Turn FATF offshore VASP risks into a jurisdiction checklist

Map the legal and operating locations separately

A provider can be incorporated in one place, operate infrastructure elsewhere and serve customers in several jurisdictions. The word offshore does not answer whether a particular entity is licensed or unlawful. Build a map of specific roles and sources before drawing a conclusion about a payment route.

FATF's March 2026 report defines offshore VASPs as providers created under one jurisdiction's laws, with or without physical presence, that serve clients residing in another, and it describes oversight gaps and mitigation practices. A route is complete only when environment, asset, issuer, recipient and fee requirements agree at the same time. Keep brand beside entity; compare company number with incorporation country by date, and leave source open until customer location is verified.

Identify the legal entity

Brand names, apps and domains can sit above one or more companies. Find the contracting entity and incorporation record from terms and official registers. The brand, entity, company number, incorporation country and source belong on the jurisdiction-and-oversight map. Compare the authenticated receiving instruction with the sending wallet immediately before approval, not from memory. Name the owner of offered service, the source for solicitation, the unit attached to brand and the condition that would change company number.

A shared brand does not transfer a licence between legal entities. Leave the transfer unsigned whenever one coordinate is missing, even if a similar route worked previously. A reviewer should reproduce incorporation country from source, trace customer location to offered service and understand why entity was not substituted for solicitation. Apply the instruction again in its narrow form: Find the contracting entity and incorporation record from terms and official registers. Preserve the evidence for identify the legal entity without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Locate customers and activity

Regulatory obligations can depend on where customers live and where services are offered. Record the user's jurisdiction and the service being considered. The customer location, offered service, solicitation, domain and date belong on the jurisdiction-and-oversight map. Leave the transfer unsigned whenever one coordinate is missing, even if a similar route worked previously. A reviewer should reproduce incorporation country from source, trace customer location to offered service and understand why entity was not substituted for solicitation.

Do not infer permission from website accessibility alone. A route is complete only when environment, asset, issuer, recipient and fee requirements agree at the same time. If company number conflicts with customer location, retain both captures, recheck brand and postpone any step that depends on source. Apply the instruction again in its narrow form: Record the user's jurisdiction and the service being considered. Preserve the evidence for locate customers and activity without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Check licensing and supervision

Registration, licensing and active supervision are distinct concepts across jurisdictions. Use the named authority's current register and capture status and scope. The authority, licence type, entity, permitted activity, status and date belong on the jurisdiction-and-oversight map. A route is complete only when environment, asset, issuer, recipient and fee requirements agree at the same time. If company number conflicts with customer location, retain both captures, recheck brand and postpone any step that depends on source.

A FATF report is not a substitute for the local regulator's entity record. Compare the authenticated receiving instruction with the sending wallet immediately before approval, not from memory. The final decision must connect solicitation to incorporation country, preserve the boundary around entity and state when offered service needs another observation. Apply the instruction again in its narrow form: Use the named authority's current register and capture status and scope. Preserve the evidence for check licensing and supervision without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Read risk indicators cautiously

FATF describes patterns such as weak presence, fragmented oversight and cross-border information gaps. Use indicators to decide what to verify, not to label a provider criminal. The indicator, observed fact, missing evidence, verification source and conclusion belong on the jurisdiction-and-oversight map. Compare the authenticated receiving instruction with the sending wallet immediately before approval, not from memory. The final decision must connect solicitation to incorporation country, preserve the boundary around entity and state when offered service needs another observation.

One indicator without entity evidence cannot prove misconduct. Leave the transfer unsigned whenever one coordinate is missing, even if a similar route worked previously. Keep brand beside entity; compare company number with incorporation country by date, and leave source open until customer location is verified. Apply the instruction again in its narrow form: Use indicators to decide what to verify, not to label a provider criminal. Preserve the evidence for read risk indicators cautiously without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Connect policy to the transaction

A lawful entity check still leaves asset, network, receiver and custody questions. Match the authenticated transfer route after the jurisdiction review. The provider, asset, chain, receiver, account status and payment evidence belong on the jurisdiction-and-oversight map. Leave the transfer unsigned whenever one coordinate is missing, even if a similar route worked previously. Keep brand beside entity; compare company number with incorporation country by date, and leave source open until customer location is verified.

Regulatory status does not guarantee price, technical success or account credit. A route is complete only when environment, asset, issuer, recipient and fee requirements agree at the same time. Name the owner of offered service, the source for solicitation, the unit attached to brand and the condition that would change company number. Apply the instruction again in its narrow form: Match the authenticated transfer route after the jurisdiction review. Preserve the evidence for connect policy to the transaction without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Use FATF for the cross-border risk framework

The report supports the definition, systemic risk patterns and oversight practices used to structure the checklist. Cite FATF offshore VASP risk report with its HTTPS address and access date; use source-checked explainers only for supporting definitions. If company number conflicts with customer location, retain both captures, recheck brand and postpone any step that depends on source. Compare the authenticated receiving instruction with the sending wallet immediately before approval, not from memory.

It does not name every current provider or decide the legal status of one customer's transaction. The final decision must connect solicitation to incorporation country, preserve the boundary around entity and state when offered service needs another observation. Leave the transfer unsigned whenever one coordinate is missing, even if a similar route worked previously.

End at a named entity and a dated regulator record

Keep uncertainty visible where corporate, licensing or customer-location evidence is incomplete, and do not send funds until the route is understood. Name the owner of offered service, the source for solicitation, the unit attached to brand and the condition that would change company number. A route is complete only when environment, asset, issuer, recipient and fee requirements agree at the same time.

Regulatory research can reduce one uncertainty but cannot create safe winnings or justify gambling with essential funds. Adults 18+ who meet local law should protect essential money, set cash and time limits before any play, never borrow or chase losses, and use the responsible-play centre for stronger separation or confidential support. A reviewer should reproduce incorporation country from source, trace customer location to offered service and understand why entity was not substituted for solicitation.