FATF’s Travel Rule faces implementation issues

The development of cryptocurrencies and other digital assets is presenting global regulators with a range of new money laundering and terrorist financing threats. To address this challenge, the Financial Action Task Force (FATF), an intergovernmental anti-money laundering (AML) and combating the financing of terrorism (CFT) watchdog, has taken action since 2018 by updating its standards to include virtual assets (VAs) and virtual asset service providers (VASPs). Yet these changes, accompanied by additional clarifications and guidance published in subsequent years, have run into a number of implementation problems at the national level.

In FATF’s latest update covering the implementation of its VA and VASP AML/CFT standards, published on June 30, the organisation noted that take-up among its constituent jurisdictions was low. In particular, it was observed that in the three years since its guidance was clarified, a majority of the 53 countries surveyed had failed to fully implement FATF requirements. Meanwhile, over the past 12 months, progress enacting the all-important “Travel Rule” requirement has been sluggish, with only 11 out of 98 surveyed jurisdictions actively enforcing the rule.

The Travel Rule, which was adopted in 2019, requires that both originators and beneficiaries of digital fund transfers must swap key identifying information. It applies to all financial institutions and VASPs, as well as obliged entities, which includes credit institutions, accountants and financial advisors, among other actors. FATF’s 2022 update notes that a quarter of responding jurisdictions had started to pass legislation relevant to the Travel Rule, while about one third of countries had not even begun the process of implementing relevant legislation or standards.

This situation is, according to FATF, opening up significant vulnerabilities in global efforts to counter money laundering and terrorist financing threats. Among other issues, the organisation notes the growth of “ransomware actors misusing VAs to facilitate payments, and ransomware cybercriminals continue to rely on a small group of non-compliant VASPs and privacy coins to move funds.”

Part of the problem is that FATF’s Travel Rule is highly complex and demands the use of technology to monitor transactions that, until recently, was unavailable. For this reason, few observers are surprised by the low levels of global adherence. “It’s not surprising because the technology hasn’t been in place. When this first came out, there wasn’t a technology solution available that would allow what FATF was saying needed to be done,” says John Bassilios, a partner at law firm Hall & Wilcox in Melbourne.

Today, however, technology solutions have been created to address the changing regulatory landscape. This includes the development of the Travel Rule Universal Solution Technology (Trust), which was first started by US VASPs but has since extended to include international VASPs. Trust makes use of two innovations to meet Travel Rule requirements: a centralised bulletin board deployed to match beneficiary and originator VASPs and an encrypted channel to safely route Travel Rule data between VASPs. This offering, and others, should help national jurisdictions to meet FATF’s regulatory requirements moving forward.

“New technology solutions have been developed that address Travel Rule requirements, so I expect regulators from different jurisdictions will now move a bit faster. I can say, from an Australian perspective, that that was one of the reasons why the country’s regulators haven't moved quickly on this. They didn’t want to implement laws mandating that something be done when it wasn’t technically achievable,” says Mr Bassilios.

Nevertheless, several challenges remain. This includes the fact that, as private sector-led technological solutions to the Travel Rule emerge, not all of them are fully interoperable. In addition, in what has been dubbed the “Sunrise Issue”, jurisdictions that regulate VAs and VASPs are encountering difficulties when engaging with peers that do not. Finally, the latitude given to national authorities to interpret FATF guidance means that some jurisdictions are adopting different approaches to Travel Rule requirements, meaning that greater harmonisation will be required moving forward.

With FATF describing the current situation as “urgent” and calling for an acceleration of efforts to implement and enforce Travel Rule requirements, sweeping regulatory change can be expected over the short to medium term, as jurisdictions around the world adapt to this new reality. On June 15, Estonia became one of the first countries in the world to enshrine Travel Rule requirements into national law, following Japan’s success in doing so in April.