Compliance and Enforcement Frameworks

1. AML/KYC Requirements for RWA Platforms

1.1 The Dual-Track Question: VASP vs. Traditional Financial Institution

The threshold compliance question for any tokenized real-world asset platform is whether it triggers AML/CFT obligations as a virtual asset service provider (VASP) under crypto-specific regulation, as a traditional financial institution under existing financial services law, or both.

This distinction is not academic. The answer determines which regulatory body supervises the entity, which AML regime applies, what reporting obligations exist, and whether the platform can passport its compliance across borders.

The FATF October 2021 Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs provides the definitive international framework. FATF defines a virtual asset as "a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes." However, the guidance explicitly excludes digital representations of fiat currencies and securities and other financial assets already covered by existing FATF Recommendations from the VA definition.

This exclusion creates a critical regulatory fork: a tokenized bond issued through a licensed broker-dealer that already complies with AML/CFT obligations under FATF Recommendations 10-23 is not intended to be treated as a VA. The issuer's regulated intermediary status provides the compliance perimeter. Conversely, a platform facilitating secondary trading of those same tokenized bonds on a public blockchain, without itself being a regulated financial institution, would likely be classified as a VASP and must register or license accordingly.

The practical consequence is that most institutional-grade RWA tokenization platforms -- such as Securitize (SEC-registered broker-dealer and transfer agent), SIX Digital Exchange (FINMA-licensed stock exchange and CSD), or ADDX (MAS-licensed RMO) -- operate under traditional financial institution AML frameworks. Their existing registrations satisfy AML/CFT obligations without requiring separate VASP designation. Newer entrants without existing financial licenses face the VASP registration pathway.

This fork is sharpest in the offshore fund-domicile jurisdictions added in this refresh. In the

Cayman Islands, the 2026 tokenised-funds framework deliberately channels tokenized fund interests and tokenized securities into the existing Mutual Funds / Private Funds Acts and SIBA regimes and carves them out of the VASP "issuance of virtual assets" regime, so a tokenised fund does not become a VASP merely by being tokenized. In the British Virgin Islands, the sole issuance of a virtual asset is expressly not a regulated VASP activity, while the same instrument is regulated as a SIBA "investment" if its rights map to the statutory list -- but AML/CFT, sanctions, and beneficial-ownership obligations apply to all BVI issuers regardless of token classification.

Ireland and Abu Dhabi (ADGM) both apply the traditional-financial-institution track to tokenized securities (CASP/MiFID supervision by the Central Bank of Ireland; FSRA "Digital Securities" supervision under FSMR), reserving the VA/VASP track for non-security crypto-assets.

Source: FATF, "Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers" (October 2021)

1.2 FATF VASP Definition Applicability

The FATF VASP definition captures any natural or legal person conducting, on behalf of another, one or more of five activities: (1) exchange between VAs and fiat, (2) exchange between VAs, (3) transfer of VAs, (4) safekeeping/administration of VAs or instruments enabling control, and (5) participation in financial services related to an issuer's VA offer or sale.

For tokenized RWA platforms, activities (3), (4), and (5) are the most commonly triggered. A platform that facilitates peer-to-peer transfers of tokenized securities on a public blockchain performs "transfer of VAs." A custodian holding private keys for tokenized fund units performs "safekeeping." A platform arranging the primary issuance of tokenized bonds performs activity (5).

As of June 2025, FATF tracks Recommendation 15 implementation across 67 jurisdictions covering approximately 98% of global VASP activity. Of 117 responding jurisdictions, 85 (73%) have passed Travel Rule legislation, up from 65 in 2024. However, jurisdictions continue to face difficulty identifying natural or legal persons conducting VA transactions, particularly where activities occur through decentralized protocols.

Across the 21 jurisdictions studied in this domain, FATF Recommendation 15/16 alignment is effectively universal: every jurisdiction either applies the Travel Rule directly to VASPs/CASPs (Cayman, BVI, Ireland, Abu Dhabi/ADGM, UAE, Bahrain, Singapore, Hong Kong, Japan, South Korea, the EU bloc, the UK, Switzerland, the US) or channels tokenized securities through regulated intermediaries whose existing wire-transfer AML rules carry the equivalent obligation. Two of the new entrants have a documented FATF grey-list history that shaped their current rigour: the Cayman Islands was removed from the FATF grey list in October 2023 (and from the EU AML high-risk list), and Abu Dhabi/ADGM sits within the UAE, which was removed from the FATF grey list in February 2024.

Source: FATF, "Targeted Update on Implementation of FATF Standards on VAs and VASPs" (June 2025)

1.3 EU: AMLR and MiCA AML Provisions (EU, Ireland, France, Germany, Liechtenstein, Luxembourg)

The

EU has constructed a dual-pronged AML framework for tokenized asset platforms through MiCA and the new Anti-Money Laundering Regulation (AMLR). This framework applies directly across all EU/EEA Member States studied here -- including

Ireland,

France,

Germany,

Luxembourg, and (via EEA incorporation)

Liechtenstein -- supervised by their respective national competent authorities (the Central Bank of Ireland, AMF/ACPR, BaFin, CSSF, and the FMA).

MiCA AML/CFT obligations apply to all Crypto-Asset Service Providers (CASPs) authorized under the regulation. CASPs are explicitly designated as "obliged entities" for AML/CFT purposes. Under MiCA Article 68, CASPs must comply with Directive (EU) 2015/849 (AMLD5) and its implementing measures, including customer due diligence, ongoing transaction monitoring, suspicious transaction reporting, and record-keeping. The transitional period for CASP authorization ends 1 July 2026 in most Member States, after which all CASPs must hold a MiCA license -- though several states shortened this window (Germany's grandfathering ended 31 December 2025; Ireland's shortened VASP-to-CASP transition ended 29 December 2025).

AMLR (Regulation (EU) 2024/1624) replaces AMLD5 with a directly applicable regulation, eliminating the divergent national transpositions that plagued the directive-based approach. AMLR will become applicable on 10 July 2027, with certain provisions effective from July 2029. AMLR explicitly includes CASPs within its scope, aligning with FATF's VASP standards.

Critically, the new EU Anti-Money Laundering Authority (AMLA), headquartered in Frankfurt, will begin direct supervision of selected high-risk obliged entities -- including CASPs -- from 1 January 2028. AMLA will directly supervise approximately 40 EU financial institutions presenting the highest AML/CFT risk. High-risk CASPs may be among those selected for direct AMLA oversight.

