FATF Guidance

What Is FATF Guidance?

FATF guidance refers to the standards, recommendations, and interpretive notes published by the Financial Action Task Force, an intergovernmental body that sets global policy for combating money laundering, terrorism financing, and proliferation financing. Established in 1989 at the G-7 Summit in Paris, FATF currently has 40 members (38 jurisdictions plus the European Commission and the Gulf Cooperation Council), and over 200 countries have committed to implementing its standards through FATF-Style Regional Bodies.

FATF produces a set of 40 Recommendations that serve as the international benchmark for AML/CFT regulation. First issued in 1990 and substantially revised in 2012, these Recommendations cover customer due diligence, suspicious transaction reporting, international cooperation, and targeted financial sanctions. While not legally binding, they are recognized as international standards by the World Bank, IMF, and UN Security Council: countries that fail to implement them face significant economic and reputational consequences.

For the cryptocurrency industry, FATF guidance became directly relevant in June 2019, when the organization amended Recommendation 15 to explicitly extend AML/CFT requirements to virtual assets and virtual asset service providers. This marked the first time a global standard-setting body applied comprehensive financial regulation to crypto businesses.

How It Works

FATF operates through a cycle of standard-setting, evaluation, and enforcement pressure. Understanding this cycle explains why FATF guidance, despite being non-binding, shapes crypto regulation worldwide.

Standard-Setting

FATF develops its 40 Recommendations through a consensus-based process among member jurisdictions. When new risks emerge (such as virtual assets), FATF can amend existing Recommendations or issue supplementary guidance. The June 2019 amendment to Recommendation 15 defined two critical terms:

• Virtual asset (VA): a digital representation of value that can be digitally traded or transferred and used for payment or investment purposes, excluding digital representations of fiat currencies, securities, and other already-regulated financial assets
• Virtual asset service provider (VASP): any entity that, as a business, conducts exchange between VAs and fiat, exchange between VAs, transfer of VAs, safekeeping or administration of VAs, or participation in the issuance or sale of VAs

Under these definitions, VASPs must be licensed or registered, implement AML/CFT programs, perform customer due diligence, conduct transaction monitoring, file suspicious activity reports, and comply with the travel rule.

The Travel Rule for Virtual Assets

Recommendation 16 (the "travel rule") requires that originator and beneficiary information accompany value transfers through the payment chain. Applied to VASPs since 2019, it mandates that for transfers above the USD/EUR 1,000 threshold, the following information must be collected and transmitted:

• Originator information: full name, account number or unique transaction reference, and either a physical address, national identity number, customer identification number, or date and place of birth
• Beneficiary information: full name and account number or unique transaction reference

For transfers below the threshold, VASPs must still collect originator and beneficiary names along with wallet addresses or transaction references, though verification is not strictly required. Individual jurisdictions can set stricter thresholds: the EU's Transfer of Funds Regulation applies a zero-euro threshold for crypto transfers, meaning all transactions require full information regardless of amount.

In June 2025, FATF revised Recommendation 16 itself to strengthen payment transparency, clarifying responsibilities within the payment chain, mandating structured data formats such as ISO 20022, and requiring tools to protect against fraud. All countries are expected to implement the revised standard by the end of 2030.

Mutual Evaluations and Listing

FATF enforces its standards through periodic mutual evaluations of member jurisdictions. Each evaluation takes up to 18 months and assesses both technical compliance with all 40 Recommendations and the effectiveness of the country's AML/CFT framework in practice. Jurisdictions that fall short face listing:

• Grey list (officially "Jurisdictions under Increased Monitoring"): countries with strategic deficiencies that have committed to resolving them through an agreed Action Plan. Grey-listing triggers enhanced due diligence from global financial institutions, loss of correspondent banking relationships, reduced foreign investment, and reputational damage.
• Black list (officially "High-Risk Jurisdictions Subject to a Call for Action"): countries with critical deficiencies that refuse to cooperate. FATF calls on all members to apply counter-measures, severely restricting financial relationships with the jurisdiction.

This listing mechanism is the primary enforcement tool. While FATF cannot impose fines or legal penalties directly, the economic consequences of grey-listing or black-listing create powerful incentives for countries to adopt VASP regulation, implement the travel rule, and enforce sanctions screening requirements.

Key Guidance Updates

2021 Updated Guidance on VAs and VASPs

In October 2021, FATF published updated guidance addressing areas that had evolved since 2019. The update covered six key areas: clarification of VA and VASP definitions, application of standards to stablecoins, risks from peer-to-peer transactions, VASP licensing requirements, travel rule implementation details, and information-sharing among supervisors.

Three topics drew particular attention:

• DeFi: FATF stated that DeFi projects would be considered VASPs when they engage as a business in covered activities. The focus is on identifying persons with control or sufficient influence over a protocol, regardless of the underlying technology. Software developers who merely write code are not implicated, but those involved in governance or management functions may be.
• NFTs: generally not considered virtual assets if used as unique collectibles. However, NFTs that function as payment or investment instruments may trigger VASP obligations for service providers facilitating their exchange.
• Stablecoins: explicitly classified as virtual assets subject to FATF Standards. Central developers, governance bodies, or issuing entities of stablecoins are likely VASPs if they establish governing rules and carry out management functions.

