## ftnea2021002

## Source details

**Canonical URL:** [ftnea2021002](https://www.imf.org/-/media/files/publications/ftn063/2021/english/ftnea2021002.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/ftn063/2021/english/ftnea2021002.pdf.md)
- [Structured JSON version](/-/media/files/publications/ftn063/2021/english/ftnea2021002.pdf.json)

---

### Introduction: scope, terminology, and market size
- Phenomenon:
  - “Phenomenal rise” in new digital instruments promising easier, faster, and cheaper global payments and transfers.
- Common terms:
  - Cryptocurrencies, digital currencies, crypto assets, virtual assets — systems for storing/capturing value and rights in digital form.
- Technology and origins:
  - Many well-known digital assets rely on cryptographic technology and are underpinned by distributed ledger technology (DLT), such as blockchain.
  - The first widely known instrument, Bitcoin, was launched in 2009.
- Market size (as of September 19, 2021):
  - Capitalization of at least US$1.97 trillion (for the top 101 cryptocurrencies).
  - For “a dozen of them,” a daily turnover of more than US$1 billion.
- Terminology and scope (FATF):
  - Adopts FATF terminology: “virtual assets (VA)” and “virtual asset service providers (VASPs).”
  - FATF’s VA definition explicitly excludes digital representations of fiat currencies, securities and other assets covered elsewhere; national digital currencies, including central bank digital currencies (CBDCs), are not discussed in this note.
- Potential benefits noted in IMF publications:
  - Greater speed, lower cost, increased efficiency in payments and transfers (including across borders), and potential to improve financial inclusion.
  - DLT offers benefits beyond VAs and is under consideration for domestic “currency” issuance (CBDCs).

### Financial integrity risks related to virtual assets (VAs)
- Overview of risks:
  - VAs can be and have been misused to facilitate fraud, theft, money laundering (ML), terrorist financing (TF), and financing of the proliferation of weapons of mass destruction (PF).
  - Without strong mitigation, VAs can pose a significant threat to the integrity of the global financial system and thereby to financial stability, sustainable growth and inclusive economic development.
- Observed scale and trends:
  - Exact global extent unclear but to date appears smaller in volume and frequency than misuse of traditional financial services.
  - Misuse is “not negligible and is rapidly increasing.”
  - Notable cases: Silk Road, AlphaBay, Wannacry ransomware attack.
  - Typologies/offenses: ML, sale of controlled substances and other illegal items (including firearms), fraud, tax evasion, sanctions evasion, cyberattacks resulting in thefts, child exploitation, human trafficking and TF.
  - Narcotics-related crimes and fraud are among the most prevalent offenses involving VAs.
  - Evidence of professional ML networks exploiting VAs, use of multiple VASPs, and use of anonymity-enhancing tools.
- Factors making VAs attractive to criminals:
  - Anonymity-enhancing features:
    - Transactions may be visible and traceable between wallets, but linking an address or wallet to a specific individual is challenging.
    - Mechanisms hindering traceability include mixers/tumblers, multiple layers of encryption, stealth addresses, ring signatures, and masking of secondary information (IP addresses, geolocation data, device identifiers, transaction hashes).
  - Non-face-to-face activities:
    - Online-only onboarding and transactions complicate customer identification and increase forged or inaccurate identification risks.
  - Decentralization and fragmentation:
    - VASPs can be physically present, registered, and host servers in different jurisdictions, providing global services without central command, complicating prevention, analysis, and law enforcement.
  - Uneven domestic AML/CFT application:
    - Many countries remain in early stages of FATF-standard implementation, enabling regulatory arbitrage and misuse of VASPs in jurisdictions with minimal AML/CFT regulations.
- Consequence for authorities:
  - These factors hinder effective AML/CFT preventive frameworks and law enforcement, creating a “perfect storm” when anonymity features and other risk factors coincide.

### Key policy and international responses
- International calls and standards:
  - IMF, World Bank, G20, and G7 called for a “responsible, balanced approach” — enabling legitimate use and innovation while mitigating risks.
  - FATF actions:
    - In June 2019, FATF finalized amendments to its global standards to impose AML/CFT requirements on VAs and VASPs.
    - FATF noted in June 2020 that progress was being made in implementation but “considerably more effort was needed.”
    - FATF undertook a 12-month review of implementation and was to consider further updates; a second FATF review was ongoing at the time of publication.
- National measures:
  - Approaches range from full or partial regulatory coverage of VA activities to outright bans.
  - Disparate and fragmented regulatory landscape has not proven fully effective and leaves room for regulatory arbitrage.
- Purpose of the Fintech Note(s):
  - Assist countries in understanding and mitigating ML, TF, and PF risks related to VAs.
  - This is the first of two Fintech Notes on VAs and AML/CFT:
    - First note: explains vulnerabilities of VAs for ML/TF/PF, clarifies which assets and service providers should be subject to AML/CFT measures, discusses measures all countries should take, and outlines action necessary in instances of criminal misuse.
    - Second note: focuses on AML/CFT regulatory and supervisory frameworks for VASPs.
  - Both notes are based on FATF standards and draw heavily on FATF’s 2019 “Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers.”
  - At drafting time, no country had been assessed against the new standards and many authorities were still establishing how best to incorporate them; the note avoids country-specific examples.

