Regulatory focus should be on business structures rather than technologies and terminologies, as advised in FATF's updated guidance.
The Financial Action Task Force (FATF) has updated its guidance on regulating cryptocurrency businesses, extending the scope of Virtual Asset Service Providers (VASPs) to include Decentralised Finance (DeFi) protocols and Non-Fungible Tokens (NFT) platforms.
The latest FATF guidance, released on October 28, 2021, clarifies that by default, non-fungible tokens are not considered VAs based on their general use. However, jurisdictions should evaluate NFTs on a case-by-case basis and regulate them as VAs when their use conforms to the VA definition.
DeFi protocols, which facilitate the transfer of funds directly between users' personal wallets, are regulated as VASPs if they're fulfilling VASP-like functions, such as facilitating the exchange or transmission of VAs. The software or technology behind a given DeFi protocol is not regulated as a VASP, but the "owner/operator" of the protocol is.
FATF defines a virtual asset (VA) as digital representations of value that can be traded or transferred and used for payment or investment purposes. VASPs are any person or business who conducts one or more of the following activities: exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, transfer of virtual assets, safekeeping and/or administration of virtual assets, or participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.
The governing body of a stablecoin is defined as anyone who "establishes or participates in the establishment of the rules governing the stablecoin arrangement." The governing board or central developers of a stablecoin issuer are recommended to be regulated as a VASP by FATF.
In the United States, FinCEN has treated stablecoin issuers as VASPs since 2019. FATF sees significant potential Anti-Money Laundering/Counter-Terrorism Financing (AML/CFT) risk in personal wallet transactions and has called on multiple countries to extend regulations governing DeFi protocols under the classification of VASPs.
By mid-2025, 43 countries had established DeFi regulatory sandboxes or frameworks, and 29% of jurisdictions were reported compliant with global virtual asset standards, reflecting ongoing FATF influence worldwide.
The focus of the VASP designation for a stablecoin is on identifying those in control of the stablecoin, regardless of its underlying technology or purpose. FATF's guidance means that DeFi protocols' owners and operators will soon be required to enact the same compliance protocols as centralized services, such as collecting KYC information from new users, monitoring transactions, and reporting suspicious activity.
To assist VASPs in meeting their Travel Rule obligations, FATF expects member jurisdictions to implement Travel Rule enforcement as soon as possible, but it's encouraging regulators to be flexible and roll these enforcements out gradually. VASPs can leverage the Notabene and Sygna integrations available on our website to meet their Travel Rule obligations.
FATF partners with various NFT platforms, including Dapper Labs, and its compliance and monitoring solutions will enable VASPs that support NFTs to meet their compliance obligations under the new guidance. Our website's tools can help with AML risk mitigation by automatically detecting and alerting compliance teams to potential high-risk activity.
However, some have argued that expanding the Travel Rule to personal wallet transactions will complicate its implementation for VASPs. Nonetheless, the FATF's updated guidance aims to ensure that the cryptocurrency industry operates within a secure and compliant environment, mitigating risks associated with money laundering and terrorist financing.
