The Financial Action Task Force (FATF) continues to monitor how jurisdictions are implementing Recommendation 15, which extends anti-money laundering (AML), counter-terrorist financing (CTF), and counter-proliferation financing (CPF) requirements to virtual assets (VAs) and virtual asset service providers (VASPs). The 2025 and 2026 targeted updates show that while countries are steadily strengthening regulatory frameworks for the crypto sector, implementation challenges, enforcement gaps, and evolving criminal threats remain significant concerns.
Progress in Implementing FATF Standards
The 2025 report highlighted growing adoption of regulatory frameworks for virtual assets, with more jurisdictions conducting risk assessments and establishing licensing or registration regimes for VASPs. FATF noted increased awareness of virtual asset-related risks and gradual progress in implementing Recommendation 15 across its global network.
The 2026 update indicates that this trend has continued. Since the publication of the 2025 report, jurisdictions have made further advances in conducting VA/VASP risk assessments, developing regulatory approaches, licensing and registering VASPs, implementing the Travel Rule, and taking supervisory and enforcement actions. These developments suggest that regulators are increasingly moving beyond policy development towards practical implementation and oversight.
Despite this progress, FATF concludes that implementation remains inconsistent across jurisdictions and that substantial regulatory gaps continue to exist.
Challenges in Licensing and Supervision
A recurring theme in both reports is the difficulty jurisdictions face in effectively regulating and supervising VASPs. The 2025 update identified challenges in licensing, registration, and identifying the natural persons who own or control virtual asset businesses. Jurisdictions also reported difficulties dealing with VASPs that operate across borders or from offshore locations.
The 2026 report reinforces these concerns. FATF notes that many jurisdictions are still struggling to translate risk assessments into effective mitigation measures and to operationalise licensing and registration frameworks in practice. The organisation also highlights continuing challenges in identifying entities conducting VASP activities and ensuring effective risk-based supervision and enforcement after registration or licensing has been granted.
According to FATF, establishing regulations alone is insufficient; the effectiveness of implementation depends on robust supervision and meaningful enforcement of compliance obligations.
Travel Rule Implementation Continues to Advance
The Travel Rule remains one of the most important tools for improving transparency in virtual asset transactions. The rule requires VASPs to collect and share information relating to the originators and beneficiaries of transfers, similar to requirements that already exist in traditional financial services.
The 2025 report found that more jurisdictions had introduced Travel Rule requirements into their legal and regulatory frameworks, although implementation remained uneven. FATF encouraged authorities to shift their focus towards operational implementation and compliance monitoring.
In 2026, FATF reported additional progress, citing continued implementation of the Travel Rule alongside broader supervisory and enforcement activities. Nevertheless, the organisation maintains that countries must continue strengthening compliance and ensuring that Travel Rule obligations are effectively applied in practice.
Stablecoins Remain a Significant Concern
One of the most notable findings in the 2025 report was the increasing use of stablecoins by illicit actors. FATF observed that stablecoins were being used by criminals and by actors linked to the Democratic People’s Republic of Korea (DPRK), raising concerns about money laundering, sanctions evasion, and other forms of illicit finance. FATF also warned that risks may emerge across the broader stablecoin ecosystem rather than solely from the stablecoins themselves.
The 2026 update confirms that the misuse of stablecoins remains an important concern. FATF identifies stablecoins as one of the key risk areas requiring ongoing monitoring and stronger risk mitigation measures by both regulators and industry participants.
DeFi Continues to Challenge Regulators
Decentralised Finance (DeFi) remains one of the most difficult areas for implementation of Recommendation 15. In 2025, FATF emphasised that DeFi arrangements should not automatically be considered outside regulatory scope and that jurisdictions should identify individuals or entities exercising control or influence over such arrangements.
The 2026 report indicates that challenges related to DeFi persist. FATF continues to view DeFi as an area where regulatory uncertainty and implementation difficulties remain significant. The organisation encourages jurisdictions to strengthen their ability to identify DeFi arrangements that may constitute VASP activity and ensure that appropriate regulatory obligations apply where required.
Emerging Risks Become More Complex
Perhaps the most significant development in the 2026 update is FATF’s growing concern about the increasing sophistication of virtual asset-enabled crime.
The 2025 report highlighted large-scale cyber theft, investment scams, and the growing use of technologies such as chatbots and deepfakes in fraud schemes. FATF also noted concerns around transactions involving unhosted wallets and the continued use of virtual assets in money laundering, terrorist financing, and proliferation financing.
Building on these observations, the 2026 report warns of the growing industrialisation of virtual asset-enabled fraud by organised criminal groups. FATF identifies increasingly complex threats involving stablecoin misuse, peer-to-peer transactions through unhosted wallets, offshore VASPs operating outside effective regulatory oversight, and continuing vulnerabilities within DeFi ecosystems.
The report suggests that illicit finance risks in the virtual asset sector are becoming more sophisticated, requiring stronger cooperation between regulators, law enforcement agencies, the private sector, and international partners.