Digital Assets, Crypto & AML — The VASP Framework

The FATF Definition of Virtual Asset

FATF's Glossary (October 2021 revision) defines a virtual asset as:

The definition has three key elements: (1) digital representation of value; (2) can be traded or transferred digitally; (3) used for payment or investment. All three must be present.

What Is NOT a Virtual Asset Under FATF?

• Central Bank Digital Currencies (CBDCs): A CBDC is a digital representation of fiat currency — it is covered as a fiat instrument elsewhere in the Recommendations and is excluded from the VA definition.
• E-money and digital payment instruments: Already covered under existing money services business or payment institution frameworks.
• NFTs: Generally not VAs given their unique and non-fungible nature. However, where NFTs are used at scale for payment or investment (e.g., fractionalised NFTs, NFT marketplaces with high volume), a case-by-case analysis is required.
• Fiat-backed stablecoins: Whether they qualify as VAs depends on their function — this is context-dependent and continues to evolve under FATF guidance.

The FATF Definition of VASP

A Virtual Asset Service Provider is any natural or legal person who as a business conducts one or more of the following activities for or on behalf of another person:

The R.15 Timeline

Core R.15 Obligations on Countries

Countries must:

1. Require VASPs to be licensed or registered with a competent authority.
2. Ensure VASPs implement AML/CFT programmes.
3. Ensure VASPs conduct CDD including verifying customers and beneficial owners.
4. Ensure VASPs monitor transactions for suspicious activity.
5. Ensure VASPs file STRs/SARs with the FIU.
6. Ensure VASPs comply with the Travel Rule.
7. Ensure VASPs screen customers and transactions against sanctions lists.
8. Designate a competent authority to supervise VASPs.

DeFi, Stablecoins, and NFTs

Decentralised Finance (DeFi)

FATF's October 2021 guidance addresses DeFi directly for the first time. The key principle: a DeFi protocol operator who has sufficient control or influence over the protocol is a VASP and must be licensed and comply with AML/CFT obligations. The "decentralised" label alone does not exempt a protocol from FATF obligations if identifiable controlling persons or entities exist.

Stablecoins

Stablecoins (assets pegged to fiat currencies) have grown dramatically as a proportion of crypto activity. Chainalysis data (2025) shows stablecoins now account for approximately 84% of illicit VA transaction volume — reflecting their dominance in everyday crypto use. This has significant implications for VASP transaction monitoring calibration.

NFTs

Non-fungible tokens are generally not VAs under FATF. However, NFT marketplaces with high transaction volumes may create VASP-like obligations. The primary ML risk of NFTs is wash trading — buying and selling the same NFT between related parties at escalating prices to create the appearance of legitimate value appreciation, allowing criminals to justify proceeds from illicit sources.

Origin and Extension to VAs

The Travel Rule originates from the US Bank Secrecy Act (FinCEN Funds Transfer Rule). FATF extended it to international wire transfers under R.16. In June 2019, the Interpretive Note to R.15 extended Travel Rule obligations to virtual asset transfers.

Required Information

Originator Information (Sending VASP Must Transmit)

• Originator's name
• Originator's account number (wallet address or account identifier)
• Originator's geographic address, national identity number, customer identification number, or date and place of birth

Beneficiary Information (Receiving VASP Must Obtain and Hold)

• Beneficiary's name
• Beneficiary's account number (wallet address or account identifier)

The sending VASP must verify the originator information before transmission. The receiving VASP must verify the beneficiary information before making funds available.

The Sunrise Issue

Unlike wire transfers, which have had decades of global Travel Rule implementation, VA Travel Rule implementation is uneven across jurisdictions. The "Sunrise Issue" refers to the problem that occurs when a VASP in a compliant jurisdiction tries to send Travel Rule data to a counterpart VASP in a jurisdiction that has not yet implemented the Travel Rule.

FATF's October 2021 guidance acknowledges this and provides transitional guidance: VASPs in compliant jurisdictions should still collect and transmit Travel Rule data. The receiving VASP's inability to process it does not excuse the sending VASP from its obligation.

By the June 2024 update, 99 jurisdictions had passed or were passing Travel Rule legislation — but nearly one-third of high-VA-risk jurisdictions had still not enacted it.

Unhosted (Self-Custodied) Wallets

When a VASP transfers VA to or from a self-custodied wallet (a wallet not held with any VASP — controlled directly by the individual), there is no counterpart VASP to transmit Travel Rule data to or receive it from. FATF guidance: countries should apply risk-based measures to manage ML/TF risks for transfers involving unhosted wallets. Many jurisdictions now require VASPs to conduct enhanced due diligence for transfers above threshold to unhosted wallets.

FATF Red Flag Indicators (September 2020)

FATF published a dedicated set of VA red flag indicators in September 2020, updated by the October 2021 guidance. These are the primary reference for VASP transaction monitoring calibration.

DeFi and Cross-Chain Risks

FATF's October 2021 guidance update addressed the growing use of DeFi protocols and cross-chain bridges in criminal laundering:

• Cross-chain bridges allow value to move between different blockchain networks. They have become important tools in the criminal ML ecosystem because they break the transaction trail across chains.
• DeFi protocols are used for "chain-hopping" at scale, enabling criminals to fragment and recombine value across multiple blockchains in seconds.
• The decentralised nature of many protocols means there is no single controlling entity to file an STR or conduct CDD — a gap that regulators are increasingly focused on.

DPRK-Linked Addresses and High-Risk Wallets

Specific blockchain wallet addresses associated with DPRK's Lazarus Group have been designated by OFAC and flagged by the UN Panel of Experts. VASPs must screen transaction addresses against these designations — customer name screening alone is insufficient for VA compliance.

Blockchain analytics tools (Chainalysis, Elliptic, TRM Labs) provide real-time wallet screening services that flag transactions touching wallets associated with sanctions, darknet markets, ransomware, and other illicit activity. These tools are now considered standard infrastructure for compliant VASP operations.

Why Africa Leads in Crypto Adoption

Africa ranks among the world's fastest-growing regions for cryptocurrency adoption. Key drivers include:

• Remittances: Crypto offers faster and cheaper cross-border transfers than traditional remittance corridors (which carry fees of 6–10%). Nigeria and Ghana are among the world's top P2P crypto trading markets by volume relative to GDP.
• Currency instability: In Nigeria, Zimbabwe, Ethiopia, and Sudan, citizens have turned to dollar-backed stablecoins to protect savings against inflation and currency devaluation.
• Unbanked populations: Mobile money platforms (M-Pesa, MTN MoMo, Airtel Money) serve as fiat on-ramps and off-ramps to crypto P2P markets for users without bank accounts.
• Youth demographics: Africa's young, mobile-first population adopts digital financial tools faster than older demographics in other regions.

Regulatory Landscape by Jurisdiction

Case Study: MMM Global Bitcoin Ponzi Scheme

MMM Global was a Russian-originated Ponzi scheme that spread aggressively into Africa and Asia in 2016–2017 — specifically targeting Nigeria, South Africa, Zimbabwe, Ghana, and the Philippines.

The scheme operated as a "mutual aid community," promising returns of 30–100% per month. Crucially, from 2016 it began requiring participants to contribute using Bitcoin, reducing its exposure to bank account freezes and adding a cryptocurrency layer to the scheme's evasion strategy.

Key compliance lessons from the MMM Bitcoin iteration:

• Cryptocurrency was used specifically to evade banking-sector AML controls — a deliberate choice by the scheme's operators.
• High-volume, high-frequency Bitcoin transactions from Nigerian and South African users to overseas wallets represented clear red flags that existing TM systems were not calibrated to detect.
• Mobile money platforms used as fiat on-ramps meant traditional bank monitoring missed significant portions of the scheme's cash flow.
• The non-face-to-face, digital nature of the scheme meant digital onboarding signals (device fingerprinting, IP patterns) were the primary available detection channel.