Offshore VASP Risk: How Crypto Businesses Should Identify and Manage oVASP Exposure

On 11 March 2026, FATF published its report Understanding and Mitigating the Risks of Offshore Virtual Asset Service Providers, making oVASP exposure a named compliance issue rather than a subcategory of general counterparty risk. The report’s central finding is that fewer than half of global jurisdictions—only 46%—have adopted an activity-based approach to VASP regulation and supervision, meaning that most jurisdictions still apply licensing or registration requirements based on where a provider is incorporated rather than where it actually operates and serves customers. This gap is what makes offshore VASP risk materially different from simply working with a foreign counterparty.

For crypto businesses, the practical consequence is that a counterparty with a registration document from one jurisdiction may be conducting its actual business, serving its actual customers, and running its actual transaction flows in entirely different markets—with no meaningful supervision covering that activity. The risk is not that the company is foreign. The risk is the mismatch between incorporation, actual operations, customer base, licensing scope, and the supervision that is supposed to govern them.

This creates specific problems around counterparty exposure, nested relationships, Travel Rule information gaps, weak AML controls, and audit defensibility. For general counterparty checks, the process of verifying legal entity status, regulatory status, Travel Rule readiness, and on-chain risk is covered in AMLBot’s guide on Counterparty VASP Due Diligence. This article focuses specifically on the additional risks created by offshore and cross-border operating models.

What Is an Offshore VASP / oVASP?

VASP stands for Virtual Asset Service Provider—a company that provides crypto exchange, transfer, custody, or related financial services in connection with virtual assets. An offshore VASP, or oVASP, is a VASP that is created under the laws of one jurisdiction, with or without a physical presence, while providing its services to clients residing in another jurisdiction. This is FATF’s own working definition from the March 2026 report. The term does not carry an automatic legal or criminal classification. An offshore VASP is not inherently illegal. The risk assessment depends on whether the provider’s actual activity is covered by meaningful supervision—and in most cases that question requires more than checking a registration certificate.

Offshore VASP vs Foreign VASP

The two terms are often used interchangeably, but they describe different risk profiles. A foreign VASP is any provider registered or based in a jurisdiction other than the assessing business’s own. This alone is not a risk indicator. Many cross-border relationships involve properly licensed, well-supervised foreign counterparties that present no particular AML concern beyond normal due diligence.

Offshore VASP risk appears when the mismatch between entity, licensing scope, customer base, and actual activity creates a supervision gap. A provider that is incorporated in one jurisdiction, serves customers primarily in a second jurisdiction, routes funds through a third, and holds a license that technically covers none of their actual services creates a compliance exposure that a standard foreign VASP relationship does not. The risk is structural, not geographic.

Why oVASP Exposure Matters in 2026

The FATF report published in March 2026 made oVASP exposure a specific compliance issue because the combination of factors driving it has intensified: the fragmented global implementation of VASP licensing regimes, the growth of cross-border crypto services, the expansion of stablecoin flows across jurisdictions, the persistence of Travel Rule gaps in most markets, and the increasing sophistication of nested relationships where unlicensed providers access financial infrastructure through accounts held at regulated entities.

FATF President Elisa de Anda Madrazo described the core problem directly: oVASPs create blind spots that criminals exploit to conduct large-scale fraud, convert illicit proceeds, and provide financial support to terrorist groups—with the blind spots arising specifically from regulatory gaps between jurisdictions. The report cited a Nigerian FIU investigation into an investment fraud scheme where oVASPs served as final cash-out points, with one global VASP-linked wallet holding approximately $600 million at the time of analysis.

For businesses, the implication is that requesting a company certificate is no longer sufficient to assess the risk a counterparty presents. The question is who actually provides the service, to whom, where, and under what supervision. The broader FATF standards under which these obligations arise are explained in AMLBot’s guide on FATF Crypto Standards for VASPs.

Why Offshore VASPs Create AML/CFT Risk

The AML/CFT risk created by oVASP exposure is not a single problem but a cluster of related issues that arise from the structural mismatch between where a provider is registered and where it actually operates. These issues should be understood as part of the broader landscape of AML/CFT Risks in Crypto, including fraud, sanctions exposure, laundering typologies, scam-related flows, and weak control environments.

Regulatory Arbitrage and Licensing Gaps

Some providers deliberately incorporate in jurisdictions with lower compliance costs, weaker enforcement mechanisms, or limited supervisory capacity—while serving customers in more regulated markets where they have no local license and face no meaningful oversight. This is regulatory arbitrage, and FATF’s March 2026 report identified it as a primary driver of the risks oVASPs create. Registration alone is not evidence of adequate supervision. A registration document confirms that a provider exists as a legal entity in a particular jurisdiction. It does not confirm that the license covers the actual services being provided, that the licensed entity is the one conducting the activity, or that the supervising authority has any effective oversight over what the provider does in other markets. For businesses building an audit-defensible compliance file, demonstrating that the counterparty relationship was assessed properly requires going beyond the registration document.

