Counterparty VASP due diligence is the process of assessing the virtual asset service provider (VASP) on the other side of a virtual asset transfer. Before sharing customer information under the Travel Rule, a VASP should establish the counterparty’s identity, assess its regulatory status and AML/CFT controls, and determine whether it can securely handle the required information. The assessment should also consider potential exposure to sanctions, fraud and other illicit financial activity.
This guide explains the key regulatory expectations for counterparty VASP due diligence and provides a practical framework for conducting assessments, identifying risk factors, documenting decisions and maintaining evidence for audits and supervisory reviews.
Key takeaways on counterparty VASP due diligence
- Assess the counterparty, not just the customer: Counterparty VASP due diligence evaluates the virtual asset service provider on the other side of a transfer.
- Conduct risk-based assessments: FATF guidance supports assessing counterparties before relevant relationships begin, with periodic reviews and reassessments when risks change. Applicable local rules determine the precise requirements.
- Verify the essentials: Confirm the counterparty’s legal identity, licensing or registration status, AML/CFT controls and ability to comply with applicable Travel Rule requirements.
- Look beyond legislation: FATF’s 2026 targeted update highlights the continuing gap between Travel Rule legislation and effective supervision and enforcement.
- Separate registration from control effectiveness: Registration does not, by itself, demonstrate that a counterparty’s AML/CFT controls are adequate.
- Document decisions and exceptions: Maintain a counterparty register, record risk assessments and approval decisions, and establish procedures for unreachable or higher-risk counterparties.
What is counterparty VASP due diligence?
When a customer transfers virtual assets between platforms, the transaction may involve an originating VASP and a beneficiary VASP. Under the FATF Recommendations, Recommendation 16, as applied to virtual asset transfers through Recommendation 15, establishes requirements for obtaining, holding and transmitting specified originator and beneficiary information. These requirements are commonly known as the Travel Rule and are implemented through the applicable national regulatory frameworks.
However, transmitting Travel Rule information also requires confidence that the receiving VASP is appropriately identified and can handle the information securely. Counterparty VASP due diligence helps establish the counterparty’s identity, regulatory status and AML/CFT controls, while assessing the risks of engaging with it. The process has similarities to correspondent banking due diligence, as both involve assessing another financial service provider rather than an individual customer. However, specific legal requirements for correspondent relationships apply only where the relevant regulatory conditions are met.
FATF guidance supports a structured approach to counterparty assessment.
- First, the VASP determines whether the transfer involves another VASP or an unhosted wallet.
- Second, where another VASP is involved, it identifies the counterparty and verifies its legal identity and regulatory status.
- Third, it assesses whether the counterparty is an appropriate party to transact with and can meet the applicable Travel Rule requirements, including the secure handling of required originator and beneficiary information.
What regulators expect
FATF standards and guidance are not binding law on their own. Instead, each jurisdiction implements them through its own rules. So, the frameworks below differ in legal force, although they point in the same direction.
FATF (guidance)
FATF’s updated guidance on virtual assets and VASPs, finalised in October 2021, supports risk-based counterparty assessment before relevant relationships begin. It also covers periodic review. Its June 2025 best practices on Travel Rule supervision treat counterparty due diligence as a core supervisory focus.
EU (binding)
Regulation (EU) 2023/1113, the Transfer of Funds Regulation, is directly applicable across EU Member States and has applied the Travel Rule to crypto-asset service providers (CASPs) since 30 December 2024. Separately, Article 19b of the EU AML Directive, introduced by that Regulation, establishes enhanced due diligence requirements for qualifying cross-border correspondent relationships with respondent institutions established outside the EU. These requirements include verifying licensing or registration, assessing AML/CFT controls, obtaining senior management approval and documenting the respective responsibilities. They do not apply to every transfer between an EU CASP and a non-EU provider.
The framework is scheduled to transition with the application of Regulation (EU) 2024/1624, the EU AML Regulation, from 10 July 2027. Article 37 addresses enhanced due diligence for qualifying correspondent relationships involving crypto-asset service providers. Firms should consult the provisions applicable at the relevant date when assessing their obligations.
UAE (VARA, binding)
The Travel Rule provisions in VARA’s rulebooks require risk-based due diligence before a VASP transacts with a counterparty VASP in another jurisdiction. That due diligence need not be repeated for every later transaction, unless heightened counterparty risk is identified.
India (FIU-IND)
FIU-IND’s AML/CFT/CPF guidelines for VDA service providers, updated on 8 January 2026, address Travel Rule compliance and related controls. Registered VDA SPs should therefore assess the regulatory status and risks of their counterparties, including offshore platforms. Where an offshore provider’s activities fall within India’s registration requirements, firms should verify its FIU-IND registration. They should also assess the legality of the relationship and the counterparty’s controls separately.
Firms should always check the current rules in each jurisdiction where they operate. Our guide to global crypto Travel Rule compliance summarises the wider landscape.
How to conduct counterparty VASP due diligence
A practical process usually follows six steps. Each step should leave a record that an auditor or supervisor can review.
1. Determine the counterparty type
First, establish whether the destination or source address belongs to a VASP or to an unhosted wallet. Travel Rule messaging tools and blockchain analytics can help with this. If the firm cannot tell, a sensible internal control is to treat the transfer as higher risk until it resolves the question.
2. Identify the counterparty VASP
Next, confirm the legal entity behind the platform. That means its registered name, jurisdiction, ownership and, where relevant, group structure. Trading brands often differ from legal entity names, so match them carefully.
3. Check licensing or registration
Then confirm whether the counterparty holds a licence or registration where its jurisdiction requires one. Check the regulator’s public register directly rather than relying only on the counterparty’s own claims. Also check whether it is permitted to serve customers in your market. Remember, though, that registration is not proof of effective AML/CFT controls.
4. Assess AML/CFT controls
After that, review the counterparty’s AML/CFT framework in proportion to risk. Evidence should match the risk and what is available. For example, it might include an AML policy summary, a due diligence questionnaire or recent audit evidence. Key questions include whether it performs KYC, screens for sanctions, monitors transactions and files suspicious transaction reports.
5. Review risk indicators
In addition, review adverse media, regulatory actions and sanctions exposure. Treat three inputs separately. First, jurisdiction risk, such as FATF lists. Second, the firm’s own country risk ratings. Third, transaction-level exposure from blockchain analytics, which can show direct or indirect links to illicit or sanctioned activity.
6. Decide, document and monitor
Finally, record a risk rating and a decision. The decision may be to approve, approve with conditions, restrict or decline. Where local rules require senior management approval, obtain it. Otherwise, it remains a sound governance control for higher-risk relationships. Then add the counterparty to a register. Set a review date based on its risk rating, any regulatory timelines and trigger events.
Key risk factors in counterparty VASP due diligence
The table below summarises the factors most firms assess, with examples of evidence.
| Risk factor | What to check | Example evidence |
|---|---|---|
| Legal identity | Legal entity, ownership and group structure | Corporate registry extract, ownership chart |
| Licensing or registration | Status with the relevant regulator | Public register entry, licence number |
| AML/CFT controls | KYC, screening, monitoring and STR processes | Due diligence questionnaire, policy summary, audit letter |
| Travel Rule capability | Whether it can receive, send and protect required data | Travel Rule protocol details, test transfer records |
| Jurisdiction risk | Home country and markets served | FATF lists and the firm’s own country risk ratings |
| Sanctions and adverse media | Designations, enforcement and negative news | Screening results, media search records |
| On-chain exposure | Direct or indirect links to illicit activity | Blockchain analytics report |
| Products and access | Higher-risk features, such as privacy coins or no-KYC access | Product review, website and terms |
The sunrise issue and unreachable counterparties
The sunrise issue arises because jurisdictions have adopted the Travel Rule at different speeds. As a result, a VASP may need to send data to a counterparty with no legal duty to receive it. FATF published its seventh targeted update on virtual assets in July 2026. In it, 91 of 109 surveyed jurisdictions reported Travel Rule legislation in force. However, 55 of those 91 had not reported focused supervisory or enforcement action on Travel Rule compliance. These are survey responses, so they show a gap in reported supervision. They do not prove that those jurisdictions lack AML/CFT enforcement generally.
