A question for the Financial Action Task Force: What exactly counts as a VASP?

It is clear now that the Financial Action Task Force (FATF) is intent on imposing strict controls on digital assets.

But how strict? The answer to that question depends on what “VASP” means.

Late last month, the global anti-money-laundering watchdog released a draft update to its guidance on cryptocurrency. If the guidance goes into effect as currently written, it will set the bar for compliance even higher than the last time it published cryptocurrency guidance, in 2019. 

That’s saying a lot because, in the 2019 guidance, FATF introduced the controversial “travel rule,” which requires “virtual asset service providers” (VASPs) to share originator and beneficiary information with one another during transactions above $3,000. 

Traditional money service businesses (MSBs) face the same travel rule requirement. But the new cryptocurrency guidance has thrown out the $3,000 threshold and instead says all transactions should be subject to the travel rule.

The previous iteration of the travel rule was also clearer about its mandates, with the latest draft triggering a degree of confusion. Specifically, it appears to empower financial regulators to stretch the definition of a VASP — even to the point that an individual could be counted as one. 

The new language has many in the cryptocurrency industry now wondering: what exactly counts as a VASP?

DeFi in the crosshairs?

In 2018, FATF added two new definitions to its official glossary: “virtual asset” and “virtual asset service provider,” or VASP.  A virtual asset is any transferable digital representation of value.

The definition of a VASP is less straightforward: “any natural or legal person” who operates as a business providing services, including the act of exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, transfer and digital safekeeping of virtual assets, or the “participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.”

Until now, this definition was thought to pertain only to crypto-focused money services businesses (MSBs): venues that conduct activity like escrow, brokerage, order-book services and advanced trading services. But the new guidance appears to take the travel rule mandate down to the peer-to-peer level. Anyone who facilitates a transfer of any amount could theoretically be considered a VASP, according to the draft guidance. 

That means DeFi platforms won’t be getting any breaks. “The decentralization of any individual element of operations does not eliminate VASP coverage if the elements of any part of the VASP definition remain in place,” reads the guidance.

This isn’t the first clue that FATF is taking aim at illicit finance in the DeFi realm. Last year, it released a 12-month review of its crypto recommendations, in which it clarified that jurisdictions could ban noncustodial wallets if they felt the money laundering risk associated with them was too high. This could create a situation where considerable funds get locked in DeFi with no way of compliantly cashing out.

In its discussion of the definition of VASPs, the FATF is clear that software is not one. “A DApp itself (i.e. the software program) is not a VASP under the FATF standards, as the Standards do not apply to underlying software or technology,” reads the guidance. “However, entities involved with the DApp may be VASPs under the FATF definition.”

But in the world of DeFi, “entities” could mean a lot of things. Some decentralized venues like Uniswap V3 and Curve give centralized companies certain degrees of legal ownership over their contract in the form of licenses. This makes it easier to make the argument that the decentralized exchange (DEX) as a business could be the legal “owner” of the smart contract. The “owner” is likely to be considered the VASP in this case, “even if other parties play a role in the service or portions of the process are automated.” 

The definition might not be limited to ownership. The guidance also says those who engage in “business development” related to the DApp likely also qualify as VASPs. This is anyone who builds on the smart contract “as a business in facilitating or conducting the activities previously described on behalf of another natural or legal person.” Even though the code is usually open-source, most decentralized marketplaces are maintained by a core team of developers. They may be considered VASPs. 

But other open source developers that aren’t on the DEX’s payroll may also contribute to the project. Is this considered operating in a business capacity? In theory, anyone contributing to the smart contract in a way that could be considered they are acting “as a business” could be considered a VASP.

Joseph Weinberg, the co-founder of Shyft, which has developed a data-sharing network for exchanges, said the wording as it stands is confusing.

“It’s leaving people questioning ‘does this involve users? Does this involve DeFi developers? Does this involve key signers of [decentralized autonomous organizations]?" he told The Block. "The way that it’s written currently, all of those participants or parties or users fall into different scopes, which is a drastic change to the way traditional intermediaries are regulated."

If this guidance goes into effect, current centralized data sharing systems, like the bulletin sharing framework pioneered by Coinbase, wouldn’t cover DeFi. DeFi platforms would likely require their own new technology, according to Weinberg. 

It’s just a draft

That’s a big “if,” though. FATF won’t issue the final guidance until June, and there’s still time remaining in a public consultation period.

Former FATF executive secretary Rick McDonell, who advises both Shyft Network and crypto exchange Binance on FATF compliance, said it’s most likely that the FATF will find ways to tighten the VASP definition over the course of the public consultation process. 

The final guidance, according to McDonell, probably won’t cause as much alarm in the crypto industry and DeFi world as the draft has. 

“They’re getting the impression that this means that every individual could be identified as a VASP,” he said. “Well, that cannot work, and I don’t think that’s what the intention is. Otherwise, you might as well have cash banned as well because then everyone would be classified potentially under the same definition in the guidance as someone who needs to be monitored.”

All regulators are struggling with DeFi, according to McDonell. FATF, which has a mandate to assess and curb vulnerabilities to terrorist financing and money laundering, still doesn’t have a “fully-fledged” model for crypto in place, said McDonell. Still, he noted that nuance in this draft shows that FATF has become very knowledgeable about digital assets. 

Weinberg agreed. “This was the most technical, in-depth crypto native-esque paper I've ever personally read from any government or intergovernmental organization," he said. "This is basically an attempt at trying to move away from the SWIFT era of thinking into the crypto world."

Ultimately, the draft guidance should be seen as a genuine appeal for help navigating and assessing the risks inherent to crypto, said McDonnell. FATF has not yet provided “real clarity” on how it assesses the risks associated with cryptocurrency, he said, adding:

“And that's partly what I think the guidance is asking for consultation about: what should constitute the risk assessment model.”