Framework overlap

Does NIST SP 800-171A Rev 3 cover FATF Recommendation 16?

You hold NIST SP 800-171A Rev 3 and have been told to do FATF Recommendation 16. Here is how much overlaps, control by control.

15% of FATF Recommendation 16 you already have

NIST SP 800-171A Rev 3 already covers about 15% of FATF Recommendation 16, leaving 11 of 13 controls as genuinely new work.

Already covered 1 Likely covered 1 New work 11

What is genuinely new work

Nothing in NIST SP 800-171A Rev 3 reaches these. This is the list to scope.

R.16-VATR.Beneficiary
Beneficiary information requirements
R.16-VATR.CVDD
Counterparty VASP Due Diligence (CVDD)
R.16-VATR.CrossBorder
Cross-border transfer controls + intermediary VASP handling
R.16-VATR.DataQuality
Data accuracy, validation and quality assurance
R.16-VATR.Governance
Governance, training and independent testing
R.16-VATR.IVMS101
InterVASP Messaging Standard (IVMS101) and Travel Rule technical infrastructure
R.16-VATR.Originator
Originator information requirements
R.16-VATR.Record
Record retention for Travel Rule data (FATF R.11 + R.16)
R.16-VATR.Sanctions
Sanctions screening of Travel Rule data
R.16-VATR.Status
FATF R.16 Virtual Asset Travel Rule - corpus status, 2024 update + implementation pipeline
R.16-VATR.SunriseSproblem
Sunrise Problem - cross-jurisdictional implementation gaps
Show the 2 you already have
R.16-VATR.Unhosted
Unhosted (self-hosted / non-custodial) wallet transfers - 2024 Targeted Update
R.16-VATR.Scope
Scope and applicability of Travel Rule to VASPs (R.16 + Interpretive Note to R.15/R.16)

How this is calculated

Already covered means a mapping runs from a control in NIST SP 800-171A Rev 3 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition