FATF — DeFi Regulation & Liability Frameworks

The Financial Action Task Force (FATF) is an intergovernmental body established in 1989 that sets international standards for combating money laundering, terrorist financing, and proliferation financing. Its 40 Recommendations form the global AML/CFT framework and are assessed through mutual evaluations of member and non-member jurisdictions. FATF guidance is not legally binding but exerts enormous influence: jurisdictions that fail to comply risk being placed on the FATF "grey list" or "black list," triggering enhanced due diligence requirements from counterparties worldwide.

FATF's approach to DeFi is anchored in a single principle: if a person or entity controls or sufficiently influences a DeFi arrangement, that person or entity is a Virtual Asset Service Provider (VASP) and must comply with all FATF Recommendations applicable to VASPs, regardless of how "decentralized" the arrangement appears.

Key Publications on DeFi

Recommendation 15 and Interpretive Note (Amended June 2019)

FATF Recommendation 15 was amended in June 2019 to explicitly cover virtual assets (VAs) and virtual asset service providers (VASPs). The Interpretive Note to Recommendation 15 (INR.15) defines "virtual asset" and "VASP" and extends the full suite of AML/CFT obligations — customer due diligence, record-keeping, suspicious transaction reporting, and the Travel Rule — to VASPs.

• Source: FATF Recommendations

Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (October 2021)

The definitive FATF publication on DeFi. This 110-page guidance document replaced the June 2019 guidance and introduced substantial new material on "so-called DeFi" (paragraphs 67-78), non-fungible tokens, stablecoins, and peer-to-peer transactions.

• Document: Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers
• Date: 28 October 2021
• Source: FATF Official Publication Page
• PDF: Full Document

Targeted Update on Implementation — June 2023

Third annual implementation review. Found that the majority of jurisdictions had not yet implemented basic VASP regulation.

• Source: FATF 2023 Targeted Update (PDF)

Targeted Update on Implementation — June 2024

Fifth update on R.15 compliance. Found 75% of jurisdictions were only partially compliant or non-compliant. Noted insufficient Travel Rule implementation and identified DeFi as an emerging risk requiring monitoring.

• Source: FATF 2024 Targeted Update
• PDF: Full Report

Targeted Update on Implementation — June 2025

Sixth update. Compliance with R.15 improved to 29% largely compliant (40 of 138 jurisdictions), up from 25% in 2024. Non-compliance dropped from 25% to 21%. Travel Rule legislation enacted in 85 of 117 jurisdictions (73%), up from 65 in 2024. Published alongside new Best Practices on Travel Rule Supervision.

• Source: FATF 2025 Targeted Update
• PDF: Full Report

Best Practices on Travel Rule Supervision (June 2025)

Companion document to the 2025 Targeted Update. Provides detailed supervisory guidance for jurisdictions implementing Travel Rule compliance for VASPs.

• Source: Best Practices PDF

Targeted Report on Stablecoins and Unhosted Wallets — Peer-to-Peer Transactions (3 March 2026)

Approved at the February 2026 FATF Plenary (11-13 February 2026) and published 3 March 2026. The report examines illicit-finance risks where stablecoins move through P2P transactions via unhosted (self-hosted) wallets without a regulated VASP intermediary. It reaffirms that Recommendation 15 should apply to all entities involved in stablecoin arrangements (issuers, intermediary VASPs, and other participants), and that jurisdictions should define roles and responsibilities across the stablecoin ecosystem using a risk-based approach.

Key recommendations for stablecoin issuers include maintaining technical and governance controls — the capability to freeze, burn, or withdraw stablecoins in the secondary market; performing customer due diligence at redemption; and implementing smart-contract controls such as allow-listing (white-listing) and deny-listing (black-listing) to block sanctioned or high-risk addresses. The report stresses that issuers must assess and mitigate risks not only for direct mint/redeem customers but for the wider secondary-market circulation of the token, and that supervisors need expertise in smart contracts, blockchain analytics, and cross-chain mechanics. The report cites Chainalysis data that stablecoins accounted for roughly 84% of illicit virtual-asset transaction volume in 2025, with over 250 stablecoins in circulation by mid-2025 and a market capitalisation exceeding USD 300 billion. It names DPRK-linked groups, terrorist financiers, drug traffickers, and Iranian proliferation actors among the illicit users.

