Advanced: virtual assets and the Travel Rule.

What counts as a virtual asset, and who is a VASP

The FATF Glossary defines a virtual asset as "a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes". It excludes digital forms of fiat money, securities and other financial assets that the FATF Standards already cover elsewhere.

A virtual asset service provider (VASP) is a business, not already covered elsewhere in the Standards, that does one or more of five things for or on behalf of someone else:

• exchanges virtual assets for fiat money;
• exchanges one virtual asset for another;
• transfers virtual assets from one address or account to another;
• holds or administers virtual assets, or the keys that control them;
• takes part in, or provides financial services for, an issuer's offer or sale of a virtual asset.

The FATF's 2021 guidance asks countries to apply these definitions broadly and by function: what the asset or service does matters, not the technology or the name it is given.

• Stablecoins are covered either as virtual assets or as financial assets such as securities, judged by the same criteria as anything else. Where a central developer or governance body exists, it will generally be covered too, and it should assess the money laundering risk before launch.
• NFTs used as collectibles are generally not virtual assets, but one used in practice for payment or investment can be. The label does not decide it.
• Decentralised finance (DeFi). The software itself is not a VASP. But the people who create, own or operate a DeFi arrangement, or who keep control or sufficient influence over it, can be VASPs if they provide or actively facilitate VASP services, even if the arrangement looks decentralised. Calling something DeFi is not decisive.
• Peer-to-peer (P2P) transfers between two self-hosted (or "unhosted") wallets, with no VASP or other regulated business involved, are not directly subject to AML controls, because the Standards place obligations on intermediaries. A business that only writes or sells wallet software or hardware is not normally a VASP.

One more distinction matters throughout this course. Public blockchains are pseudonymous, not anonymous: every transaction is visible, but addresses are not names. That visibility can help investigators, unless anonymity-enhancing tools are used to break the trail.

The FATF Standards and the Travel Rule

Recommendation 15 requires countries to regulate VASPs for AML and counter-terrorist financing purposes. Its Interpretive Note says, in summary:

• VASPs must be licensed or registered, at least where they are created, and criminals must be kept from owning or controlling them; unlicensed activity must be found and sanctioned.
• They must be supervised by a competent authority, with powers to inspect, compel information, impose sanctions and withdraw a licence.
• They apply the full set of preventive measures in Recommendations 10 to 21, with a threshold of USD/EUR 1,000 for customer due diligence on occasional transactions.

The Travel Rule applies the wire-transfer rule (Recommendation 16) to virtual asset transfers. The originating VASP must obtain and hold accurate information about the originator and the required information about the beneficiary, send it to the beneficiary VASP immediately and securely, and make it available to authorities on request. The beneficiary VASP must hold the same information.

Under the 2021 guidance:

• What travels: the originator's name, account number or wallet address, and one of their address, national identity number, customer number, or date and place of birth (one of these is enough); for the beneficiary, a name plus an account number or wallet address.
• Immediately means before, at the same time as, or alongside the transfer. Sending it afterwards is not acceptable.
• The information does not have to be written onto the blockchain; any technology that meets the requirement is acceptable.
• Countries may set a de minimis threshold of no more than USD/EUR 1,000. Below it, the names of both parties and their wallet addresses, or a unique transaction reference, are still required, though checking them against documents is needed only where something is suspicious.
• Because the information travels separately from the transfer, a VASP needs controls so that sanctions screening happens before funds become available, for example holding them until screening is complete.
• VASPs must do due diligence on the counterparty VASP. The FATF notes there is no technically proven way to identify the VASP behind a wallet from the address alone.
• For transfers to or from an unhosted wallet, there is no counterparty VASP to send the information to, but the VASP must still obtain the information from its own customer and scrutinise the transfer.

The "sunrise issue": countries are bringing the Travel Rule in at different times, so a VASP may have to deal with counterparties in countries where it does not yet apply.

The June 2025 revision. The FATF revised Recommendation 16 in June 2025 and expects the changes to be in effect by the end of 2030. It chose not to bring VASPs directly under Recommendation 16 but to apply the updated requirements to them through Recommendation 15. Among the changes, the originator's address and, for a natural person, date of birth become standard, along with the beneficiary's country and town.

Thresholds differ by jurisdiction. The EU's Transfer of Funds Regulation, applying since 30 December 2024, sets no de minimis threshold for crypto-asset transfers. It requires extra checks on whether a self-hosted address belongs to the customer when a transfer exceeds EUR 1,000. Never assume a single global threshold.

How far implementation has come

The FATF publishes a targeted update on virtual assets every year. The figures are largely self-reported by jurisdictions, so always quote the year and the number of respondents.

Compliance with Recommendation 15. Of 149 jurisdictions assessed by April 2026, 34% were largely compliant, 43% partially compliant, 22% non-compliant and one fully compliant (2026 update). In June 2023, of 98 assessed, about three-quarters were partially or non-compliant. Progress is real but slow.

The Travel Rule. In 2026, 91 of 109 responding jurisdictions (83%) said they had passed Travel Rule legislation, up from 35 in 2023. But 55 of those 91 had not yet issued supervisory findings or taken enforcement action. A law on paper is not the same as a rule that is enforced.

