASP or financial institution, and make it available to authorities on request; beneficiary VASPs must obtain and hold corresponding information.
• Sanctions: Countries must ensure effective, proportionate and dissuasive sanctions apply to non-compliant VASPs and their directors and senior management.
• International cooperation: Supervisors of VASPs should exchange information promptly and constructively with foreign counterparts under Recommendations 37 to 40.

As FATF-level guidance reproduced by the BVI FSC, the document itself does not create new local legal deadlines but sets out the international standards VASPs and financial institutions engaging in virtual asset activities are expected to meet under BVI's AML/CFT regime.

Key obligations

• VASPs must be licensed or registered in the jurisdiction of creation (or business location for natural persons) before conducting virtual asset activities.
• VASPs must conduct customer due diligence on occasional virtual asset transactions above the USD/EUR 1,000 threshold.
• Originating VASPs must obtain, hold and immediately and securely transmit required originator and beneficiary information on virtual asset transfers to the beneficiary VASP or financial institution, and make it available to authorities on request.
• Beneficiary VASPs must obtain and hold required originator and beneficiary information on virtual asset transfers and make it available to authorities on request.
• Countries must ensure a range of effective, proportionate and dissuasive sanctions apply to non-compliant VASPs and their directors and senior management.
• Supervisors of VASPs must exchange information promptly and constructively with foreign counterpart supervisors.

Applies to

virtual asset service providers (VASPs), financial institutions engaging in virtual asset transfers, competent authorities/supervisors, countries/national authorities