Interpretation of FATF Cryptocurrency Report: Which Areas Will Become Regulatory Focus in the Second Half of the Year?

Written by: David Carlisle, Elliptic

Compiled by: Baize Research Institute

On June 30, the Financial Action Task Force (FATF), the global standard setter for anti-money laundering and counter-terrorism financing (AML/CFT) measures, released a report on the application of its guidance on crypto assets. The publication of this report marks three years since the FATF first issued its "Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (VASPs)" in 2019.

The FATF report is essential reading for compliance teams in crypto asset businesses and financial institutions. It provides FATF's perspective on the regulatory issues facing the global crypto industry and regulators. By reading the report, compliance teams can prepare for the challenges posed by upcoming regulatory developments that may impact the crypto industry in the coming months.

DeFi: Increasing Risks of Cross-Chain Flows

One of the main issues emphasized by the FATF in its report is the growth of decentralized finance (DeFi). In the "Updated Guidance" released in October 2021, the FATF called on countries to impose AML/CFT requirements on those who can control DeFi services such as decentralized exchanges (DEXs). This is a priority identified by the FATF, partly in response to the rise in crime associated with DeFi.

The FATF noted in its "Latest Report" that the DeFi industry has grown significantly even within the short eight months following the release of guidance last year. According to the FATF, the rapid growth and evolution of the DeFi sector are concerning as they may lead to further acceleration and diffusion of risks.

The FATF's primary concern is that, despite its calls for regulation of DeFi, most DeFi protocols and decentralized applications operate outside the regulatory scope. While some regulators have begun enforcement actions against non-compliant DeFi protocols, the majority of regulators have yet to regulate this area. This is seen as a loophole by the FATF, as it allows criminals to freely use DeFi services.

The FATF's second concern regarding DeFi is the increasing use of mixers in the DeFi space for money laundering, with cybercriminals, including North Korean hackers, increasingly using mixing services to attempt to obscure their illegal activities, such as the mixer Tornado Cash, favored by hackers.

Thirdly, the FATF highlighted that the risks associated with cross-chain activities in the DeFi space are on the rise. According to the FATF: "DeFi protocols can be used to execute 'chain hopping,' which makes transactions harder to trace." Chain hopping refers to criminals exchanging funds between different crypto assets to obfuscate law enforcement's tracking of funds. In the DeFi ecosystem, this is achieved using cross-chain bridges that allow users to seamlessly transfer funds between blockchains.

Cross-chain bridges are becoming an increasingly important part of the "criminal ecosystem." Illicit actors—such as ransomware attackers and hackers—can use these services to launder money across different blockchains. Furthermore, funds transferred across chains via cross-chain bridges are easily susceptible to hacking. In just the first six months of 2022, hackers stole over $1 billion in crypto assets from several cross-chain bridges.

The FATF's focus on these issues sends a clear message: illegal activities involving DeFi mixers and cross-chain bridges will become an area of increasing regulatory scrutiny in the second half of 2022.

To address the growing risks of DeFi, VASPs and financial institutions should ensure they are utilizing blockchain analytics capabilities to detect risks associated with DeFi mixers and cross-chain bridges.

Non-Custodial Wallets

Another contentious issue mentioned by the FATF in its report is the ongoing debate surrounding non-custodial wallets.

The FATF emphasized what it sees as the risks of non-custodial wallets: they allow users to transact without a regulated entity that can conduct KYC checks on users. Recently, the U.S. Deputy Secretary of the Treasury referred to non-custodial wallets as a concerning specific illicit financial risk because they enable users to transact outside the regulatory framework. The EU and the UK have also recently proposed measures to address the risks posed by non-custodial wallets.

The FATF's "Latest Report" highlights that many other countries are still determining what measures to take to mitigate the risks of non-custodial wallets. However, the FATF noted that some countries view blockchain analysis as a core part of this work.

As regulatory scrutiny of non-custodial wallets is expected to tighten, VASPs should ensure they have implemented blockchain analytics solutions that can help them identify non-custodial wallets with high risks of illicit finance.