### Key concepts and definitions used in the note
- FATF’s approach:
  - Uses a broad concept of VA to capture the widest range of virtual instruments that can be misused for ML/TF/PF; domestic legal classification and market terminology do not determine VA categorization under FATF.
  - Determination depends on nature and use; may be complex due to lack of universally agreed definitions.
- Terminology:
  - Crypto assets (IMF usage): digital representations of value enabled by advances in cryptography and DLT.
  - Cryptocurrency: generally a digital asset designed to work as a medium of exchange; ownership records stored in a ledger using strong cryptography; typically not issued by a central authority.
  - Stablecoins and “so-called” Global Stablecoins (GSCs):
    - FSB: “a type of crypto asset that aims to maintain a stable value relative to a specified asset, or a pool or basket of assets.”
    - FATF treats “stablecoin” as primarily a marketing term (“so-called stablecoins” and “so-called stablecoins with the potential for mass adoption”).
- Technologies and mechanisms (examples):
  - Distributed Ledger Technology (DLT): a database stored, shared, and synchronized on a computer network; data updated by consensus among participants. Blockchain is a type of DLT but DLT need not use a chain-of-blocks architecture.
  - Digital Wallet: virtual account that can hold VAs; forms include hardware wallets, desktop wallets, online/cloud wallets, mobile wallets, printed wallets.
  - Mixer/Tumbler: combines and intermingles multiple transactions and distributes them among multiple wallets.
  - Ring Signature: hides the originator of a transfer by requiring signatures from several VA users to conduct a transaction.
  - Transaction Hash: alphanumeric unique identifier of a transaction.

### Box 2 — FATF definitions, VASPs, and regulatory implications
- FATF definition of Virtual Asset (VA):
  - “A digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes.”
  - Clarifies exclusions: digital representations of fiat currencies, securities and other financial assets covered elsewhere.
- Types of digital assets captured as VAs (per FATF):
  - Centralized and decentralized assets convertible to money or another VA.
  - Mainstream digital assets (e.g., Bitcoin, Ethereum, Monero) and pegged assets (so-called GSCs), and tokenized assets.
- Assets explicitly not considered VAs under FATF:
  - Tokens that cannot be used for payment or transfer of value (certain utility tokens).
  - Nonconvertible digital assets specific to a virtual domain (e.g., airline frequent flyer airmiles, credit card awards).
  - National digital currencies (including CBDCs).
- Observations on scope and monitoring:
  - Determinations may be challenging as the landscape evolves; ongoing monitoring needed to ensure relevant virtual assets are captured by AML/CFT frameworks.
  - Footnote: discussions and public consultation underway on which entities are captured as VASPs; revised Guidance expected late 2021.
- VASPs: role and rationale:
  - VAs have given rise to VASPs to facilitate transactions, provide platforms, or host custody.
  - Whether a person/entity is a VASP depends on activities and for whose benefit.
  - FATF scope includes virtual-to-virtual and virtual-to-fiat transactions.
  - All five categories of VASP activity are conducted “as a business,” entailing remuneration.
- Activities indicating a VASP (when conducted as a business):
  - VA exchanges (including kiosks/ATMs), cryptocurrency exchangers, converters, brokerage, trading, escrow services.
  - VA transfer services: moving VAs from one address/account to another on behalf of others.
  - Custodial services: virtual wallet providers hosting or maintaining custody/control over another person’s VAs.
  - Administration of another person’s VAs.
  - Financial services related to an issuer’s offer/sale of a VA (e.g., ICO advisory services).
- Entities/activities not considered VASPs under FATF:
  - Individuals acting on a private basis.
  - Peer-to-peer transactions where neither party is a VASP or AML/CFT-regulated entity.
  - Platforms merely providing a forum for peer-to-peer activity without intermediation.
- Delineation challenges:
  - Distinction between hosting and intermediation can be tenuous; FATF focuses on “active” facilitation of financial activity.
  - Smart contracts and DApps complicate control/benefit assessments; an “owner or operator” of a dApp may be a VASP.
- Regulatory implications and recommendations:
  - Countries must ensure VAs and, unless banned, VASPs are properly regulated domestically.
  - Options:
    - Apply pre-existing AML/CFT laws if they adequately incorporate VASPs (e.g., as money service business, payment service provider, or dealer in securities).
    - Include VASPs as a new category of AML/CFT-obliged entity.
  - Ensure AML/CFT frameworks apply to financial institutions and DNFBPs when they provide covered VA-related services; DNFBPs engaging in VA activities should be subject to comparable frameworks.
- Operational aspects and standard evolution:
  - FATF adopted changes to its standards in 2018 and 2019 to explicitly apply them to the virtual context and provided additional tailoring where necessary.

