What does FATF Recommendation 15 ask countries to do about crypto?

What FATF is

The Financial Action Task Force (FATF) is an independent inter-governmental body.² It develops policies to protect the global financial system against money laundering, terrorist financing and the financing of weapons of mass destruction.² Its Recommendations are recognised as the global standard against money laundering and terrorist financing.²

FATF does not pass laws itself. It writes standards, and countries put them into their own laws.^1,3 FATF then checks how well each country has done this.⁴

Recommendation 15 in one sentence

The core sentence for crypto is short. Countries "should ensure that virtual asset service providers are regulated for AML/CFT purposes, and licensed or registered and subject to effective systems for monitoring and ensuring compliance".¹ AML/CFT stands for anti-money laundering and countering the financing of terrorism.²

FATF revised Recommendation 15 in October 2018 and added its interpretive note in June 2019, to bring virtual assets and VASPs into FATF's standards.^1,3 Its interpretive note says countries should treat virtual assets as "property", "funds" and similar terms used elsewhere in the Recommendations.⁵

What counts as a virtual asset

FATF defines a virtual asset as "a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes".¹ It does not include digital versions of fiat money, securities and other financial assets already covered elsewhere in FATF's standards.¹

Who is a VASP

A VASP is a person or company that, "as a business", carries out one or more of five activities "for or on behalf of" someone else.¹ The five activities are:

1. Exchange between virtual assets and fiat currencies.¹
2. Exchange between one or more forms of virtual assets.¹
3. Transfer of virtual assets.¹
4. Safekeeping or administration of virtual assets, or of the instruments that give control over them.¹
5. Taking part in, and providing, financial services related to an issuer's offer or sale of a virtual asset.¹

Notice the words "as a business" and "on behalf of" another person.¹ Someone swapping their own coins for themselves is not doing it for anyone else.¹

What about DeFi?

In its October 2021 guidance, FATF said a decentralised finance (DeFi) app, meaning the software itself, is not a VASP.² But people who keep "control or sufficient influence" over a DeFi arrangement may be VASPs if they provide or actively facilitate VASP services.² Calling a project "DeFi" does not settle the question.²

Licensed or registered: where?

At a minimum, a VASP should be licensed or registered where it was created, such as where its company was set up.⁵ Countries may also require a VASP to be licensed or registered there if it serves customers in that country or operates from it.⁵ So a firm set up in one place can need permission in several.⁵

The risk-based approach

FATF asks countries to identify and understand their money laundering risks from virtual assets.⁵ Then they should apply a "risk-based approach", so that their measures are "proportionate to the risks identified".⁵ VASPs must assess and act on their own risks too.⁵

Some fixed numbers still apply. For example, the interpretive note sets USD/EUR 1,000 as the threshold above which VASPs must do customer due diligence on occasional transactions.⁵ Customer due diligence means checking who your customer is.^5,6

The Travel Rule (pointer)

Under Recommendation 15, a sending VASP must get and hold details of the sender and the receiver of a virtual asset transfer, and pass them to the receiving VASP.⁵ This is often called the Travel Rule. Module 23 covers it in detail.³

In July 2026, FATF said 83% of the jurisdictions it surveyed had passed laws for the Travel Rule, up from 73% in 2025.³

Checking countries: mutual evaluations and the grey list

FATF checks countries through mutual evaluations. These are in-depth peer reviews, where members from different countries assess another country.⁴ They look at two things: technical compliance, meaning the laws on paper, and effectiveness, meaning whether those laws work in practice.⁴

A country with poor results can enter a review process.⁷ FATF publishes two public statements after each plenary meeting, held in February, June and October.⁷

FATF says these lists are "often externally referred to" as the black list and the grey list.⁸ A country on the grey list has committed to fix its weaknesses quickly, within agreed timeframes.⁸ We do not name listed countries here, because the lists are updated three times a year.⁸

Rules on paper, gaps in practice

In July 2026, FATF said many countries still find it hard to identify the people and firms carrying out VASP activities.³ It said many had yet to turn their laws into effective supervision and enforcement.³ Banning VASPs is allowed under FATF's standards, but FATF said how well a ban works depends on robust supervision and enforcement.³