The Financial Action Task Force’s latest review of virtual asset rules points to a clear pattern: more jurisdictions are putting crypto laws on the books, but many have yet to enforce them in practice. In its seventh targeted update on implementation of standards for virtual assets and virtual asset service providers, the watchdog said progress is visible, while major gaps remain in supervision, licensing, and preventive controls.

Implementation improves, but unevenly

FATF surveyed 147 jurisdictions and found that 86% have now carried out virtual asset and VASP risk assessments, up from 76% in 2025. It also said 83% have passed Travel Rule legislation, compared with 73% previously. The share of jurisdictions rated “Largely Compliant” rose from 29% to 34%.

At the same time, the report highlights the difference between rulemaking and action. Of the jurisdictions with Travel Rule legislation in place, 60% have not taken any supervisory or enforcement action. FATF also found that when jurisdictions were assessed on preventive anti-money laundering and counter-terrorist financing measures, only 13 of 139 fully met the standard.

Licensing data shows a similar gap. While 73% of jurisdictions require VASP licensing, only 58% have actually issued a licence, and only 40% meet mutual evaluation criteria. Among the 95 jurisdictions that require licensing, 81% are carrying out supervisory inspections, up from 73%, and 71% have taken enforcement action.

Persistent blind spots in crypto oversight

The update says prohibition is not solving the problem on its own. Twenty-three percent of jurisdictions now prohibit VASPs, up from 11% in 2023, but FATF said enforcement has not progressed accordingly. Decentralised finance also remains largely outside formal identification, with 93% of jurisdictions not having identified qualifying DeFi arrangements and only a small number imposing licensing requirements.

Peer-to-peer activity is another weak point. FATF said 88% of jurisdictions consider P2P transfers through unhosted wallets to be high risk, yet only 23% collect metrics on that activity. It also noted that stablecoin issuer licensing is now being tracked separately, reflecting increased focus after its March 2026 report on stablecoins.

New threats: freeze-resistant stablecoins and AI-enabled crime

Among the risks singled out in the update is the rise of so-called freeze-resistant stablecoins. FATF described a stablecoin marketed as immune to asset freezing and issued across multiple blockchains, warning that such products could undermine controls that rely on issuer-level freezes. The report says stablecoins should therefore face robust AML/CFT requirements, and adds that terrorist groups are increasingly using stablecoins for fundraising and transfers.

FATF also pointed to the industrialisation of fraud and the growing overlap between sanctions evasion, terrorist financing, proliferation financing, and organised crime. It referenced Cambodia-based scam centres and pig-butchering networks, including a Cambodia conglomerate that laundered at least $4 billion between August 2021 and January 2025, with DPRK-linked figures cited in the report.

Artificial intelligence is described as an amplifier of these risks. According to the update, AI can speed up identity fraud, recruitment scams, sanctions-evasion methods, and attacks on blockchain-based financial applications.

Compliance tools now treated as baseline controls

A central message of the report is that blockchain analytics and wallet controls are no longer optional enhancements. FATF’s recommendations for VASPs, stablecoin issuers, and qualifying DeFi arrangements say firms should have wallet screening, blacklisting and whitelisting, and freezing or blocking capabilities that can adapt to changing threats.

The watchdog also calls for enhanced due diligence on unhosted wallet transactions, transaction monitoring using blockchain analytics, checks on offshore VASPs, and assessment of exposure to DeFi protocols, bridges, mixers, and cross-chain tools. It argues that crypto’s transparency can support preventive action by screening, flagging, or blocking risky activity before funds move.

In the near term, FATF says the priority is not writing a new rulebook but enforcing the one that already exists. It says jurisdictions should operationalise supervisory regimes, issue licences where required, act against unlicensed activity, and improve their ability to trace, freeze, and seize illicit virtual assets through legal and operational cooperation with the private sector.

Source: www.chainalysis.com