For tokenized securities classified as financial instruments under MiFID II, the existing AML framework for investment firms and credit institutions applies without modification. In Ireland, for example, CASPs and intermediaries are subject to the Criminal Justice (Money Laundering and Terrorist Financing) Acts plus the MiCAR/Transfer-of-Funds Regulation obligations, and the CBI supervised roughly 23 AML-registered VASPs under the pre-MiCA regime before replacing that registration with full conduct-and-prudential CASP authorisation. The MiCA/AMLR framework is additive, not substitutive, for platforms dealing in both crypto-assets and financial instruments.

Sources:

• Jones Day, "Crypto Assets, CASPs, and AML/CFT Compliance: The New European Regulatory Landscape Under MiCA and AMLR" (July 2025)
• Sumsub, "EU's New Anti-Money Laundering Authority on Track for Full Operations in 2028"
• Deloitte, "The EU AML Package"

1.4 United States: BSA/FinCEN Requirements

In the

US, AML/KYC obligations for tokenized securities platforms derive primarily from the Bank Secrecy Act (BSA) and its implementing regulations administered by the Financial Crimes Enforcement Network (FinCEN).

Broker-dealers registered with the SEC and FINRA are already subject to BSA obligations, including:

• Customer Identification Program (CIP): Rule 17a-8 requires broker-dealers to implement CIP procedures consistent with 31 CFR 1023.220
• Suspicious Activity Reporting (SARs): Filing with FinCEN for transactions of $5,000 or more that the firm knows or suspects involve funds derived from illegal activity
• Currency Transaction Reports (CTRs): For cash transactions exceeding $10,000
• Customer Due Diligence (CDD) Rule: Identifying and verifying beneficial owners of legal entity customers (effective May 2018)
• Written AML/KYC program: Under FINRA Rule 3310, broker-dealers must implement a written AML compliance program

Platforms operating as Alternative Trading Systems (ATS) for tokenized securities must first be registered broker-dealers and FINRA members. Their AML obligations are identical to those of any other broker-dealer. The January 2026 SEC joint statement confirmed that "the format of issuance or technology used for recordkeeping, whether onchain or offchain, does not alter the application" of these requirements.

The DTC tokenization pilot (December 2025 no-action letter) imposes additional AML requirements: all wallets registered with DTC must be screened for OFAC compliance before receiving tokenized security entitlements. With the SEC's 18 March 2026 approval of Nasdaq tokenized-securities trading (Release 34-105047), OFAC screening is similarly built in at the wallet-registration level for the Nasdaq system (go-live targeted Q3 2026, settling T+1 conventionally through NSCC/DTC rails).

For platforms handling fiat currency in connection with tokenized securities transactions, state money transmitter licensing may also apply across 49 states plus DC, each carrying its own AML requirements. More than 26 states have adopted the Money Transmission Modernization Act (MTMA) to harmonize these requirements.

Source: SEC Joint Statement on Tokenized Securities (January 28, 2026); DTCC Tokenization Pilot Announcement (December 2025)

1.5 Americas: Brazil, Canada, and the Offshore Domiciles

Brazil: Brazil operates a dual-track AML framework mirroring its dual securities/VASP regulators (BCB and CVM). Under BCB Resolution 520 (in force 2 February 2026), authorized virtual-asset service providers (SPSAVs) must segregate client assets from firm assets and implement cybersecurity, internal-control, governance, and AML/CTF measures including the Travel Rule. The 270-day adaptation deadline for existing providers is 30 October 2026, with reporting obligations beginning 4 May 2026. Brazil has also finalized OECD CARF adoption via IN RFB 2,291/2025 (DeCripto). Notably, Provisional Measure 1,303/2025 -- which would have imposed a flat crypto tax and folded crypto into the IOF financial-transaction tax -- was rejected by the Chamber of Deputies on 8 October 2025, so the progressive 15%-22.5% capital-gains regime and the BRL 35,000 monthly exemption remain in force.

Canada: AML supervision runs through FINTRAC, with crypto trading platforms (CTPs) transitioning from interim restricted-dealer registration to full investment-dealer registration and CIRO membership through 2025-2026. CIRO's Digital Asset Custody Framework governs client-asset safekeeping for CTP dealer members. Canada's approach reflects the IOSCO 18 Policy Recommendations (November 2023) and is assessed under FATF mutual evaluations via FINTRAC.

Cayman Islands: VASPs are subject to the full Cayman AML/CFT regime (KYC/CDD, sanctions screening) supervised by CIMA as the single integrated regulator. The Travel Rule applies under Part XA of the Anti-Money Laundering (Amendment) (No. 2) Regulations 2020, effective 1 July 2022, consistent with FATF Recommendation 16; VASPs file an annual AML return plus quarterly Travel Rule Returns. The 2026 tokenised-funds framework keeps tokenized fund interests inside the Mutual Funds / Private Funds regimes (with their own AML obligations) rather than the VASP regime. The Cayman Islands was removed from the FATF grey list in October 2023.

British Virgin Islands: VASPs and SIBA licensees are subject to the BVI's AML/CFT framework -- the Anti-Money Laundering Regulations and the AML/TF Code of Practice (both amended with effect from 1 December 2022 to capture virtual-asset activity), the Proceeds of Criminal Conduct Act, and the FSC's VASP AML/CFT/PF Guide (1 February 2023). Each VASP must appoint an FSC-approved AML Compliance Officer and a Money Laundering Reporting Officer (MLRO). The relevant CDD transaction threshold is US$1,000 (notably lower than many fiat thresholds), and the Travel Rule is implemented (per law-firm analysis, VASP Act Section 25(2)), requiring collection/tracing of IP addresses, timestamps, geolocation, device identifiers, wallet addresses, and transaction hashes, with records retained for at least five years.

Sources:

• CIMA, "Travel Rule Requirements for VASP" (Part XA AML (Amendment) (No. 2) Regulations 2020; effective 1 July 2022)
• BCB Resolutions 519/520/521 (SPSAV framework), in force 2 February 2026

1.6 Asia-Pacific: Singapore, Hong Kong, Japan, South Korea, Australia

Singapore implements FATF standards through a dual-track AML framework corresponding to its twin regulatory pillars for digital assets.

Under the Securities and Futures Act (SFA): Entities holding Capital Markets Services (CMS) licences for dealing in tokenized capital markets products must comply with MAS Notice SFA04-N02 on AML/CFT. Requirements include customer due diligence, ongoing monitoring, suspicious transaction reporting to the Suspicious Transaction Reporting Office (STRO), sanctions screening, and record-keeping for a minimum of five years. These obligations apply identically to tokenized and non-tokenized securities activities.

Under the Payment Services Act (PSA): Digital Payment Token (DPT) service providers must comply with MAS Notice PSN02 on Prevention of Money Laundering and Countering the Financing of Terrorism. The Payment Services (Amendment) Act 2021, effective in stages from 4 April 2024, expanded the DPT regulatory scope to include custodial services, DPT transmission, cross-border transfers, and exchange services.

