Highlights from the report include:
➡️ Most countries want to regulate the sector (101 vs 88 in 2024), only a minority are taking the partial or full prohibition route (33 vs 20 in 2024), and there are less and less undecided (29, down from 39).
➡️ 113 countries report having (or being in the process of adopting) a VASP registration/licensing framework (up from 91). Of these, 76 report having already registered / licensed VASPs.
➡️ In almost 40% of cases, jurisdictions use criteria other than domiciliation to trigger licensing requirements (from experience, that tends to be serving customers in that country).
➡️ More jurisdictions have taken supervisory or enforcement action against VASPs (70, up from 54/55).
➡️ The adoption of Travel Rule requirements is also progressing: 99 jurisdictions have passed or are passing relevant legislation, compared to 80 last year.
➡️ Travel Rule supervisory / enforcement action is slower, which is expected given how recent the regulatory frameworks are, but that won't last long, and this report was accompanied by one on Travel rule supervision best practices which are currently being dissected.
The report also includes a section on ML/TF/PF risks:
➡️ Continued use of VA for ML, with the USD 1.46bn ByBit hack by North-Korean affiliates cited as an example, as well as VA use in fraud and scams. There is less evidence on scale of use for terrorism, where groups still rely mainly on traditional methods.
➡️ Most illicit activity now uses stablecoins (less volatility, more liquidity, less tx costs), which is also indicative of their potential for mass adoption
➡️ Risk mitigation notably includes the analysis of blockchain data, the ability of some stablecoin issuers to block/freeze funds, but this needs to be coupled with strong compliance measures.
⚠️ Regarding decentralised finance more jurisdictions answered that DeFi activities that meet criteria (e.g. person that maintains control or significant influence) need to register / get a licence, and this was only slightly less than those that answered that their AML/CTF framework doesn’t apply. In practice, most have reported not having identified one, but a handful (4) reported having registered / licensed at least one, and 7 reported having taken supervisory action.
The trend towards regulation of the VA sector continues, and nothing suggests it will stop. Besides, the adoption of regulatory frameworks is followed closely by supervisory and enforcement action.