FATF releases finalized crypto guidance with clarifications on DeFi, NFTs

The Financial Action Task Force has released revised and finalized crypto guidance, containing clarifications on who falls under its recommended requirements.

The global anti-money laundering watchdog first issued its virtual asset guidance in 2019. That draft called for crypto exchanges and money transmitters which it refers to as virtual asset service providers (VASPs) to meet standards applied to traditional financial companies. Much of this proposed approach focused on a so-called travel rule, which asked VASPs to collect and transmit originator and beneficiary information on parties participating in a transaction.

Since then, some jurisdictions have begun the process of implementing these standards, and the FATF has continued to review and amend its draft guidance. The body has also conducted reviews of the implementation process in jurisdictions and absorbed industry feedback on its proposed standards.

Critics expressed concern over the technical challenges this approach posed since there was no way to transmit this information securely when the FATF first announced its intended standards. Since then, solutions have emerged, but the FATF continued to raise the bar in its reviews, making clear the dangers of so-called non-custodial wallets and proposing to apply travel rule standards to less-easily categorized entities within the realm of decentralized finance (DeFi).

This set off a flurry of feedback from the industry as many felt it was unclear how the FATF would apply its VASP standards to DeFi. For this reason, the body punted on finalizing the guidance at its July plenary meeting until October, taking the time to augment the draft guidance with additional clarifications.

Now, that guidance is finalized and those clarifications are in.

Broad but case-by-case

While the clarifications do hone in on what the FATF is looking for, it’s important to note that the body reiterated in each case that it still intends for the definitions to be interpreted broadly and utilized as needed by jurisdictions to combat illicit finance activity.

The FATF acknowledges that understanding the function of a technology should be put above whether it fully adheres to the letter of the definition. Services should be analyzed based on what they provide rather than how they might fit into the nomenclature the FATF has provided.

“Countries should not apply their definition based on the nomenclature or terminology which the entity adopts to describe itself or the technology it employs for its activities…The obligations in the FATF Standards stem from the underlying financial services offered without regard to an entity’s operational model, technological tools, ledger design, or any other operating feature,” said the guidance.

Is an NFT a VA?

It began by clarifying what constitutes a virtual asset, or VA. For the FATF, VAs aren’t merely the digital representation of value, they also have to have a tradable or exchangeable component. That value has to be able to be transferred rather than just a mode of record keeping.

It clarified that non-fungible tokens (NFTs) don’t appear to constitute VAs, but if they are used in such a way that falls under FATF standards, they should be regulated as such, even if their general use doesn’t fit the VA definition. The FATF recommends a “functional approach” to regulating these new types of assets that seem to straddle the line of the definition and regulate them on a case-by-case basis.

“Some NFTs that on their face do not appear to constitute VAs may fall under the VA definition if they are to be used for payment or investment purposes in practice,” said the guidance. “Other NFTs are digital representations of other financial assets already covered by the FATF Standards. Such assets are therefore excluded from the FATF definition of VA, but would be covered by the FATF Standards as that type of financial asset.”

The DeFi problem

The FATF’s VASP definition covers “any natural or legal person” who is a business acting on behalf of another legal or natural person conducts the exchange of VAs to fiat or other VAs, the transfer of VAs, the “safekeeping and administration of VAs or instruments enabling control over VAs” and “participation in and provision of financial services related to an issuer’s offer and/or sale” of VAs.

For centralized entities, this is pretty clear-cut. If an entity is facilitating a transfer, exchange or custodial service, it’s likely subject to VASP standards.

What’s less clear is how it applies to blockchain-based services like decentralized applications (DApps).

The clarifications say DApps are not VASPs since the standards don’t apply to the underlying software. However, creators, owners, operators or anyone maintaining “control or sufficient influence in the DeFi arrangements” likely are, even if portions of the protocol are decentralized or automated.

In brief, the FATF is asking countries to identify owner/operators of protocols and hold them to the VASP standards:

“For example, there may be control or sufficient influence over assets or over aspects of the service’s protocol, and the existence of an ongoing business relationship between themselves and users, even if this is exercised through a smart contract or in some cases voting protocols. Countries may wish to consider other factors as well, such as whether any party profits from the service or has the ability to set or change parameters to identify the owner/operator of a DeFi arrangement.”

Still the FATF is leaving a lot of room for countries to decide for themselves how they want to deal with DeFi. In a nod to the pace of development in the space, the FATF guidance acknowledges that jurisdictions will have to continually reassess new projects and how they relate to the guidance. However, it warns that many projects wield the word “decentralized” when there remains some natural or legal person that could be held accountable.

“It seems quite common for DeFi arrangements to call themselves decentralized when they actually include a person with control or sufficient influence, and jurisdictions should apply the VASP definition without respect to self-description,” said the guidance.

For more breaking stories like this, make sure to follow The Block onTwitter.

2021 The Block Crypto, Inc. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.