Nested Relationships and Hidden VASP Activity

A nested relationship occurs when an offshore or unlicensed provider accesses the services of a regulated VASP through another account rather than directly as an identified institution. FATF’s March 2026 report explicitly highlights this as a misuse pattern: offshore, unlicensed VASPs access services from a licensed VASP by posing as private individual customers. The licensed VASP then unknowingly processes what amounts to exchange, transfer, or payment activity for the unlicensed provider’s own customers—with no visibility over who those end customers are.

FATF explicitly invokes Recommendation 13—the correspondent banking standard—as the applicable framework for managing nested VASP relationships, making clear that the compliance obligation is not simply to check the direct counterparty but to understand what activity is happening behind that relationship.

Transaction patterns are often the clearest indicator of hidden VASP activity. Many unrelated incoming deposits, frequent outgoing settlements, high transaction velocity, and flows that look like customer activity rather than ordinary business use are the signatures of nested service relationships rather than a single entity managing its own treasury. A counterparty whose onboarding file looks acceptable may later show wallet behavior that resembles hidden VASP activity—which is why crypto transaction monitoring matters beyond the onboarding stage.

Weak Travel Rule and Information-Sharing Controls

When a counterparty is an oVASP, it may operate in a jurisdiction that has not implemented Travel Rule requirements domestically, meaning there is no legal obligation for it to transmit originator and beneficiary information alongside transfers. Even where Travel Rule obligations exist in principle, an oVASP using complex group structures can deflect information requests by claiming that customer data is legally controlled by a different subsidiary in another jurisdiction—a documented pattern in FATF’s report, with formal mutual assistance requests sometimes taking up to a year to yield basic subscriber information. The practical result is that a business receiving transfers from an oVASP counterparty may have incomplete originator or beneficiary records, weakening the audit trail and creating gaps in the source-of-funds documentation that exchanges, banks, and regulators may subsequently request. Travel Rule readiness should be assessed alongside on-chain risk, not instead of it.

How to Identify oVASP Exposure Before Working With a Counterparty

Check the Entity, Not Just the Brand

Large crypto brands often operate through multiple legal entities across different jurisdictions. The brand name visible on a website or in a commercial agreement may not be the entity that actually holds customer funds, executes transfers, issues the license, or controls the wallets. Identifying oVASP exposure starts with mapping the full entity structure: which company is the contracting entity, which is the operating entity, which holds custody, which processes payments, and which controls the wallet addresses involved in the relationship.

If the brand, website, license holder, custody entity, and wallet controller do not point to the same legal entity—or to a clearly disclosed and connected group structure—this should be treated as a signal for enhanced review rather than a technicality to be noted and set aside. FATF’s report flags global customer pooling as a specific structural concern: some VASPs manage all customer accounts through a group-level arrangement and, when regulators request information about specific customers, claim the customer is serviced through a different group entity in another jurisdiction.

Compare Jurisdiction, Customer Base, and Actual Activity

After identifying the relevant legal entities, the next step is comparing what the documents say with what the provider actually does. The questions that drive this assessment include: where is the company registered and where is management actually located; which countries are its customers predominantly based in; which legal entity provides custody, exchange, or transfer services to those customers; is that entity licensed for those services in those markets; does the provider claim that no license is required while actively serving customers in regulated jurisdictions; and does the declared business model match the actual transaction behavior visible on-chain?

For startups building their first risk framework, this kind of counterparty and offshore exposure assessment should also be part of broader business-wide risk evaluation, as covered in the Crypto Startup AML Checklist.

Review Wallet Exposure and Transaction Patterns

Entity documents establish what a provider claims to be. On-chain data shows what its wallets actually do. Wallet screening for sanctions exposure, scam connections, darknet market links, mixer usage, stolen fund exposure, and high-risk exchange interactions provides the transaction-level risk picture that document review cannot supply. For assessing potential nested VASP activity, the behavioral indicators matter as much as the risk categories: high transaction volume, many distinct counterparties, fast in-and-out flow patterns, and omnibus-style wallet behavior are signals that a wallet is handling aggregated customer activity rather than a single entity’s own treasury management.

