A virtual asset service provider (VASP) operating across borders faces a risk surface that few single-jurisdiction compliance programs are built to cover. The regulatory obligations that apply in the jurisdiction where your entity sits are rarely the same as those triggered by the location of your users, the currency of your banking, or the routing of your transactions. When those layers diverge – and in cross-border digital-asset business they almost always do – a gap in your business risk assessment (BRA) is not a paperwork deficiency. It is the opening through which regulators issue enforcement notices, correspondent banks terminate accounts, and licensed exchanges delist your token.
A rigorous VASP business risk assessment from a cross-border perspective maps every dimension of that exposure: the entity structure, the licence perimeter, the AML compliance program, the Travel Rule obligations, the KYC framework, and the transaction monitoring architecture. Done correctly, it is the foundational document that supports a licence application, survives a regulator audit, and gives a banking partner a credible reason to maintain the relationship. This page sets out the regulatory basis for the assessment, the process OBOLUS applies, the cross-border complications that most generic programs miss, and the decision matrix that determines how deep the review needs to go.
What Is a VASP Business Risk Assessment and Why Is It a Legal Obligation?
A VASP business risk assessment is a structured, documented analysis of the money-laundering, terrorist-financing, and sanctions risks that a virtual asset service provider's activities generate – and of whether the controls in place are proportionate to those risks. Under the FATF Recommendations, including Recommendation 15 on virtual assets, every VASP must conduct and maintain such an assessment as the foundation of its AML/CFT program. The assessment is not optional; every major licensing regime that has adopted the FATF standard – from MiCA and the CASP authorisation regime across the EU to VARA in Dubai, MAS in Singapore, the SFC regime in Hong Kong, the FCA's cryptoasset registration in the UK, and the VASP Act frameworks in the BVI and Cayman Islands – requires the operator to demonstrate a documented, risk-based approach before a licence is granted and throughout the supervisory relationship.
The legal weight of the assessment comes from two directions simultaneously. Regulators treat an inadequate BRA as evidence of a systemic compliance failure – the kind that justifies suspension of a licence, a public censure, or a requirement to appoint a skilled-person reviewer at the firm's expense. Banking partners treat it differently but with equal force: a VASP that cannot produce a current, coherent risk assessment when a correspondent bank's compliance team asks will frequently find its account closed within weeks, not months. We have seen both outcomes. In each case, the underlying problem was a program built for one jurisdiction that was then stretched, untouched, across a multi-jurisdictional operating model.
The BOFU reality: If you are reading this because a regulator has raised questions or a banking relationship is under review, the assessment process is already behind schedule. Contact OBOLUS at info@oboluslaw.com for a scoped triage – we can identify the critical gaps within days.
What the Cross-Border Dimension Adds to a Standard Risk Assessment
A cross-border VASP risk assessment must resolve conflicts between overlapping legal regimes, not simply satisfy the rules of the jurisdiction in which the entity is registered. This is the core analytical challenge that a domestic compliance template cannot address.
Consider a structure common in our practice: a holding entity in a low-tax jurisdiction, an operating VASP licensed in an EU member state under MiCA's CASP regime, a custody subsidiary in a FINMA-regulated Swiss structure, and a payment layer running through a Singapore MAS-licensed payment institution. Each layer carries its own AML regime with its own Travel Rule threshold, its own definition of a politically exposed person, its own transaction-monitoring expectations, and its own mandatory reporting obligations. A BRA that covers only the EU operating entity will pass the MiCA national competent authority's initial review. It will not satisfy MAS. It will not satisfy FINMA. And it will not satisfy a US correspondent bank applying FinCEN guidance to the consolidated group.
The cross-border assessment must map each regulated entity in the group, identify the applicable regime for each, resolve conflicts (particularly around the Travel Rule data threshold, which varies materially by jurisdiction), and produce a consolidated risk narrative that a supervisory authority in any of the relevant jurisdictions can read as coherent and complete. In our cross-border practice, we regularly advise groups where four or five regulatory regimes are in active interplay – and where a gap in one entity's assessment creates a systemic vulnerability for the whole structure.
A second, frequently underestimated dimension is geographic customer risk. VARA and the ADGM/FSRA regime in Abu Dhabi apply to operators in Dubai and the wider UAE. But a VARA-licensed exchange serving users in high-risk jurisdictions flagged by FATF carries an elevated residual risk that the BRA must acknowledge, document, and address with specific controls. Failing to do so is one of the most common findings in supervisory reviews of early-stage VASPs across the Gulf, the EU, and Southeast Asia.