NFTs: A Picture of Growing Risks

Like DeFi, non-fungible tokens (NFTs) are another crypto innovation that has developed in recent years, and the FATF believes that the rapidly growing market is changing the risk landscape.

In particular, the FATF believes that the expansion of NFTs into non-financial markets and the increasing number of active wallets buying and selling NFTs may affect risk dynamics. Additionally, the FATF pointed out that NFTs present certain regulatory challenges because they are difficult to classify within a legal framework. Depending on their use and characteristics, they may be classified as securities, artwork, or a type of crypto asset, which can determine the applicable regulatory nature. Most countries have yet to clarify their regulatory arrangements for the NFT market, which may exacerbate AML/CFT risks.

NFTs can pose numerous financial crime risks. In particular, the NFT market is susceptible to fraud, wash trading, and manipulation, and is vulnerable to hacking and theft, with potential sanctions risks as well.

As the FATF and regulators begin to examine the risks in the NFT space, compliance teams should ensure they are equipped to mitigate financial crime risks.

For example, VASPs can utilize transaction screening solutions to identify whether they are processing payments related to NFT fraud and theft, and they can use multi-currency forensic tools to conduct in-depth analyses of payments in crypto assets like Ethereum to see if those payments are linked to the illegal use of NFTs by criminals.

Travel Rule: A Necessary Condition for Combating Sanction Evasion and Ransomware

In October 2018, the FATF began calling on countries to apply the Travel Rule (a long-standing compliance requirement for traditional financial institutions) to VASPs. At its core, the Travel Rule requires VASPs to identify the originators and beneficiaries of transactions above a certain amount and securely transmit that information and data to their VASP counterparts. The purpose of this rule is to assist law enforcement in detecting and investigating money laundering and other financial crimes in the crypto asset space.

The FATF's "Latest Report" issued a stern warning to member countries and VASPs that have not implemented the "Travel Rule"—countries should impose information and data sharing requirements on VASPs in accordance with FATF standards. The FATF believes that the current pace of implementation of the Travel Rule by countries and the private sector is too slow, and further delays pose significant risks to the international financial system.

According to the report, since the FATF released its "Guidance" three years ago, only 29 out of 98 countries surveyed by the FATF have made the Travel Rule a local requirement for VASPs, and only 11 countries are actively enforcing and supervising it.

Despite the availability of Travel Rule compliance solutions in the market, the lack of urgency among countries is stifling VASP compliance.

The report highlighted two areas of risk where failure to implement the Travel Rule poses specific risks:

The first relates to sanctions compliance. The FATF noted, "The rapid implementation of the FATF's Travel Rule is an important component of supporting effective identification of counterparties and effective sanctions screening."

The second is ransomware. Since ransomware attackers often cash out their criminal proceeds on unregulated trading platforms in countries that have failed to implement FATF standards, strengthening the implementation of the Travel Rule—at least in theory—will ensure that VASPs collect additional information about counterparties, which will assist law enforcement.

The report also noted that blockchain analysis is a crucial method for disrupting ransomware. According to the FATF: "Blockchain tools provide support and information for successful law enforcement cases, targeted financial sanctions, and other actions to disrupt ransomware financing."

Further scrutiny by the FATF will prompt countries to accelerate the implementation of the Travel Rule, and compliance teams should take steps to ensure they are prepared to comply.

Key Takeaways

The FATF's new report highlights key issues that will become a focus of the regulatory agenda in the second half of 2022 and beyond. Cross-chain DeFi, non-custodial wallets, NFTs, and Travel Rule compliance will be top priorities for VASP compliance teams.

Ensure you have blockchain analytics capabilities that enable you to detect and manage risks associated with cross-chain DeFi activities and DeFi mixers like Tornado Cash.

Utilize blockchain analytics to identify non-custodial wallets associated with sanctioned actors, ransomware groups, and other illicit actors.

Detect transactions related to the illicit use of NFTs.

Understand Travel Rule solutions and prepare for compliance.