On 30 June, the Financial Action Task Force (FATF) released a status report on the targeted implementation of its standards for Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs), highlighting that most jurisdictions are not embracing the FATF’s Travel Rule (Travel Rule). We have, in previous releases, discussed the FATF’s 2019 update to its recommendations, 2019 VASP guidance, 2021 VA review, and 2021 update to the VASP guidance.
On 24 June 2022, the Treasury of the United Kingdom (UK) published a review of the UK’s anti-money laundering and countering financing of terrorism (AML/CFT) regulatory and supervisory regime. The UK Government decided to conduct a wider strategic forward-looking review of its regime than it was obliged to in its five-year post-implementation reviews of regulations, given the UK’s exit from the European Union.
Who needs to read it? Why?
VASPs and any others involved in the business of VAs should pay close attention to the FATF’s views on their regulation. VAs and VASPs are a key area of development, both globally and in New Zealand, in the AML/CFT sphere, and what the FATF says holds substantial weight there. With the increasing digitisation of the economy and the spread of VAs, the trends and issues that the FATF identifies are increasingly relevant to a wider range of reporting entities.
The UK report will be of interest to the New Zealand regulators as well as reporting entities and their advisers, to see what moves are being taken overseas while awaiting the release of New Zealand’s own Statutory Review Report – currently sitting with the Minister of Justice
What does it cover?
FATF VASP report
Three years after the FATF extended its AML/CFT standards to those financial activities involving VAs and VASPs, it has again reviewed whether jurisdictions have successfully implemented the FATF standards on VAs and VASPs, specifically the Travel Rule. This requires the private sector to obtain and exchange beneficiary and originator information with VA transfers.
The report also included an update on the general implementation of the FATF’s Recommendation 15 (relating to the regulation of VASPs) and its Interpretive Note in addition to emerging risks and market developments.
The key findings of the report are as follows.
- Most jurisdictions are yet to fully implement the FATF’s Recommendation 15 and its Interpretive Note. Of the 53 jurisdictions assessed, none were rated Compliant, 12 were rated Largely Compliant, 33 were rated Partially Compliant, and 8 were rated Non-Compliant. The jurisdictions are not named, but New Zealand was rated “Largely Compliant” under the Mutual Evaluation (which we have discussed in more detail) in April 2021.
- Jurisdictions have been slow to implement the Travel Rule. 29 of 98 responding jurisdictions claimed to have passed Travel Rule legislation, but only 11 had started enforcement and supervisory measures. 26 of the 98 are in the process of passing legislation, but 36 have not even begun to introduce the Travel Rule. New Zealand will be in that latter group, as the Travel Rule has not been introduced here.
- The private sector has successfully used technological solutions (albeit with some limitations) to facilitate compliance with the Travel Rule. There are, however, still improvements to be made in strengthening interoperability between solutions to ensure full compliance and enable global implementation.
- As the public and private sectors have implemented the Travel Rule, they have encountered issues (in particular) between jurisdictions that regulate VAs and VASPs and those that do not. This “sunrise issue” is exacerbated by jurisdictions taking different approaches to compliance, for example in regard to unhosted wallets, data protection rules, and thresholds.
- The FATF’s investigations into the decentralised finance and non-fungible tokens markets suggest that “decentralised” is, in some cases, being used as a marketing term rather than a technical description of the product. Even in some so-called decentralized arrangements, the FATF has found that often there continues to be people and centralized aspects that could be subject to AML/CFT regulation.
- The threat of ransomware actors using VAs to facilitate illegal payments continues to be significant. Cybercriminals continue to benefit from a small group of non-compliant VASPs and privacy coins to move their funds.
UK report
Many of the UK AML/CFT review’s conclusions are to proceed with further investigation and engagement. Among the more specific conclusions were that:
- the balance of mandatory requirements and the risk-based approach was appropriate;
- it was not viable to give entities that were small or new to AML/CFT regulation a different set of obligations while they built up knowledge and resources;
- where there is reliance on another entity for customer due diligence purposes, it is appropriate that responsibility remains with the relying party; and
- it would be valuable for the government to provide evidence of the practical uses of Suspicious Activity Reports, to enhance understanding of what is done with them and the intelligence they bring.
Our view
The most recent guidance in New Zealand on VASPS was issued by the Department of Internal Affairs in March 2020, and broadly states that “VASPs are considered ‘financial institutions’”.
However, there is some debate around whether this reflects the strict legal position, as VASPs are not explicitly referred to in the legislation, and the FATF’s latest Mutual Evaluation of New Zealand’s AML/CFT regime considered that not all VASPs were captured. A formalised position in the legislation itself (or its regulations) would provide much-needed clarity for those operating in this space.
The Statutory Review of the New Zealand AML/CFT regime, in its consultation paper (issued in October 2021), acknowledged the need for reform in the VA space. However, as the Report currently sitting with the Minister has not yet been released, we do not know what finally was recommended.
We encourage the Minister to present this report to Parliament and release it to the public as soon as possible, so reporting entities and their advisers can see the shape of proposed reforms and begin to plan how to keep their operations compliant.
Our view is that the opportunity to address the regulation of VAs and VASPs presented by the Review should be embraced as a matter of urgency, as the trend toward digitisation will only increase their presence in New Zealand and the wider world. Unprepared jurisdictions risk becoming an exploitable gap in global AML/CFT protection, and/or being treated as being on a form of grey list which creates barriers to international connectivity.
What next?
The VASP report will no doubt continue to be an area of keen interest to the FATF and, accordingly, jurisdictions all around the world. A further review of Travel Rule implementation progress is intended by June 2023.
Once the Statutory Review Report is released, the New Zealand government will need to make decisions as to the timing of any recommended changes to the regime. We will publish another news alert when the Report is released.
If you have any questions in relation to the FATF’s report, the AML/CFT treatment of VAs and VASPs, or the AML/CFT regime more generally, please contact one of our experts.
This article was co-authored by Sam Short (Solicitor) and Elise Plunket (Law Clerk) in our Financial Services team.
Key contacts
Speak with one of our experts.
