The Counterparty You Cannot Vouch For: VASP Risk After R16

When the Financial Action Task Force (FATF) extended its travel rule to virtual assets in 2019, it borrowed a mechanism built for banks and applied it to a market that does not work like banking. Wire transfers move between institutions that know each other through decades of correspondent relationships. Virtual asset transfers move between counterparties that may never have exchanged a message before, may sit in a jurisdiction with no travel rule at all, and may not even be identifiable as institutions. The revised Recommendation 16 (R16), agreed at the FATF June 2025 Plenary, sharpens the data a virtual asset service provider (VASP) must send. It does far less to solve the question that actually governs the risk: who is on the other end, and can they be trusted with it?

That question is the whole of counterparty risk in virtual asset transfers, and it is the part of travel rule compliance that most firms have not resolved. The industry has spent five years building the pipes to transmit originator and beneficiary data. It has spent far less effort on the harder discipline of deciding whether the entity at the other end of the pipe is one to which data should be sent at all. And beneath even that lies an uncomfortable possibility the sector rarely says aloud: that the travel rule, lifted intact from correspondent banking, may be the wrong tool for a market that has no correspondents. It is worth holding that thought while examining where the rule strains, because each strain points back to it.

Identification is the first risk

In correspondent banking, a firm knows its counterparty before a payment is ever sent. In virtual asset transfers, identification is frequently the hardest step and it happens under time pressure. A VASP receiving a transfer must first determine whether the destination is another VASP or an unhosted wallet, because the obligations differ entirely. The FATF's own Best Practices on Travel Rule Supervision, published in June 2025, records a case examined by Japan's Financial Services Agency in which a VASP treated a beneficiary wallet as unhosted and so failed to take adequate steps to determine whether it was in fact controlled by a foreign VASP, and whether that VASP's jurisdiction had been deemed equivalent for travel rule purposes.

That failure is instructive because it is not a data-transmission error. The firm could transmit perfectly. It simply misread who it was transmitting to, and in doing so skipped the counterparty assessment entirely. Misidentification is the original sin of virtual asset compliance: every downstream control, from screening to record-keeping, is calibrated to a counterparty type that may be wrong.

The sunrise problem is a decision

The most discussed obstacle in travel rule compliance is the sunrise issue: the uneven adoption of the rule across jurisdictions, so that a compliant VASP routinely transacts with counterparties that are under no obligation to receive or return data. It is usually framed as an interoperability problem. It is more accurately a risk-assessment problem. When a firm cannot transmit data because the counterparty's jurisdiction has not implemented the rule, the decision it faces is not technical but judgemental: does it proceed, delay, or decline?

The FATF's 2025 Targeted Update found that 73 percent of surveyed jurisdictions, 85 of 117, had passed travel rule legislation, up from 65 in 2024. That progress conceals the real exposure. Even among jurisdictions with legislation, supervision and enforcement remain inconsistent, and a substantial share had yet to enforce the rule at all. The UK's approach makes the risk logic explicit: where a cryptoasset transfer arrives with missing or incomplete information, a firm must weigh the countries in which the counterparty operates and the status of the travel rule there before making a risk-based decision on whether to release the assets to the beneficiary. The rule does not tell the firm what to decide. It tells the firm that it must decide, and be able to justify the decision.

This is where counterparty risk becomes real. A firm that treats every sunrise transaction as acceptable is a conduit. A firm that blocks all of them is unusable. Between those poles sits the assessment, and the quality of that assessment is what a supervisor will examine.

Jurisdictional risk is now measurable

The revised standards give firms a sharper instrument for that assessment than they had before. Alongside the June 2025 update, the FATF published an updated table setting out the implementation status of Recommendation 15 across jurisdictions with materially important VASP activity, covering approximately 98 percent of the global virtual asset market. The FATF is careful to state that inclusion in the table carries no indication of a jurisdiction's risk or compliance. Used correctly, however, it lets a firm see how a counterparty's home jurisdiction compares on licensing, travel rule adoption and supervisory enforcement.

The practical consequence is blunt. A counterparty in a jurisdiction that has barely implemented Recommendation 15 but is pushing growing cross-border volume is not a routine relationship. It is a flashing light. The table turns that light on. Jurisdictional risk stops being a vague background concern and becomes a factor a firm can evidence, document and act on, and a counterparty risk assessment that ignores the implementation status of the counterparty's own regulator is no longer defensible.

Nesting hides the real VASP counterparty

The counterparty a firm can see is not always the counterparty it is dealing with. The FATF's 2025 report on offshore VASPs sets out how providers created under the laws of one jurisdiction, serving clients in another, structure their activities to avoid regulatory obligations. More troubling for counterparty risk is the nested relationship the report describes, in which an offshore, unlicensed VASP accesses the services of a licensed VASP by posing as an ordinary individual customer. The licensed firm believes it is serving a retail client. It is in fact providing infrastructure to an unregulated institution processing third-party flows.

