FIAU flags new FATF guidance on crypto, DeFi risks – Maltese firms face compliance pressure
The FIAU is urging subject persons to review two new FATF reports on virtual assets and DeFi, warning that compliance gaps could expose firms to regulatory action.
The Financial Intelligence Analysis Unit has flagged two new publications from the Financial Action Task Force that directly affect how Maltese businesses handle crypto assets and decentralised finance.
The FIAU is calling on subject persons to review the reports and assess whether their AML/CFT frameworks adequately address exposure to virtual assets, virtual asset service providers, stablecoins, unhosted wallets and DeFi arrangements.
One report is the Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs. It notes progress since 2025 in regulating and supervising the sector, but warns that significant challenges remain in risk assessment, licensing, enforcement and operationalising the Travel Rule.
The FATF specifically flags emerging risks from stablecoins, peer-to-peer transactions, offshore VASPs and the use of virtual assets in money laundering, terrorist financing and proliferation financing.
The second publication is a Targeted Report on Regulatory Challenges from Decentralised Finance. It examines how DeFi arrangements, though still a small part of the market, are growing in significance due to institutional investor participation and interaction with regulated entities.
The report distinguishes between genuinely decentralised arrangements and those with identifiable controllers or sufficient influence. This distinction determines whether FATF Standards apply, but even arrangements outside direct regulation may pose risks requiring alternative mitigation measures.
The FATF identifies chain-hopping, cross-chain bridges, ransomware-related activity and fraud as key DeFi-related typologies. These techniques can be used to launder proceeds or obscure fund movements.
For Maltese businesses, the message is clear. The FIAU expects subject persons to incorporate these findings into their risk assessments, policies, procedures and transaction monitoring frameworks, particularly where they have direct or indirect exposure to crypto-asset risks.
Firms that fail to update their compliance frameworks could face regulatory scrutiny as Malta continues to position itself as a hub for fintech and iGaming, sectors increasingly intertwined with virtual assets.