FATF (GAFI)

FATF is not a regulator with direct binding power. It issues standards, the 40 Recommendations, which include Recommendation 15 on virtual assets and service providers (VASP) and Recommendation 16, the Travel Rule. Jurisdictions transpose them into their own law and FATF verifies compliance through mutual evaluations, peer reviews. It also maintains two watchlists: the grey list of jurisdictions under increased monitoring and the black list of high-risk jurisdictions subject to countermeasures, whose composition is updated at each plenary.

Founded in 1989 by the G7 to combat money laundering, FATF issued its first set of 40 Recommendations in 1990 and broadened its mandate to terrorism financing in 2001. It brings together its members, including the world's main financial centers, and its Secretariat is administratively hosted at the OECD in Paris, though they are separate organizations. For crypto-assets, the key milestones are the amendment of Recommendation 15 in October 2018, the VASP guidance of June 2019, the October 2021 update on DeFi and NFTs, and the revision of Recommendation 16 in June 2025.

FATF matters because it is the ultimate source of much of the global AML framework, including crypto-asset regulation. A country's inclusion on its lists carries real reputational and financial effects, such as heightened scrutiny and costlier access to correspondent banking. Its standards are applied by national bodies such as SEPBLAC in Spain or FinCEN in the United States, and the European Union translates and reinforces them through MiCA and the transfer of funds regulation. Compliance providers such as Notabene, Sumsub, Chainalysis and Elliptic operate within this framework.