FATF releases the "Targeted Update on the Implementation of FATF Standards for Virtual Assets and Virtual Asset Service Providers": Interpretation of Global Regulatory Progress and Risk Threats

On July 16, the Financial Action Task Force (FATF) released its seventh targeted update report on the implementation of FATF standards for virtual assets and virtual asset service providers. Based on questionnaire responses from 147 jurisdictions, 149 mutual evaluation reports, and outcomes from VACG meetings, the report systematically assessed global progress in implementing R.15 and highlighted risk threats including pig butchering scams, theft of assets by North Korean hacker groups, misuse of stablecoins, peer-to-peer transactions via non-custodial wallets, offshore virtual asset service providers, and regulatory gaps in DeFi.

Beosin will interpret the core content of this report to help readers quickly understand global virtual asset compliance developments and risk trends, enhancing awareness and response capabilities regarding virtual asset compliance risks.

R. Recommendation 15 of the International Standards for Combating Money Laundering, Terrorist Financing, and Proliferation Financing: FATF Recommendations requires countries and financial institutions to identify, assess, and mitigate money laundering, terrorist financing, and proliferation financing risks posed by emerging technologies. In 2018, FATF revised R.15 to include virtual assets (VAs) and virtual asset service providers (VASPs) within its AML/CFT and anti-proliferation financing requirements.

1.1 Global Compliance Rating Data

As of April 2026, 149 jurisdictions have accepted the R.15 compliance assessment. Global implementation has slightly improved compared to 2025:

- Fully Compliant: Only 1 jurisdiction (Bahamas) - Largely Compliant: Increased from 29% in 2025 to 34% (51 jurisdictions), a modest rise - Partially Compliant: Decreased from 50% to 43% (64 jurisdictions) - Non-Compliant: Increased from 20% to 22% (33 jurisdictions)

The report notes significant variations in implementation across regions, with lower-capacity jurisdictions still facing substantial challenges in implementing R.15.

1.2 Challenges Facing VA and VASP Risk Assessments

The report shows that 86% of respondent jurisdictions (124 out of 145) have completed a money laundering, terrorist financing, and proliferation financing risk assessment for the virtual asset sector, a significant increase from 76% in 2025 (124 out of 163). However, the vast majority of jurisdictions are unable to translate the findings of these risk assessments into corresponding preventive and regulatory measures. Mutual evaluation data reveals that only 48 out of 149 respondent jurisdictions have fully or substantially completed R15.3 risk assessments and implemented a risk-based approach. This indicates that in many countries, risk assessments remain at the reporting stage, lacking concrete implementation plans and mechanisms to convert assessment outcomes into specific regulatory actions.

1.3 VASP Regulatory Path Selection and Corresponding Challenges

The percentage of jurisdictions with a clear regulatory path increased from 82% in 2025 to 89% in 2026 (128 out of 144); jurisdictions without a determined regulatory framework decreased from 18% to 11% (16). The established regulatory models include:

(1) Allow VASPs to operate legally: 66% (95)

(2) Complete or partial prohibition of VASPs: 23%, showing a yearly increasing trend (2023: 11% → 2024: 14% → 2025: 20% → 2026: 23%)

Some of the prohibited methods include banning virtual assets as a payment tool while permitting investment trading within a controlled framework, along with additional restrictions on high-risk activities such as privacy coins, mining, and custody services.

Particular attention must be paid to the significant gap in the implementation of regulatory models banning VASPs. Among the 33 jurisdictions that fully or partially prohibit virtual assets, only 6 meet basic compliance standards; only 1 ban jurisdiction fully implements the R15.3 risk assessment requirements. Without effective enforcement and supporting mechanisms for active identification and prosecution, the proliferation of black markets and offshore platforms will persist, increasing global financial risks.

In jurisdictions that permit VASPs to operate legally, 76 have actually completed VASP licensing or registration, with no increase compared to 2025. The FATF standard requires jurisdictions to mandate registration or licensing for service providers established and operating locally; among the 114 jurisdictions that have established licensing systems, 44% cover only local service providers, while 34% adopt a broader regulatory scope, requiring eligible offshore service providers to register locally as well. Currently, countries commonly face challenges in identifying the actual operating entities behind virtual asset businesses.