2025-2026 Targeted Reports

FATF has continued to monitor virtual asset risks through annual targeted updates. The June 2025 update found that 85 of 117 surveyed jurisdictions (73%) had passed travel rule legislation, up from 65 the prior year, though only 29% of jurisdictions were rated largely compliant with Recommendation 15. The update also flagged increasing use of stablecoins by illicit actors.

In March 2026, FATF published a targeted report on stablecoins and unhosted wallets, noting that stablecoins accounted for 84% of illicit virtual asset transaction volume in 2025. A July 2026 report on DeFi found that nearly 93% of surveyed jurisdictions had never applied FATF standards to a qualifying DeFi arrangement, and only four jurisdictions had licensing rules for DeFi platforms.

FATF Guidance and National Law

FATF recommendations become enforceable only when individual jurisdictions incorporate them into national legislation. How countries implement the standards varies significantly:

This divergence extends beyond thresholds. Definitions of VASPs vary across jurisdictions, approaches to unhosted wallets range from permissive to restrictive, and DeFi treatment remains highly uneven. For businesses operating across borders, this patchwork of implementations creates compliance complexity that tools like sanctions screening and transaction monitoring systems must navigate.

Why It Matters for Crypto

FATF guidance fundamentally shapes the compliance landscape for any business handling virtual assets. Exchanges, custodians, payment processors, and stablecoin issuers all operate within frameworks derived from FATF Recommendations. Understanding FATF guidance matters for several reasons:

• Licensing and registration requirements for VASPs in most jurisdictions trace directly to FATF's 2019 amendments
• The travel rule creates technical requirements for information-sharing between VASPs that affect protocol design, wallet architecture, and payment flows
• FATF's expanding scope into stablecoins, DeFi, and unhosted wallets signals the direction of future regulation globally

For stablecoin payment infrastructure in particular, FATF compliance is a prerequisite for institutional adoption. As explored in the stablecoin travel rule compliance guide, implementing the travel rule for stablecoin transfers requires coordination between originating and beneficiary VASPs, with compliant data exchange at each step.

Risks and Criticisms

Overreach Into Self-Hosted Wallets

FATF has flagged unhosted (self-custodied) wallets as posing money laundering and terrorism financing risks because they allow transactions without a regulated intermediary performing KYC. Critics, including the digital rights organization Coin Center, argue that transfers between VASPs and unhosted wallets are fundamentally different from intermediated wire transfers and should not trigger identical travel rule obligations. This concern is especially relevant for self-custody protocols where users control their own keys.

The Sunrise Problem

Because jurisdictions implement the travel rule at different speeds, VASPs in early-adopting countries face compliance costs that competitors in non-compliant jurisdictions avoid. As of FATF's 2026 update, 83% of surveyed jurisdictions had passed travel rule legislation, but adoption and enforcement remain uneven. This asymmetry creates an unlevel playing field and can disincentivize compliance in the private sector.

Privacy Concerns

The Electronic Frontier Foundation has warned that FATF-aligned regulations expand financial surveillance into cryptocurrency, undermining privacy features that dissidents and activists in authoritarian regimes rely on. The tension between AML/CFT objectives and financial privacy remains one of the most contested areas in crypto regulation.

One-Size-Fits-All Framework

Applying a regulatory framework originally designed for banks and wire transfers to decentralized protocols, peer-to-peer transfers, and programmable money creates friction. DeFi protocols without identifiable operators, DAOs with distributed governance, and purely peer-to-peer transactions do not map cleanly onto the VASP model. FATF's own 2026 DeFi report acknowledged that 93% of jurisdictions have never applied its standards to a DeFi arrangement, suggesting the framework needs further adaptation.

Frequently Asked Questions

Is FATF guidance legally binding?

No. FATF produces recommendations and guidance that function as international standards, not binding treaties. They become legally enforceable only when individual countries incorporate them into national law. FATF's power comes from the mutual evaluation and listing process, which creates economic and reputational incentives for compliance.

How does the travel rule affect Bitcoin and stablecoin transfers?

The travel rule requires VASPs to share originator and beneficiary information for transfers above a jurisdiction-specific threshold (FATF sets a floor of USD/EUR 1,000). For stablecoin payments routed through compliant service providers, this means identity data must accompany each qualifying transfer. Peer-to-peer transfers between unhosted wallets are not directly covered, but VASPs must apply due diligence when interacting with unhosted wallet users.

What happens if a country ignores FATF guidance?

Countries that fail to implement FATF standards risk being placed on the grey list or black list. Grey-listed countries face enhanced due diligence from global banks, loss of correspondent banking relationships, and reduced foreign investment. Black-listed countries face counter-measures from all FATF members, effectively isolating them from the global financial system.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.