Gaps the FATF highlights:

• Peer-to-peer transfers through unhosted wallets, which the 2026 update calls a structural gap; 58 of 66 jurisdictions that answered rate P2P as high risk.
• DeFi: in 2026 only four jurisdictions required DeFi arrangements to be licensed or registered, and only two had actually done so.
• Stablecoins: the 2025 and 2026 updates report that stablecoins have become the asset most used in illicit on-chain activity, including by terrorist groups. That observation draws on industry data and should be read as an estimate.
• Offshore VASPs and over-the-counter brokers that serve customers in countries where they are not licensed.

The threats behind the numbers. The 2026 update describes an "industrialisation" of fraud using virtual assets by organised crime, including scam compounds. And DPRK-linked actors continue to steal on a large scale: in February 2025, according to the FBI, North Korea stole about US$1.5 billion in virtual assets from the exchange Bybit, the largest single theft of its kind. The FATF's 2025 update put the figure at US$1.46 billion and reported that only 3.8% had been recovered.

Red flags, techniques and tracing

The FATF's 2020 red flag indicators were drawn from more than 100 cases. They come in six groups. In summary:

• Size and frequency of transactions: amounts kept below reporting or record-keeping thresholds; bursts of high-value transfers; deposits followed at once by withdrawal to a private wallet, which turns the exchange into a mixer.
• Transaction patterns: a large first deposit that does not fit the customer; a new user who moves the whole balance out; many unrelated wallets sending small sums that are then consolidated; trading at a loss with no business reason.
• Anonymity: privacy coins; mixers and tumblers; unregistered P2P exchangers; links to darknet markets, gambling or ransomware; many wallets controlled from the same device or IP address; repeated small transactions at crypto ATMs.
• Senders and recipients: several accounts to evade limits; refusal to complete KYC or forged documents; profiles that suggest a money mule or a scam victim, such as an older customer with no previous interest in virtual assets.
• Source of funds or wealth: funds from mixers, fraud, ransomware, sanctioned addresses or darknet markets; wealth from VASPs with weak AML controls.
• Geography: VASPs or counterparties in countries that do not regulate virtual assets, or customers who move to them.

Techniques in official cases: mixers and tumblers; privacy coins; chain hopping, swapping one virtual asset for another, often across blockchains through bridges; dispersing funds across thousands of addresses; over-the-counter brokers and unregistered exchangers for cash-out; and money mules.

Pig butchering. FinCEN's 2023 alert describes investment scams, often run from Southeast Asia by criminal groups using victims of labour trafficking. They start with a "wrong number" message or a social media contact, build trust, and draw the victim into a fake investment platform. Warning signs for a bank include a customer with no crypto history suddenly buying large amounts, cashing in savings or borrowing against a home to do so, and paying "taxes" or "fees" to release supposed profits.

Tracing, and its limits. Because public ledgers are visible, investigators and compliance teams can use blockchain analysis to follow funds and to assess the risk of an address. The FATF is clear about the limits: privacy coins and mixers break the trail, analytics data varies in coverage and accuracy, and there is no proven way to tell from an address alone which VASP is behind it. Off-chain evidence often decides a case. In the Bitfinex case below, the funds were seized because investigators found the private keys in an online account under a search warrant.

Cases and lessons

• Bitfinex hack laundering (US Department of Justice, February 2022). About 119,754 bitcoin were stolen from the exchange Bitfinex in 2016. In 2022 two people were arrested and charged with conspiring to launder the proceeds; the charges described fictitious identities, automated transactions, deposits into many exchanges and darknet markets, chain hopping into privacy coins, and US business accounts used to make the banking look legitimate. More than 94,000 bitcoin, then worth over US$3.6 billion, were seized after investigators obtained the private keys. The Department of Justice called it its largest financial seizure ever.
• Tornado Cash (US Treasury and Department of Justice). In August 2022 the US Treasury sanctioned the mixer Tornado Cash, saying it had been used to launder more than US$7 billion since 2019, including over US$455 million stolen by the DPRK-linked Lazarus Group. In November 2024 a US federal appeals court ruled that its immutable smart contracts were not "property" that could be blocked under the relevant law, and in March 2025 the Treasury removed the sanctions while saying it remained deeply concerned about DPRK laundering. Separately, in August 2025 a jury convicted one of its founders of conspiracy to operate an unlicensed money transmitting business. The delisting was a legal ruling about sanctions powers, not a finding that mixers are low risk; the Treasury's view that mixers should generally be treated as high risk stands.
• The Bybit theft (FBI, February 2025). DPRK actors stole about US$1.5 billion in virtual assets, converted much of it to bitcoin and other assets, and spread it across thousands of addresses on several blockchains. The FBI published the addresses and asked exchanges, bridges and other services to block transactions from them.

What the cases teach:

• Speed matters. Stolen funds are dispersed within hours, so screening against published addresses and acting before release are what prevent losses.
• The ledger helps, but rarely closes a case alone. Seizures and convictions depend on keys, accounts, documents and cooperation off the chain.
• Sanctions law and AML risk are separate questions. A tool can fall outside one and still be high risk under the other.

In Kenya: the 2022 ESAAMLG mutual evaluation found virtual assets and VASPs were not prohibited but not regulated, and rated Kenya non-compliant on Recommendation 15; the Central Bank of Kenya had cautioned the public about bitcoin in 2015. The Virtual Asset Service Providers Act, 2025 came into force on 4 November 2025. It makes the Capital Markets Authority and the Central Bank of Kenya the regulators, each for listed activities, requires licensing, and makes VASPs reporting institutions under the Proceeds of Crime and Anti-Money Laundering Act. Existing providers were given one year to comply, and as at November 2025 licensing awaited regulations and no VASP had been licensed. Check the current regulations and licence register.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.