So, firms need a documented exception process for counterparties that cannot receive Travel Rule data. First, determine whether the transfer can lawfully proceed under the applicable rules. Next, check whether those rules permit an alternative secure transmission method. Then decide on escalation, holding or declining the transfer, or other legally permitted measures. Enhanced monitoring alone does not cure a mandatory Travel Rule failure.
Unhosted wallets need separate treatment. They have no VASP on the other side, so counterparty VASP due diligence does not apply. Instead, firms apply unhosted wallet controls under the applicable rules. These may include obtaining required information, verifying ownership or control, assessing transaction risk and using blockchain analytics. Thresholds and specific measures vary by jurisdiction.
Common gaps in counterparty VASP due diligence
Firms should check their counterparty controls for these common weaknesses:
- No counterparty register, or a register that lists platforms but not risk ratings or review dates.
- Licensing checks based on a counterparty’s website rather than the regulator’s register.
- No defined process for counterparties that cannot receive Travel Rule data.
- Due diligence completed once at onboarding, with no periodic review or trigger events.
- No senior management approval for higher-risk counterparties.
- Blockchain analytics results that are not linked to counterparty risk ratings.
These gaps matter because supervisors increasingly test Travel Rule controls in practice. Our guide to the Travel Rule compliance audit explains how auditors test these controls.
Frequently asked questions (FAQ)
Is counterparty VASP due diligence required for every transfer?
Generally, no. FATF guidance and rules such as VARA’s focus on due diligence before the first transaction, with risk-based review after that. However, firms should reassess a counterparty when its risk changes, for example after regulatory action. Local rules may set specific requirements.
How is counterparty VASP due diligence different from customer due diligence?
Customer due diligence assesses the firm’s own customer. By contrast, counterparty VASP due diligence assesses another service provider that the firm sends data to or receives assets from. In that sense, it resembles correspondent banking due diligence, although the legal rules differ.
What if the counterparty VASP is not licensed?
The appropriate response depends on the regulatory requirements applicable to the counterparty and the markets in which it operates. If a licence or registration is required but the counterparty does not hold it, this is a significant risk indicator. Depending on the jurisdiction, the circumstances and the applicable rules, dealing with the counterparty may also be prohibited. Firms should verify its regulatory status, determine whether the proposed relationship is legally permissible, consider restricting or declining the relationship where appropriate, and assess any applicable reporting obligations.
Can blockchain analytics replace counterparty VASP due diligence?
No. Blockchain analytics helps identify counterparties and on-chain exposure. However, it cannot confirm licensing, ownership or the quality of AML/CFT controls on its own.
How often should counterparty assessments be reviewed?
Frequency should follow risk and any regulatory timelines. For example, a firm might review higher-risk counterparties more often than lower-risk ones. It should also review them after material changes or trigger events, such as sanctions designations or enforcement actions.
Related Compliance7 guides
- Core guide: VASP Compliance in India: What FIU-Registered Firms Still Get Wrong
- Related: Travel Rule Compliance Audit: How VASPs Can Prepare in 2026
- Related: Global Crypto Travel Rule Compliance: Regulatory Expectations for VASPs in 2026
- Related: AML Audits for Crypto Exchanges and VASPs: What Regulators Expect
This article is for informational purposes only and does not constitute legal or regulatory advice. Requirements vary by jurisdiction. For guidance specific to your business, consult a qualified compliance professional.
