Which parts of FATF guidance should agencies prioritise first for virtual assets?

Why FATF guidance should be prioritised in a specific order

For agencies, the highest-value FATF priorities are the ones that remove friction at the point of operational contact. First-contact recognition matters because if staff do not identify a virtual-asset case early, later controls never get applied. Legal authority for seizure and disposal matters because recovery efforts fail when the agency can identify assets but cannot lawfully secure them. Operational tracing and custody controls matter because seized value can still be lost through poor handling, exposure, or transfer errors.

That ordering is practical, not theoretical. FATF guidance is most useful where it helps agencies move from policy intent to case execution, especially when virtual assets appear inside a broader investigation rather than as the original subject. The priority is to close the gap between detecting the asset, asserting control over it, and preserving it long enough to realise value or support forfeiture.

What first-contact recognition changes in real cases

First-contact recognition is the point where many virtual-asset cases are won or lost. Front-line investigators, financial intelligence staff, and prosecutors need enough pattern recognition to spot wallets, exchanges, stablecoins, self-custody arrangements, and conversion paths early. When that recognition is delayed, evidence can be missed, seizure windows can close, and the asset may move beyond practical reach.

Recognition also shapes escalation speed. A case team that can quickly distinguish a virtual-asset lead from ordinary digital evidence can engage the right legal, forensic, and exchange-contacting workflow before the asset is dissipated. That is why FATF material should not be treated as background reading only for specialists; it has direct operational consequences for intake and triage.

Why seizure authority and post-seizure control are the next critical gap

The second priority is the legal and procedural authority to seize and dispose of virtual assets. Agencies often know what they are looking at before they know whether they can lawfully control it, which creates a dangerous delay. If seizure powers, preservation orders, transfer permissions, and disposal pathways are unclear, the agency may have visibility without enforceability.

Once seizure happens, the problem changes again. The asset must be safeguarded, recorded, and maintained in a way that preserves both value and evidentiary integrity. That requires clear ownership of keys, approvals for transfers, and documented custody steps. For virtual assets, the recovery risk is not only legal, it is operational: a seized asset can still be compromised, inaccessible, or unrecoverable if handling is weak.

Where tracing and secure custody determine whether recovery succeeds

The third priority is the operational capability to trace, secure, and account for virtual assets after seizure. Tracing includes following flows across wallets, exchanges, and chains, while custody includes controlling the private keys, recovery phrases, and transfer processes that actually unlock value. Agencies need repeatable procedures for attribution, transfer verification, and storage because the asset can be lost through mistake as easily as through malicious action.

This is also where interagency coordination becomes important. Tracing without timely exchange engagement, or seizure without a secure custody chain, leaves value stranded. The practical test is whether the agency can prove where the asset is, who can move it, and how the recovery path is protected from loss or dispute.

Risk and Threat Considerations

The main risk is that agencies focus on policy language instead of the operational sequence that protects value. If first-contact recognition is weak, virtual assets may be overlooked until they have been moved, mixed, or converted. If legal seizure authority is ambiguous, staff may delay action even when they have located the asset. If custody controls are weak, the agency can recover the asset on paper and still lose it in practice.

Failure mechanism: The failure usually comes from a break in the chain of action, not from a single missing rule, for example poor intake recognition, unclear legal powers, or unsafe post-seizure handling that allows the asset to be dissipated or stranded.

Impact: The result is reduced recovery, weaker evidentiary continuity, and a higher chance that value is permanently lost before the case reaches forfeiture or disposal.

Practitioner Guidance

What to prioritise: Start with the controls that shorten time to action. If staff cannot recognise a virtual-asset lead at intake, the rest of the guidance will be applied too late to matter. Agencies should therefore train front-line teams first, then align legal and operational playbooks to that recognition step.

What to verify: Confirm that your process answers three questions in sequence: can the asset be identified, can it be lawfully seized, and can it be securely controlled after seizure? If any one of those answers is unclear, the recovery path is incomplete.

Practitioner takeaway: For virtual assets, the most important judgement is to treat recognition, authority, and custody as one recovery chain, because the weakest step usually determines whether value is actually recoverable.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• How should security teams prioritise NHI remediation in cloud environments?
• How should jurisdictions implement FATF Recommendation 15 for virtual assets and VASPs without creating gaps in AML/CFT supervision?
• When should agencies prioritise building an asset forfeiture programme for digital assets?