Under the Financial Services and Markets Act (FSMA) Part 9: The Digital Token Service Provider (DTSP) regime, effective 30 June 2025, extends AML obligations to entities providing digital token services solely to overseas clients from Singapore. MAS has stated it will grant DTSP licences only under "extremely limited circumstances" due to the inherently higher money-laundering risk of such business models.

Hong Kong: AML/CFT obligations run through the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), with the SFC supervising tokenized securities and VATPs and the HKMA supervising banks and tokenized deposits. The April 2026 framework permitting 24/7 retail secondary trading of tokenised SFC-authorised products on VATPs carries the same suitability and custody controls (including token-burning mechanisms) as their non-tokenized counterparts.

Japan: AML obligations derive from the Act on Prevention of Transfer of Criminal Proceeds, applied by the JFSA, with JAFIC as the financial intelligence unit. Type I FIBOs (the registration required to operate a security-token / STO platform) must segregate client assets and meet fit-and-proper standards.

South Korea: Under the Virtual Asset User Protection Act (VAUPA, in force 19 July 2024, which excludes security tokens), VASPs must segregate customer deposits in custodian bank accounts, use real-name verified accounts, and invest deposits only in safe assets. Security-token AML sits under the FSCMA / KSD-registration track; the enabling FSCMA and AERSB amendments passed the National Assembly on 15 January 2026 and take effect January 2027.

Australia: AML/CTF supervision is held by AUSTRAC under the AML/CTF Act 2006 (digital currency exchange registration), separate from ASIC's financial-product supervision under the Corporations Act. Australia's first bespoke statute, the Corporations Amendment (Digital Assets Framework) Act 2026 (Royal Assent 8 April 2026), creates Digital Asset Platform (DAP) and Tokenised Custody Platform (TCP) categories but commences 9 April 2027; ASIC's no-action position runs until 30 June 2026.

Sources:

• MAS Notice PSN02 on AML/CFT for Digital Payment Token Services
• MAS, "MAS Clarifies Regulatory Regime for Digital Token Service Providers" (2025)

1.7 Switzerland, United Kingdom, and the Gulf

Switzerland: FINMA applies AML obligations under the Anti-Money Laundering Act (AMLA) to all supervised financial intermediaries, including banks, securities firms, DLT trading facility operators, and FinTech licence holders. Swiss banks providing crypto custody services (AMINA Bank, Sygnum Bank) are subject to full banking AML requirements. FINMA Guidance 01/2026 (12 January 2026) established additional requirements for custody of crypto-based assets, including mandatory counterparty due diligence and foreign custodian assessments.

UK: Since 10 January 2020, cryptoasset businesses must register with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), with a historically low approval rate. Security tokens classified as specified investments are subject to the full AML framework applicable to FCA-authorised investment firms. Under the FSMA 2000 (Cryptoassets) Regulations 2026 (SI 2026/102, made 4 February 2026), a comprehensive authorisation regime with enhanced AML requirements commences 25 October 2027.

Bahrain: The Central Bank of Bahrain (CBB), as sole financial-services regulator, applies the Crypto-Asset Module (CRA), which requires segregation of client assets, independent custody, regular reconciliation, and FATF Travel Rule compliance for virtual-asset transfers.

UAE: AML obligations derive from Federal Decree-Law No. 20/2018 plus zone-specific rules across VARA (Dubai), the ADGM FSRA, the DIFC DFSA, and the federal CMA. The FATF Travel Rule is implemented, and the UAE was removed from the FATF grey list in February 2024.

Abu Dhabi (ADGM): As a financial free zone within the UAE, ADGM applies UAE federal AML/CFT law (Federal Decree-Law No. 20/2018 and Cabinet Resolutions Nos. 10 and 20 of 2019) together with the FSRA's own Anti-Money Laundering and Sanctions Rules and Guidance (AML Rulebook) and the FATF Recommendations. ADGM/FSRA is a signatory to the IOSCO Multilateral Memorandum of Understanding (MMoU), recognised by IOSCO as fully compliant with international standards of cooperation and enforcement.

2. Travel Rule for Tokenized Securities

2.1 FATF Recommendation 16 Applicability

FATF Recommendation 16 (the "Travel Rule") requires originating and beneficiary institutions to exchange identifying information about senders and recipients of fund transfers. Through the updated Interpretive Note to Recommendation 15 (INR.15), this obligation was extended to virtual asset transfers conducted by VASPs.

For VA transfers, required information includes:

The FATF-recommended de minimis threshold is USD/EUR 1,000 -- transfers below this amount may be subject to reduced requirements, though jurisdictions may impose stricter thresholds.

For tokenized securities, the applicability determination depends on the regulatory status of the intermediary:

• If the transfer occurs through a regulated financial institution (e.g., a broker-dealer executing a trade in tokenized bonds), existing Recommendation 16 obligations for wire transfers apply
• If the transfer occurs through a VASP (e.g., a licensed crypto exchange facilitating secondary trading of tokenized fund units), the VA-specific Travel Rule obligations apply
• If the transfer is peer-to-peer between unhosted wallets without VASP involvement, the Travel Rule does not directly apply -- but this scenario creates regulatory blind spots that supervisors are actively addressing

Source: FATF, "Best Practices on Travel Rule Supervision" (June 2025)

2.2 Technical Solutions

Three principal protocol families enable Travel Rule compliance for virtual asset transfers:

TRISA (Travel Rule Information Sharing Alliance): An open-source, peer-to-peer protocol enabling VASPs to exchange Travel Rule data securely. TRISA uses mutual TLS authentication and certificate-based identity verification through a Global Directory Service (GDS). TRISA achieved interoperability with TRP/OpenVASP in November 2023 and has launched Envoy, an open-source messaging service for Travel Rule data exchange. TRISA is designed to be regulator-friendly, with a dedicated regulator portal for supervisory access.

TRP (Travel Rule Protocol) / OpenVASP: An open-source messaging protocol maintained by the OpenVASP Association. TRP supports structured data exchange between VASPs and is interoperable with TRISA and Sygna Bridge.

Notabene: A commercial compliance platform that integrates multiple Travel Rule protocols (TRP, OpenVASP, TRUST, Sygna Bridge, TRISA), enabling VASPs to connect with counterparties regardless of which underlying protocol they use. Notabene functions as a network aggregator, addressing the fragmentation problem across protocol standards.

The data format standard IVMS 101, developed under FATF auspices, is the most commonly adopted, used by 73% of new implementations in 2024 (up from 41% in 2022). A new global VASP registry being built by FATF and IOSCO is scheduled for launch in late 2025, assigning unique identifiers to every compliant VASP and targeting a reduction in connection failures from 29% to under 10%.

Sources:

• TRISA - Travel Rule Information Sharing Alliance
• Notabene Travel Rule Messaging Protocols
• InnReg, "Crypto Travel Rule Guide (Updated 2026)"

2.3 Threshold Differences Across Jurisdictions

Australia applies AUSTRAC AML/CTF transfer obligations; a fixed tokenized-securities Travel Rule de minimis is not separately stated pending the DAP/TCP regime (commences 9 April 2027). For the EEA-incorporated jurisdictions (Liechtenstein) and EU Member States (Ireland, France, Germany, Luxembourg), the EU Transfer of Funds Regulation zero-threshold applies directly.

The EU's Transfer of Funds Regulation (TFR) imposes the strictest threshold globally: Travel Rule obligations apply to all crypto-asset transfers, with no de minimis exemption. This is more stringent than the FATF recommendation and creates an asymmetry with most other jurisdictions.

2.4 Challenge: Tokenized Securities on Public Blockchains

The Travel Rule presents unique challenges when tokenized securities trade on public blockchains:

The sunrise problem persists -- jurisdictions that have implemented the Travel Rule cannot consistently exchange data with counterparties in jurisdictions that have not. This is particularly acute for tokenized securities with global investor bases, where the underlying fund is frequently domiciled in one jurisdiction (e.g. a Cayman, BVI, Irish, or Luxembourg fund) while distribution and trading occur in another.

Unhosted wallet transfers: When a whitelisted investor transfers tokenized securities from a custodial wallet to a self-hosted wallet (or vice versa), the VASP/financial institution on one side of the transaction may not have a counterparty to exchange Travel Rule data with. The EU TFR addresses this by requiring CASPs to collect beneficiary information even for transfers to/from unhosted wallets above EUR 1,000.

Smart contract interactions: Transfers of tokenized securities through smart contracts (e.g., collateralization of BUIDL tokens on DeFi protocols) may not involve a readily identifiable counterparty VASP, creating compliance gaps.

Institutional workaround: Most institutional RWA platforms solve this problem by restricting transfers to whitelisted addresses only. BlackRock's BUIDL, for example -- structured as a BVI-domiciled fund -- permits 24/7 peer-to-peer transfers only between wallets that have been verified and whitelisted through Securitize's KYC process, ensuring that both originator and beneficiary information is known to the intermediary before any transfer occurs.

3. Sanctions Screening

3.1 OFAC Compliance for RWA Platforms

All

US persons and entities -- including tokenized securities platforms, their operators, and their investors -- must comply with sanctions administered by the Office of Foreign Assets Control (OFAC). OFAC's Specially Designated Nationals and Blocked Persons (SDN) List applies to blockchain addresses and wallet identifiers associated with sanctioned persons, entities, and jurisdictions.

For tokenized RWA platforms, OFAC compliance requires:

• Address screening: Screening all wallet addresses involved in transactions against the SDN List and other OFAC sanctions lists before executing transfers
• Ongoing monitoring: Continuous screening as OFAC updates its lists (addresses can be added at any time)
• Blocking and rejecting: Blocking property of SDN-listed persons and rejecting transactions with sanctioned parties
• Reporting: Filing blocked property reports with OFAC within 10 business days

The DTC tokenization pilot explicitly requires all registered wallets to be OFAC-screened before receiving tokenized security entitlements. The SEC-approved Nasdaq tokenized-securities trading system (Release 34-105047, 18 March 2026) similarly incorporates OFAC screening at the wallet-registration level.

3.2 EU and Other Multi-Jurisdiction Sanctions Screening

EU sanctions are administered under Council Regulation (EC) No 881/2002 and subsequent instruments, enforced by national competent authorities in each Member State (the CBI for

Ireland, BaFin for

Germany, the AMF/ACPR for

France, the CSSF for

Luxembourg, and -- via EEA incorporation -- the FMA for

Liechtenstein). CASPs authorized under MiCA must comply with EU restrictive measures, including asset freezes targeting designated persons and entities.

In 2025, the EU adopted sweeping sanctions packages explicitly targeting crypto-related financial activity, including measures against Russian crypto service providers and the ruble-backed stablecoin A7A5, which was found to have facilitated $93.3 billion in transactions in just 10 months. These developments underscore the operational reality that sanctions screening for tokenized asset platforms must extend beyond traditional financial sanctions lists to crypto-specific designations.

Outside the EU/US blocs, the new jurisdictions apply their own sanctions regimes layered on FATF standards: the

Cayman Islands and BVI build sanctions screening into the VASP CDD/AML obligations applicable to all issuers and platforms, while Abu Dhabi (ADGM) applies the FSRA's AML and Sanctions Rules and Guidance on top of UAE federal sanctions law.

Source: Chainalysis, "Crypto Sanctions: 2026 Crypto Crime Report"

3.3 Smart Contract-Level Compliance

Institutional tokenized RWA platforms implement sanctions compliance at the smart contract level through three mechanisms:

Address whitelisting: The most common approach. Smart contracts maintain an on-chain registry of approved wallet addresses. Only addresses that have passed KYC/AML and sanctions screening can hold or receive tokens. Transfers to non-whitelisted addresses are rejected at the protocol level. This is the approach used by Securitize for BlackRock BUIDL, by ERC-1400 compliant security tokens, and by most institutional tokenization platforms.

Transfer restriction logic: Smart contracts encode transfer restriction rules that check sender and recipient addresses against on-chain compliance registries before allowing transactions. The ERC-1400 security token standard, pioneered by Polymath, was designed specifically for this purpose -- embedding compliance checks (including KYC verification, accreditation status, and jurisdictional restrictions) directly into the token's transfer function.

Programmable compliance modules: Platforms like Securitize and Tokeny deploy modular compliance layers that can be updated without redeploying the underlying token contract. This allows sanctions lists to be updated in near real-time without disrupting token functionality. In the Cayman 2026 tokenised-funds framework, operator-approved transfers perform an equivalent function -- preventing uncontrolled secondary movement and supporting AML/sanctions compliance and register integrity.

3.4 Tornado Cash Precedent and Implications for RWA Platforms

The Tornado Cash sanctions episode provides the most significant precedent for understanding how sanctions law applies to blockchain-based financial infrastructure.

On 8 August 2022, OFAC designated Tornado Cash, an open-source, non-custodial cryptocurrency mixer, on the SDN List. This designation was challenged in court by crypto users who argued that immutable smart contracts could not constitute "property" of a foreign national or entity.

On 26 November 2024, the US Court of Appeals for the Fifth Circuit ruled in Van Loon v. Department of the Treasury that OFAC had exceeded its statutory authority under IEEPA. The court held that Tornado Cash's immutable smart contracts lacked the hallmarks of ownership, control, and exclusivity necessary to constitute "property" -- once deployed, no person or entity could change, delete, or restrict their operation.

On 21 March 2025, the Treasury Department withdrew the Tornado Cash sanctions designation, following the court's ruling.

Implications for RWA platforms:

1. Immutable smart contracts may be beyond OFAC's sanctioning authority under current law -- but this does not eliminate sanctions risk for the operators or users of such contracts
2. Permissioned, upgradeable contracts (the standard for institutional RWA tokenization) remain clearly within OFAC's enforcement perimeter because identifiable persons control them
3. The episode reinforced that compliance-by-design -- building sanctions screening into the token's transfer logic -- is the most robust approach for RWA platforms
4. Despite the Tornado Cash delisting, the Trump administration's Digital Asset Report reiterates that OFAC sanctions continue to apply in the digital asset context

Sources:

• K2 Integrity, "The Tornado Cash Delisting and Sanctions Compliance Implications for Crypto"
• Paul Hastings, "A Whirlwind of Change: The Delisting of Tornado Cash"
• Venable LLP, "A Legal Whirlwind Settles: Treasury Lifts Sanctions on Tornado Cash"

4. KYC/Whitelisting for Tokenized Securities

4.1 On-Chain Identity and Whitelisting

The defining compliance mechanism for institutional tokenized securities is on-chain whitelisting: maintaining a blockchain-based registry of wallet addresses that have been verified through off-chain KYC/AML processes. Only whitelisted addresses can hold, send, or receive tokens. This approach enforces regulatory compliance at the protocol level, making non-compliant transfers technically impossible rather than merely illegal.

Securitize ID is the dominant institutional KYC/whitelisting solution for tokenized securities. Securitize operates as an SEC-registered broker-dealer and transfer agent, managing the end-to-end investor onboarding process for products including BlackRock's BUIDL fund (>$2.5 billion AUM). The process works as follows:

1. Investors submit identity documentation through the Securitize platform
2. Securitize performs KYC/AML verification, accredited/qualified investor status checks, and sanctions screening
3. Upon approval, the investor's wallet address is added to the on-chain whitelist maintained in the token's smart contract
4. The smart contract's transfer function checks both sender and recipient addresses against the whitelist before permitting any transfer
5. Transfers between non-whitelisted addresses are automatically rejected

ERC-1400 (Security Token Standard): Developed by Polymath, ERC-1400 is a library of interoperable Ethereum standards designed specifically for security tokens. Its core innovation is embedding compliance logic -- including KYC verification, transfer restrictions, holding period enforcement (e.g., Rule 144 in the US), and jurisdictional limitations -- directly into the token standard. ERC-1400 supports identity registries tied to wallet addresses, enabling issuers to enforce that only investors who have undergone KYC/AML checks and meet accreditation requirements can participate in token transfers.

Tokeny T-REX (Token for Regulated EXchanges): An open-source permissioned token protocol used in the EU for compliant tokenized securities. T-REX integrates on-chain identity verification through the ONCHAINID standard and has been adopted by institutions including Societe Generale-FORGE.

Sources:

• Securitize, "Introducing the BlackRock BUIDL Fund"
• Polymath, "ERC 1400 - The Security Token Standard"

4.2 Permissioned vs. Permissionless Approaches

The tokenized RWA market has converged on a spectrum of approaches to on-chain compliance:

Fully permissioned (closed ecosystem): Tokens exist on a private or consortium blockchain accessible only to vetted participants. Examples include SDX (SIX Digital Exchange) in

Switzerland, which operates a DLT-based CSD targeting supervised financial institutions only, and BOOSTRY/ibet for Fin in

Japan, which operates a consortium blockchain for security tokens among registered Type I FIBOs.

Permissioned tokens on public blockchains (dominant institutional model): Tokens are deployed on public blockchains (Ethereum, Polygon, Avalanche, Solana) but with smart contract-enforced transfer restrictions that limit transfers to whitelisted addresses. This is the approach used by BlackRock BUIDL (Ethereum, Avalanche, and six other chains), Franklin Templeton FOBXX (Stellar, Polygon, and eight other chains), the ADGM-domiciled Realize T-BILLS Fund ($RBILL on Ethereum and IOTA), and most institutional tokenized bond issuances. This model combines the transparency and interoperability of public blockchains with the compliance guarantees of permissioned access.

Permissionless with compliance overlay: An emerging model where tokens are freely transferable on public blockchains but compliance checks are enforced at the application layer (e.g., DEX front-ends check user wallet addresses against compliance registries before facilitating trades). The February 2026 Uniswap Labs-Securitize integration for BUIDL represents this approach: BUIDL shares are made available through UniswapX technology, but all participants must be pre-qualified and whitelisted through Securitize.

4.3 Institutional RWA Platform KYC Implementation

BlackRock BUIDL approach: BUIDL is structured as a BVI-domiciled fund relying on the 3(c)(7) exemption from the US Investment Company Act, limited to qualified purchasers (individuals with $5 million+ in investments). Securitize serves as both the registered transfer agent and broker-dealer. All investors must pass Securitize's KYC/AML verification before their wallet addresses are whitelisted. The fund supports 24/7/365 peer-to-peer transfers, but only between verified wallets. When BUIDL was accepted as collateral on Binance (November 2025), all investors utilizing the capability were pre-qualified and whitelisted through Securitize.

ADDX (

Singapore): ADDX operates as a fully regulated private market exchange holding RMO and CMS licences from MAS. Investors must meet Singapore's accredited investor thresholds (net personal assets exceeding S$2 million, or financial assets exceeding S$1 million, or annual income of at least S$300,000). KYC is performed during account onboarding, with wallet addresses whitelisted for trading on the platform.

SIX Digital Exchange (

Switzerland): SDX restricts access to supervised financial institutions. Individual investors access SDX products through their existing banking relationships, with KYC performed by the intermediary bank. SDX's DLT-based CSD maintains ownership records on the distributed ledger, with only onboarded banks holding participant accounts.

Fund-domicile gatekeeping (Cayman, BVI, Ireland, Luxembourg, ADGM): The fund-domicile jurisdictions enforce KYC primarily through professional/institutional-investor gating and operator-approved transfers rather than retail whitelisting.

Cayman registered mutual funds commonly impose a US$100,000 minimum initial investment and restrict to professional/sophisticated investors; BVI Professional Funds require US$100,000 minimum with professional/sophisticated gating;

Irish QIAIFs require a EUR 100,000 minimum subscription; and ADGM limits Exempt-Offer Digital Securities on an MTF to non-retail clients (full retail MTF secondary trading only where an Approved Prospectus is registered on a primary RIE). In each case the off-chain KYC performed by the fund administrator or licensed intermediary -- not an on-chain whitelist alone -- is the compliance perimeter.

5. Enforcement Actions

5.1 SEC Enforcement Against Unregistered Security Token Offerings

The

US SEC has been the most active enforcement authority globally for security token offering violations. Between April 2021 and December 2024, the SEC initiated 125 cryptocurrency-related enforcement actions, resolving 98 with $6.05 billion in penalties.

Foundational enforcement actions:

2025-2026 enforcement shift: Following the formation of the SEC Crypto Task Force in January 2025, the enforcement posture shifted dramatically. Approximately 89 cryptocurrency enforcement cases were dropped or frozen. High-profile lawsuits were dismissed without penalty, including actions against Coinbase, Kraken, and Ripple (partially). Enforcement is now focused exclusively on fraud cases.

In December 2025, the SEC charged three crypto platforms and four investment clubs with defrauding US retail investors of at least $14 million through fictitious "Security Token Offerings" where no trading actually occurred. This case illustrates that even under the lighter-touch regime, fraud-based enforcement remains active.

Sources:

• Cornerstone Research, "SEC Cryptocurrency Enforcement 2024 Update"
• Holland & Knight, "SEC Enforcement 2025 Year in Review"
• Skadden, "SEC Moves to Lighten Regulation and Encourage Capital Formation" (2026)

5.2 Notable Enforcement Actions Across Jurisdictions

UK -- FCA:

• Fined CB Payments Limited (Coinbase Group) over GBP 3.5 million for onboarding approximately 13,416 high-risk customers in breach of voluntary requirements (October 2020 - October 2023)
• Brought the first criminal prosecution for unregistered cryptoasset activity under the Money Laundering Regulations 2017 in September 2024 (crypto ATM operator)
• Issued 450 consumer alerts against firms potentially operating without proper authorisation by late 2024

Hong Kong -- SFC/HKMA:

• AML fines against financial institutions exceeded HKD 1.6 billion in 2025, with 68% targeting CDD and STR failures
• 147,660 suspicious transaction reports filed in 2024 (51% year-on-year increase)
• Unlicensed VATP operation carries up to 7 years imprisonment and HKD 5 million fine
• In March 2026, authorities executed high-profile raids on brokerages for AML violations

Japan -- JFSA:

• The JFSA has used administrative orders (business improvement and suspension orders) against crypto-asset exchanges for AML and custody failures
• No major enforcement actions specific to tokenized securities (ERTRs) have been publicly reported as of early 2026
• The cabinet-approved FIEA crypto-asset reclassification bill (10 April 2026, pending Diet) would raise criminal penalties from 3 to 10 years and fines from JPY 3 million to JPY 10 million for in-scope crypto-asset offences

Singapore -- MAS:

• MAS has stated it will grant DTSP licences only under "extremely limited circumstances," with all non-licensed DTSPs required to cease operations by 30 June 2025
• The regulator's enforcement philosophy emphasizes preventive licensing rigour over post-hoc penalties

Canada -- CSA/CIRO:

• The CSA reminded crypto-backed lending platforms of securities-law obligations (22 October 2025) and is transitioning CTPs from interim restricted-dealer registration to full investment-dealer/CIRO membership; enforcement runs through provincial regulators (OSC, AMF, BCSC) and FINTRAC for AML

UAE & Abu Dhabi -- VARA / FSRA / CMA:

• The federal CMA (ex-SCA) can impose fines up to AED 4,000,000, plus disgorgement and criminal referrals; the UAE was removed from the FATF grey list in February 2024
• VARA holds enforcement powers including licence suspension/revocation and financial penalties
• ADGM's FSRA exercises Market Abuse (FSMR Part 8) and transaction-reporting powers over Digital Securities and cooperates cross-border via the IOSCO MMoU

Cayman Islands -- CIMA:

• Operating custody/platform services without a VASP licence is a breach exposing the entity to cease-and-desist and other enforcement; issuance of virtual assets requires prior CIMA approval; marketing/advertising-accuracy duties carry misrepresentation penalties

British Virgin Islands -- FSC:

• Breach of the AML/CFT requirements, or unregistered VASP operation, carries fines up to US$100,000 and/or 5 years' imprisonment; officers are personally liable where they knowingly authorised, permitted, or acquiesced in the offence. As at 30 July 2025, 14 VASPs were registered while the FSC ran thematic AML/CTF, IT-infrastructure, and business-continuity reviews

5.3 Penalties Summary by Jurisdiction

Germany, France, Liechtenstein, and Luxembourg apply the EU/MiCA penalty ceiling (up to EUR 5M or 12.5% of annual turnover) through BaFin, the AMF/ACPR, the FMA, and the CSSF respectively. Australia applies Corporations Act / AML-CTF Act penalties through ASIC and AUSTRAC.

6. Comparative Table

The table below summarizes the AML/Travel-Rule/enforcement posture of all 21 jurisdictions studied. EU/EEA Member States that apply the harmonized MiCA/TFR/AMLR framework are grouped where their facts are identical, with jurisdiction-specific notes.

7. What Works and What Does Not

7.1 Approaches That Work

Compliance-by-design through on-chain whitelisting. The most effective compliance model for tokenized RWAs is one where regulatory requirements are embedded in the token's smart contract logic, making non-compliant transfers technically impossible. BlackRock BUIDL's architecture -- where all wallets must be pre-verified through Securitize before any transfer can occur -- has scaled to over $2.5 billion in AUM without a single compliance incident attributable to on-chain transfer controls. This approach eliminates the enforcement problem by preventing violations rather than detecting them after the fact. The Cayman 2026 framework codifies an equivalent at the legal layer through mandatory operator-approved transfers reconciled to book-entry registers.

Activity-based regulation under existing financial services law. Jurisdictions that regulate tokenized securities under existing securities and capital markets frameworks -- treating a tokenized bond as a bond, not as a novel crypto product -- achieve more consistent compliance outcomes. Singapore's "same activity, same risk, same regulatory outcome" principle, Switzerland's DLT Act amendments to existing federal law, Hong Kong's "see-through" approach, the UK's "same risk, same regulatory outcome" principle, ADGM's FSMR s. 58(2)(b) deeming power, and the US SEC's January 2026 statement that blockchain "does not alter the application of the federal securities laws" all exemplify this approach. Regulated intermediaries (broker-dealers, banks, CSDs, fund administrators) already have mature AML/KYC infrastructure that extends naturally to tokenized instruments.

Institutional-grade KYC gatekeeping at the platform/domicile level. Platforms that perform rigorous KYC at onboarding (ADDX requiring accredited investor verification, SDX restricting access to supervised financial institutions, Securitize performing qualified purchaser checks) create effective compliance perimeters. The same gatekeeper logic operates at the fund-domicile layer in the new entrants: Cayman registered funds (US$100,000 minimum), BVI Professional Funds (US$100,000 minimum), Irish QIAIFs (EUR 100,000 minimum), and ADGM Exempt-Offer Digital Securities (non-retail only) all leverage existing fund-administrator AML infrastructure rather than building parallel blockchain-native compliance systems.

7.2 Approaches That Do Not Work

Reliance on post-hoc enforcement without clear ex-ante rules. The US experience under the prior SEC administration (2021-2024), which pursued 125 enforcement actions against crypto firms while providing limited prospective guidance on compliance, created regulatory uncertainty that deterred legitimate tokenized securities activity while failing to prevent fraud. The December 2025 SEC enforcement against fictitious STOs demonstrates that bad actors are not deterred by ambiguous regulation.

Jurisdiction-shopping through regulatory arbitrage. The multi-zone UAE model (VARA, ADGM, DIFC, CMA) offers flexibility but also creates complexity. Firms may structure operations to exploit gaps between regimes. The UAE's placement on the FATF grey list from March 2022 to February 2024 illustrated the consequences of perceived regulatory fragmentation at the international level. The offshore fund domiciles (Cayman, BVI) mitigate this risk by pairing tax neutrality with full FATF-aligned AML, quarterly Travel Rule reporting (Cayman), and OECD AEOI (CRS/CARF) -- both jurisdictions cleared the FATF grey list before being treated as credible RWA domiciles.

Attempting to apply AML obligations to immutable smart contracts. The Tornado Cash episode demonstrated the legal and practical impossibility of sanctioning autonomous, immutable code. For RWA platforms, this reinforces that compliance must be enforced at the human-controlled layer (wallet whitelisting, intermediary gatekeeping, operator-approved transfers) rather than at the protocol layer when contracts are truly immutable.

Fragmented Travel Rule implementation. The "sunrise problem" -- where some jurisdictions have implemented the Travel Rule while counterparties have not -- undermines the regime's effectiveness, and is most acute where a fund is domiciled in one jurisdiction (Cayman, BVI, Ireland, Luxembourg) but distributed in another. Cross-VASP data sharing standards remain fragmented across TRISA, TRP, OpenVASP, TRUST, and proprietary systems. The EU/EEA's zero-threshold approach under TFR, while maximally comprehensive, creates compliance asymmetries with the USD 3,000 US threshold and the USD/EUR 1,000 FATF recommendation.

8. Recommended Framework

8.1 Core Principles

Based on the comparative analysis of compliance and enforcement frameworks across the 21 jurisdictions, the following principles should guide regulatory design for tokenized RWA platforms:

Principle 1: Substance over form. Regulatory obligations should be determined by the economic substance of the activity and the underlying asset, not by the technology used for recordkeeping or transfer. A tokenized bond is a bond. A tokenized fund unit is a fund unit. The blockchain changes the plumbing, not the regulatory perimeter. The convergence of the US Howey test, Singapore's economic-substance test, Switzerland's FINMA function test, the EU/ESMA classification guidelines, and ADGM's FSMR s. 58(2)(b) deeming power on this principle is striking.

Principle 2: Compliance at the control point. AML/KYC obligations should be imposed at the point where a human or entity exercises control -- the platform operator, the licensed intermediary, the transfer agent, the fund administrator -- not at the protocol level. Smart contract-enforced whitelisting and operator-approved transfers are powerful compliance tools, but regulatory accountability must rest with identifiable legal persons.

Principle 3: Proportionate thresholds. Travel Rule thresholds should converge toward the FATF USD/EUR 1,000 recommendation. The EU/EEA's zero-threshold approach, while maximally inclusive, imposes disproportionate operational costs on low-value institutional transfers of tokenized securities. The US USD 3,000 threshold is too high relative to the FATF standard.

Principle 4: Interoperable standards. Jurisdictions should mandate adoption of IVMS 101 as the data format standard for Travel Rule compliance, and support the FATF-IOSCO global VASP registry to reduce counterparty identification failures -- a priority sharpened by the cross-border domicile/distribution split that characterizes the RWA market.

Principle 5: Graduated enforcement. Enforcement should distinguish between: (a) fraud and intentional evasion, warranting criminal prosecution and maximum penalties; (b) regulatory non-compliance by good-faith actors operating in grey areas, warranting administrative remediation; and (c) technical non-compliance due to evolving technology, warranting guidance and temporary relief.

8.2 Recommended AML/KYC Architecture for RWA Platforms

8.3 Cross-Border Coordination

Regulators should:

1. Adopt mutual recognition of AML/KYC verifications performed by equivalently regulated counterparts, reducing duplicative compliance for cross-border tokenized securities (cf. FATF mutual evaluation framework)
2. Standardize VASP registration through the forthcoming FATF-IOSCO global registry, reducing Travel Rule connection failures
3. Harmonize Travel Rule thresholds toward the FATF USD/EUR 1,000 de minimis
4. Coordinate enforcement through multilateral arrangements, particularly for platforms operating across jurisdictions (VARA + ADGM + DIFC; EU NCAs + ESMA + AMLA; SEC + FINRA + FinCEN; the IOSCO MMoU network that ADGM, the Cayman Islands, the BVI, and the EU NCAs all participate in)

9. Decision Matrix

9.1 Platform Compliance Pathway Decision Matrix

START: Does the platform deal in tokens that qualify as securities/
       financial instruments under applicable law?
  |
  +-- YES --> Is the platform already licensed as a financial institution
  |           (broker-dealer, bank, investment firm, CMS/CASP/FSP holder,
  |            fund administrator)?
  |             |
  |             +-- YES --> Apply existing financial institution AML framework
  |             |           (BSA/FinCEN in US; MiFID II/AMLR in EU/IE/FR/DE/LU/LI;
  |             |            SFA/PSA in SG; FSMR AML in ADGM; SIBA/Funds in KY/VG)
  |             |           Travel Rule: existing wire transfer rules apply
  |             |           Additional: smart contract whitelisting / operator-
  |             |           approved transfers recommended
  |             |
  |             +-- NO --> Obtain appropriate securities/investment services licence
  |                        THEN apply financial institution AML framework
  |                        Note: VASP registration may also be required if
  |                        handling non-security crypto-assets concurrently
  |
  +-- NO --> Does the platform deal in tokens that qualify as
             crypto-assets/virtual assets (not securities)?
               |
               +-- YES --> Register/license as VASP/CASP
               |           (MiCA CASP in EU/IE/FR/DE/LU/LI; FCA crypto
               |            registration in UK; PSA licence in SG; VARA in
               |            Dubai; VASP Act in KY/VG; CRA in Bahrain)
               |           Apply VASP-specific AML framework
               |           Travel Rule: VA-specific obligations apply
               |
               +-- MIXED (both securities and non-securities) -->
                          Dual licensing required
                          Apply BOTH financial institution AND VASP AML frameworks
                          Travel Rule: apply more stringent standard

