FATF VASP Guidance: The Definition, the Risk-Based Approach, the Limits

Every crypto-AML conversation invokes "FATF" as if it were a statute. It is not. FATF sets standards — Recommendation 15 for virtual assets/VASPs, Recommendation 16 the Travel Rule — and those standards only bite through national law, implemented unevenly. This guide is the definition, the risk-based approach and the limits, hedged, because VASP status is a legal determination, not a self-assessment.

TL;DR

• FATF = global AML/CFT standard-setter; the FATF Recommendations are standards, not directly binding law — they bite via national implementing legislation.
• Recommendation 15 = virtual assets / VASPs; Recommendation 16 = the Travel Rule.
• VASP definition turns on five enumerated activities (VA↔fiat, VA↔VA, transfer, safekeeping/administration, participation in an issuer's VA offer/sale).
• Risk-based approach expected — but FATF says only a minority of jurisdictions fully apply it to VASP supervision.
• Offshore VASP (formed in one jurisdiction, serving another) = FATF-flagged elevated illicit-finance risk.
• Jurisdiction-specific, evolving — "FATF-compliant" ≠ compliant everywhere; confirm with compliance counsel. Not legal/compliance advice.

FATF sets standards, not law

FATF (the Financial Action Task Force) is the global standard-setter for AML/CFT. The FATF Recommendations are standards, not directly binding law; they take legal effect only when a jurisdiction implements them via its own legislation, which differs in scope, timing and detail. "FATF requires X" is shorthand for "FATF recommends X; your jurisdiction's implementing law determines what applies to you" — a compliance-counsel question.

The VASP definition (five activities)

FATF broadly defines a Virtual Asset Service Provider as a natural or legal person who, as a business, conducts one or more of:

Whether a specific business is in scope is a legal determination under the implementing national law — not a self-assessment.

The risk-based approach

FATF expects jurisdictions and VASPs to apply a risk-based approach — identify, assess and mitigate ML/TF risk proportionately, not uniform controls applied blindly. FATF's own updates indicate only a minority of jurisdictions fully apply the risk-based approach to VASP supervision, so implementation maturity varies widely. The principle is global; the practical expectation depends on the supervising jurisdiction.

Why FATF flags offshore VASPs

FATF defines an offshore VASP as one created under one jurisdiction's laws (with or without physical presence) serving clients in another, and has highlighted elevated illicit-finance risk where supervision is weak/absent. This ties directly to crypto-company jurisdiction choice: registering somewhere without genuine supervision and substance can increase regulatory and counterparty risk, not reduce it.

Practical guidance

1. Read "FATF" as a standard, not your law — find the implementing national legislation.
2. Test VASP status against the five activities under the applicable law — counsel, not self-assessment.
3. Build a genuine risk-based approach — expect supervisory variance by jurisdiction.
4. Treat offshore-VASP structuring cautiously — weak supervision raises risk.
5. Satisfy each relevant jurisdiction — "FATF-compliant" is not compliant everywhere.
6. Confirm with compliance counsel per jurisdiction — evolving; not legal/compliance advice.

How vendor tools relate to FATF compliance

Chainalysis and Elliptic provide blockchain analytics and risk/screening that support a risk-based AML programme. They do not determine VASP status or what a jurisdiction's implementing law requires — those remain legal determinations for the business and its compliance counsel. Confirm any tool reflects the current national rules.

How Wag3s helps

Wag3s is not an AML/screening provider. Wag3s HR and the finance OS keep the auditable financial record that a risk-based AML programme and the AML/KYC process rely on, while VASP determination and the implementing-law obligations stay with the business and compliance counsel. See the HR product page.

Further reading

• Crypto Travel Rule Compliance
• OFAC Crypto Sanctions Compliance
• AML & KYC for Crypto Businesses
• Crypto Company Jurisdiction Guide
• Offshore Crypto Company: the Substance Myth
• DAC8 Compliance Guide

Sources

• FATF = global AML/CFT standard-setter; the FATF Recommendations are standards, not directly binding law — take legal effect via national implementing legislation (scope/timing/detail differ by jurisdiction)
• FATF Recommendation 15 = virtual assets / VASPs; Recommendation 16 = Travel Rule; FATF VASP definition = a person who as a business conducts one or more of: VA↔fiat exchange; VA↔VA exchange; VA transfer; safekeeping/administration of VAs or instruments enabling control; participation in/provision of financial services for an issuer's offer/sale of a VA
• Risk-based approach expected of jurisdictions/VASPs; FATF updates indicate only a minority of jurisdictions fully apply RBA to VASP supervision (implementation maturity varies)
• Offshore VASP = formed under one jurisdiction's law serving clients in another — FATF flags elevated illicit-finance risk where supervision weak; VASP status is a legal determination under implementing national law, jurisdiction-specific; not legal/compliance advice