Quick guide on assessing the Money Laundering risks of virtual assets (VA) and virtual asset service providers (VASP)

According to the FATF’s 2025 Targeted Update on the Implementation of the FATF Standards on VA and VASPs, although there has been some progress with compliance, many jurisdictions still struggle with the implementation of some of the fundamental requirements of R.15, particularly undertaking a risk assessment on VA/VASP [30].

When undertaking a risk assessment related to VA/VASPs, countries should consider how VASPs differ to traditional financial institutions (FIs), and how and to what extent VA/VASPs interact with the traditional financial and non-financial sectors. The table below explains some key differences between VA/VASPs and traditional fiat currencies and FIs.

Countries that decide to prohibit or limit VA/VASPs should still understand the ML risks associated with them and any unlicensed activity. Countries should have a detailed decision-making process evidencing the basis upon which it has adopted its approach towards addressing AML risks linked to VASPs. This can include outright prohibition, restricted permissible VA/VASP activities or the application of an VA/VASP authorisation process. It should include the analysis undertaken to assess the impact the chosen approach could have on the possible ML risks linked to VA/VASPs operating in or from the country. It should also consider that the risks associated with the sector and ability to enforce such a prohibition or limitation may evolve rapidly, and a plan to continue to assess the risks, including emerging risks, on an ongoing basis.

Regardless of whether a country decides to prohibit VA/VASP activity, additional risk mitigating measures may be necessary, including identifying VASPs that operate illegally in the jurisdiction, assessing the risk of VA/VASP services offered in the country by a VASP based abroad, and applying proportionate and dissuasive sanctions to such entities. Based on a country’s risk profile, restricting VA/VASP activity through either a prohibition or activity restrictions should also be supported through ongoing mitigating measures such as outreach to the private sector about such risks and enforcement actions where such restrictions are not complied with and risk-mitigation strategies that account for the cross-border element of VA activities and VASP operations [38].

This annex contains a non-exhaustive reference guide table with suggested areas for assessing the ML risks linked to VA/VASPs, followed by some case examples from countries that have done a VA/VASP risk assessment.