1.4 Travel Rule legislation is advancing quickly, but enforcement is lagging behind.

The Travel Rule extends the FATF’s payment transparency requirements (Recommendation 16) to the virtual asset sector: virtual asset service providers and financial institutions must collect, retain, and transmit complete information about the sender and recipient in real time and securely during transfers.

The implementation of Travel Rule legislation has accelerated significantly: 83% of surveyed jurisdictions (91 out of 109) have enacted Travel Rule legislation, compared to 73% in 2025. However, 55 jurisdictions that have enacted the law have not yet conducted any regulatory inspections or enforcement actions related to the Travel Rule. Most jurisdictions have only recently implemented the legislation, and their regulatory frameworks are still under development, resulting in significant delays in enforcement.

2.1 Virtual assets are used for upstream crimes, money laundering, terrorist financing, and proliferation financing

Southeast Asian fraud hubs have become the primary global source of illicit funds in virtual assets, with typical crimes including "pig butchering" investment scams that generate tens of billions of dollars in illegal profits annually. Criminal networks launder funds through multiple layers of non-custodial wallets, OTC channels, and regional underground financial systems. The report highlights the systemic risks posed by weak AML jurisdictions, using the example of a major Cambodian financial group (Huiwang Group) laundering at least $4 billion in illicit funds and being exploited by a North Korean hacker network; entities lacking KYC controls can simultaneously provide money laundering pathways for multiple types of illegal actors.

Reports reveal that proliferation financing, terrorist financing, and sanctions evasion share the same virtual asset infrastructure and criminal patterns. Sanctions evasion groups are increasingly shifting from domestic exchanges to offshore intermediaries, global platforms, over-the-counter (OTC) channels, and stablecoin payment gateways. North Korea continues to launder illicit funds through exchanges, DeFi protocols, cross-chain bridges, and multisignature wallets. In terrorist financing, criminals heavily utilize USDT stablecoins on the TRON chain, paired with tools designed to obscure the flow of transaction fees. The report cites Spain’s 2025 “Borelli Operation,” which dismantled a cross-border cryptocurrency fraud network involving €460 million in illicit funds and over 5,000 victims. The group operated through Hong Kong shell companies and bank accounts disguised as legitimate investment platforms, laundering proceeds via cash, bank transfers, and layered virtual asset movements, highlighting the hierarchical and industrialized nature of transnational fraud networks, as well as their deep integration with human trafficking, sanctions evasion, and cross-border money laundering.

In addition, the misuse of artificial intelligence may amplify the risks within the above virtual asset crime chain. AI is being used to generate deepfake videos, analyze smart contract vulnerabilities, and automatically generate attack code, accelerating intrusions into DeFi and cross-chain infrastructure. Illicit funds are rapidly split and transferred via stablecoins, decentralized exchanges, and cross-chain bridges, significantly increasing the difficulty of tracking and freezing. The report explicitly states that regulators worldwide must treat AI-enabled virtual asset crime as a structural risk and enhance capabilities in deepfake detection, native blockchain forensic tools, and public-private information sharing mechanisms.

2.2 Stablecoins become the preferred vehicle for illicit funds

In 2025, 84% of illegal crypto transactions were conducted via stablecoins, with USDT/USDC serving as the primary tool for terrorist organizations, hackers, and drug cartels.

Criminal organizations have developed proprietary stablecoins designed to evade law enforcement freezes, creating a new type of risk. For example, a Cambodian financial group (Huiwang Group) issued a USD-pegged stablecoin claiming it is unregulated and that its assets cannot be frozen. After third-party stablecoin issuers froze $29 million in assets linked to the group, the criminal organization began developing its own anti-freeze stablecoin, deploying it across multiple blockchains, significantly increasing the difficulty of tracking. This case demonstrates that virtual asset service providers cannot rely solely on issuer freeze functions for risk control; countries must mandate that stablecoin issuers build technical capabilities that enable cooperation with law enforcement in freezing and seizing tokens, bringing them fully under anti-money laundering regulation.

Additionally, terrorist organizations (ISIS, Al-Qaeda) are gradually abandoning Bitcoin in favor of stablecoins, using address rotation, small-value transaction splitting, multi-layer OTC trades, and combining DeFi with non-custodial wallets to evade compliance scrutiny.