Nesting defeats counterparty due diligence at its foundation, because the assessment is performed against the wrong entity. A firm that verifies its immediate customer but never asks whether that customer is itself moving other people's funds has assessed a facade. The FATF found that under half of jurisdictions, 46 percent, apply an activity-based approach that would bring such offshore providers into supervision. In the majority that do not, the burden of detecting the concealed counterparty falls on the firm itself. This is the point at which the borrowed mechanism shows its seams. Identity-based compliance assumes a counterparty who can be named and held responsible; a pseudonymous market populated by shells and nested access is precisely the environment in which that assumption fails, however diligent the firm.

The ledger raises the standard

Virtual asset transfers carry an advantage that wire transfers do not: the ledger is public. The FATF's March 2026 report on stablecoins and unhosted wallets leans on this directly, encouraging VASPs to use blockchain analytics to determine the risk level of a customer's counterparties and, where a transfer involves an unhosted wallet, to look multiple hops back through a transaction's history to understand the wider financial crime risk. Counterparty assessment is no longer a one-time check at the point of a relationship. It is a continuous reading of on-chain behaviour.

The public ledger removes the oldest excuse in compliance: that the information was not available. It was always available; the firm simply did not look. Once the tools to trace a counterparty's exposure across multiple prior transactions are demonstrably in use across the industry, a firm that does not use them cannot argue its assessment was adequate. The report notes that stablecoins have become the dominant vehicle for illicit on-chain activity, which places the sharpest counterparty risk precisely where transaction volume is heaviest. The transparency the ledger offers a firm is the same transparency a supervisor will use to judge it.

Which sharpens the uncomfortable question. If the ledger already exposes counterparty risk directly, what is the travel rule's off-chain message actually adding? Delphine Forma, a compliance specialist in the sector, has argued that the FATF should reassess whether a rule designed for traditional finance fits the crypto context at all, asking whether names are always necessary when tech-native tools may serve the same purpose more effectively. That is not an argument against transparency. It is an argument that firms may be pouring resources into transmitting a fragile proxy for information the chain reveals more reliably on its own. A counterparty risk framework built only on the message risks optimising the wrong instrument.

Reassess the counterparty, not the pipe

The temptation is to treat travel rule compliance as a messaging project that is largely finished once data flows. That is the misreading. The messaging is the easy part. The risk sits in the counterparty, and the counterparty is exactly what the messaging cannot verify.

A defensible programme rests on four questions, and most firms can answer only the last one well. Is counterparty identification treated as a risk control in its own right, with a documented method for telling a VASP from an unhosted wallet before any obligation is assigned? Is the sunrise decision governed by a policy that says when the firm proceeds, delays or declines, rather than left to whoever is on the desk that day? Does jurisdictional implementation status actually feed the counterparty rating, and are nested and offshore relationships tested for rather than assumed away? And does on-chain analysis run continuously, not once at onboarding and never again? A firm that can answer all four has a counterparty risk framework; a firm that has only built the pipes has a transmission system mistaken for a control.

Conclusion: Who benefits from the doubt

The travel rule was designed to make the sender and receiver of value visible to each other and to authorities. In virtual assets, it has largely delivered the transmission and left the trust unsolved: a VASP can send immaculate data to a counterparty it cannot identify, in a jurisdiction it cannot rely on, concealing an entity it has never assessed. The revised Recommendation 16 does not close that gap; it raises the standard against which the gap will be judged. But the deeper unease should not be smoothed over, because a rule that assumes a nameable, accountable counterparty has been dropped into a market built to frustrate exactly that assumption, and no amount of diligence fully reconciles the two. Counterparty risk, in the end, is the discipline of deciding who benefits from the doubt when the other end of a transfer cannot be vouched for, and under sunrise gaps and nested shells the honest answer is often the criminal. Managing that doubt is the whole of the task, and pretending the message alone resolves it is the most dangerous assumption a firm can make.

Are you managing the counterparty, or just the message that describes it?

At OpusDatum, we start from the premise the travel rule leaves unresolved: that in virtual assets the counterparty, not the message, is the risk. We help firms build assessment around what the ledger actually shows, from identification and jurisdictional rating to nested-relationship testing and analytics-led monitoring, rather than treating transmission as the end of the obligation. The goal is a counterparty risk framework that holds up whether or not the rule keeps pace with the market it governs.

To review how the revised Recommendation 16 reshapes your counterparty risk approach, contact us.