This week, the Financial Action Task Force (FATF) published its 12-month review of the progress made by both the public and private sectors in implementing its recommendations around cryptocurrency regulation. Those recommendations, originally published in June 2019, call on FATF’s 200+ member and observer jurisdictions to implement regulations such as:
- Required licensing of Virtual Asset Service Providers (VASPs), including exchanges, hosted wallet providers, and more
- Implementation of Know Your Customer (KYC) procedures and enhanced due diligence
- Required risk-based AML/CFT compliance powered by transaction monitoring for VASPs
- Travel Rule compliance: VASPs must identify the originators and beneficiaries of transfers above 1,000 USD/EUR, and send that information to their VASP counterparty, where one exists
FATF’s findings were largely positive, in that both the public and private sectors self-reported that they have made substantial progress towards implementing its recommendations. Nonetheless, FATF also says it intends to extend its review period another year until June 2021, at which point they would expect full implementation across all jurisdictions for both the public and private sectors.
Why the delay? FATF indicates that while jurisdictions have made progress, inconsistencies between jurisdictions — in terms of exact regulations implemented, bodies given responsibility for enforcement and supervision, and adoption of technologies necessary for enforcement — mean that more time is needed for all jurisdictions to align and foster the international cooperation necessary for these regulations to be effective globally. Below, we’ll share the key takeaways from FATF’s 12-month review for both the public and private sectors.
Public sector: More jurisdictions implementing FATF standards but enforcement is inconsistent
FATF has numbers it can point to when it says that jurisdictions have made progress toward implementing its recommended cryptocurrency regulations. Representatives from 32 of 54 FATF jurisdictions who responded to the organization’s polling indicated that they’ve implemented regulations requiring AML/CFT compliance programs for VASPs. However, 32 jurisdictions is only around 15% of total jurisdictions subject to FATF mutual evaluations. Many of the jurisdictions who didn’t respond to the poll haven’t implemented the recommended regulations, so there’s still much work to be done, hence the one-year extension of the review period.
FATF’s report also highlights inconsistencies amongst the 32 jurisdictions who self-reported that they have begun implementing its recommended standards. For instance, of those 32, just 15 reported they have implemented the Travel Rule as a regulatory requirement, with most who didn’t citing a need for holistic technology solutions to make it possible for VASPs to comply with the rule. While tools like Chainalysis Know Your Transaction (KYT) make it possible to collect the necessary information on originators and beneficiaries for Travel Rule-triggering transactions, the industry is still searching for solutions that allow that information to be transmitted to other VASPs around the world.
In addition, only 23 of the 32 self-reporting jurisdictions implementing FATF recommendations indicate they currently require licensing and registration for VASPs. This points to an important distinction between jurisdictions’ willingness to put FATF’s cryptocurrency regulations on the books versus their ability to enforce them. Cryptocurrency regulation enforcement is nearly impossible for jurisdictions lacking a central licensing authority that knows all of the VASPs authorized to operate in the jurisdiction. So, while it’s a positive sign that many jurisdictions have enacted AML/CFT compliance program requirements for VASPs, many more still need to implement licensing laws during the extended review period.
FATF also provided data on the number of Suspicious Transaction Reports (STRs and equivalent Suspicious Activity Reports, or SARs) filed related to cryptocurrency, based on reporting from 19 of the 32 jurisdictions that have implemented FATF recommendations. Those 19 jurisdictions report a total of 134,500 STRs filed between January 2018 and March 2020. However, most of those STRs were filed by financial institutions and payment service providers rather than by VASPs themselves, which indicates that more training and education may be necessary to give VASP compliance teams and local regulators the investigatory and reporting capabilities necessary to identify and file all instances of suspicious activity.
Finally, FATF also points to inconsistencies in who different jurisdictions designate as responsible for enforcing cryptocurrency regulations. Across the 32 who say they have implemented AML/CFT compliance requirements, some leave enforcement to financial services supervisors, while others tap central banks, securities regulators, tax authorities, or newly created specialist VASP supervisors. Each of these bodies vary widely in their level of cryptocurrency expertise and regulatory priorities, which could spell trouble given how important inter-jurisdictional cooperation between these bodies will be for the regulations to be successful globally. This is another area where FATF can take steps to provide more training and education across jurisdictions to get each country’s enforcement body aligned on goals and techniques.
Private sector: Progress on cryptocurrency regtech must continue
While we don’t yet have the technological solutions to implement Travel Rule compliance at scale, FATF notes that the cryptocurrency industry is making steady progress. So far, this is best exemplified by efforts made toward establishing a global messaging standard for how VASPs should communicate information on originators and beneficiaries that must be transmitted to VASP counterparties on Travel Rule-triggering transactions, such as those led by the InterVasp Messaging Standard (IVMS). FATF points to these initiatives as one of the private sector’s most important contributions to global regulatory standardization over the last year.
Beyond just messaging standards, FATF also notes that multiple providers are making progress on technical solutions for real-time Travel Rule fulfillment. The development of multiple solutions is especially encouraging, as these technologies will need to be adopted by VASPs around the globe, and must accommodate the different jurisdictions’ unique requirements.
However, FATF also notes that VASPs’ implementation of AML/CFT compliance programs must improve. Notably, the report worries that private sector players in some jurisdictions currently lack the knowledge of AML/CFT fundamentals necessary to establish compliance programs in line with global standards. Interestingly, though perhaps not counterintuitively, the report also notes that the knowledge gap is a less pronounced issue in jurisdictions like the United States that have had cryptocurrency regulation on the books for longer (since 2013 in the United States’ case). This speaks to the need for better training and the continued proliferation of cryptocurrency compliance tools to bring the jurisdictions lagging in compliance domain knowledge in line with their peers around the world, and is likely another reason for FATF’s year-long extension of the review period.
FATF to foster more international cooperation during extended review period
In addition to Tuesday’s 12-month review, FATF also announced its intention to develop an international framework for authorities in each of its jurisdictions to coordinate regulatory efforts and share information about the VASPs under their supervision. The organization plans to meet in October to begin developing that framework. Planned outputs of that meeting include a list of red flags indicating money laundering, terrorist financing, and other forms of financial crime in cryptocurrency transactions, which can be distributed to regulators and compliance professionals in member jurisdictions. Given the need for more consistency between jurisdictions in adoption and implementation of FATF’s recommended cryptocurrency regulations, we hope to see more such efforts from FATF during the extended review period so that all jurisdictions can implement the organization’s full recommendations by June 2021.