By SanctionsAI team · Updated 2026-08-09

FATF Recommendation 15: Virtual assets and VASPs

FATF Recommendation 15 is the global standard for AML/CFT regulation of virtual assets and VASPs. Adopted in 2019, updated in 2021, it requires countries to regulate and supervise VASP activities.

TL;DR: FATF Recommendation 15 requires countries to apply AML/CFT controls to virtual asset activities, license or register VASPs, and implement the Travel Rule for virtual asset transfers.

Key requirements

RequirementDetail
Licensing/registrationVASPs must be licensed or registered in their jurisdiction
SupervisionVASPs subject to supervisory oversight and enforcement
AML/CFT programCustomer due diligence, record-keeping, suspicious transaction reporting
Travel Rule (R.16)Share originator/beneficiary data for transfers above USD/EUR 1,000
Sanctions screeningScreen customers and transactions against UN and national sanctions lists

Who is a VASP under FATF?

A VASP is any business that: (1) exchanges virtual assets for fiat or other virtual assets, (2) transfers virtual assets, (3) custodies virtual assets, (4) provides financial services related to virtual assets. This includes exchanges, custodial wallets, and payment processors.

Compliance tip: SanctionsAI provides API-based screening that satisfies FATF R.15 sanctions screening requirements for VASPs.

Screen your agent's next payment

Check any wallet, name, or entity against OFAC, EU, UN sanctions lists in real time.

Free wallet checker

Frequently Asked Questions

What is FATF Recommendation 15?
The global standard for AML/CFT regulation of virtual assets and VASPs. Requires countries to regulate, license, and supervise VASP activities.
Who is a VASP under FATF?
Any business that exchanges, transfers, or custodies virtual assets, or provides related financial services.
What is the Travel Rule threshold?
USD/EUR 1,000 for cross-border virtual asset transfers. VASPs must share originator and beneficiary information.
Does FATF R.15 apply to DeFi?
FATF says DeFi protocols without a central operator are not VASPs. Front-end operators and governance participants may have obligations.

← Back to regulations · SanctionsAI