• Document: Targeted Report on Stablecoins and Unhosted Wallets — Peer-to-Peer Transactions
• Date: 3 March 2026
• Source: FATF Publication Page
• PDF (FIAU Malta mirror): Full Report

Understanding and Mitigating the Risks of Off-shore VASPs (11 March 2026)

Approved at the February 2026 FATF Plenary and published 11 March 2026. The report addresses gaps in oversight of offshore VASPs (oVASPs) — VASPs created under the laws of one jurisdiction (with or without physical presence) that serve clients residing in another — which criminals exploit for large-scale fraud, money laundering, and terrorist financing. It finds that less than half (46%) of jurisdictions have adopted an activity-based approach to VASP regulation and supervision, and flags "nested" arrangements in which unlicensed offshore VASPs access services from a licensed VASP by posing as ordinary individual customers.

The report sets out good practices to detect, license/register, supervise, and sanction non-compliant oVASPs, and recommends that financial institutions and VASPs assess their exposure to unlicensed oVASPs, apply consistent AML/CFT/CPF rules across all entities in their group, and refrain from establishing relationships with unlicensed or unregistered providers. The work is part of FATF's broader R.15 follow-up on stablecoins, offshore VASPs, DeFi, and market-monitoring trends.

• Document: Understanding and Mitigating the Risks of Off-shore VASPs
• Date: 11 March 2026
• Source: FATF Publication Page
• PDF: Full Report

DeFi Classification Position — The "So-Called DeFi" Framework

The Core Principle (Paragraphs 67-78, October 2021 Guidance)

FATF's position is built on a critical distinction:

• A DeFi application (the software itself) is not a VASP. The FATF Standards do not apply to underlying software or technology.
• However, creators, owners, and operators — or any persons who maintain control or sufficient influence over a DeFi arrangement — may fall under the FATF definition of a VASP where they are providing or actively facilitating VASP services, even if the arrangement appears decentralized.

FATF explicitly rejected the argument that decentralization alone exempts an arrangement from regulation. The guidance states that countries should look through the technology to the persons and entities involved.

The Owner/Operator Test

FATF established a functional four-part test to determine whether a person or entity involved in a DeFi arrangement qualifies as a VASP:

1. Control over assets or protocol — Does an individual or entity exhibit control over assets or over the service's protocol itself?
2. Customer relationship — Does an individual or entity have a business relationship with customers, even if exercised through a smart contract?
3. Profit motive — Does an individual or entity profit from the service being offered to customers?
4. Other indicia of control — Can the person set or change parameters, upgrade contracts, freeze funds, or otherwise exercise governance?

If any of these criteria are met, the person or entity is likely a VASP and subject to FATF obligations.

The "Fully Decentralized" Exception

FATF acknowledged that if a DeFi project is entirely automated and outside the control of any owner/operator, it likely does not constitute a VASP. However, FATF treated this as a narrow exception, noting that in practice most DeFi arrangements retain some degree of centralized control through development teams, governance token holders, or administrative key holders.

Technology Neutrality

Software developers creating decentralized applications (dApps) are not considered VASPs unless they specifically use the dApp to engage in VASP functions. Individual governance token holders are similarly excluded unless they satisfy the owner/operator test.

AML/KYC Position

Applicability to DeFi

Under FATF's framework, any entity identified as a VASP through the owner/operator test must implement:

• Customer Due Diligence (CDD) — KYC at onboarding and ongoing monitoring
• Record-keeping — Maintain transaction records for at least five years
• Suspicious Transaction Reporting (STR) — File reports with the financial intelligence unit
• Sanctions screening — Screen against UN, OFAC, and other sanctions lists

Travel Rule (Recommendation 16)

The FATF Travel Rule requires VASPs to obtain, hold, and transmit originator and beneficiary information for virtual asset transfers. For DeFi:

