Jersey makes VASPs follow existing AML controls in new Chapter 16

The Jersey Financial Services Commission (JFSC) has issued Chapter 16 of its AML/CFT/CPF Handbook, effective from 31 October 2026, for virtual asset service providers (VASPs). It says VASPs must comply with the same anti-money laundering, counter-terrorist financing and counter-proliferation financing requirements that apply to traditional financial institutions under Sections 1 to 11 of the Handbook.

The chapter applies to services relating to virtual assets within Part 4 of Schedule 2 to the Proceeds of Crime (Jersey) Law 1999 and the Money Laundering Order. It adds VASP-specific expectations on risk assessments, enhanced due diligence, the Travel Rule, blockchain analysis and financial crime typologies.

Risk assessments and customer due diligence

Chapter 16 is supplemental to Section 3.3 on business risk assessments and Section 7 on enhanced due diligence. VASPs should give particular attention to foreign counterparties operating in jurisdictions with weak or ineffective AML/CFT/CPF frameworks, and should consider avoiding counterparties that cannot demonstrate effective controls.

The chapter identifies anonymity-enhancing tools as higher-risk features, including mixers, tumblers, privacy coins and decentralised platforms. It warns that new illicit-financing typologies can reduce transparency in virtual-asset and fiat transactions. VASPs must remain alert to the use of virtual assets for layering and regularly update their risk-assessment frameworks as risks evolve.

For high-risk customers and transactions, VASPs are encouraged to collect additional information to identify and avoid prohibited activity and support follow-up action. The examples include:

- the purpose of a transaction or payment;
- the nature, end use and end user of the item;
- proof of ownership of funds;
- the parties and their relationship;
- source of wealth and source of funds;
- the counterparty's identity and beneficial ownership; and
- export-control information, including licences and end-user certification.

If a VASP cannot verify an individual's identity, it should consider refusing to establish the relationship or execute a one-off transaction. Where the relationship already exists, it may need to terminate it. In all cases, the VASP should consider filing a suspicious activity report.

The Travel Rule section states that virtual-asset transfers must carry accurate originator and beneficiary information. The chapter also says a supervised person may use blockchain analysis to support ongoing monitoring. Such tools can trace transactions across different blockchains, identify the original source of funds and help assess whether that source is legitimate.

The risks of relying on blockchain technology as evidence of identity must be considered for each application and recorded in the business risk assessment. Firms may combine blockchain analytics with traditional monitoring methods.

Fifty indicators for transaction and customer monitoring

The chapter describes red flags as “non-exhaustive indicative patterns or behaviours”. The 50 numbered indicators cover transactions, anonymity, senders and recipients, source of funds and geography. They are not framed as automatic breaches, but as signs that may justify mitigation, investigation or ending activity.

Transaction indicators include:

- structuring transactions below record-keeping or reporting thresholds;
- repeated high-value transfers within 24 hours, particularly from new or inactive accounts;
- immediate transfers to several VASPs in unrelated or weak-regulation jurisdictions;
- depositing and immediately withdrawing virtual assets, converting them into several other assets without a logical explanation, or sending them straight to a private wallet;
- large initial deposits followed by same-day or next-day withdrawals;
- many small payments from unrelated wallets that are accumulated and converted to fiat; and
- large fiat-to-virtual-asset or virtual-asset-to-virtual-asset conversions without a business rationale.

The list also covers transactions involving stolen or fraudulent funds, abnormal cash-outs, transfers from multiple people to the same wallet, repeated use of the same IP address, and virtual-asset-to-fiat exchanges made at a loss or despite unusually high fees.

Anonymity-related indicators include virtual assets linked to mixing or tumbling services, darknet marketplaces, illegal activities, theft reports or questionable gambling sites. The chapter also flags:

- use of several high-anonymity virtual assets despite higher fees;
- transfers involving decentralised, unhosted hardware or paper wallets across borders;
- access from darknet-linked IP addresses or anonymous communications software, including VPNs;
- numerous apparently unrelated wallets controlled from the same IP or MAC address;
- transactions involving VASPs with weak or non-existent customer due diligence; and
- virtual assets with poorly documented designs or links to fraudulent schemes.

Customer and onboarding indicators include multiple accounts under different names, repeated account-opening attempts from one IP address, incomplete or forged customer due diligence, inaccurate explanations of source of funds or counterparties, and frequent changes to identity or financial information that could indicate account takeover.

The chapter separately identifies possible money-mule or scam-victim profiles, including customers unfamiliar with virtual-asset technology, older customers conducting numerous transactions, financially vulnerable customers and customers buying large amounts of virtual assets inconsistent with their wealth or financial history.

Source-of-funds indicators include links to fraud, extortion, ransomware, sanctioned addresses, darknet marketplaces and mixers. The list also includes virtual-asset transactions involving online gambling services, cash-funded card activity, instant withdrawals after incoming payments and wealth derived mainly from virtual assets, initial coin offerings or other VASPs with weak AML/CFT controls.

Geographical indicators include funds sent to or received from exchanges not registered in the customer's or exchange's jurisdiction, and transfers involving high-risk jurisdictions or jurisdictions without adequate AML/CFT controls or virtual-asset regulation.

Scope and implementation

Chapter 16's glossary distinguishes utility tokens, payment and exchange tokens, privacy coins, platform tokens, asset-backed and fiat-backed stablecoins, and closed-loop tokens. It lists custodians, exchanges, payment processors and brokers, OTC desks, asset managers, issuers and investment or trading platforms as VASP categories.

Miners, validators and pool operators are not usually captured by the VASP definition, but could be considered VASPs where they hold sufficient control or validation power. Technology and ancillary providers, including mixing services and blockchain explorers, are also marked as outside the FATF VASP recommendations, without the chapter stating that every such provider is outside Jersey's legal scope.

The JFSC says supervised persons should assess each service independently: there is no single profile in which criminal enterprises use virtual assets for money laundering.

Chapter 16 forms part of a wider JFSC handbook update effective on the same date. Section 9 covers reporting money laundering, terrorist-financing and proliferation-financing concerns to the Financial Intelligence Unit, while Section 15 sets codes of practice for direct customer MLCO and MLRO roles.