FATF’s July 2026 report warns that “DeFi” is not automatically outside AML/CFT regulation.
FATF is pressing jurisdictions to move from analysis to actual supervision: 93% have not implemented its standards for qualifying DeFi arrangements, and only two have licensed or registered one.
Where a person or company exercises control or sufficient influence – through governance tokens, admin keys, upgrades, infrastructure or economic benefits – the arrangement may fall under Recommendation 15. VASPs interacting with DeFi must apply risk-based customer and counterparty due diligence, monitor risks such as bridges, mixers and chain-hopping, and avoid arrangements where compliance is not possible.
How TRISA Envoy Helps
TRISA Envoy helps with the information-sharing layer: it verifies VASP counterparties, securely exchanges IVMS101 originator and beneficiary data, reaches out-of-network firms through Sunrise Messaging, and preserves encrypted, auditable records. Envoy does not perform KYC, sanctions screening, blockchain analytics or DeFi control assessments, but can integrate with solutions providers as needed and VASPs can flexibly build the controls they need for their customer base, use cases, and jurisdictions.