• The Travel Rule applies to any transfer involving a VASP (as identified through the owner/operator test)
• Transfers between two unhosted (self-custodied) wallets where no VASP is involved fall outside the Travel Rule's direct scope, though jurisdictions may impose additional requirements
• VASPs must take adequate steps to determine whether a counterparty wallet is controlled by another VASP or is an unhosted wallet
• For transfers to or from self-hosted addresses exceeding jurisdiction-specific thresholds (e.g., EUR 1,000 under
  EU Transfer of Funds Regulation), VASPs must verify customer ownership of the unhosted wallet

Peer-to-Peer Transactions

FATF did not recommend outright bans on unhosted wallet transactions. Instead, it urged jurisdictions to work with the private sector on blockchain analytics, train financial investigators, and leverage technology to understand P2P transaction risks. FATF acknowledged that banning self-hosted wallets may prove ineffective given cryptocurrency's borderless nature.

Regulatory Recommendations for National Regulators

FATF's October 2021 Guidance recommends that national regulators:

1. Apply R.15/INR.15 to all VASPs, including those operating DeFi arrangements where an owner/operator exists
2. Conduct risk assessments of virtual asset activities, including DeFi
3. License or register all VASPs and apply fit-and-proper tests to owners and operators
4. Supervise VASPs for AML/CFT compliance, using risk-based supervisory frameworks
5. Implement the Travel Rule for VA transfers involving VASPs
6. Apply sanctions against non-compliant entities, including those operating from offshore jurisdictions
7. Monitor DeFi developments and assess whether arrangements previously outside regulatory scope have acquired owner/operators

Implementation Status

Global Compliance Snapshot (June 2025)

Key Implementation Observations

• Only one jurisdiction maintains full compliance with R.15 across all FATF assessment criteria
• 49% of jurisdictions remain only partially compliant as of 2025
• Of 85 jurisdictions with Travel Rule legislation, 59% (50 jurisdictions) have yet to issue findings or take enforcement actions
• 82% of jurisdictions have defined their regulatory approach to VAs/VASPs, but execution lags
• Nearly half of advanced jurisdictions require specific DeFi arrangements licensing, though enforcement remains weak

Jurisdictions With Materially Important VASP Activity

FATF identified jurisdictions with significant VA sectors for enhanced scrutiny. These include

US,

UK,

Singapore,

Japan,

South Korea,

Hong Kong, and others. Progress among these jurisdictions has been faster than the global average but still uneven.

Mutual Evaluation Methodology

FATF amended its assessment methodology in 2022 and commenced its 5th round of evaluations in 2024. Evaluations have two components:

• Technical compliance — Whether a jurisdiction's legal framework covers R.15/INR.15 requirements
• Effectiveness — Whether the jurisdiction is actually supervising and enforcing its VA/VASP framework in practice (assessed through on-site visits)

The effectiveness assessment is weighted more heavily, meaning that jurisdictions with laws on the books but no supervisory action will receive poor ratings. A complete mutual evaluation takes approximately 18 months.

Recent Developments (2024-2026)

Upcoming FATF Work on DeFi

FATF's 2025 Targeted Update noted that further guidance on DeFi arrangements, stablecoins, and offshore VASPs will be released between late 2025 and mid-2026. The stablecoins/unhosted-wallets and offshore-VASPs reports (both March 2026, above) delivered part of this workstream; further DeFi-specific guidance and a 2026 update on R.15 implementation status remained anticipated as of the date of this entry. The expected DeFi guidance is anticipated to address:

• More detailed criteria for applying the owner/operator test to specific DeFi architectures (DEXs, lending protocols, bridges)
• Supervisory expectations for jurisdictions hosting DeFi-related entities
• Risk indicators for DeFi-related money laundering and terrorist financing
• DPRK-linked actors' exploitation of DeFi (the 2025 update noted $1.46 billion stolen by DPRK-linked actors in 2025, with stablecoins accounting for most on-chain illicit activity)

Assessment

Influence

FATF's influence on DeFi regulation is very high. Its owner/operator test has become the de facto global framework for determining when a DeFi arrangement triggers regulatory obligations. The

EU's MiCA framework,

Singapore's Payment Services Act, and

Japan's JFSA guidance all incorporate elements of the FATF approach.

Effectiveness

Mixed. The owner/operator test provides a conceptually sound framework but faces practical challenges:

• Identification difficulty — Determining the owner/operator of a pseudonymous DeFi protocol operating across jurisdictions is operationally complex
• Enforcement gaps — Even where legislation exists, enforcement lags significantly (59% of jurisdictions with Travel Rule laws have taken no enforcement action)
• Jurisdictional arbitrage — DeFi developers can relocate to non-compliant jurisdictions, undermining the framework
• The "truly decentralized" gap — For protocols that genuinely lack an identifiable owner/operator, FATF has no solution beyond monitoring

Key Gaps

1. No specific guidance on cross-chain bridges, which pose unique AML risks due to their role in obfuscating transaction trails
2. The governance token holder exclusion may create a loophole for large token holders who exercise de facto control through voting
3. Limited guidance on DeFi lending protocols, where the "customer relationship" criterion is unclear
4. The narrow "fully decentralized" exception is difficult to apply in practice, creating regulatory uncertainty

---

<!-- related-coverage:BEGIN — auto-generated by related_coverage.py; edit via --apply re-run, not by hand -->

Related coverage

FATF — DeFi Regulation & Liability Frameworks in other research domains:

• CBDC Frameworks
• Crypto Mining Regulations
• Digital Asset Taxation
• Institutional Crypto Custody Regulations
• NFT & Digital Collectibles Regulations
• Payment Services & Crypto Payment Regulation
• Stablecoin Regulations & License Regimes
• Tokenized Real-World Assets (RWA) Regulation

<!-- related-coverage:END -->

Verification Notes

• FATF October 2021 Updated Guidance verified via official FATF publication page and PDF. PDF returned 403 on direct fetch; content verified through multiple secondary analyses (TRM Labs, Merkle Science, Norton Rose Fulbright, Skadden).
• Paragraphs 67-78 DeFi content verified through TRM Labs analysis, Merkle Science analysis, and Skadden analysis.
• 2025 Targeted Update statistics verified via FATF official page and 21 Analytics summary.
• 2024 Targeted Update verified via FATF official page.
• Travel Rule implementation data (85 of 117 jurisdictions) verified via FATF 2025 update and Chainalysis analysis.
• Best Practices on Travel Rule Supervision (June 2025) verified via FATF PDF.
• Upcoming DeFi guidance timeline (late 2025 to mid-2026) sourced from the 2025 Targeted Update.
• Owner/operator test four-part criteria verified through TRM Labs and Merkle Science analyses of the October 2021 Guidance.
• The specific paragraph numbers (67-78) for DeFi content are cited consistently across all secondary sources but could not be independently verified from the primary PDF due to 403 access restriction.
• 2026-06-04 refresh: Added the FATF Targeted Report on Stablecoins and Unhosted Wallets — Peer-to-Peer Transactions (3 March 2026) and the report Understanding and Mitigating the Risks of Off-shore VASPs (11 March 2026). Both were approved at the 11-13 February 2026 FATF Plenary. FATF's own publication pages (fatf-gafi.org) returned HTTP 403 on direct fetch; publication dates, statistics, and recommendations were verified through reputable secondary analyses: A&O Shearman FinReg (stablecoins report, 3 March 2026 date), Chainalysis (stablecoins secondary-market analysis), Norton Rose Fulbright Global Regulation Tomorrow (offshore VASPs, 11 March 2026 date), and the FIAU Malta PDF mirror of the stablecoins report (PDF).
• The 84% illicit-volume figure and USD 300 billion / 250+ stablecoins figures originate from the FATF March 2026 stablecoins report citing Chainalysis data; reported as FATF-cited industry data, not independently audited.
• February 2026 Plenary outcomes (report approvals, Giles Thomson appointment as incoming President July 2026-June 2028, Kuwait/Papua New Guinea grey-listing) verified via ComplyAdvantage summary of the FATF Plenary (11-13 February 2026); the underlying FATF plenary-outcomes page returned 403.
• The existing USD 1.46 billion DPRK/Bybit theft figure (from the June 2025 Targeted Update) was re-verified and remains accurate; no correction required.
• No material FATF DeFi/VASP publication was identified between mid-March 2026 and 2026-06-04 beyond the two March 2026 reports above; the next R.15 implementation-status update was still anticipated for 2026 as of this refresh.