On 21 July 2026, the Financial Action Task Force (FATF) published its Targeted Report on Regulatory Challenges from Decentralised Finance, updating the 2021 FATF Guidance on Virtual Assets and Virtual Asset Service Providers (VASPs) in light of DeFi's expansion. FATF recommendations are not directly binding but represent the international AML/CFT standard against which member jurisdictions' domestic laws are assessed during FATF mutual evaluations, making this report a practical compliance reference for national regulators and supervised entities.
FATF Recommendation 15 requires jurisdictions to apply AML/CFT controls (including registration or licensing, customer due diligence, transaction monitoring, and the Travel Rule) to VASPs. The targeted report applies a functional and risk-based approach to determine when DeFi operators qualify as VASPs subject to Recommendation 15. The report identifies governance token concentration, administrative privileges, control over upgrades, economic benefit concentration, and influence over development and infrastructure as indicators of de facto control sufficient to trigger VASP classification, even where an arrangement presents itself as decentralised.
DeFi protocol operators, governance token holders with material voting power, liquidity providers, and regulated financial entities with exposure to DeFi protocols face heightened regulatory risk following the report. National AML regulators, including FinCEN in the United States, the FCA in the United Kingdom, and the Monetary Authority of Singapore (MAS), will draw on the FATF approach when assessing whether specific DeFi participants meet the VASP definition and require registration. Institutional investors entering DeFi markets are expected to face counterparty due diligence obligations from their regulated intermediaries.
The implementation gap documented by the report is substantial: 132 of 143 responding jurisdictions have not applied Recommendation 15 to DeFi arrangements, and only two have licensed or registered a DeFi arrangement. The report acknowledges enforcement challenges arising from pseudonymity, cross-border operations, and the absence of a single identifiable legal entity in many arrangements. Outstanding questions include how the FATF Travel Rule applies to DeFi transactions where counterparty identification is technically constrained, and the extent to which smart contract developers bear VASP obligations.
Licentium advises virtual asset service providers, DeFi market participants, and regulated financial institutions on FATF Recommendation 15 compliance, AML programme design, and regulatory risk assessment in digital asset markets. Work we undertake includes VASP classification analysis, AML/CFT policy drafting, Travel Rule compliance, DeFi protocol regulatory risk assessment, and multi-jurisdictional regulatory strategy for crypto-native and traditional finance clients active in digital asset markets.