Authors: Iris, Mao Jiehao
In the article "Mankiw Research | A Quick Look at the New Cayman Regulations: Virtual Asset Compliance Enters the "Deepening Supervision Period"" published by Mankiw, we shared in detail the strict regulations of the Cayman Islands' 2024 VASP Amendment on Web3 project architecture, auditing, and licensing. Previously, we have also interpreted the VASP bills issued by Dubai and Hong Kong.
I wonder if you have noticed a common point: no matter which country or region, the definition scope, architectural design, information disclosure obligations and AML/KYC regulatory requirements of VASP show a highly convergent trend.
So why do VASP laws around the world show such a striking convergence? Is it just a coincidence, or is there another "invisible referee" behind it?
Here, Attorney Mankiw can give you a clear answer: Behind the global regulatory convergence, there is a real driving force, which is FATF (Financial Action Task Force).
How does FATF shape the fate of Web3 projects?
So, who exactly is FATF? And how can it influence the direction of VASP laws in various countries?
Let me give you a brief introduction: FATF (Financial Action Task Force), founded in 1989, was initiated by the G7 and supported by the OECD. It is the world's most influential anti-money laundering (AML) and counter-terrorist financing (CFT) policy-making organization. The "40 Recommendations" it formulated have become the "bottom line standard" for global financial supervision.
Although FATF itself does not have direct law enforcement power, it continues to exert pressure on financial cooperation through the legislative transmission of member countries and the regular mutual evaluation mechanism (gray list, blacklist), directly promoting legislation in various countries and the private sector (trading platforms, custodians, DeFi projects) to assume specific compliance obligations, ultimately affecting every Web3 project party and investor.
As of now, FATF has 39 member countries, including the United States, China, the United Kingdom, Singapore, Dubai, Cayman Islands and many other popular Web3 jurisdictions. In recent years, these countries and regions have introduced highly similar VASP laws in accordance with FATF's requirements.
As the highest standard setter for global anti-money laundering and anti-terrorist financing policies, the "40 Recommendations" issued by FATF have become an important blueprint for the financial regulatory legal systems of various countries, especially in the fields of banking, securities, funds, insurance, and the virtual assets that have emerged in recent years. The rules it has formulated are almost equivalent to the "global financial compliance bottom line."
FATF's impact on the Web3 industry can be traced back to 2019. That year, FATF included virtual assets and virtual asset service providers (VASPs) in the regulatory framework for the first time, and issued the "Guidelines for Virtual Assets and VASPs", which explicitly required member countries to include VASPs in their national anti-money laundering and anti-terrorist financing systems.
For Web3 entrepreneurs, starting from this year, the project's governance structure design, capital chain transparency, and cross-border business layout have gradually begun to be included in the global compliance and regulatory vision.
In the following years, FATF will issue supplementary documents or evaluation reports, such as the "Updated Guidelines for Virtual Assets" in October 2021, multiple rounds of "Mutual Evaluation Reports" and "Compliance Progress Reviews" from 2022 to 2024, as well as "Gray Lists" and "Black Lists", and continue to expand regulatory coverage of new business models such as NFTs, DeFi, and stablecoins.
Although FATF does not directly intervene in the project, it ultimately affects the business decision-making space of every Web3 entrepreneur and investor through the legislation of member countries and the supervision of the private sector. So, how does FATF implement these standards step by step into the VASP laws of various countries?
Attorney Mankiw believes that there are several clear paths to start with:
1. Directly formulate regulatory bottom line standards
FATF has clearly defined VASP in a broad sense, covering centralized exchanges, custodial wallets, OTC service providers, as well as DeFi protocols and NFT platforms with governance or control rights. VASP laws in various countries are designed based on this, and the definition boundaries are constantly expanding, leaving less and less room for circumvention.
2. Promote the implementation of the core rule "Travel Rule"
FATF requires all countries to write the "Travel Rule" into local laws. VASPs must transmit the identity information of the initiator and recipient during the virtual asset transfer process, directly open up the KYC chain, seamlessly integrate with traditional financial systems such as banks, and ensure that the flow of funds is transparent throughout the process.
3. Regularly evaluate each other and apply pressure
FATF conducts "mutual compliance assessment" and "follow-up assessment" on member countries every year, and puts countries that fail to implement the regulations on the "grey list" or "black list", restricting their international financial cooperation and foreign investment inflows. In order to avoid being included in the list, countries have accelerated the introduction of VASP laws to strictly control industry risks.
4. Continuously update guidance and expand the scope of management
By issuing supplementary documents, FATF continues to include emerging business models such as NFT, stablecoins, and DeFi into the scope of supervision. Countries are also forced to revise their bills at the same time to ensure that "no blind spots are left."