9.2 Sanctions Compliance Decision Matrix

9.3 Jurisdiction Selection Matrix for RWA Platform Compliance

Verification Notes

This guidance document mirrors the canonical per-jurisdiction fact matrix (.claude/rwa-regulation-fact-matrix.json, N = 21 jurisdictions) and the underlying country files under regulations/. No fact has been introduced that is not in the matrix or already verified in the prior version of this file. "X of N" aggregates are re-derived for N = 21. Where the matrix records a fact as NOT VERIFIED or NO DATA FOUND, this document reflects that honestly rather than asserting a value.

Corrections Applied in This Refresh (2026-06-04)

1. US Nasdaq tokenized securities -- updated from "proposed" to SEC-approved 18 March 2026 (Release 34-105047), go-live targeted Q3 2026, settling T+1 conventionally (§1.4, §3.1, §6).
2. Brazil MP 1,303/2025 -- recorded as rejected by the Chamber of Deputies on 8 October 2025; the progressive 15%-22.5% CGT and BRL 35,000 monthly exemption remain in force (§1.5, §6).
3. Australia DAF Act 2026 -- recorded as enacted (Royal Assent 8 April 2026), commencing 9 April 2027; ASIC no-action position until 30 June 2026 (§1.6, §5.2, §6).
4. UK cryptoasset regime -- updated to FSMA 2000 (Cryptoassets) Regulations 2026 (SI 2026/102), commencing 25 October 2027 (§1.7, §6).
5. EU DLT Pilot Regime operator count -- the EU now counts six authorized DLT market infrastructures (CSD Prague, 21X, 360X, Axiology/Lithuania, LISE/France, Securitize/Spain) per the ESMA register; reflected where relevant in the cross-domain context.

Four New Jurisdictions Integrated

• Cayman Islands -- VASP AML/CFT regime; Travel Rule under Part XA AML (Amendment)(No.2) Regs 2020 (eff. 1 July 2022); quarterly Travel Rule Returns; CIMA single regulator; 2026 tokenised-funds carve-out from VASP regime; removed from FATF grey list Oct 2023; integrated into §1.1, §1.5, §2.3, §3.2, §4.3, §5.2, §6, §7, §8, §9.
• British Virgin Islands -- AML Regs/Code (amended 1 Dec 2022); Travel Rule via VASP Act Sec. 25(2) (law-firm-attributed); US$1,000 CDD threshold; US$100,000 / 5-year penalties; 14 VASPs (Jul 2025); integrated into §1.1, §1.5, §2.3, §4.3, §5.2, §6, §7, §8, §9.
• Ireland -- Criminal Justice (ML/TF) Acts + MiCAR/TFR; CBI single NCA; ~23 pre-MiCA AML-registered VASPs; shortened CASP transition ended 29 Dec 2025; integrated into §1.1, §1.3, §3.2, §4.3, §6, §8, §9.
• Abu Dhabi (ADGM) -- UAE federal AML (Decree-Law 20/2018; Cabinet Resolutions 10 & 20 of 2019) + FSRA AML & Sanctions Rulebook + FATF Recommendations; IOSCO MMoU signatory; FSMR Part 8 market-abuse powers; integrated into §1.1, §1.7, §3.2, §4.1, §4.3, §5.2, §6, §7, §8, §9.

Claims Carried Forward (Verified in Prior Cycle)

1. FATF Travel Rule implementation statistics (85 of 117 jurisdictions, 73%): FATF June 2025 Targeted Update on VA/VASP implementation. Source: FATF Targeted Update June 2025
2. EU AMLR application date (10 July 2027) and AMLA direct supervision (1 January 2028): Jones Day (July 2025); Sumsub AMLA Report
3. Tornado Cash delisting (21 March 2025) following Fifth Circuit ruling (November 2024): K2 Integrity; Paul Hastings; Venable
4. SEC enforcement statistics ($6.05B in penalties, 125 actions, ~89 cases dropped): Cornerstone Research; Holland & Knight
5. SEC December 2025 fictitious STO fraud charges ($14 million): Morgan Lewis
6. FCA CB Payments fine (GBP 3.5 million): FCA enforcement announcements.
7. Securitize/BlackRock BUIDL whitelisting process (BVI-domiciled fund): Securitize BUIDL; PR Newswire BUIDL on Binance (November 2025)
8. IVMS 101 adoption (73% of new implementations in 2024): InnReg
9. TRISA-TRP interoperability (November 2023): OpenVASP Association
10. EU A7A5 stablecoin sanctions ($93.3 billion): Chainalysis
11. Singapore DTSP regime effective 30 June 2025: MAS; Reed Smith
12. Hong Kong AML fines exceeding HKD 1.6 billion (2025) and 147,660 STRs (2024): Tookitaki enforcement guide and HK Lawyer analysis as cited in the Hong Kong regulation file.
13. UAE removed from FATF grey list February 2024: Chambers & Partners and multiple secondary sources.
14. Cayman removed from FATF grey list October 2023: CIMA Travel Rule page; Chambers Fintech 2026 (Cayman).
15. ERC-1400 security token standard and Polymath: Polymath ERC-1400; Blockchain App Factory

Items Not Independently Verified (per matrix)

• BVI VASP Act Section 25(2)/27/30/10 numbering -- law-firm-attributed (Charltons Quantum); the primary Act PDF returned HTTP 403 and was not machine-fetched; treat section citations as indicative.
• Cayman registered-fund US$100,000 minimum -- reflects the long-standing Mutual Funds Act route; not re-verified line-by-line against the 2025 Revision.
• ADGM-specific Travel Rule numeric de minimis -- ADGM applies UAE federal AML/FATF Travel Rule; a separate ADGM-only numeric threshold is not independently verified (UAE federal AED 3,500 used).
• Exact VASP/CASP registration counts per jurisdiction -- approximate figures from regulator updates and secondary sources (e.g. BVI 14 VASPs at 30 July 2025; Ireland ~23 pre-MiCA VASPs).
• FATF-IOSCO global VASP registry launch timeline ("late 2025" per InnReg; may have been delayed).
• Specific AMLA entity-selection criteria for direct CASP supervision (methodology under development 2026-2027).

Last verified: 4 June 2026