A virtual asset is a digital representation of value that can be traded or transferred and used to pay or invest, as defined by FATF, generally excluding fiat, securities, and other assets already covered by existing rules. This definition sets the regulatory perimeter for what counts as crypto under AML rules and who qualifies as a service provider.
What is a virtual asset, in plain English?
A virtual asset is FATF's term for what most people just call crypto. In its definition, a virtual asset is a digital representation of value that can be digitally traded or transferred and used for payment or investment. Bitcoin, most tokens, and similar instruments fit. The definition deliberately carves out things already covered by other rules, like fiat currency, traditional securities, and other regulated financial assets, so the term captures the new category rather than duplicating the old ones.
The reason this dry-sounding definition matters is that it draws a regulatory perimeter. If something is a virtual asset, then the businesses that deal in it are usually virtual asset service providers, and they inherit AML obligations: customer due diligence, transaction monitoring, sanctions screening, and the Travel Rule. If something falls outside the definition, a different set of rules, or none of these, may apply.
So the concept is really about scope. It answers the questions: is this instrument in the crypto AML regime, and is this business a regulated provider? Those answers drive the entire compliance stack, which is why getting the classification right is a foundational step, not a technicality.
In scope versus out of scope
The definition sorts instruments into those that carry crypto AML obligations and those covered elsewhere.
What changes | Out of scope | Virtual asset (in scope) |
Examples | Fiat currency, regulated securities | Bitcoin, most transferable tokens |
Rule set | Existing banking or securities rules | Crypto AML obligations apply |
Provider status | Bank, broker, or existing regime | Virtual asset service provider |
Gray areas | Clear when squarely covered | Certain tokens and NFTs are borderline |
Who is involved?
Who | Their role |
FATF | Defines the term and sets the standard that national regulators translate into law. |
Regulators | Decide how the definition applies locally and who counts as a service provider. |
Service providers | Exchanges and others whose scope determines their KYC, monitoring, and Travel Rule duties. |
Compliance teams | Classify borderline instruments to apply the right controls and meet real obligations. |
What it looks like in practice
In practice
A platform plans to launch support for a new type of token. The compliance team's first question is not about the technology but about scope: is this token a virtual asset under the applicable rules, and does supporting it make the platform a regulated service provider for that activity.
The token sits in a gray area, with features that look partly like a security and partly like a payment instrument. If it is treated as a virtual asset, the platform must apply KYC, monitoring, sanctions screening, and the Travel Rule to related transfers. If it is instead a security, a different regime applies. The team documents its classification carefully, because misjudging it could leave real obligations unmet or attach the wrong controls entirely.
Why it matters to operators
Scope drives obligations, so the virtual asset classification is where a compliance program begins. Whether you owe KYC, transaction monitoring, sanctions screening, and Travel Rule compliance on a given activity depends on whether the instrument is a virtual asset and whether you are acting as a service provider. Get that right and the rest of the stack follows; get it wrong and you are either over-controlling something outside the regime or, worse, missing duties you actually have.
The tricky part is the edges. Borderline instruments like certain tokens and some NFTs create genuine classification gray areas, and the answer can differ by jurisdiction. The operator risk is misjudging scope in either direction, which is why teams document their reasoning and revisit it as products and rules evolve rather than assuming a one-time call holds forever.
What to watch for
- Scope drives everything. Classification determines whether KYC, monitoring, screening, and the Travel Rule apply, so treat it as a foundational decision.
- Carve-outs. Fiat, securities, and other already-regulated assets generally fall outside the term and under their own rules instead.
- Borderline tokens and NFTs. Instruments with mixed features create gray areas; document your classification reasoning.
- Jurisdiction differences. The same instrument can be scoped differently across regions, so a single global assumption is risky.
- Provider status. Being in scope often makes your business a virtual asset service provider with the full set of obligations attached.
Quick questions
Is a virtual asset the same as cryptocurrency?
Close, but virtual asset is the formal regulatory term FATF uses. It covers cryptocurrencies and most transferable tokens, while deliberately excluding fiat and assets already covered by other rules.
What is excluded from the definition?
Generally fiat currency, traditional securities, and other financial assets already covered by existing regimes. The term is meant to capture the new category rather than duplicate rules that already exist.
Why does the classification matter so much?
Because it sets the regulatory perimeter. If something is a virtual asset, businesses dealing in it usually take on crypto AML obligations. If not, a different rule set, or none of these, applies.
Are NFTs virtual assets?
It depends. Some NFTs sit in a gray area between a collectible and a financial instrument, and treatment varies by jurisdiction and by how the NFT is actually used. That is exactly why classification can be hard.
What is a virtual asset service provider?
A business that conducts activities like exchanging, transferring, or safekeeping virtual assets. Being in scope as a virtual asset provider brings obligations such as KYC, monitoring, screening, and the Travel Rule.
What goes wrong if scope is misjudged?
You either apply the wrong controls to something outside the regime or fail to meet obligations you genuinely have. Both create risk, which is why teams document classifications and revisit them as rules evolve.
Go deeper
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.
- OFAC, US Treasury ↗ — Administers US sanctions programs, the SDN list, and licensing.