Here is an interesting fact. In 2023, the UAE was included in the gray list by FATF. At that time, a large number of local trading platforms and custodians faced upgraded compliance reviews, and foreign investment was blocked. The restriction lasted for more than half a year until March 2024, when the rectification was completed, when the UAE was officially removed. Similar cases also occurred in South Korea and Singapore, fully demonstrating the far-reaching impact of FATF's "invisible referee" on the global regulatory trend.
This also explains why the VASP laws we see in Cayman, Dubai, Hong Kong and other jurisdictions have their own characteristics on the surface, but the core provisions are highly consistent. The "invisible referee" behind them is the global top-level standard set by FATF.
Of course, this also means that as the global Web3 regulatory process accelerates, all member countries will soon arrange clearer regulatory bills for the Web3 industry based on those formulated by FATF.
What impacts and challenges does it have on Web3 entrepreneurship?
Attorney Mankiw believes that under the global standards of FATF, VASP projects and even investors face three major impacts and challenges:
As member countries strictly align their requirements on KYC, Travel Rules, and black and gray lists, the transparency requirements for sources and destinations of funds have been significantly increased, and the funding chains of some high-risk countries have been almost cut off.
Many project parties believe that DAO or NFT projects are naturally evasive, but from the perspective of FATF, as long as there is concentration of governance and financial rights, they still fall within the scope of VASP regulation. Therefore, the shareholders, directors, and beneficial owners of these projects need to be identified in advance, the space for project architecture design is narrowed, and the pressure for architecture adjustment increases sharply.
- With the tightening of policies in regions with loose regulation such as the Cayman Islands, a single jurisdiction will no longer be a "safe haven" for Web3. Cross-border license applications, technical system docking, and audit reports have gradually become rigid investments that Web3 project parties must face, and compliance costs are rising globally.
Under this comprehensive trend, how should Web3 project owners and investors respond to these global challenges?
How to find a compliance path in FATF supervision?
As FATF standards become the inevitable underlying logic of regulation, how to reduce compliance costs and maintain long-term competitiveness is an issue that every Web3 project owner and investor must seriously consider.
So, in addition to fully complying with the FATF regulatory plan, Mankiw recommends that VASP project parties and investors can do the following in advance to avoid passively responding to compliance pressure:
1. Choice of Jurisdiction
Taking the current popular places with relatively clear regulations and crypto-friendliness as an example, the Cayman Islands is suitable for custody, issuance, and fund-type VASP projects, but the shareholder structure must be optimized in advance to avoid shareholder penetration review obstacles; Dubai is suitable for technology research and development and innovative businesses, and can quickly enter the market through the regulatory sandbox, but the Travel Rule compliance package needs to be arranged in advance; Singapore and Hong Kong are more suitable for trading platforms and custody services, and must meet strict AML/KYC requirements and capital requirements in advance.
2. Project architecture design
Sort out the governance structure of your own project in advance, pay special attention to whether the governance power is concentrated and whether the financial attributes of the project are too strong, to avoid being forced to be regulated due to the identification of the actual controller. At the same time, it is recommended to equip a full-time compliance officer or independent director in advance to improve the project governance structure and compliance system so as to pass the license application and subsequent regulatory review more smoothly. In addition, when developing and operating infrastructure projects, pay attention to the substantial isolation between projects to avoid unclear separation leading to a ripple effect.
3. Regarding the Travel Rule
Design a cross-border transaction data transmission plan that meets FATF requirements in advance. It is especially recommended that trading platforms and custodians consider introducing privacy-enhancing technologies such as MPC (multi-party computing) and ZKP to create a compliance-friendly and user-trusted technical solution, which may instead form their own competitive barriers.
4. Global VASP License Layout
As mainstream trading platforms represented by Binance have successively applied for and obtained VASP licenses in multiple countries and regions, the necessity and strategic significance of VASP license layout have become increasingly significant. At the same time. With the synchronization of compliance driven by FATF standards, the path of "relying on the Cayman and BVI single-jurisdiction framework to bypass supervision" has gradually become ineffective. The future trend is that multi-jurisdiction VASP licenses + transparent sources of funds + governance penetration will become standard. Therefore, Mankiw also recommends that project parties can lay out VASP licenses in Singapore, Dubai, Europe (such as Estonia, Lithuania) and other jurisdictions in advance according to their own business models and market positioning, so as to build a robust global compliance network, reduce compliance risks in a single jurisdiction, and enjoy policy dividends in advance.
By the way, professional matters must be left to professionals.
If you also want to meet the regulatory core of FATF in advance and make full compliance preparations, please feel free to consult Mankiw. As a senior Web3 lawyer, Mankiw has long been paying attention to global regulatory trends and has rich experience in commercial law, license application and regulatory compliance at the practical level. He can provide Web3 project parties with a full range of compliance services to help companies move forward steadily.
