29 April 2026: VA and VASP Sector Risk Assessment Released
The Isle of Man Government has today released the Island’s Virtual Assets (VA) and Virtual Assets Service Providers (VASPs) Sector Risk Assessment. The document is available on the Isle of Man Countering Financial Crime website.
The sectoral National Risk Assessment (NRA) considers the money laundering (ML), terrorist financing (TF) and proliferation financing (PF) risks arising from the use of Virtual Assets and Virtual Asset Service Providers operating in, or from, the Isle of Man.
Ratings
The overall ML risk relating to VAs and VASPs in the IOM is assessed as Medium.
TF and PF risks are assessed as Very Low for both.
Core Threats involving Virtual Assets and VASP sector
Key ML threats identified in the report include:
- Online/cyber fraud, including:
- Investment fraud
- Romance scams / “pig butchering”
- Rug‑pulls and pump‑and‑dump schemes
- Cyber‑attacks on VASPs, including ransomware;
- Illicit online gambling;
- Payment for illicit products/services via VAs;
- Corruption and bribery using VAs;
- Increasing use of USDT (stablecoin) to move illicit funds;
- Overseas predicate crimes, particularly in UK‑linked cases; and
- Organised Crime Group exploitation of VA transfer speed and anonymity.
Key TF threats identified in the report include:
- Crowdfunding and social media fundraising;
- Use of decentralised platforms and unregistered VASPs; and
- Attempts to exploit anonymity tools
NOTE: There is no evidence of TF exposure through domestic VASPs, and no transactions linked to high‑risk TF jurisdictions.
Key PF threats identified in the report include:
- DPRK cyber‑attacks and VA theft;
- Iran’s use of mining to evade sanctions; and
- Use of VAs for revenue‑raising by sanctioned actors.
NOTE: There is no evidence of PF‑related VA activity in the Isle of Man, nor evidence of large‑scale mining.
Gambling Sector Findings Summary
Online gaming operators (10 firms with VA exposure) are categorised as medium‑high risk, but strong controls reduce residual risk. Operators with an exposure to VAs are treated as Medium-High to High risk for supervisory purposes.
Online gambling operators may accept VAs only under tightly controlled models that require conversion to fiat via regulated VASPs, with enhanced supervision applied.
Exposure to VAs in other regulated sectors is limited and controlled. Interaction between VASPs and banks, insurers and other financial institutions remains very low.
Industry Expectations
- VASPs, gaming operators, FIs and DNFBPs should:
- Integrate findings from the VA and VASP risk assessment into BRA, CRA, and TRA;
- Consider interdependencies with other NRAs (ML, TF, PF, Legal Persons, Gambling and TCSP);
- Maintain vigilance over:
- VA‑enabled fraud
- Cybercrime targeting customers
- PF/TF emergence (especially in decentralised ecosystems)
- Continue to engage with regulators and the IOMFCP; and
- Assess their own VA‑related exposures, including indirect exposures.
Operators must include consideration for all topical NRAs and any relevant sectoral NRAs within the firms BRA. It is expected that consideration of the suite of NRAs should be completed by 1 September 2026, and any updates to the relevant persons BRA adopted and approved as soon as practicable after that date.
Useful Resources:
FATF Report: Targeted Report on Stablecoins and Unhosted Wallets
GSC Virtual Assets/Goods Guidance
2026 Isle of Man VA/VASP Report (NRA)
2026 Isle of Man Money Laundering NRA
2026 Isle of Man Money Laundering in Gambling Report (Gambling NRA)