Learning Hub
Recommendation 15 is one sentence in the FATF standards — and eleven technical criteria in the document assessors actually use. The criteria are quoted here from the Methodology itself, because the commonest error in this field is citing the Recommendation for a rule that lives two documents away.
This page explains how Recommendation 15's technical criteria are constructed, quoted from the FATF Methodology (5th round). It is not legal advice, and it cannot tell you whether any particular firm's arrangements would satisfy any supervisor. The criteria are what an assessor looks for in a country's framework; what any supervisor actually does with them changes faster than any page, and is dated wherever it is described. The authoritative text is the FATF's own publication of the Methodology.
The structure that organises everything on this page sits in criterion 15.3. First the country assesses the risks of its virtual-asset sector (15.3(a)) and calibrates its response to them (15.3(b)). Then each firm is required to assess, manage and mitigate its own risks (15.3(c)) — and a supervisor reads the second assessment against the first.
That nesting is why a published sectoral risk assessment is the most useful document a supervised firm can read: it is the examiner's own marking scheme. The criteria below set out the rest of the machinery — the perimeter, the supervisor's powers, feedback, sanctions, targeted financial sanctions, and cooperation.
Quoted, not summarised. Where the operative rule sits in an assessor's footnote — as it does for prohibition, and for who may count as a competent authority — the footnote is shown with the criterion it qualifies.
A prohibition is not an exemption. Toggle to see which criteria an assessor still applies to a country that has banned virtual assets — the Methodology's own footnote 82.
“Countries and financial institutions should identify and assess the ML/TF risks that may arise in relation to the development of new products and new business practices, including new delivery mechanisms and the use of new or developing technologies for both new and pre-existing products.”
“Financial institutions should be required to: (a) undertake the risk assessments prior to the launch or use of such products, practices and technologies; and (b) take appropriate measures to manage and mitigate the risks.”
“In accordance with Recommendation 1, countries should: (a) identify and assess the money laundering, terrorist financing and proliferation financing risks emerging from virtual asset activities and the activities or operations of VASPs; (b) based on their understanding of their risks: (i) apply a risk-based approach to ensure that measures to prevent or mitigate money laundering and terrorist financing are proportionate to the risks identified and (ii) implement risk-based measures, proportionate to the risks identified and allocate resources efficiently, to mitigate PF risks; and (c) require VASPs to take appropriate steps to identify, assess, manage and mitigate their money laundering, terrorist financing and proliferation financing risks, as required by criteria 1.12, 1.13 and 1.14.”
fn 83: Proliferation financing risk refers strictly and only to the potential breach, non-implementation or evasion of the targeted financial sanctions obligations referred to in R.7.
“Countries should ensure that: (a) VASPs are required to be licensed or registered at a minimum: (i) when the VASP is a legal person, in the jurisdiction(s) where it is created; and (ii) when the VASP is a natural person, in the jurisdiction where its place of business is located; and (b) competent authorities take the necessary legal or regulatory measures to prevent criminals or their associates from holding, or being the beneficial owner of, a significant or controlling interest, or holding a management function in, a VASP.”
fn 84: a country need not impose a separate licensing or registration system for persons already licensed or registered as financial institutions and permitted under that licence to perform VASP activities.
fn 85: jurisdictions may also require VASPs that offer products and/or services to customers in, or conduct operations from, their jurisdiction to be licensed or registered in this jurisdiction.
“Countries should take action to identify natural or legal persons that carry out VASP activities without the requisite license or registration and apply appropriate sanctions to them.”
fn 88: Note to assessors: Criterion 15.5 applies to all countries, regardless of whether they have chosen to license, register or prohibit virtual assets or VASPs.
“Consistent with the applicable provisions of Recommendations 26 and 27, countries should ensure that: (a) VASPs are subject to adequate regulation and risk-based supervision or monitoring by a competent authority, including systems for ensuring their compliance with national AML/CFT requirements; (b) supervisors have adequate powers to supervise or monitor and ensure compliance by VASPs with requirements to combat money laundering and terrorist financing, including the authority to conduct inspections, compel the production of information and impose a range of disciplinary and financial sanctions, including the power to withdraw, restrict or suspend the VASP's license or registration, where applicable.”
fn 89: in this context a competent authority cannot include an SRB (self-regulatory body).
“In line with Recommendation 34, competent authorities and supervisors should establish guidelines and provide feedback, which will assist VASPs in applying national measures to combat money laundering and terrorist financing and, in particular, in detecting and reporting suspicious transactions.”
“In line with Recommendation 35, countries should ensure that: (a) there is a range of proportionate and dissuasive sanctions, whether criminal, civil or administrative, available to deal with VASPs that fail to comply with AML/CFT requirements; and (b) sanctions should be applicable not only to VASPs, but also to their directors and senior management.”
