Recommendation 15 and its Interpretive Note

Recommendation 15 is the reason crypto businesses are obliged entities at all. Its Interpretive Note is short, but each paragraph turns into a concrete duty: a license application, a supervisory inspection, a lower due diligence threshold, a sanction on a director. A compliance officer who can map a national rule back to the paragraph it implements can tell what is a global floor, what is a local addition and what an assessor will check.

Two halves of one Recommendation

Recommendation 15 (New technologies) has two parts. The first, older part requires countries and financial institutions to identify and assess the money laundering and terrorist financing risks of new products, business practices, delivery mechanisms and technologies, and requires institutions to assess those risks before launch and take measures to manage them. The second part, added in October 2018, requires countries to ensure that virtual asset service providers (VASPs) are regulated for AML/CFT purposes, licensed or registered, and subject to effective systems for monitoring compliance.

The first half applies to VASPs too. Listing a new token, adding a chain, launching staking or opening a crypto ATM network are all new products or technologies, and a supervisor will ask to see the risk assessment that preceded the launch.

The Interpretive Note to Recommendation 15 (INR.15), adopted in June 2019 and amended since (including corresponding changes in February 2025), sets out the detail. Who counts as a VASP, and what is outside the definition, is covered in the lesson The VASP as an obliged entity.

INR.15 paragraph by paragraph

Paragraph 7(b), the Travel Rule, is covered in depth in the lesson Recommendation 16 applied to virtual assets.

Licensing and registration

INR.15 paragraph 3 sets the minimum: a VASP that is a legal person must be licensed or registered in the jurisdiction where it was created, which the FATF Guidance reads as where it is incorporated; a natural person where their place of business is. Countries may also require licensing of VASPs that offer products or services to customers in, or conduct operations from, their territory. Paragraph 4 spares financial institutions already licensed and permitted to carry on VASP activities a second license. FATF also accepts that a country may prohibit VASP activity, provided it still finds and sanctions those who operate anyway.

Paragraph 3 also carries a fit and proper test: authorities must prevent criminals or their associates from holding a significant or controlling interest, being a beneficial owner, or holding a management function. It also requires authorities to find and sanction unlicensed operators.

A worked case. A fictional VASP, Kestrel, is incorporated in Country X, runs its operations team from Country Y and markets to retail customers in Country Z.

1. Country X must license or register Kestrel: that is the minimum in paragraph 3.
2. Country Y may require a license because Kestrel conducts operations from its territory.
3. Country Z may require a license because Kestrel offers services to its residents.
4. If Kestrel holds only a Country X license, it must check whether Y and Z use the optional host-country powers, which a substantial minority of jurisdictions do.

The compliance team records each conclusion, the legal basis and the review date. The lesson How national regimes implement the standard shows how to keep that record across many countries.

Supervision and sanctions

Paragraphs 5 and 6 decide what happens after licensing. Supervision must be risk-based and carried out by a competent authority with real powers: inspection, compelled production of information and a range of disciplinary and financial sanctions up to withdrawal of the license. Sanctions must reach directors and senior management, not only the firm. Assessors test both paragraphs in the effectiveness review of supervision and preventive measures (IO.3 under the 2022 Methodology), looking for evidence that inspections happen and sanctions are actually imposed. How supervisors do this is covered in the lesson Supervision, examinations and enforcement.

Preventive measures with VASP qualifications

Paragraph 7 applies Recommendations 10 to 21 to VASPs. The table shows how each lands in a crypto program.

Targeted financial sanctions under R.6 and R.7 apply to VASPs as to every person, which is why freezing designated assets without delay belongs in every VASP program.

The October 2021 Updated Guidance

The FATF published the Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers on 28 October 2021, replacing its June 2019 guidance. It is not binding, but assessors and supervisors rely on it. It updated six areas:

1. clarification of the definitions of virtual assets and VASPs (including when NFTs and DeFi arrangements are in scope);
2. how the FATF Standards apply to stablecoins, including their central governance bodies;
3. risks of peer-to-peer transactions and tools to address them;
4. licensing and registration of VASPs;
5. implementation of the Travel Rule by the public and private sectors;
6. principles of information-sharing and cooperation among VASP supervisors.

For a compliance team, areas 3 to 5 translate most directly into controls: risk-based treatment of transfers to and from unhosted wallets, evidence for license applications and counterparty checks, and a Travel Rule process. Area 6 explains why one supervisor's findings about a VASP can reach another supervisor quickly.

Targeted updates: the implementation gap

Countries were slow to implement. The FATF ran two 12-month reviews (2020 and 2021) and has published annual targeted updates since 2022. In February 2023 it adopted a roadmap to strengthen implementation of R.15, and since 2024 it has published a table showing the status of R.15 implementation in FATF members and jurisdictions with materially important VASP activity.

The seventh targeted update (July 2026) and a targeted report on decentralized finance (July 2026) pointed to:

• a gap between passing Travel Rule laws and supervising and enforcing them;
• persistent gaps in turning risk assessments into mitigating measures, in making licensing work in practice and in finding unlicensed and offshore VASPs;
• very few jurisdictions applying the standard to DeFi arrangements that qualify as VASPs;
• a recommendation that financial institutions and VASPs not interact with a DeFi arrangement where they cannot comply with the relevant Recommendations.

The practical consequence is an uneven world. A VASP licensed in a strict jurisdiction will deal with counterparties licensed elsewhere, and with some licensed nowhere, so counterparty due diligence and risk-based limits matter as much as its own license.

Exam focus: the two halves of R.15 (risk assessment before launching new products or technologies; VASP regulation, licensing and supervision); what INR.15 requires of countries, supervisors and VASPs; licensing at a minimum where the VASP is created, the optional host-country power and the fit and proper test; supervision by a competent authority, not a self-regulatory body, and sanctions that reach directors and senior management; the USD/EUR 1,000 CDD threshold for occasional transactions and how R.10 to R.21 apply to VASPs; the six areas of the October 2021 Updated Guidance; the February 2023 roadmap and the purpose of targeted updates.