Red Flags That May Indicate Offshore VASP Risk

Business Red Flags

At the entity and documentation level, common offshore VASP red flags include a provider that serves regulated markets but holds a license in a different jurisdiction or claims no license is required; vague or inconsistent legal entity information where the brand, license holder, and operating entity do not match; unclear or undisclosed beneficial ownership; terms of service that describe the service differently from how it actually operates; no named compliance contact or a nominal compliance officer who cannot meaningfully respond to requests; refusal to explain the customer base or operating markets; and AML, KYC, or KYT policies that are absent, generic, or inconsistent with the scale of the business.

On-Chain Red Flags

At the transaction level, warning indicators include high-risk source or destination exposure in wallet screening; repeated interaction with risky services such as mixers, darknet markets, or high-risk exchanges; fast layering patterns where funds move rapidly through multiple addresses without apparent commercial purpose; sudden changes in transaction behavior that do not match the declared business model; and wallet clusters with exposure to illicit typologies identified by blockchain analytics. These indicators should be reviewed together with the broader alert workflow rather than as isolated signals—the process for handling them is covered in AMLBot’s guide on High-Risk Crypto Transaction Alerts.

Operational Red Flags

In the compliance interaction itself, red flags include an incomplete or refused Travel Rule response; no documented sanctions screening process; inability to explain source of funds or wallet ownership; no alert review or escalation process; no audit trail for compliance decisions; and poor or delayed responses to routine compliance questions that any properly supervised institution would be able to answer without difficulty. FATF’s March 2026 report specifically notes the appointment of nominal compliance officers—individuals with insufficient seniority, no access to customer data, and no real authority to act—as a supervisory concern that businesses should also watch for in counterparty relationships.

How to Manage oVASP Risk After Detection

Not every oVASP signal requires automatic rejection. The appropriate response depends on the risk level found, the nature of the relationship, the available documentation, and the business’s own risk appetite and jurisdiction. The goal is a documented, proportionate decision—not a reflexive action in either direction.

Apply Enhanced Due Diligence When the Risk Is Not Clear

Where initial review surfaces offshore VASP indicators but does not resolve them conclusively, enhanced due diligence provides a structured way to gather the information needed for a defensible decision. Enhanced due diligence for oVASP exposure may include requesting additional entity documentation that clarifies the relationship between brand, operating entity, and license holder; licensing confirmation that shows the scope of authorization matches the actual services provided; ownership and beneficial ownership clarification; a review of the counterparty’s AML, KYC, and KYT procedures; Travel Rule capability confirmation with evidence of actual implementation; wallet ownership proof tying the wallet addresses used in the relationship to the identified legal entity; source of funds and source of wealth explanation for the counterparty; and an expected transaction flow description that can be compared to actual on-chain behavior.

Restrict or Reject Relationships When Risk Cannot Be Explained

If a counterparty cannot explain its licensing scope, wallet control, customer base, or Travel Rule readiness after a reasonable enhanced due diligence process, the business faces a compliance decision: restrict the relationship, reject it, or escalate it to a senior compliance or legal review. This is a risk-based compliance decision, not a blacklist. The question is not whether the provider is offshore—it is whether the risk created by the relationship can be adequately assessed, documented, and managed. FATF’s March 2026 report recommends that businesses refrain from establishing or maintaining business relationships with unlicensed or unregistered providers where the exposure cannot be managed.

Keep an Audit Trail for Every Decision

Whether the decision is to proceed, enhance monitoring, restrict, or reject, the compliance record should capture the entity checks conducted, the licensing review and its findings, jurisdiction analysis, ownership information gathered, service model description, wallet screening results, transaction monitoring alerts, Travel Rule capability assessment, compliance correspondence, and the final risk decision with the reasoning behind it. This audit trail matters not only for internal governance but for regulators, banking partners, auditors, and institutional counterparties that conduct their own due diligence on the business and its relationships.

Offshore VASP Risk Checklist for Crypto Businesses

Conclusion

Offshore VASP risk is now a specific compliance issue, not simply a cross-border detail that can be managed with a standard counterparty file. FATF’s March 2026 report established the framework: oVASPs create regulatory blind spots that arise from the mismatch between where providers are incorporated, where they actually operate, and where supervision actually applies. The fact that only 46% of jurisdictions have adopted an activity-based regulatory approach means this mismatch is the norm in most markets, not an exception.

For crypto businesses, the key question when assessing any counterparty relationship that may involve offshore VASP exposure is not whether the company is foreign. The question is whether the activity is properly supervised, whether the exposure is explainable, and whether the monitoring is in place to catch changes in risk profile before they become compliance incidents. That requires entity due diligence, activity-based risk assessment, wallet screening, Travel Rule review, ongoing monitoring, and documented decisions that can withstand regulatory or partner scrutiny.

Follow AMLBot:
🔗 Website
🔗 Telegram
🔗 Support Team
🔗 LinkedIn

FAQ