MSTR Cat

Crypto Law/Level I · What crypto is in law/1.3 Who's who/Lesson 7

International bodies: FATF, IOSCO and the FSB

The global groups that write crypto standards without any power to enforce them, and how their recommendations turn into national law.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Zero-tax residency stays lawful but not invisible: UAE and Swiss residents keep low or no tax on private gains, while CARF and DAC8 report holdings to the country of residence; US citizens remain taxed on worldwide income regardless.
  2. Using a MiCA-authorised provider in your EU country costs nothing extra and passports protections across the EU; the transitional periods of up to 18 months for existing providers have ended, so unlicensed firms may lose access.
  3. Under the EU Transfer of Funds Regulation, transfers to or from your own self-hosted wallet above €1,000 require the provider to verify you control it; proving ownership once, for example by signed message, avoids repeated delays.
  4. Germany’s holding-period rule leaves private crypto sales held over one year untaxed, with gains under €1,000 a year exempt for shorter holdings (§23 EStG); exceed the €1,000 threshold and the whole short-term gain is taxed.

MaterialsThe FATF’s 26 June 2025 targeted update on virtual assets and virtual asset service providersIOSCO’s Final Report with Policy Recommendations for Crypto and Digital Asset Markets (16 November 2023)The FSB’s global regulatory framework for crypto-asset activities (17 July 2023)Lesson 1.1.7, on reading a crypto-law headline

Wonder

  1. Can an international body fine a crypto company?
  2. Why do so many countries end up with similar crypto rules?
  3. What does ‘same activity, same risk’ actually mean?

Explore

  1. International standard setters are groups of governments or regulators that agree on common rules. They cannot fine anyone, license a business or send anyone to court. Instead, their members promise to adopt the standards in their own laws, and the groups check progress through reviews and public reports, so the pressure is mainly reputational and diplomatic. Three bodies shape crypto most: the Financial Action Task Force (FATF) for money laundering, the International Organization of Securities Commissions (IOSCO) for investment markets, and the Financial Stability Board (FSB) for risks to the whole financial system.
  2. The FATF was established in 1989 by the G7 group of large economies, and in April 1990 it issued its first Forty Recommendations against money laundering. In 2019 it updated Recommendation 15 and its Interpretive Note so that anti-money-laundering and counter-terrorist-financing rules apply to virtual assets and to virtual asset service providers (VASPs), businesses such as exchanges and custodians. That update includes the ‘travel rule’: VASPs should pass on information about the sender and recipient of a transfer, much like the US rule (lesson 1.3.4).
  3. The FATF tracks how countries carry this out. In its sixth targeted update, published on 26 June 2025, it reported progress since 2024 but said more work was needed on licensing and registration, that countries still struggle to identify who runs VASPs, and that offshore providers remain a risk. It counted 99 jurisdictions that had passed or were passing laws to implement the travel rule. Its reviews matter because countries rated weak can face closer scrutiny from banks and other governments, which raises the cost of doing business with them.
  4. IOSCO brings together securities regulators whose members, it says, regulate more than 95% of the world’s securities markets in some 130 jurisdictions. On 16 November 2023 it published 18 policy recommendations for crypto and digital asset markets, aimed at crypto-asset service providers and built on the principle of ‘same activity, same risk, same regulatory outcome’. In other words, a crypto platform doing what an exchange or broker does should face equivalent protections. On 19 December 2023 IOSCO added nine recommendations on decentralised finance (DeFi).
  5. The FSB was established in April 2009 as the successor to the Financial Stability Forum, and works at the request of the G20. On 17 July 2023 it finalised a global regulatory framework for crypto-asset activities, made of two sets of high-level recommendations: one for crypto-asset activities and markets, and a revised one for ‘global stablecoin’ arrangements used across many countries. Its 2025 peer review found welcome progress but significant gaps and inconsistencies between jurisdictions, and as of October 2026 its work centres on cross-border risks from global stablecoins.
  6. These standards reach people only through national law. The EU’s Markets in Crypto-Assets Regulation (MiCA) has applied in full since December 2024, with transitional periods of up to 18 months for existing providers; the US GENIUS Act regulates stablecoins (lesson 1.2.5); and the EU’s DAC8 tax rules follow an OECD standard (lesson 1.3.3). When a headline says ‘global crypto rules’, ask which body wrote them, whether they are recommendations or law, and which country has adopted them. A practical check: find your country’s latest FATF evaluation or follow-up report and read its rating for Recommendation 15.

Key facts

  • The FATF was established by the G7 in 1989 and issued its first Forty Recommendations in April 1990.
  • In 2019 the FATF updated Recommendation 15 and its Interpretive Note to apply anti-money-laundering measures to virtual assets and virtual asset service providers.
  • The FATF reported on 26 June 2025 that 99 jurisdictions had passed or were passing legislation implementing the travel rule.
  • IOSCO published 18 policy recommendations for crypto and digital asset markets on 16 November 2023 and nine DeFi recommendations on 19 December 2023.
  • The FSB was established in April 2009 as the successor to the Financial Stability Forum.
  • The FSB finalised its global regulatory framework for crypto-asset activities on 17 July 2023.

Exercise nine, six, three, one

9CollectList up to 9 crypto rules you have heard described as international or global, such as the travel rule, stablecoin reserve rules, exchange licensing or tax reporting (some lists are shorter).
6ClusterSort them into 6 categories: FATF standards, IOSCO recommendations, FSB recommendations, EU law, US law, and rules whose source you do not know.
3DistillReduce the 6 to 3 groups: international recommendations only, recommendations already turned into law where you live, and claims you would need to trace to a source.
1CrystallizeWrite 1 sentence explaining, in your own words, how a recommendation from a body like the FATF ends up affecting what a crypto platform asks of you.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS