FATF mapped DeFi, NFTs and crypto’s travel rule into its global compliance framework

The Financial Action Task Force released its updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers on October 28, 2021, giving national authorities and crypto businesses a final 2021 map for applying the global anti-money-laundering and counter-terrorist-financing standards to a fast-changing sector.

The central fact is direct and verifiable: the 111-page FATF document says it updated the 2019 guidance and superseded it. The release did not create a cryptocurrency statute in every jurisdiction. It was guidance from the international standard-setter to countries and covered firms, intended to inform national licensing, supervision and compliance. That distinction limits the claim while preserving why the document mattered.

Six areas of clarification

FATF organized the update around six subjects: the definitions of virtual assets and virtual-asset service providers, or VASPs; stablecoins; peer-to-peer transactions; VASP licensing and registration; implementation of the travel rule; and information-sharing among supervisors.

The document retained a broad, functional approach. A virtual asset had to be digital, transferable or tradable, and usable for payment or investment. Assets already covered elsewhere in FATF's framework as fiat currency, securities or other financial assets were not meant to receive a second classification as virtual assets. The practical objective was to prevent labels or technical architecture from deciding whether a financial activity fell within the standards.

For stablecoins, FATF said countries and covered businesses should assess money-laundering and terrorist-financing risk before launch and on an ongoing basis. The guidance treated the arrangement's actual functions and the roles of participating entities as more important than the marketing term “stablecoin.”

DeFi and NFTs faced a functional test

The most consequential interpretive section for protocol builders concerned decentralized applications. FATF said software itself was not a VASP. But creators, owners, operators or other people retaining control or sufficient influence over a DeFi arrangement could fall within the VASP definition when they provided covered services as a business for others. FATF pointed to factors such as control over assets or protocol features, an ongoing business relationship with users, and the ability to set or change parameters.

That was not a finding that every DeFi protocol had an identifiable regulated operator. The guidance expressly acknowledged that no central owner or operator might be found when nobody exercised control or sufficient influence. In those cases, it told countries to monitor risks and consider mitigants. Coinburn's interpretation is that the document rejected both categorical extremes: calling a service “decentralized” did not automatically remove relevant people from scope, while autonomous software was not automatically a regulated person.

NFT treatment was similarly fact-specific. Unique digital collectibles were generally outside FATF's virtual-asset definition when used as collectibles, but the guidance warned authorities to examine practical function rather than terminology. An NFT used in practice for payment or investment could still qualify as a virtual asset or fall under another part of the standards.

The travel rule remained an implementation problem

FATF's travel-rule section addressed the originator and beneficiary information that covered institutions must obtain, hold and transmit for qualifying transfers. It also confronted an operational gap: a VASP could not always identify the institution controlling a beneficiary address from that address alone. The guidance therefore described counterparty identification and due diligence, and acknowledged uneven national adoption as the “sunrise issue.”

Transfers involving unhosted wallets were not prohibited by the document. A VASP handling such a transfer was told to obtain required originator and beneficiary information from its own customer, monitor the transaction under its broader obligations, and apply risk-based controls.

Why October 28 mattered

The October 28 publication narrowed major interpretive uncertainties at the intersection of compliance and protocol design. Its significance was institutional rather than a measured market move: it supplied a common reference for supervisors, exchanges, custodians, stablecoin arrangements and potentially controlling participants in DeFi services.

No cryptocurrency price, volume or percentage claim is made here because the cited records do not establish a causal market reaction. The open questions on October 28, 2021 were implementation questions: how individual jurisdictions would translate the standards, how firms would exchange travel-rule data across borders, and where authorities would locate control or sufficient influence in particular DeFi arrangements.