### Risk Assessment, Legal Foundations, and Operational Recommendations (Annex / main text)
- Risk Assessment:
  - Prior determination of ML/TF/PF risks is required; avoid blanket assumptions.
  - Assess sector-specific risk factors: properties of VA activities, products/services, delivery channels, customer base, and geography.
  - Special attention to:
    - Availability and significance of decentralized VAs.
    - VAs or services that hinder traceability and VASPs’ ability to implement AML/CFT measures.
  - Assess quality of AML/CFT measures applied by VASPs and other reporting entities.
  - Effective assessment requires solid technical knowledge, close private-sector engagement for market data, and international cooperation.
  - Global stablecoins (GSCs) identified as potential game changers; require strong AML/CFT measures both in GSC networks and domestically.
- Legal Foundation:
  - Adapting to VAs may require updating legal frameworks; steps include:
    - (i) Ex ante policy decision (ban or regulate).
    - (ii) Review legal framework to establish breadth of legal/regulatory changes.
    - (iii) Review criminal law to ensure effective enforcement (ban enforcement and criminal misuse).
  - Practical measures include ability to freeze and seize VAs.
- Legal Framework for Preventing and Sanctioning ML and TF:
  - ML and TF offenses should apply regardless of asset type; many countries’ laws already apply to VAs, others may need amendments.
  - Further changes may be needed for customs declarations, international cooperation, LEA investigatory powers, freezing/seizing, targeted financial sanctions, confiscation, and management of proceeds.
- Financial Intelligence Units (FIUs):
  - May need to revise reporting templates to capture VA-specific data: wallet account information; transaction details including transaction hash and originator/recipient information; login information including IP addresses; mobile device information.
  - FIUs need solid understanding of virtual transactions, enhanced anonymity features, and typologies; ability to conduct operational analysis and identify transactions indicative of ML/TF/PF.
- Investigations and Prosecutions:
  - LEAs need powers/capabilities for VA investigations, including compulsory production of VASP records and freezing/seizing VAs.
  - Traditional investigative skills useful but insufficient; new skills required for tracing VA transactions and electronic searches.
  - Recommend cybercrime-specialized investigators, specific training (blockchain transaction identification, darknet simulation), strengthened interagency cooperation, special units with tech expertise, and dialogue with foreign counterparts.
  - Useful technological tools:
    - Blockchain explorers.
    - Specialized firms that collect and analyze transaction data across VA networks.
  - Prosecutors and judges require enhanced training to understand technological evidence and legal frameworks.
- Seizing, Freezing, Confiscation, and Management of VAs:
  - Tainted VAs should be subject to freezing, seizing, and confiscation; modalities tailored to virtual space.
  - Seizing/Freezing:
    - LEAs need to identify public and private keys and manage keys, recovery seeds, and/or VA wallet files.
    - Seizure should be almost instantaneous (e.g., moving VAs into an LEA-controlled wallet), possibly requiring legal/practice adjustments for speed.
    - Frameworks needed to locate wallet instruments or access private keys/recovery seeds.
  - Management of seized VAs:
    - Options: (i) convert VAs into fiat; or (ii) manage VAs by creating and securing a wallet held/managed by LEA or a wallet service provider (maintain records of private keys, recovery seeds).
    - Considerations: high price volatility, duration of criminal procedures, cybersecurity risks, valuation point decisions, and secure official wallets (cold storage).
  - Confiscation:
    - Courts should determine holding VAs or converting to fiat, potentially requiring legal framework adjustments.
- International Cooperation:
  - Close and swift cooperation between countries is key due to high mobility of VAs.
  - Clear legal basis required for information exchange and cooperation, even where VA activities are restricted or banned domestically.
  - Traditional mutual legal assistance (MLA) may be too slow; build informal cooperation channels for swift conservatory action (freezing/seizing wallets) pending formal processes.
  - MLA issues where dual criminality depends on counterpart criminal frameworks capturing VAs.
  - Good domestic coordination useful because different authorities may have different foreign cooperation channels.

### Recommendations for AML/CFT implementation and supervision (FATF-related)
- Risk-based approach:
  - Countries should identify, assess, and understand ML/TF risks from virtual asset activities and VASPs, and apply a risk-based approach.
  - Require VASPs to identify, assess, and mitigate their own ML/TF risks.
- Licensing and registration:
  - VASPs should be required to be licensed or registered.
  - Minimum: licensed or registered in jurisdiction(s) where they are created.
  - Natural person VASPs: licensed/registered where their place of business is located.
  - Jurisdictions may require VASPs offering products/services to customers in their jurisdiction or conducting operations from their jurisdiction to be licensed/registered there.
  - Prevent criminals or associates from holding significant or controlling interest or management functions in a VASP.
  - Identify unlicensed VASP activity and apply sanctions.
  - No need for separate licensing where entities already licensed as financial institutions and subject to full AML/CFT obligations.
- Supervision, monitoring, and enforcement:
  - VASPs subject to adequate regulation and supervision/monitoring for AML/CFT; implement FATF Recommendations.
  - Supervisors (not an SRB) should conduct risk-based supervision, have powers to inspect, compel information, and impose sanctions including withdrawing/restricting/suspending licenses or registrations.
- Sanctions:
  - Range of effective, proportionate and dissuasive sanctions (criminal, civil, administrative) in line with Recommendation 35; applicable to VASPs and their directors/senior management.
- Preventive measures and application of Recommendations R.10–R.21:
  - Requirements of R.10–R.21 apply to VASPs with qualifications:
    - (a) R.10 — occasional transactions designated threshold for CDD is USD/EUR 1 000.
    - (b) R.16 — originating VASPs must obtain and hold required and accurate originator information and required beneficiary information on virtual asset transfers, submit it to beneficiary VASP or financial institution immediately and securely, and make it available on request to appropriate authorities.
      - Beneficiary VASPs must obtain and hold required originator and accurate beneficiary information and make it available on request.
      - Other R.16 requirements (monitoring availability of information, freezing action, prohibiting transactions with designated persons/entities) apply as set out in R.16.
      - Same obligations apply to financial institutions when sending/receiving virtual asset transfers on behalf of a customer.
    - Footnotes clarify definitions and that information can be submitted directly or indirectly; not necessary to attach information directly to virtual asset transfers.
- International cooperation:
  - Countries should rapidly, constructively, and effectively provide the widest possible international cooperation relating to ML, predicate offences, and TF relating to virtual assets (Recommendations 37 to 40).
  - Supervisors of VASPs should exchange information promptly and constructively with foreign counterparts regardless of differences in nomenclature or status of VASPs.

### Initiatives to build LEA capacity (Annex 2)
- Project Titanium:
  - Ongoing research project including INTERPOL and 14 other European agencies to support LEA investigations of criminal and terrorist activities involving VAs.
  - Aims to develop services and forensic tools for: (i) monitoring trends in virtual currency and darknet market ecosystems; (ii) analyzing transactions across different virtual currency ledgers; and (iii) generating court-proof evidence reports based on reproducible and legally compliant analytical procedures.
- BITCRIME and VIRTCRIME:
  - Bitcrime: bilateral German-Austrian research project (2014–2017) on prevention and prosecution of organized financial crime with virtual currencies.
  - VIRTCRIME: ongoing project focusing on misuse of cryptocurrencies other than Bitcoin.
- Confidential FATF Report on Guidance on Financial Investigations Involving Virtual Assets:
  - Published in June 2019; provides guidance and practical advice to national domestic authorities (especially FIUs and LEAs) to improve detection, investigation, and confiscation of virtual assets involved in serious financial crimes including ML and TF purposes.

### Conclusion and necessities for effective mitigation
- FATF standards provide clarity on ML/TF/PF risk mitigation in the virtual space and facilitate domestic transposition.
- FATF treats VAs broadly the same as other asset types while accounting for intrinsic characteristics.
- Main challenges: keeping up with technology and increasing stakeholder dialogue.
- VAs likely to persist and be used increasingly in cross-border transactions; broad use of GSCs would require rapid coordinated global action.
- Necessities for effective mitigation:
  - Solid understanding of VAs’ underpinnings and operating models.
  - Building expertise and capacity across policy makers, AML/CFT supervisors, FIUs, LEAs, and the judiciary.
  - Close dialogue with the VASP industry.
  - Close and prompt cross-jurisdictional cooperation.
  - Leveraging technology to support AML/CFT implementation.
- International community engagement (FATF, IMF, and others) should continue, including monitoring developments and facilitating FATF standards implementation; IMF to provide advice and capacity development.

*International Monetary Fund | October 2021*

### Introduction 1

### ftnea2021002 - Introduction 1

### Introduction: scope, terminology, and market size
- The last decade has seen a “phenomenal rise” in new digital instruments promising easier, faster, and cheaper global payments and transfers.
- Common marketplace terms: cryptocurrencies, digital currencies, crypto assets, virtual assets — all describe systems of storing/capturing value and rights in digital form.
- Technology and origins:
  - Many well-known digital assets rely on cryptographic technology and are underpinned by distributed ledger technology (DLT), such as blockchain.
  - The first widely known instrument, Bitcoin, was launched in 2009.
- Market size as of September 19, 2021:
  - Capitalization of at least US$1.97 trillion (for the top 101 cryptocurrencies).
  - For “a dozen of them,” a daily turnover of more than US$1 billion.
- Terminology and scope under FATF:
  - The note adopts FATF terminology: “virtual assets (VA)” for the instruments and “virtual asset service providers (VASPs)” for the new actors.
  - FATF’s VA definition explicitly excludes digital representations of fiat currencies, securities and other assets covered elsewhere; therefore national digital currencies, including central bank digital currencies (CBDCs), are not discussed in this note.
- Potential benefits of VAs noted in IMF publications:
  - Greater speed, lower cost, increased efficiency in payments and transfers (including across borders), and potential to improve financial inclusion.
  - DLT offers benefits beyond VAs and is under consideration for domestic “currency” issuance (CBDCs).

### Financial integrity risks related to virtual assets (VAs)
- Overview:
  - VAs can be and have been misused to facilitate fraud, theft, money laundering (ML), terrorist financing (TF), and financing of the proliferation of weapons of mass destruction (PF).
  - Without strong mitigation, VAs can pose a significant threat to the integrity of the global financial system and thereby to financial stability, sustainable growth and inclusive economic development.
- Observed scale and trends:
  - The exact global extent of misuse is unclear but to date appears smaller in volume and frequency than misuse of traditional financial services.
  - Misuse is “not negligible and is rapidly increasing.”
  - Notable cases include Silk Road, AlphaBay, and the Wannacry ransomware attack.
  - Typologies and offenses involving VAs include ML, sale of controlled substances and other illegal items (including firearms), fraud, tax evasion, sanctions evasion, cyberattacks resulting in thefts, child exploitation, human trafficking and TF.
  - Narcotics-related crimes and fraud are among the most prevalent offenses involving VAs.
  - Some evidence of professional ML networks exploiting VAs, use of multiple VASPs, and use of anonymity-enhancing tools.
- Factors that make VAs attractive to criminals:
  - Potential for greater anonymity and availability of anonymity-enhancing features:
    - Many transactions (e.g., Bitcoin) are visible online and traceable from one wallet to another, but linking an address or wallet to a specific individual is challenging.
    - Mechanisms that hinder traceability include mixers/tumblers, multiple layers of encryption, stealth addresses, ring signatures, and masking of secondary information (IP addresses, geolocation data, device identifiers, transaction hashes).
  - Non-face-to-face activities:
    - Online-only onboarding and transactions complicate customer identification and increase the risk of forged or inaccurate identification information.
  - Potential for decentralization and fragmentation of near-instant global services:
    - VASPs can be physically present in one jurisdiction, registered in another, host servers in others, and provide services globally without a central command, complicating prevention, financial intelligence analysis, and law enforcement.
  - Uneven application of domestic AML/CFT measures:
    - Many countries remain in early stages of FATF-standard implementation, creating opportunities for regulatory arbitrage and misuse of VASPs domiciled or operating in jurisdictions with nonexistent or minimal AML/CFT regulations.
- Consequences for authorities:
  - These factors hinder effective implementation of AML/CFT preventive frameworks and law enforcement action, creating a “perfect storm” when anonymity features and other risk factors coincide.

### Key policy and international responses
- International calls and standards:
  - IMF, World Bank, G20, and G7 have called for a “responsible, balanced approach” to VAs—enabling legitimate use and fostering innovation while mitigating risks.
  - In June 2019, FATF finalized amendments to its global standards to clearly impose AML/CFT requirements on VAs and VASPs (see Annex 1 in source).
  - FATF noted in June 2020 that progress was being made in implementation but “considerably more effort was needed.”
  - FATF undertook a 12-month review of implementation and was to consider further updates; a second FATF review was ongoing at the time of publication.
- Measures taken by countries:
  - Approaches range from full or partial regulatory coverage of VA activities to outright bans on some or all VA transactions.
  - The disparate and fragmented regulatory landscape has not proven fully effective and leaves room for regulatory arbitrage.
- Purpose of the Fintech Note(s):
  - Assist countries in understanding and mitigating ML, TF, and PF risks related to VAs.
  - This is the first of two Fintech Notes on VAs and AML/CFT:
    - This first note: explains vulnerabilities of VAs for ML/TF/PF, clarifies which assets and service providers should be subject to AML/CFT measures, discusses measures all countries should take, and outlines action necessary in instances of criminal misuse.
    - The second note focuses on AML/CFT regulatory and supervisory frameworks for VASPs.
  - Both notes are based on FATF standards and draw heavily on FATF’s 2019 “Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers.”
  - At drafting time, no country had been assessed against the new standards and many authorities were still establishing how best to incorporate them; hence the note avoids country-specific examples.

### Key concepts and definitions used in the note
- FATF’s approach:
  - FATF uses a broad concept of VA to capture the widest range of virtual instruments that can be misused for ML/TF/PF purposes; the domestic legal classification (e.g., security or commodity) and market terminology do not determine VA categorization under FATF standards.
  - Whether an asset falls within FATF’s VA definition depends on its nature and use; the determination can be complex due to lack of universally agreed definitions.
- Examples of related terminology and distinctions:
  - Crypto assets (IMF usage): digital representations of value enabled by advances in cryptography and DLT.
  - Cryptocurrency: generally understood as a digital asset designed to work as a medium of exchange; ownership records stored in a ledger using strong cryptography; typically not issued by a central authority.
  - Stablecoins and “so-called” Global Stablecoins (GSCs):
    - FSB: “a type of crypto asset that aims to maintain a stable value relative to a specified asset, or a pool or basket of assets.”
    - FATF treats “stablecoin” as primarily a marketing term and refers to them as “so-called stablecoins”; coins termed “global stablecoins” are referred to as “so-called stablecoins with the potential for mass adoption” for FATF purposes.
- Technologies and mechanisms (examples):
  - Distributed Ledger Technology (DLT): a database that is stored, shared, and synchronized on a computer network; data updated by following rules for consensus among participants. Blockchain is a type of DLT but DLT need not use a chain-of-blocks architecture.
  - Digital Wallet: a virtual account that can hold VAs; forms include hardware wallets, desktop wallets, online/cloud wallets, mobile wallets, printed wallets.
  - Mixer/Tumbler: combines and intermingles multiple transactions and distributes them among multiple wallets.
  - Ring Signature: hides the originator of a transfer by requiring signatures from several VA users to conduct a transaction.
  - Transaction Hash: an alphanumeric unique identifier of a transaction.

*Source: ftnea2021002 - Introduction 1 (International Monetary Fund, October 2021).*

### Box 2. Key Terminology II

### Box 2. Key Terminology II

### FATF definition of Virtual Asset (VA)
- The FATF Glossary defines a virtual asset as “a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes.”
- The FATF clarifies that “VAs do not include digital representations of fiat currencies, securities and other financial assets that are already covered elsewhere in the FATF Recommendations.”

### Types of digital assets captured as VAs (per FATF)
- Both centralized and decentralized assets that are convertible to money or another type of VA.
- Mainstream digital assets often referred to as digital currencies or cryptocurrencies (e.g., Bitcoin, Ethereum, Monero), including those that are pegged (e.g., so-called GSCs, regardless of whether they are commodity-backed (e.g., Digix Gold Tokens), money-backed (e.g., Tether), or cryptocurrency-backed (e.g., Synthetix)).
- Asset that have been tokenized.

### Assets explicitly not considered VAs under the FATF standards
- Tokens that cannot be used for payment or transfer of value, such as certain utility tokens that only grant a certain right (e.g., of access or to vote).
- Tokens that do not intersect with the real economy: nonconvertible digital assets that are specific to a particular virtual domain and cannot be exchanged for fiat (e.g., airline frequent flyer airmiles, credit card awards, or similar loyalty program rewards or points).
- National digital currencies (including CBDCs). Transactions or activities involving CBDCs will be subject to the preexisting FATF standards applicable to “traditional” financial assets.

### Observations on evolving scope and monitoring
- Determinations as to whether an asset qualifies as a VA may be challenging as the virtual landscape evolves.
- Some types of digital assets currently excluded from the FATF definition may later possess attributes of VAs or have financial integrity implications.
- “Careful, ongoing monitoring of the developments in the virtual space is therefore needed in order to ensure that all relevant virtual assets are captured by the AML/CFT framework.”
- Footnote: Discussions and a public consultation were underway on which entities are captured by the standards as VASPs; the revised Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers was expected to be published in late 2021.

### Virtual Asset Service Providers (VASPs): role and rationale
- VAs have given rise to a new “ecosystem” of professionals—VASPs—to facilitate transactions, provide platforms, or host custody for users who prefer not to self-manage.
- The FATF identified VASPs based on activities. Whether a person or entity is a VASP depends on how they use VAs and for whose benefit.
- The FATF scope includes both virtual-to-virtual and virtual-to-fiat transactions or operations.
- All five categories of VASP activity are comprised of those acting “as a business,” entailing some form of remuneration (e.g., commission, spread, or other benefit).

### Activities that, when conducted as a business, indicate a VASP
- VA exchanges: providing an intersection between the virtual and real economy or between different virtual environments; includes VA kiosks (e.g., ATMs, bitcoin teller machines, bitcoin ATMs, or vending machines), cryptocurrency exchangers, converters, VA brokerage services, VA trading services, VA escrow services.
- VA transfer services: conducting transactions on behalf of other persons by moving VAs from one address or account to another.
- Custodial services: virtual wallet providers that host wallets or maintain custody or control over another person’s VAs.
- Administration of another person’s VAs: managing or administering (including transmission) of VAs independently of the owner.
- Financial services related to an issuer’s offer and/or sale of a VA (such as in an initial coin offering, ICO), including advisory and other services related to the launch of ICOs.

