CySEC Circular C657: FATF Report on Implementation of Recommendation 15 by VASP Jurisdictions

TO : Regulated Entities i. Crypto Asset Service Providers (‘CASPs’) ii. Cyprus Investment Firms (‘CIFs’) iii. Administrative Service Providers (‘ASPs’) iv. UCITS Management Companies (‘UCITS MC’) v. Self-Managed UCITS (‘SM UCITS’) vi. Alternative Investment Fund Managers (‘AIFMs’) vii. Self-Managed Alternative Investment Funds (‘SM AIFs’) viii. Self-Managed Alternative Investment Funds with Limited Number of Persons (‘SM AIFLNP’) ix. Companies with sole purpose the management of AIFLNPs x. Small Alternative Investment Fund Managers (‘Small AIFMs’) FROM : Cyprus Securities and Exchange Commission DATE : 17 September 2024 CIRCULAR NO. : C657 SUBJECT : FATF’s report titled ‘Status of implementation of Recommendation 15 by FATF Members and Jurisdictions with Materially Important VASP Activity’ With this Circular, the Cyprus Securities and Exchange Commission (the ‘CySEC’) brings to the attention of the Regulated Entities the following: On March 28, 2024, the Financial Action Task Force (the ‘FATF’) published a report entitled ‘Status of implementation of Recommendation 15 by FATF Members and Jurisdictions with Materially Important VASP1 Activity’ (the ‘Report’). The Report includes a table with 58 jurisdictions (all FATF members plus 20 jurisdictions categorized by FATF as having “materially important VASP activity”) setting out the implementation status of the said jurisdictions with FATF Recommendation 15 (New Technologies) as well as their latest assessment rating by MONEYVAL (the ‘Table’). These jurisdictions were identified based on two criteria: trading volume and userbase, based on open-source datasets from January to December 2022 and cross-checked against data from blockchain analytics companies. The purposes of the Table are to enable the FATF network to best support these jurisdictions in regulating and supervising VASPs for AML/CFT purposes and to encourage jurisdictions 1 For the avoidance of any doubt, it is clarified that the term Virtual Assets and Virtual Asset Services Providers means Crypto Assets and Crypto Asset Services Providers for the purposes of this Circular.

2 with materially important VASP activity to fully implement Recommendation 15 in a timely manner. This table also seeks to help supervisors/regulators and the private sector around the globe discern the status of implementation of Recommendation 15 by jurisdictions with materially important VASP activity. CySEC, notes that MONEYVAL’s 3rd Enhanced Follow-up Report demonstrated the progress that the Republic of Cyprus made in terms of technical compliance with the FAFT Recommendation 15. According to a Press Release issued on May 2nd 2024 by the Council of Europe, since November 2022, Cyprus improved the virtual asset service providers regime with only a few minor deficiencies remaining. The country has been re-rated on Recommendation 15 from ‘Partially Compliant’ to ‘Largely Compliant’. A relevant announcement was issued by CySEC on the 3rd of May 2024. CySEC would like to point that in line with the FATF’s 2021 Updated Guidance for a Risk￾Based Approach to VASPs, Regulated Entities should consider the risks of virtual asset transfers with jurisdictions that have not taken steps towards regulating or banning VASPs. Subject to their own ML/TF risk assessment, Regulated Entities may also consider designating VASPs from jurisdictions which do not effectively implement licensing or registration requirements as higher risk and implement appropriate measures to suitably mitigate the increased ML/TF risks. FATF’s 2021 Updated Guidance for a Risk-Based Approach to VASPs was circulated to the Regulated Entities via C476. Paragraph 199 of the said guidance notes that CASPs should make a risk-based decision on whom to transact with and acknowledges that the risk mitigating measures taken by each individual CASP may vary. In general, these business decisions are made by each individual CASP based on their risk-based analysis from an AML/CFT perspective, as well as considering other compliance issues, including data storage and security, and the profitability of the business relationship. Originating entities may wish to require travel rule compliance from their beneficiaries, by contract regardless of the lack of regulation in the beneficiary jurisdiction. The CySEC urges the Regulated Entities to take duly into account the afore-mentioned FATF’s report and considers the Table to be of assistance to the Regulated Entities engaging or seeking to engage in VA activities, more specifically in understanding the risks of VA transfers and enhancing their risk-based approach under the Prevention and Suppression of Money Laundering Activities Law (L. 188(I) 2007) as amended from time to time. Sincerely, Dr George Theocharides Chairman, Cyprus Securities and Exchange Commission