Consider these two scenarios – A bank is asked to open an account for a crypto exchange.

A payments firm is about to send funds to a counterparty that provides wallets.

In both cases the compliance team faces the same question: who are we actually dealing with?

The counterparties in question are virtual asset service providers, or VASPs: the exchanges, custodians, wallet providers and transfer services that handle crypto assets on behalf of customers, and that the Financial Action Task Force (FATF) brings within anti-money laundering rules.

Blockchain analytics tools do an excellent job of tracing wallets and transactions.

What they cannot establish is the legal identity, ownership and ultimate control of the company running the service.

That is company data, and it lives in registries, filings and corporate documents, not on the chain.

FATF’s July 2026 targeted update on virtual assets says jurisdictions still struggle to identify the natural and legal persons carrying out VASP activity, and that offshore VASPs remain a persistent challenge.

Many of the jurisdictions with Travel Rule legislation, which requires VASPs to pass originator and beneficiary details along with transfers, have yet to take related supervisory or enforcement action.

FATF also describes crypto-enabled illicit activity as increasingly complex and interconnected, including scam center operations linked to organised crime.

Singapore shows the same pattern from the licensing side, where VASPs are regulated as digital payment token service providers.

In a written reply to Parliament in August, the Monetary Authority of Singapore said that, out of close to 300 license applications, 37 are currently licensed , with most of the rest rejected or withdrawn.

Source link