### Common practice and overlaps
- VASPs often conduct combinations of these activities (e.g., exchange and transfer services; custodial services combined with transfers).
- Wallet providers commonly send and receive VAs using private and public keys to sign transactions digitally.

### Entities and activities not considered VASPs under FATF
- Individuals acting on a private basis (not conducting a business) are not VASPs; personal use, transfers, or management are outside AML/CFT obligations.
- Peer-to-peer transactions where neither party is a VASP or other AML/CFT-regulated entity are not covered.
- Platforms merely providing a forum for peer-to-peer activity without intermediation generally do not fall within the FATF definition of VASP.

### Delineation challenges and technology considerations
- The distinction between hosting activity and providing intermediation can be tenuous; FATF guidance focuses on “active” facilitation of financial activity, though “active” is not defined and interpretations may vary across countries.
- Smart contracts and decentralized applications (DApps) can complicate assessments of control and benefit:
  - An “owner or operator” of a dApp may come within the definition of a VASP.
  - Questions arise about demonstrating control or benefit from a decentralized platform that operates by consensus and whether traditional notions of ownership apply to self-executing applications.
- The FATF emphasis: focus on the nature of the financial activity or conduct surrounding the VA and the ML and TF risks it poses rather than the underlying technology.

### FATF definition of Virtual Asset Service Provider (Box 4)
- “A VASP is any natural or legal person who is not covered elsewhere under the Recommendations and conducts, as a business, one or more of the following activities or operations for or on behalf of another natural or legal person:
  (i) Exchange between VAs and fiat currencies, and/or (ii) between one or more forms of VAs;
  (iii) Transfer of VAs;
  (iv) Safekeeping and/or administration of virtual assets or instruments enabling control over VAs; and,
  (v) Participation in and provision of financial services related to an issuer’s offer and/or sale of a VA.”

### Regulatory implications and recommendations for countries
- Countries must ensure that VAs and, unless they ban VA activities, VASPs are properly regulated in their domestic legal frameworks.
- Countries should ensure AML/CFT frameworks apply to all relevant entities and professionals.
- Options include:
  - Applying pre-existing AML/CFT laws if they adequately incorporate VASPs (e.g., as a type of money service business, payment service provider or dealer in securities), ensuring coverage of all VASPs and virtual assets and tailoring requirements to VASPs’ specific needs.
  - Including VASPs as a new category of AML/CFT-obliged entity under domestic laws.
- Countries should ensure AML/CFT frameworks apply to financial institutions and DNFBPs where they provide covered VA-related services or financial activities or operations; this may include banks, securities broker-dealers, and DNFBPs such as casinos.
- Where DNFBPs engage in VA activities, they should be subject to a legal and regulatory framework on par with the one called for under the FATF standards for financial institutions.

### Operational aspects and standard evolution
- To address financial integrity risks related to VAs, a solid, multipronged approach is necessary.
- The FATF adopted changes to its standards in 2018 and 2019 to explicitly apply them to the virtual context and provided additional tailoring where necessary.

*International Monetary Fund | October 2021*

### Annex 1). As is the case with traditional assets, the

### VIRTUAL ASSETS AND ANTI-MONEY LAUNDERING AND COMBATING THE FINANCING OF TERRORISM (1)

### Risk Assessment
- Effective mitigation requires a prior determination of the level of ML/TF/PF risks of VAs; blanket assumptions may lead to inappropriate allocation of resources.
- Countries should establish the actual and inherent ML/TF/PF risks impacting their jurisdiction to tailor mitigation and focus AML/CFT efforts on higher risks.
- Assessments should analyze sector-specific risk factors: properties of VA activities, products or services offered, delivery channels, customer base, and geographical areas of VASPs’ operations.
- Special attention to:
  - availability and significance of decentralized VAs;
  - VAs or services that hinder traceability and VASPs’ ability to implement AML/CFT measures.
- Risk assessment should establish the quality of AML/CFT measures applied by VASPs and other reporting entities, including risk management policy and internal oversight mechanisms.
- Effective assessment requires:
  - solid technical knowledge of the virtual world;
  - close engagement with the private sector, IT professionals, and existing VASPs for market data (market share, turnover, customer base, geography) and typologies;
  - international cooperation and understanding of broader domestic context (consumer protection, company formation, economic citizenship, prudential supervision, monetary policy, tax regime).
- Global stablecoins (GSCs) are identified as potential game changers: unless strong AML/CFT measures are implemented, they can pose significant financial integrity risks. Countries reviewing GSC projects should assess all features of arrangements and the domestic framework, and ensure effective mitigating measures both in GSC networks (e.g., with multiple control points) and domestically.

### Legal Foundation
- Adapting to VAs may require updating a country’s legal framework; the need varies case-by-case.
- Recommended steps:
  - (i) Ex ante policy decision on approach: ban VA-related activities or regulate AML/CFT activities.
  - (ii) Review legal framework to establish breadth of legal and regulatory changes needed (a ban must be in law or other enforceable means to detect and sanction unauthorized activities).
  - (iii) Review criminal law framework to ensure it allows effective enforcement action (both of a ban and of criminal misuse of VAs).
- Practical measures and policy considerations needed to implement amendments, including ability to freeze and seize VAs.

### Legal Framework for Preventing and Sanctioning ML and TF
- VAs should be captured to the same extent as traditional assets; ML and TF offenses should apply regardless of asset type.
- In many countries ML and TF offenses already apply to VAs; in others amendments to criminal laws may be required.
- Further legal/regulatory changes may be needed to facilitate enforcement, including broadening provisions related to:
  - customs declarations;
  - international cooperation;
  - LEAs’ investigative powers specific to VAs;
  - freezing/seizing, targeted financial sanctions, confiscation, and management of proceeds of crime.