“With respect to the preventive measures, VASPs should be required to comply with the requirements set out in Recommendations 10 to 21, subject to the following qualifications: (a) R.10 — The occasional transactions designated threshold above which VASPs are required to conduct CDD is USD/EUR 1 000. (b) R.16 — For virtual asset transfers, countries should ensure that: (i) originating VASPs obtain and hold required and accurate originator information and required beneficiary information on virtual asset transfers, submit the above information to the beneficiary VASP or financial institution (if any) immediately and securely and make it available on request to appropriate authorities; (ii) beneficiary VASPs obtain and hold required originator information and required and accurate beneficiary information on virtual asset transfers and make it available on request to appropriate authorities; (iii) other requirements of R.16 (including monitoring of the availability of information and taking freezing action and prohibiting transactions with designated persons and entities) apply on the same basis as set out in R.16; and (iv) the same obligations apply to financial institutions when sending or receiving virtual asset transfers on behalf of a customer.”
fn 90: for the purposes of applying R.16 to VASPs, all virtual asset transfers should be treated as cross-border transfers.
“With respect to targeted financial sanctions, countries should ensure that the communication mechanisms, reporting obligations and monitoring referred to in criteria 6.5(d), 6.5(e), 6.6(g), 7.2(d), 7.2(e), 7.3 and 7.4(d) apply to VASPs.”
Registry note, recorded as found (see file header): in this consolidation R.6.5's sub-limbs run (d) humanitarian-carve-out compliance, (e) communication of designations, (f) freeze reporting — so the citation as written captures 6.5's humanitarian and communication limbs but not its freeze-reporting limb, while capturing both under R.7. Not resolved here; quote the imported limbs from R6R7_IMPORTS and let the asymmetry show.
“Countries should rapidly provide the widest possible range of international co-operation in relation to money laundering, predicate offences and terrorist financing relating to virtual assets, on the basis set out in Recommendations 37 to 40. In particular, supervisors of VASPs should have a legal basis for exchanging information with their foreign counterparts, regardless of the supervisors' nature or status and differences in the nomenclature or status of VASPs.”
Six criteria survive a prohibition, and the shape is odd: a country that has banned the sector must still assess its risks (15.3(a)–(b)) and must still find and sanction the people operating in it (15.5). The ban removes the ability to supervise by licensing. It does not remove the sector from the assessor's view.
FATF puts the expectation in its own words:
“While a prohibition is permissible under the FATF Standards, as discussed in previous Targeted Updates, it may be difficult to implement effectively unless jurisdictions take proactive steps to identify prohibited VA/VASP activities and apply appropriate supervisory and enforcement measures to prevent and sanction such activities. An increase in the use of prohibitions may therefore raise concerns in the future if jurisdictions are not able to enforce them effectively.”
11% → 23%
of surveyed jurisdictions prohibit, and the share is rising
16 of 151 (2023) → 20 of 147 (2024) → 33 of 163 (2025) → 33 of 144 (2026). FATF calls it a steady increase, and notes prohibition is most common among MENAFATF members.
16 / 21
explicitly prohibiting jurisdictions reported enforcement action in 2026
Against VASPs operating illegally — against 9 of 17 in 2025 and 9 of 14 in 2024. The number that had sat at nine for three years nearly doubled in one cycle. FATF still adds: implementation remains uneven.
1
prohibiting jurisdiction has fully met the relevant R.15 requirement
On the risk-assessment sub-criteria (15.3), per the 2026 assessment results. A ban does not discharge the duty to assess the sector it bans.
Four prohibiting jurisdictions appear in the Updates' per-jurisdiction annex — and the enforcement column tells a two-year story. In 2025 exactly one of them answered it; in 2026 none does, while the narrative reports sixteen of twenty-one prohibitors taking action. The column moved, not the world.
| Jurisdiction | Enforcement (2025 annex) | Enforcement (2026 annex) | R.15 rating |
|---|---|---|---|
| Egypt | Yes | N/A | LC (2024) |
| China | N/A | N/A | LC (2020) |
| Morocco | N/A | N/A | PC (2024) |
| Saudi Arabia | N/A | N/A | not assessed |
These are the prohibiting jurisdictions visible in the Updates' annex of FATF members and jurisdictions with materially important VASP activity — not all 33 prohibitors in the survey. Read the two years together: Egypt's enforcement column answered "Yes" in 2025 and reads "N/A" in 2026, alongside every other prohibitor — while the 2026 narrative reports 16 of 21 prohibitors taking enforcement action. The likeliest reading is that the annex column is now treated as inapplicable to prohibitors, which is precisely why "N/A" is never evidence of inaction — and an LC rating speaks to the framework, not to whether enforcement bites.
Source: FATF, 7th Targeted Update on Implementation of the FATF Standards on VAs and VASPs, July 2026 (supersedes the June 2025 update; annex comparison drawn from both).