121. If a supervisor's authority is extended to include a sector not previously supervised for AML/CFT purposes, a first step is to identify the regulatory population and begin to understand the risk environment. This is particularly important, as it underpins a number of decisions, including what resources, skills and experience are needed to effectively supervise the sector. This task is often more straightforward if the authority is being extended to cover activities carried out by entities that are already regulated for other purposes (the challenge may be to track down and share this information among authorities). Identifying the population is more challenging when it involves entities that are not already supervised for another purpose (e.g. VASPs in most jurisdictions). For example, it can be difficult to accurately predict the size of the population before the registration/licensing process begins. In one jurisdiction that was early to introduce AML/CTF regulations for VASPs, the supervisor estimated that approximately 50 VASPs would register as obliged entities. However, when the regime came into force, the actual number of registrations received was around 350. The challenge can be more acute where there are no trade associations or industry bodies and there are numerous smaller operators. Additional challenges occur when entities are physically based outside the jurisdiction but are able to operate within them (e.g. online casinos or VASPs).