How Does the Travel Rule Fit Into a Cross-Border Risk Assessment?
The Travel Rule – the obligation under FATF Recommendation 16 to pass originator and beneficiary data alongside a virtual asset transfer – is both a compliance obligation and a risk indicator, and a properly constructed BRA addresses it in both capacities. As a compliance obligation, the Travel Rule requires the originating VASP to collect and transmit identifying information about the sending party, and the beneficiary VASP to collect and retain information about the recipient. As a risk indicator, the BRA must document how the firm identifies counterparty VASPs, assesses their compliance status, handles transfers to or from non-compliant or unregistered VASPs, and manages the sunrise problem – the period during which counterparty VASPs in some jurisdictions were not yet subject to Travel Rule obligations.
The Travel Rule threshold – the transfer value above which the obligation is triggered – varies by jurisdiction and is a [VERIFY] figure in each regime. The BRA must map the applicable threshold for every corridor in which the VASP operates. A firm routing transfers through Singapore, the EU, and the UAE faces three different threshold rules, and a single global policy set at the most conservative threshold is the minimum defensible approach. We have seen firms apply the threshold from their registration jurisdiction to all corridors and then fail a supervisory review in a second jurisdiction precisely because they never analysed the cross-border divergence.
The BRA should also address the firm's transaction monitoring architecture in relation to Travel Rule data: whether the monitoring system ingests originator/beneficiary data and uses it to generate risk alerts; how unmatched or incomplete Travel Rule data is treated operationally; and how the escalation path to the Money Laundering Reporting Officer (MLRO) functions when a Travel Rule-compliant transfer nevertheless triggers a suspicious-transaction indicator.
What Does the OBOLUS Cross-Border Risk Assessment Process Look Like?
The OBOLUS VASP business risk assessment follows a structured four-stage process, each stage producing a document that feeds the next and that can be disclosed independently to a regulator or a banking partner.
Stage one is entity and perimeter mapping. We identify every regulated entity in the group, the applicable regime for each, the nature of the regulated activity, and the geographic scope of the customer base. For a group with multiple regulated entities, this stage also identifies the compliance dependencies between entities – where one entity's BRA relies on controls operated by another, and whether those arrangements are documented in a way that a regulator in each jurisdiction would accept.
Stage two is risk identification and scoring. We apply a risk matrix calibrated to the specific activity type – exchange, custody, payment, advisory – and to the relevant FATF guidance on virtual asset risk. The matrix covers customer risk (individual, institutional, PEP, high-risk geography), product and service risk (the specific tokens supported, the transaction types permitted, the on-ramp and off-ramp mechanisms), channel risk (direct onboarding versus intermediated access), and jurisdictional risk (the regulatory status of counterparty VASPs and banking partners). Each risk dimension is scored and the aggregate picture drives the design of the controls program.
Stage three is controls gap analysis. We map the existing AML compliance program – the KYC framework, the customer due-diligence and enhanced-due-diligence procedures, the transaction monitoring system configuration, the MLRO structure, the suspicious-activity reporting process, and the Travel Rule implementation – against the risk picture produced in stage two. Gaps are ranked by regulatory severity: those that would produce an automatic supervisory finding in the primary jurisdiction are addressed first.
Stage four is the production of the BRA document itself, together with a remediation roadmap. The BRA document is written to the standard that a national competent authority under MiCA, a VARA inspection team, or an FCA skilled-person reviewer would expect to receive – not to the standard of an internal memo. In our practice, we have found that VASPs that treat the BRA as a regulatory submission document, rather than an internal process note, consistently perform better in supervisory reviews and in banking due-diligence processes.
If your group operates across more than one regulated jurisdiction and your current BRA covers only the primary entity, the gap analysis will almost always surface material findings. To map the assessment against your specific structure, write to info@oboluslaw.com or message us at t.me/oboluslaw.
What Are the Most Common Mistakes in Cross-Border VASP Risk Assessments?
The most pervasive mistake in cross-border VASP risk assessments is treating the BRA as a one-time document produced for a licence application, then left unchanged as the business evolves. Regulators – including ESMA's guidance to national competent authorities under MiCA, VARA's supervisory frameworks, and the FCA's expectations for cryptoasset registrants – consistently emphasise that the BRA must be a living document, updated when the business model changes, when new products are added, when new geographies are served, or when the risk environment shifts materially. A BRA dated more than twelve months ago that predates a material business change is, in practical terms, no BRA at all from a supervisory standpoint.
The second most common mistake is the offshore-licence fallacy. A common assumption is that a single licence in a permissive jurisdiction is sufficient to serve clients globally. It is not. A VASP licensed in the BVI under the VASP Act 2022 is authorised to operate within the BVI framework. It does not carry MiCA passporting rights into the EU. It does not satisfy MAS licensing requirements for serving Singapore-resident customers. And it does not override the jurisdictional reach of FinCEN or the NYDFS BitLicense for US-nexus activity. In our cross-border practice, we have seen businesses structured on this assumption face parallel enforcement inquiries in two or three jurisdictions simultaneously – a scenario that is far more costly to resolve than the cost of a proper multi-jurisdictional licence stack from the outset.
A third persistent error is the failure to document the MLRO's oversight of the risk assessment process. Regulators in the major hubs increasingly expect evidence that the MLRO – not just the compliance team – has reviewed and signed off on the BRA, has been given adequate resources and independence to do so, and has flagged any concerns to senior management in writing. Where that governance trail is absent, even a technically adequate BRA can be treated as a systemic governance failure.
Finally, we see repeated failures around customer-risk segmentation. Many early-stage VASPs apply a single customer risk tier to all institutional counterparties, without distinguishing between a well-regulated EU bank acting as a payment agent and an unregistered offshore OTC desk. The BRA must articulate the logic of that segmentation in terms the regulator can follow, and the transaction monitoring thresholds must map to the segments, not to a single global default.
Which Profile Needs What Level of Assessment?
The depth and structure of a cross-border VASP risk assessment depends on the operator's profile. The following matrix describes the key configurations we encounter in practice and the appropriate assessment approach for each.
Profile A – Single-jurisdiction VASP, early stage, MiCA or equivalent. A newly licensed CASP operating in one EU member state with a defined product set and a European-only customer base requires a foundational BRA calibrated to the MiCA CASP standard. The key risk dimensions are product risk (the specific tokens supported) and customer risk (onboarding quality, PEP screening). Timeline for a well-scoped assessment: typically a matter of weeks. Primary risk: the BRA becomes stale as the product evolves; a scheduled annual review is mandatory from day one.
Profile B – Multi-entity group, EU plus Gulf or Asia hub. A group with a MiCA CASP, a VARA-licensed entity, and a Singapore MAS-regulated payment institution requires a consolidated BRA that resolves the inter-regime Travel Rule conflicts described above, documents the group's intra-entity transaction flows, and produces entity-level BRA annexes that can be disclosed to each regulator independently. The assessment is substantially more complex; it typically requires allied counsel input in each relevant jurisdiction. Timeline and scope vary by the number of entities and the complexity of the transaction flow map. Primary risk: a gap between entities creates the consolidated vulnerability described in the cross-border section above.
Profile C – VASP under regulatory review or banking pressure. A VASP that has received a supervisory inquiry, a request for information, or a notice of a skilled-person review requires a different approach: a rapid gap analysis against the specific findings or concerns raised, followed by a remediation plan and, where necessary, a revised BRA prepared for disclosure. Timeline is measured in days to weeks, not months. In a recent matter, we worked with a payment-layer VASP that had received a correspondent bank's AML questionnaire requesting a current BRA alongside its Travel Rule implementation documentation. The existing BRA predated the firm's expansion into a new corridor. We produced a revised, cross-border-calibrated assessment within a compressed timeline; the banking relationship was maintained.
Profile D – Pre-licence, multi-product, global ambitions. A business planning to launch an exchange, custody service, and a token-issuance program simultaneously, targeting users across the EU, the Gulf, and Asia, must treat the BRA as a pre-condition to every licence application, not as a post-approval deliverable. Regulators including VARA, the FSRA in Abu Dhabi, and the SFC in Hong Kong examine the BRA as part of the initial application review. An applicant that arrives at the regulatory process without a complete, jurisdiction-calibrated assessment will face delays – and, in some cases, a request to resubmit.
What Governance Structure Does a Cross-Border VASP Need Around Its BRA?
The BRA does not stand alone. It is the central document in a governance architecture that must be visible, documented, and operationally live at the time of any regulatory interaction. At its core, that architecture requires a nominated MLRO with defined responsibilities, sufficient seniority and independence to escalate concerns to the board, and documented access to the resources needed to keep the BRA current.
In a cross-border group, the MLRO governance question becomes more complex. Where the group has a primary MLRO and local compliance officers in each regulated jurisdiction, the BRA must document the escalation paths between them, the data-sharing arrangements that allow the group MLRO to maintain a consolidated risk picture, and the protocols for handling a suspicious-transaction report that crosses jurisdictional lines. In our practice, we have seen groups where each entity had a nominally compliant local program but where the absence of a documented group-level escalation architecture meant that a cross-border suspicious transaction was reported in one jurisdiction and missed entirely in another. That structural gap – invisible in a per-entity review – is precisely what a cross-border BRA is designed to surface and address.
Senior-management sign-off on the BRA is not merely a formality. VARA, ESMA, and the FCA each have supervisory expectations around board-level ownership of the AML risk appetite. A BRA that has been reviewed and approved by the board, with minutes evidencing that review, carries materially more weight in a supervisory interaction than one that sits in the compliance team's document management system without a governance trail.
Self-Assessment: Does Your Current BRA Cover the Cross-Border Dimensions?
The following checklist reflects the questions a regulator or banking partner is likely to ask of a VASP's cross-border risk assessment. A "no" or "uncertain" answer to any item should be treated as a gap requiring attention.
- Does the BRA cover every regulated entity in the group, or only the primary jurisdiction?
- Does it map the applicable AML regime for each entity and identify where regimes conflict or overlap?
- Does it document the Travel Rule threshold that applies in each operational corridor, not just the registration jurisdiction?
- Does it address the risk posed by transfers to or from non-compliant or unregistered counterparty VASPs?
- Does the KYC framework segment customers by risk tier with logic the regulator can follow?
- Is the transaction monitoring system configuration documented, with thresholds mapped to customer risk tiers?
- Does the MLRO have documented authority, independence, and resources, with board-level sign-off recorded?
- Has the BRA been reviewed and updated within the past twelve months or following any material business change?
- Does the document address geographic customer risk, including FATF high-risk jurisdiction exposure?
- Is the BRA formatted and written to the standard a regulatory disclosure would require?
If a prior application stalled or a banking account was placed under review, a gap analysis against this checklist will often identify the structural reason. For a scoped second read, write to info@oboluslaw.com.
Related at OBOLUS
- AML & Travel Rule compliance for digital-asset businesses – the full practice overview covering AML, KYC and Travel Rule obligations across all major regimes.
- Regulator AML audit defence from a cross-border perspective – how OBOLUS manages supervisory reviews and audit responses across multiple jurisdictions.
- Oracle and data-feed liability from a cross-border perspective – legal risk analysis for DeFi infrastructure operators and token issuers using third-party data sources.
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule requires a VASP initiating a virtual asset transfer to collect and transmit identifying information about the originator, and the receiving VASP to collect and retain information about the beneficiary. The obligation derives from FATF Recommendation 16 and has been implemented across MiCA, VARA, MAS, the FCA regime, and other major frameworks. The specific data fields required and the transfer threshold above which the obligation is triggered vary by jurisdiction and should be mapped for each operational corridor.
Who must act as MLRO for a crypto firm?
A Money Laundering Reporting Officer (MLRO) must be a sufficiently senior, independent individual with documented authority to escalate suspicious-transaction concerns to the board and to interact with the relevant financial intelligence unit. Most major licensing regimes – including MiCA CASP authorisation, VARA, and the FCA cryptoasset registration – require the MLRO to be approved or notifiable to the regulator. In a cross-border group, the MLRO architecture must address escalation paths between entities and the handling of cross-border suspicious-transaction reports.
How do regulators audit crypto AML programs?
Regulators in the leading hubs – including ESMA-aligned national competent authorities under MiCA, VARA, and the FCA – audit crypto AML programs through a combination of desk-based documentation reviews and on-site or remote interviews. They typically request the BRA, the MLRO's annual report, transaction monitoring configuration documentation, a sample of suspicious-activity reports, and evidence of board-level AML oversight. An inadequate BRA – one that is undated, fails to cover cross-border exposures, or predates material business changes – is frequently the primary finding in early-stage supervisory reviews.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the AML, Travel Rule and compliance architecture that sits around every regulated digital-asset operation. Digital assets are the entirety of our practice. We map the licence, compliance and banking stack across operating, custody and payment layers before you commit – and we act only for businesses, which means our analysis is free of the conflicts that affect multi-service providers. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in cross-border AML program design, VASP business risk assessments, and regulatory compliance architecture for digital-asset service providers operating across multiple licensing regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.