All You Need to Know About VASP FATF


Since virtual currency can exchange value with physical commodity and financial markets, a lot of discussions and applications have been developed. However, the technology behind blockchain and cryptocurrency has a higher entry threshold than the value exchange system evolved in human history in the past. Under the premise that it’s hard for most people to understand, there are endless cases of cryptocurrency being illegally used by intentional people. For example, recently, an American oil company was demanded to pay bitcoin ransom by hackers, or the Ponzi scheme of virtual currency (requiring investors to pay fees and get paid by recruiting new distributors), obliterating well-intentioned supporters and legitimate service provision.

As virtual assets are difficult to recognize but easily adopted by criminal organizations, FATF has issued relevant norms and guidelines requiring countries to include virtual assets in anti-money laundering supervision of financial systems since June 2020, and has then officially implemented its audit against member countries.

Taiwan issues corresponding laws and regulations on FATF norms

Although Taiwan is a non-member country with the hundreds rest of other countries, not abiding by the same regulations would mean taking risks of being rejected in the international financial system. Therefore, on May 25 this year, the FSC announced the draft "Regulations Governing Anti-Money Laundering and Countering the Financing of Terrorism for Enterprises Handling Virtual Currency Platform or Transaction", which requires five major types of virtual trading businesses to be regulated by the Anti-Money Laundering Act starting from July 1, 2021.

In accordance with Article 154(1) of the Administrative Procedures Act and Article 5(2) of the Anti-Money Laundering Act, the provisions of Article 6(3), Article 7(4), Article 8(3), Article 9(3), Article 10(3) and Article 7(5) of the Anti-Information Terrorism Act, the FSC invited relevant ministries and industry representatives to discuss the draft and issued a notice of the draft on 2021/06/02 coinciding with the effective date of the Executive Yuan's designation of the virtual trading platform and trading business scope. The full report can be downloaded here.

截圖 2022-08-23 上午10.49.35.png

According to the Executive Yuan's declaration dated April 6 this year, the "Virtual Exchange Platform and Trading Business" (VASP) includes:

The exchange of virtual currency between TWD, foreign currencies and currencies issued in Mainland China, Hong Kong or Macau.

2 Exchanges of virtual currency.

3 Transfers of virtual currency.

4 Maintaining, managing or providing management tools for virtual currency.

5 Participate in and provide financial services related to the issuance or sale of virtual currency.


Among the 18 draft articles of the FATF, all should be complied starting from July 1st except for Article 7, which has been delayed due to difficulties in implementing the real-name system for cross-border platforms. Regulatory restrictions should be enforced on the establishment of an internal control and audit system for money laundering prevention, customer identification, transaction record keeping, reporting of transactions over a certain amount, and reporting of suspected money laundering or information terrorism transactions, etc.

Coverage and Impact of the Act

In addition to the common fiat and virtual currency exchanges and crypto exchanges, the regulation will also cover certain service providers that assist in the transfer of virtual assets or virtual currency mixer, as well as software and hardware providers that provide virtual asset-related custody services or tools, or financial service providers related to ICOs and IEOs. The amount of manpower and time consumption troubles financial institutions every year in meeting the CDD and AML regualtions, not to mention the great challenges for most VASPs to meet the requirement. As of now, some service providers are known to be ending some of their services on June 30, but it remains to be seen whether this will be temporary or permanent. However, it is obvious that the implementation of laws and regulations will have an impact on some operators.

How KryptoGO Helps VASPs Meet Regulations

In continuous pursuant on efficient and cost-effective compliance solution for financial institutions, KryptoGO has an one-stop search engine for customer due diligence. While KryptoGO has focused its product development on the needs of traditional financial institutions, they now offer a KYABC (Know your Address, Business, and Customer) solution to address the tight schedule in compliance with VASPs. The solution utilizes rtificial intelligence in machine learning to match customer information, eliminating 95% of virtual asset traders without criminal risk.

In the past, enterprises had to search through multiple databases and then cross-match the search results manually to determine whether they were the target of scrutiny, which was a tedious and time-consuming process. Through the customer due diligence search engine, enterprises inputs basic information of customers, and the system automatically scans a large database of international sanctions lists, negative news, etc., and generates risk reports for further risk assessment and decision making. The automated solutions has proven to save over 80% of operational costs, and effectively filters out up to 95% of irrelevant risk information on the target.


KryptoGO understands the difficulties faced by the virtual assets service industry under the upcoming regulations. In the area of customer screening, the due diligence search engine performs 99.9% of the screening, but the final step is still required to be performed by enterprises to confirm the customer's identity according to the international money laundering control laws.

Why are we reliable?

In 2020, KryptoGO won awards in the "2020 International Supervision Technology Hackathon" competition co-directed by the FSC, FSA, and CPSC, under the themes of eKYC and Real-time Market Supervision, as well as POC (Proof of Concept) awards from three financial institutions, making it the most awarded national startup in the competition. More important than the awards, however, was the fact that KryptoGO's product solution passed the regulatory compliance checkpoint set by the organizers during the competition: 1. proving the compliance of the application itself and achieving market validation; 2. confirming the accuracy of the solution to address potential customer pain points.

At this point in time, the KryptoGO Compliance solution has been adopted by 25 branches of MegaBank in 12 countries around the world, and vigorously seeks for implementation in financial institutions. In the face of increasingly stringent financial regulatory, KryptoGO is ready to be the number one gatekeeper for organizations.

Common Questions about the “VASP Anti-Money Laundering and Anti-Financing Measures” issued by the FSC

What is VASP?

The full name of VASP is “Virtual Asset Service Provider”, which is a new industry category of FATF for virtual currency.

Do we need KYC even if we have no contact with fiat currency?

According to the Money Laundering Control Act, those who exchanges fiat currency for another person is classified as a virtual platform and trading business and is required to take appropriate anti-money laundering measures, including Know Your Customer (KYC).

Always being a concern in the bank? Get to know “KYC” in 5 minutes - KryptoGO Blog

What do I need to do to comply with the Virtual Money Laundering Regulation on July 1st ?

According to the draft on June 2nd , operators are required to at least perform customer identification, ongoing review, record keeping, ongoing monitoring of transactions, suspicious transaction reporting, implement internal controls and audits, and conduct periodic money laundering risk assessments.

Does the draft need to be fully compliant by 07/01?

Considering article 7 of the Travel Rule on virtual transfer of goods is subject to international implementation, and the competent authority will set another implementation date.

In consideration of Article 7 in the Travel Rules concerning the transfer of virtual currency, It should be subject to the international implementation situation, then the competent authority shall determine another implementation date.

Except for the Travel Rule, all of them will be implemented from 07/01.

Top 3 Challenges in Regulatory Implementation for the Travel Rule - KryptoGO Blog

How will the regulatory authorities check? Are there any standards that can be followed?

We may conduct audits on a risk-based basis at any time, including on-site and off-site audits, and may designate or request the industry to appoint specialized professional and technical personnel to conduct audits of the industry's anti-money laundering and anti-counterfeiting activities and submit reports to us at the expense of the subject of the audits. We may order the industry to provide us with books, documents, electronic data files or other information related to anti-money laundering and anti-counterfeiting activities for the purpose of such audits. The foregoing information shall be stored in any form, whether in paper, electronic files, e-mail or any other form, and shall not avoid, deny or hinder access for any reasons.

The audit may be conducted at any time, using a "risk-based approach" with no SOPs or quantitative standards.

What information do I need to collect in order to confirm the customer’s identity?

There is no certain standard. The more comprehensive the KYC information with the customer, the better, such as: full name, address, citizenship, date of birth, government issued photo ID, social security number, tax ID, bank statements, utility bills and bank card photos. Not only does this ensure compliance with BSA and FATF Recommendation 16, but it is also critical for law enforcement agencies investigating crimes such as money laundering, terrorist financing, drug trafficking and distribution of child abuse materials.

Balancing between user experience and compliance is an art.

How do we determine if we need an advanced program?

There is no limit to the number of uses of the standard solution, but there is no API and the scope of data is limited to Taiwan. Therefore, if you are considering to interface with an internal system and have a customer base that is not limited to Taiwan, an advanced solution is recommended.

If there is no API, do we need to hire someone to review it?

Article 7 of the Anti-Money Laundering Measures for Financial Institutions: Financial institutions should conduct their own customer identification operations. If a financial institution is required by law or by our association to rely on a third party to identify and verify the identity of the customer, the identity of the agent, the identity of the beneficial owner, or the purpose and nature of the business relationship, the financial institution relying on the third party should still be ultimately responsible for confirming the identity of the customer.

KryptoGO does its best to complete 99.9% of the customer screening process, but regardless of whether there is an API or not, a final step to confirm the identity of the customer is required. The international anti-money laundering control laws stipulate that there is no way to transfer criminal responsibility to a third party.

After buying the system, can you comply? Do I need to do anything else?

Our due diligence engine will provide objective and neutral due diligence results based on publicly available information, and quickly provide search results with high accuracy and low false positive rate under the sufficiently wide data coverage. As for the acceptance of clients, it depends on internal processes and regulations, which can refer to our anti-money laundering consulting services.

What is the KYABC scenario? Can you give me an example?

We understand the pain points of VASPs and offer a one-stop regulatory solution that can be applied to the review of virtual money transfers as well as the name matching functionality of the traditional AML process, including the Travel Rule real name transfer regulation.

How much does it cost to upgrade during the subscription period of the standard solution?

We charge the cost of the advanced plan minus the amount corresponding to the remaining standard plan subscription period, without any upgrade or migration process.

Are there any special offers for VASP?

For VASP we offer a one-year, $100,000 total solution "System + Service" that includes 20 hours of CAMS consulting and one year of unlimited online consulting. The CAMS Anti-Money Laundering Firm will ensure full compliance. You will receive an one month unlimited online counseling if you pay by July 1st. (The service includes CAMS' assistance in setting up internal KYC/AML management processes, staff training, and assisting companies to thoroughly implement money laundering prevention and counter-terrorism from the inside out.)

Read more…