This article was compiled and organized by BlockWeeks
FATF on Thursday released the long-awaited final guidance for virtual asset service providers (VASP), further clarifying which entities may be included in the VASP definition. This guidance revolves around customer due diligence, the Travel Rule, and anti-money laundering and counter-terrorism financing, attempting to draw regulatory boundaries for the most ambiguous areas of the crypto industry—especially DeFi, NFTs, and protocol developers.
Overall, the final guidance mostly reiterates previously known baseline requirements, and the wording remains broad, leaving room for interpretation and implementation in each jurisdiction. It should be emphasized that FATF recommendations are not legally binding; they are more like goals set for national governments, national regulators, and affected entities.
Core Change: Software Is Not a VASP, but Its Controllers May Be
The most closely watched part of the new guidance is its treatment of software, decentralized applications (DApps), and crypto platforms. FATF makes clear that software itself, including DApps and crypto platforms, does not by definition constitute a VASP; however, individuals who direct the creation and development of these DApps or platforms may meet the VASP definition, especially when they retain control or sufficient influence over assets, software, protocols, or platforms, or maintain an ongoing business relationship with software users—even if such control or influence is exercised through smart contracts.
FATF also makes clear that when determining whether something is a VASP, the function of the technology is the primary determining factor, not the technology design itself. However, when assessing which entities constitute VASPs, each jurisdiction must specifically consider the underlying financial stack. The guidance states that the obligations in the FATF standards arise from the underlying financial services provided and are unrelated to an entity's operating model, technical tools, ledger design, or other operational characteristics.
NFTs and DeFi: Functional Characterization and Degree of Decentralization Become Key
For non-fungible tokens (NFTs), FATF assumes they are art and digital collectibles and therefore generally are not classified as virtual assets. But this judgment may change with the function of the NFT. FATF gives examples noting that NFTs used for payment or investment purposes may constitute virtual assets, and centralized entities handling such NFTs may also be regarded as VASPs.
DeFi is another major focus of this guidance. To the industry's slight relief, FATF's new guidance does not suggest that DeFi can only exist in a licensed manner through centralized, regulated VASPs. Instead, the guidance specifically emphasizes that the degree of decentralization of control over a protocol or application is the decisive factor in determining whether it should be regarded as a VASP. Truly decentralized applications and protocols are unlikely to be regarded as VASPs; projects controlled by founding teams or possessing admin keys are more likely to fall within the scope of VASPs.
FATF also astutely points out that many protocols and applications are decentralized in name only (DINO, Decentralized in Name Only), and jurisdictions should be wary of project parties' decentralization claims, instead rigorously assessing whether the relevant entities should actually be regarded as VASPs. This position is similar to previous statements by U.S. regulators, including SEC Chair Gary Gensler, namely supporting crypto applications and blockchain protocols with strong decentralization claims.
Unresolved Mystery: Where Is the Line for Sufficient Decentralization
The new guidance is an honest attempt by FATF to provide clarity for the Travel Rule. The broad wording gives jurisdictions some room for interpretation and flexible setting of regulatory parameters. But the guidance still has obvious omissions regarding certain crypto assets or social organizations, and it leaves several important questions.
The most central question is: where should the line for sufficient decentralization be drawn? The underlying infrastructure itself lies on a broad spectrum. Most L1 blockchains retain a certain degree of centralization at launch in order to build and innovate quickly; sidechain operators hold admin keys and are not fully decentralized; even rollups intended to achieve trust minimization and permissionlessness currently retain centralized components. How regulators assess these different architectures will directly affect the compliance paths of a large number of projects.
In addition, although FATF guidance focuses on anti-money laundering and counter-terrorism financing, it still overlaps with other regulatory objectives such as tax reporting, investor protection, and financial market stability. The greater regulatory impact on the crypto industry will come from the ongoing contest among U.S. regulators, policymakers, and legislators. Members of Congress, regulators, and government officials have already put forward a series of proposals attempting to clarify how matters left to subjective interpretation should be regulated and which regulatory agencies should be responsible.
U.S. Regulatory Follow-Up: Stablecoins and Congressional Legislation Are the Next Stop
U.S. regulation is already advancing in a direction consistent with FATF guidance. More influential will be upcoming rulemaking by U.S. regulators or legislation being advanced by Congress. In the short term, the President's Working Group on Stablecoins (PWG) report is seen as the first step by the United States toward building a regulatory framework for this large crypto asset class. The market expects the report to recommend a two-track approach: retaining some oversight authority for the SEC while seeking new legislation to regulate stablecoin issuers as banks.
DeFi will remain a focus of ongoing discussion and may also be affected by anti-money laundering or tax reporting regulation. However, FATF guidance actively encourages projects and social groups to gain more decentralization and autonomy, and these values are something market participants can identify with. For most existing market participants, the emergence in the medium term of a more licensed DeFi or centralized DeFi (CeDeFi) operating environment may be seen as positive progress, because KYC/AML compliance has always been regarded as an obstacle to institutional adoption of digital assets. Appropriate regulation is expected to give the green light to a larger range of market participants still on the sidelines, enabling them to participate and drive the evolution of DeFi.
Crypto's advantages over existing currencies and traditional systems are becoming increasingly obvious. More regulation entering this field, if implemented thoughtfully, will only reinforce a growing consensus: crypto is here to stay. But any new regulation must understand the advantages and limitations of the underlying technology. FATF has attempted to provide an iterable regulatory framework and has continuously improved it based on previous draft guidance; next, whether U.S. regulators and legislators can regulate this growing and powerful industry with similar nuance and foresight will become the key focus of the market.
