I85PREP
⌘ K
CAFP study materials
CAFP study resources

CAFP: Emerging Risks and Technologies: Virtual Assets, Fintech, and Digital Identity

CAFP · Work through your exam, one topic at a time.

All guide sections

Emerging Risks and Technologies: Virtual Assets, Fintech, and Digital Identity

What the exam tests

This domain tests how new technologies change AML/CFT risk: virtual assets, VASPs, the travel rule, fintech models and digital identity. Expect questions on FATF Recommendation 15, blockchain analytics and synthetic identity.

Core rules and concepts

  • FATF Recommendation 15 requires countries to regulate VASPs for AML/CFT and to apply the travel rule: originating and beneficiary VASP information should accompany virtual-asset transfers. The FATF defines a virtual asset as a digital representation of value that can be traded or transferred and used for payment or investment.
  • VASPs include exchanges, custodians and some brokers; decentralised finance, mixers and anonymity-enhanced cryptocurrencies create higher risk. Blockchain analytics can trace flows but not fully de-anonymise off-chain activity.
  • Fintech risks include rapid onboarding, mobile money, open banking APIs, robo-advisers and third-party reliance. Controls must scale with volume without weakening CDD.
  • Digital identity: eKYC, biometrics and liveness detection can improve verification, but synthetic identities, deepfakes and data breaches create new risks. Digital identity systems must be tested, monitored and privacy-compliant.
  • NFTs and stablecoins may fall within virtual-asset rules depending on design and jurisdiction; do not assume all tokens are outside scope.

Worked example

A crypto exchange onboards a customer who uses a mixer before sending funds to the exchange. The travel rule data is missing, and the customer's wallet has exposure to a darknet market. The exchange should treat the customer as high risk, conduct EDD, obtain source of funds, and consider filing a SAR. If the exchange cannot obtain travel-rule information, it should apply a documented risk-based policy, which may include blocking or restricting the transfer. Reasoning: mixers and missing originator information are red flags; VASPs must apply the travel rule and enhanced monitoring.

Traps that cost marks

Do not assume virtual assets are unregulated everywhere; FATF R.15 sets the standard. Do not ignore the travel rule for VASPs. Do not treat blockchain analytics as conclusive. Do not accept a digital identity check without liveness or document verification. Do not assume NFTs are always outside AML scope.