FATF's long-debated crypto guidance is almost finalized — here's what to expect

A years-long effort by the world’s anti-money-laundering (AML) watchdog to come up with guidance for governments on regulating cryptocurrencies is finally nearing the finish line.

After punting on finalizing its revised guidance for “virtual assets” in July, the Financial Action Task Force (FATF) plans to exit this year with new crypto guidance firmly in place. FATF told The Block that it will finalize its long-awaited guidance by November. 

In 2019, FATF issued guidance that said crypto exchanges and money transmitters — or, as it calls them, Virtual Asset Service Providers (VASPs) — should be beholden to similar rules as traditional finance. Two years later, some jurisdictions are in the process of implementing the policies described in the draft guidance, and FATF has already conducted two reviews on the practical implementation of its guidelines. 

Still, FATF has yet to publish a final version. That was supposed to happen in July, but during the organization’s plenary session its members decided to delay finalizing the guidance until October in order to provide more time to consider the crypto industry’s feedback. 

Two major issues remain unresolved: how to adhere to the so-called travel rule, which would require VASPs to collect and transmit information on both parties executing a transaction, and a controversial draft definition of VASP, which is broad enough that it’s left many confused as to who exactly will be subject to the new standards — especially when it comes to the less-easily-categorized entities of the decentralized finance (DeFi) realm.  

There is another plenary session on the docket from October 19-21, and FATF has told The Block it is currently finalizing the agenda for that meeting. It did not disclose whether finalizing the guidance will make the list or if that will come later. 

Finalizing the guidance will be the formal end to a meandering, two-year-long debate. But it will also set in stone new disclosure rules for crypto traders and entities that have the potential to transform the industry on a global scale.

The travel rule

The FATF first solidified its intention to retain “rule 7(b),” which has become known as the "travel rule," in June of 2019. It issued the controversial standard in the first iteration of its draft guidance, stating that it would require VASPs to gather names, account numbers and location information for both the “originator” and the “beneficiary” of a crypto transaction. 

This rule closely resembles a mandate (also called the travel rule) from the U.S.’s  Bank Secrecy Act (BSA), which requires financial institutions to pass information between them in order to curb illicit financial activity. Many in the crypto community aren’t fans of the BSA, since it empowers institutions and government agencies with broad surveillance and record-keeping tools.

But more than that, many argued that FATF’s proposed BSA-like regulations were, at the time, impossible to apply to crypto because of its decentralized nature. When the draft rule first came out, there wasn’t a way to securely share the necessary information between exchanges, and there was no consensus between the exchanges about the best way to create one. 

Since then, a number of solutions have cropped up. Some are decentralized networks that all are welcome to use, and others are centralized coalitions, like Coinbase’s proposed model.

The necessary consensus, though, still has not emerged. That may help explain why although some jurisdictions have already implemented the travel rule, they have not yet brought any related enforcement cases. In effect, crypto firms have benefited from somewhat of a grace period amid the uncertainty.

The DeFi problem

But when that grace period ends, it’s still unclear who will be in the crosshairs. That’s because certain crucial definitions in the guidance are vague. Many in the industry are scratching their heads, for instance, over who qualifies as a VASP. 

In the U.S., the best parallel is a money service business (MSB), which U.S. regulators define as a venue that conducts business like escrow, brokerage, order-book services and advanced trading services. FATF currently defines VASP as “any natural or legal person” who operates a business that exchanges cryptocurrencies for fiat currencies or between different cryptocurrencies, that transfers or stores digital assets, or engages in the “participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.”

As it stands, many have taken the “natural or legal person” language to mean that anyone who facilitates a transfer of any amount could theoretically be considered a VASP. What’s more, the FATF has encouraged jurisdictions to further stretch the definition as needed to curb money laundering. It said that could even include using the definition to ban non-custodial wallets, or counting those involved with developing dApps as VASPs.

These movements set off a wave of panic in the DeFi community, since applying travel rule regulations to certain facets of the DeFi space, like decentralized exchange protocols, could be near impossible. How do you exchange originator and beneficiary information when you send funds to a smart contract? Where do you report the necessary information when two non-custodial wallets transact? If something goes wrong, who is culpable in these situations?

“It’s leaving people questioning ‘does this involve users? Does this involve DeFi developers? Does this involve key signers of [decentralized autonomous organizations]?" As Joseph Weinberg, the co-founder of data-sharing network Shyft told The Block in April of this year. "The way that it’s written currently, all of those participants or parties or users fall into different scopes, which is a drastic change to the way traditional intermediaries are regulated."

All that said, the FATF is listening, and appears to be genuinely trying to answer those questions. In its second 12 month review this July, it identified five areas to clarify in the November revision: the definition of "VASP," licensing and registration of VASPs, peer-to-peer transactions, stablecoins and the implementation of the travel rule. 

It’s important to note that FATF says it isn’t planning to revise the rules it has already published in draft form. It claims that it only plans to better articulate them.