### Financial Intelligence
- FIUs may need to revise reporting templates to capture VA-specific data:
  - wallet account information;
  - transaction details including transaction hash and originator/recipient information;
  - login information including IP addresses;
  - mobile device information.
- FIUs need solid understanding of virtual transactions, enhanced anonymity features, and types of VAs used for criminal purposes.
- FIUs must be able to conduct operational analysis, build networks of potential subjects, and identify transactions indicative of ML/TF/PF for sharing with LEAs.

### Investigations and Prosecutions of Activities in the Virtual Space
- LEAs need powers and capabilities to pursue VA-related investigations, including compulsory measures for production of records held by VASPs and freezing/seizing of VAs.
- Traditional investigative skills remain useful but may be insufficient; new skills required for online investigations (tracing VA transactions, searches of electronic devices where permitted).
- Countries should consider adequacy of expertise (e.g., cybercrime-specialized investigators) and provide specific training (blockchain transaction identification, darknet simulation).
- Strengthen interagency cooperation, develop special units with tech expertise, and ensure dialogue with foreign counterparts.
- Technological solutions useful to investigations:
  - blockchain explorers for searches related to addresses, transactions, and other DLT records;
  - specialized firms that collect and analyze transaction data across VA networks.
- Prosecutors and judges require enhanced training to understand technological evidence and legal frameworks for VAs and VASPs.

### Seizing, Freezing, Confiscation, and Management of VAs
- Tainted VAs should be subject to freezing, seizing, and confiscation; modalities must be tailored to the virtual space.
- Seizing/Freezing:
  - LEAs typically need to identify public and private keys and have applications managing keys, recovery seeds, and/or VA wallet files.
  - Specialist investigative skills and technologies may be required.
  - Because VAs are highly mobile, seizure should ideally apply almost instantaneously (e.g., moving VAs immediately into an LEA-controlled wallet), which may require adjusting legal requirements and practices to allow sufficient speed.
  - Frameworks needed to enable LEAs to locate wallet instruments or access private keys/recovery seeds.
- Management of seized VAs:
  - Options: (i) convert VAs into fiat and manage seized monies traditionally; or (ii) manage VAs in existing form by creating and securing a wallet held/managed by LEA or a wallet service provider (maintain records of private keys, recovery seeds).
  - Considerations: high price volatility, duration of criminal procedures, cybersecurity risks, decisions on valuation point (price at enforcement vs price at end of criminal process), and securing official wallets (cold storage less prone to cyberattacks).
- Confiscation:
  - Courts should determine whether to hold VAs or convert them to fiat, potentially requiring legal framework adjustments.

### International Cooperation
- Close and swift cooperation between countries is key due to the highly mobile nature of VAs.
- Clear legal basis required for information exchange and cooperation, even where VA activities are restricted or banned domestically.
- Traditional processes like mutual legal assistance (MLA) may be too slow; need to build informal cooperation channels with authorities able to take swift conservatory action (freezing/seizing wallets) pending formal processes.
- Issues where MLA depends on dual criminality if counterpart criminal frameworks do not capture VAs.
- Good domestic coordination useful because different authorities may have different channels to foreign counterparts.

### Conclusion
- The new FATF standards provide clarity on ML/TF/PF risk mitigation in the virtual space and facilitate transposition into domestic frameworks.
- FATF treats VAs broadly the same as other asset types while accounting for intrinsic characteristics.
- Main challenges: keeping up with technology and increasing stakeholder dialogue.
- VAs are likely to persist and be used increasingly in cross-border transactions; broad use of GSCs would require rapid coordinated global action.
- Necessities for effective mitigation:
  - solid understanding of VAs’ underpinnings and operating models;
  - building expertise and capacity across policy makers, AML/CFT supervisors, FIUs, LEAs, and the judiciary;
  - close dialogue with the VASP industry;
  - close and prompt cross-jurisdictional cooperation;
  - leveraging technology to support AML/CFT implementation.
- International community engagement (FATF, IMF, and others) should continue, including monitoring developments and facilitating FATF standards implementation; IMF to provide advice and capacity development.

### Annex 1. FATF Standards Related to VAs and VASPs
- FATF Recommendation 15 “New Technologies,” second paragraph:
  - “To manage and mitigate the risks emerging from virtual assets, countries should ensure that virtual asset service providers are regulated for AML/CFT purposes, and licensed or registered and subject to effective systems for monitoring and ensuring compliance with the relevant measures called for in the FATF Recommendations.”
- Interpretive Note to Recommendation 15:
  - For applying the FATF Recommendations, countries should consider virtual assets as “property,” “proceeds,” “funds,” “funds or other assets,” or other “corresponding value.” Countries should apply the relevant measures under the FATF Recommendations to virtual assets and virtual asset service providers (VASPs).

*International Monetary Fund | October 2021*

### 2. In accordance with Recommendation 1, countries

### ftnea2021002 - 2. In accordance with Recommendation 1, countries

### Risk identification, assessment, and risk-based approach
- Countries should identify, assess, and understand the money laundering and terrorist financing risks emerging from virtual asset activities and the activities or operations of VASPs.
- Based on that assessment, countries should apply a risk-based approach to ensure that measures to prevent or mitigate money laundering and terrorist financing are commensurate with the risks identified.
- Countries should require VASPs to identify, assess, and take effective action to mitigate their money laundering and terrorist financing risks.

