Framework overlap

Does BSI IT-Grundschutz cover FATF Recommendation 16?

You hold BSI IT-Grundschutz and have been told to do FATF Recommendation 16. Here is how much overlaps, control by control.

8% of FATF Recommendation 16 you already have

BSI IT-Grundschutz already covers about 8% of FATF Recommendation 16, leaving 12 of 13 controls as genuinely new work.

Already covered 1 Likely covered 0 New work 12

What is genuinely new work

Nothing in BSI IT-Grundschutz reaches these. This is the list to scope.

R.16-VATR.Beneficiary
Beneficiary information requirements
R.16-VATR.CVDD
Counterparty VASP Due Diligence (CVDD)
R.16-VATR.CrossBorder
Cross-border transfer controls + intermediary VASP handling
R.16-VATR.DataQuality
Data accuracy, validation and quality assurance
R.16-VATR.Governance
Governance, training and independent testing
R.16-VATR.IVMS101
InterVASP Messaging Standard (IVMS101) and Travel Rule technical infrastructure
R.16-VATR.Originator
Originator information requirements
R.16-VATR.Record
Record retention for Travel Rule data (FATF R.11 + R.16)
R.16-VATR.Sanctions
Sanctions screening of Travel Rule data
R.16-VATR.Scope
Scope and applicability of Travel Rule to VASPs (R.16 + Interpretive Note to R.15/R.16)
R.16-VATR.Status
FATF R.16 Virtual Asset Travel Rule - corpus status, 2024 update + implementation pipeline
R.16-VATR.SunriseSproblem
Sunrise Problem - cross-jurisdictional implementation gaps
Show the 1 you already have
R.16-VATR.Unhosted
Unhosted (self-hosted / non-custodial) wallet transfers - 2024 Targeted Update

How this is calculated

Already covered means a mapping runs from a control in BSI IT-Grundschutz to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition