Your Rails. Their Dirty Money. — What FATF's Offshore VASP Report Means for Licensed MTOs in 2026

An offshore virtual asset service provider (oVASP) is a crypto exchange or digital asset platform that is incorporated in one jurisdiction but serves customers in another without holding a local licence or meeting local AML/CTF requirements. FATF is concerned about them because they exploit regulatory gaps between jurisdictions — operating with minimal oversight, beyond the reach of the regulators in the markets where they actually serve customers. The March 2026 FATF report documents how oVASPs have been used to facilitate large-scale investment fraud (Nigeria case study), terrorist financing (Indonesia case study), and conversion of illicit proceeds across multiple blockchain layers. The specific concern for licensed financial institutions including MTOs is the "nested relationship" exploit — where oVASPs access regulated payment infrastructure by posing as individual retail customers, bypassing the enhanced due diligence that would apply to an overt business relationship with an unregistered financial entity.

A nested relationship — as described in FATF's March 2026 oVASP report — occurs when an unlicensed, offshore crypto platform accesses the services of a licensed financial institution, including an MTO, by posing as a private individual customer rather than disclosing that it is an unregistered financial business. The oVASP (or an individual acting on its behalf) opens a retail account, passes standard individual KYC checks, and uses the account to aggregate and transfer funds on behalf of the oVASP's actual customers. Because the account appears to be a legitimate retail customer, it does not trigger the enhanced due diligence that would be applied if the oVASP declared itself as a business seeking access to payment infrastructure. The FATF report identifies nested relationships as one of the primary mechanisms through which oVASPs access regulated financial infrastructure — and therefore one of the primary risk vectors that licensed MTOs must address in their compliance programmes.

FATF reports do not create direct legal obligations — FATF is an intergovernmental standard-setting body, not a regulator with direct enforcement power over individual businesses. However, FATF guidance establishes the authoritative standard against which national regulators assess the adequacy of compliance programmes. When a licensed MTO's regulator — whether AUSTRAC in Australia, the FCA in the UK, or a GCC financial intelligence unit — reviews its compliance programme, FATF guidance is the reference point they use to determine whether the programme adequately addresses known ML/TF risks. If the March 2026 report identifies oVASP nested relationships as a documented, named ML/TF risk vector, and your compliance programme does not address it, your programme has a gap by reference to the authoritative guidance that was publicly available to you. The practical obligation is clear: update your risk assessment and controls to address oVASP exposure — even though the precise legal mechanism that requires you to do so will vary by jurisdiction.

Activity-based licensing is a regulatory approach under which a platform is required to obtain a licence in a jurisdiction based on the services it provides to customers in that jurisdiction — regardless of where the platform is incorporated. Under this model, an offshore crypto exchange that serves Australian, EU, or GCC customers would need to register with those jurisdictions' regulators even if it is incorporated in a permissive jurisdiction with no regulatory requirements. Currently, only 46% of jurisdictions have adopted this approach, according to FATF's March 2026 report — which is why oVASPs operating from low-regulation jurisdictions can serve customers in regulated markets without any compliance obligations in those markets. FATF is pushing all member jurisdictions to adopt activity-based licensing, and the pressure to do so has become explicit with the March 2026 report. When this approach is adopted more widely, the regulatory perimeter will effectively close around oVASPs — but licensed MTOs need to manage their exposure to oVASPs now, not wait for that regulatory change.

Both figures are from FATF's 2025 Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs, published in June 2025 — not from the March 2026 oVASP-specific report, which is a different document in the same FATF work programme. The $51 billion figure is an industry estimate cited by FATF for illicit on-chain activity related to fraud and scams in 2024. The $1.46 billion figure is the value stolen from the VASP ByBit by DPRK-linked actors — the largest single virtual asset theft in history at the time of publication, with only 3.8% recovered. The 73% figure (jurisdictions passing Travel Rule legislation) is also from the June 2025 Targeted Update. The 46% figure (jurisdictions with activity-based licensing) is from the March 2026 oVASP report specifically. RemitSo has verified all figures against their primary FATF sources.

The minimum programme update required in response to FATF's March 2026 oVASP report has five components. First, update your ML/TF risk assessment to include oVASP nested relationship risk as a specifically addressed risk vector — document the risk, its likelihood given your customer base and corridors, and the controls you apply to mitigate it. Second, add business entity detection indicators to your KYC and EDD processes — transaction volumes inconsistent with a retail profile, fund flows from known crypto exchange addresses, and high-frequency low-value transfer patterns are the primary signals. Third, calibrate your transaction monitoring rules to include velocity and pattern checks specifically designed to surface oVASP-type activity. Fourth, ensure your travel rule compliance is current — where it applies, travel rule data is a detection input as well as a reporting obligation. Fifth, document all of the above so that when your regulator asks how you manage oVASP exposure, you have a complete, auditable answer ready. The documented response to a known risk is itself a key component of what regulators will assess.

The UK's Financial Conduct Authority is cited in the March 2026 FATF report as a case study in effective oVASP enforcement. Following the introduction of clear rules requiring oVASPs promoting services to UK residents to register with the FCA and meet UK AML/CTF requirements — an activity-based licensing approach — the FCA undertook a series of enforcement and disruption measures that resulted in the takedown of more than 1,000 scam websites. The FATF specifically highlights this as an example of what activity-based licensing combined with active enforcement can achieve. The lesson for licensed MTOs in other jurisdictions is twofold: first, the regulatory tools to manage oVASP risk are being actively developed and used — the risk of operating in a market where your regulator adopts the FCA's approach without having addressed your oVASP exposure first is very real. Second, the 1,000+ scam site takedowns demonstrate the scale of oVASP activity in a single major market — the same activity is present in every market where FATF members operate.

Yes — and this is one of the most important points in the FATF report for traditional remittance operators who consider themselves entirely separate from the crypto sector. The oVASP risk to licensed MTOs does not require the MTO to handle crypto directly. The risk arises at the cash-out point — the moment an oVASP converts illicit crypto proceeds into fiat currency through a licensed financial institution. The MTO's role is as the regulated fiat exit point. The MTO does not need to be aware that it is handling crypto-origin funds for the risk to materialise — which is precisely why the nested relationship exploit works. The oVASP presents as an individual retail customer making what appears to be a normal remittance. The MTO processes a fiat-denominated transfer. But the funds being transferred originated as illicit crypto proceeds and have passed through the oVASP's layering process before arriving at the MTO. Every licensed MTO that handles fiat remittances is potentially exposed — the crypto component is upstream, out of sight, but the compliance and reputational risk is very much with the licensed operator at the cash-out stage.