### Licensing and registration of VASPs
- VASPs should be required to be licensed or registered.
- At a minimum, VASPs should be required to be licensed or registered in the jurisdiction(s) where they are created.
- In cases where the VASP is a natural person, they should be required to be licensed or registered in the jurisdiction where their place of business is located.
- Jurisdictions may also require VASPs that offer products and/or services to customers in, or conduct operations from, their jurisdiction to be licensed or registered in this jurisdiction.
- Competent authorities should take the necessary legal or regulatory measures to prevent criminals or their associates from holding, or being the beneficial owner of, a significant or controlling interest, or holding a management function in, a VASP.
- Countries should take action to identify natural or legal persons that carry out VASP activities without the requisite license or registration and apply appropriate sanctions.
- A country need not impose a separate licensing or registration system with respect to natural or legal persons already licensed or registered as financial institutions (as defined by the FATF Recommendations) within that country, which, under such license or registration, are permitted to perform VASP activities and which are already subject to the full range of applicable obligations under the FATF Recommendations.

### Supervision, monitoring, and enforcement powers
- Countries should ensure that VASPs are subject to adequate regulation and supervision or monitoring for AML/CFT and are effectively implementing the relevant FATF Recommendations, to mitigate money laundering and terrorist financing risks emerging from virtual assets.
- VASPs should be subject to effective systems for monitoring and ensuring compliance with national AML/CFT requirements.
- VASPs should be supervised or monitored by a competent authority (not an SRB), which should conduct risk-based supervision or monitoring.
- Supervisors should have adequate powers to supervise or monitor and ensure compliance by VASPs with requirements to combat money laundering and terrorist financing including the authority to conduct inspections, compel the production of information, and impose sanctions.
- Supervisors should have powers to impose a range of disciplinary and financial sanctions, including the power to withdraw, restrict or suspend the VASP’s license or registration, where applicable.

### Sanctions regime
- Countries should ensure that there is a range of effective, proportionate and dissuasive sanctions, whether criminal, civil or administrative, available to deal with VASPs that fail to comply with AML/CFT requirements, in line with Recommendation 35.
- Sanctions should be applicable not only to VASPs, but also to their directors and senior management.

### Preventive measures and application of FATF Recommendations (R.10–R.21)
- The requirements set out in Recommendations 10 to 21 apply to VASPs, subject to the following qualifications:
  - (a) R.10 – The occasional transactions designated threshold above which VASPs are required to conduct CDD is USD/EUR 1 000.
  - (b) R.16 – Countries should ensure that originating VASPs obtain and hold required and accurate originator information and required beneficiary information on virtual asset transfers, submit the above information to the beneficiary VASP or financial institution (if any) immediately and securely, and make it available on request to appropriate authorities.
    - Countries should ensure that beneficiary VASPs obtain and hold required originator information and required and accurate beneficiary information on virtual asset transfers and make it available on request to appropriate authorities.
    - Other requirements of R.16 (including monitoring of the availability of information and taking freezing action and prohibiting transactions with designated persons and entities) apply on the same basis as set out in R.16.
    - The same obligations apply to financial institutions when sending or receiving virtual asset transfers on behalf of a customer.
- Footnote clarifications:
  - As defined in INR. 16, paragraph 6, or the equivalent information in a virtual asset context.
  - The information can be submitted either directly or indirectly. It is not necessary for this information to be attached directly to the virtual asset transfers.

### International cooperation
- Countries should rapidly, constructively, and effectively provide the widest possible range of international cooperation in relation to money laundering, predicate offences, and terrorist financing relating to virtual assets, on the basis set out in Recommendations 37 to 40.
- In particular, supervisors of VASPs should exchange information promptly and constructively with their foreign counterparts, regardless of the supervisors’ nature or status and differences in the nomenclature or status of VASPs.

### Glossary — key definitions
- Virtual Asset: A virtual asset is a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes. Virtual assets do not include digital representations of fiat currencies, securities and other financial assets that are already covered elsewhere in the FATF Recommendations.
- Virtual Asset Service Providers: Virtual asset service provider means any natural or legal person who is not covered elsewhere under the Recommendations, and as a business conducts one or more of the following activities or operations for or on behalf of another natural or legal person:
  - (i) exchange between virtual assets and fiat currencies;
  - (ii) exchange between one or more forms of virtual assets;
  - (iii) transfer of virtual assets;
  - (iv) safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets; and
  - (v) participation in and provision of financial services related to an issuer’s offer and/or sale of virtual assets.
- Footnote on transfer: In the context of virtual assets, transfer means to conduct a transaction on behalf of another natural or legal person that moves a virtual asset from one virtual asset address or account to another.
- Footnote on creating a legal person: References to creating a legal person include incorporation of companies or any other mechanism that is used.

### Annex 2 — Initiatives to build LEA capacity
- Project Titanium:
  - Ongoing research project including INTERPOL and 14 other European agencies to support LEA to investigate criminal and terrorist activities that involve VA.
  - Aims to develop services and forensic tools for: (i) monitoring trends in virtual currency and darknet market ecosystems; (ii) analyzing transactions across different virtual currency ledgers; and (iii) generating court-proof evidence reports based on reproducible and legally compliant analytical procedures.
- BITCRIME and VIRTCRIME:
  - Bitcrime was a bilateral German-Austrian research project related to the prevention and prosecution of organized financial crime committed with virtual currencies which ran from 2014 to 2017.
  - Following this project, VIRTCRIME is an ongoing project which focuses on misuse of cryptocurrencies other than Bitcoin.
- Confidential FATF Report on Guidance on Financial Investigations Involving Virtual Assets:
  - Published in June 2019, provides guidance and practical advices to national domestic authorities (especially FIUs and LEAs) to improve the detection, investigation, and confiscation of virtual assets involved in serious financial crimes, including money laundering and terrorist financing purposes.

*International Monetary Fund | October 2021*

---


_Source: https://www.imf.org/-/media/files/publications/ftn063/2021/english/ftnea2021002.pdf_