2.3 Peer-to-Peer Trading Risks with Non-Custodial Wallets

Peer-to-peer transactions in non-custodial wallets involve no licensed intermediaries and are not subject to anti-money laundering compliance obligations, creating a structural regulatory gap. Although on-chain transactions are traceable, their anonymity allows criminals to obscure fund origins through layered wallets, increasing the complexity of tracking and investigation. The cross-border instant settlement of stablecoins further amplifies cross-border money laundering risks. These transactions lack mandatory reporting obligations for suspicious activities; only stablecoin issuers can assist law enforcement by freezing involved wallets and submitting suspicious transaction reports as supplementary measures.

88% of the 66 surveyed jurisdictions classify peer-to-peer transactions as high-risk; however, only 23% (31 out of 133) consistently track and monitor the market size of peer-to-peer transactions, making risk quantification difficult due to fragmented industry data.

*For a more detailed analysis of the risks associated with stablecoin peer-to-peer transactions involving non-custodial wallets, readFATF’s Special Report on Stablecoins and Non-Custodial Wallets: Understanding Risk Threats and Mitigation Strategies>

2.4 Offshore VASP Regulatory Arbitrage Issue

An offshore virtual asset service provider (oVASP) refers to a platform whose registration and operational location are separate from the jurisdiction of its clients. If the oVASP’s registration jurisdiction has weak anti-money laundering oversight, it creates money laundering risks for both the registration jurisdiction and the clients’ jurisdiction; if the clients’ jurisdiction does not require oVASPs to register, the platform can completely evade local regulation.

A further risk lies in nested account issues: if offshore service providers disguise themselves as ordinary retail users to open accounts on domestic compliant exchanges, large-scale illegal transactions far exceeding typical retail volumes can occur, and weak risk controls on domestic platforms may introduce significant risks such as sanctioned entities and illicit funds.

The report highlights regulatory arbitrage as a fundamental structural risk: offshore service providers register in jurisdictions with lax regulations to reduce compliance costs such as customer due diligence and the travel rule, undercutting compliant, licensed platforms with lower prices, undermining a fair regulatory environment, and destabilizing local regulatory systems.

Countries have gradually implemented regulatory measures: identifying offshore service providers through blockchain analysis, open-source intelligence, and suspicious transaction reports from domestic platforms; adopting "territorial business regulation," mandating registration for any platform that markets to local residents or integrates with local payment channels; some jurisdictions require offshore service providers to appoint a local compliance officer and fully retain customer data. For non-compliant offshore service providers, graduated actions should be applied, including public warnings, removal from app stores, cutting off domestic financial channels, and criminal prosecution; cross-border collaboration should be facilitated through domestic inter-agency coordination, mutual visits with international regulatory bodies, and FIU networks.

2.5 Regulatory Gap in Decentralized Finance (DeFi)

Globally, it is difficult to identify the actual controllers of DeFi projects, and most jurisdictions have not established licensing or registration requirements for DeFi projects within the FATF regulatory scope. Issues with DEXs, cross-chain bridges, and privacy tools disrupting on-chain fund tracking pathways remain unresolved, leading to a持续扩大的 gap in money laundering risk controls.

In the 2026 survey data, only 18% (26 out of 142) have completed a DeFi industry risk assessment, and 9% are in the process of doing so. 93% (132) are unable to identify domestic DeFi projects that meet the VASP definition; 31% (44) have existing risk control rules that cover DeFi, but only four have implemented mandatory licensing requirements, and only two have actually completed the registration and licensing of DeFi projects. Only 35% (50) of regulatory authorities engage in dialogue with the industry to map out DeFi business models and risks.

The core challenges in regulating DeFi include cross-border operations, the absence of a legal entity, and lack of clear regulatory leverage. Regulatory agencies lack the technical expertise in blockchain technology to determine actual control of projects, and there has been only one reported enforcement case against a non-compliant DeFi project.

3.1 Core Tasks for Regulatory Authorities

3.1.1 Comprehensive Risk Assessment

Whether adopting a licensing or prohibition model, a clear and comprehensive understanding of the money laundering/terrorist financing/proliferation financing risks associated with VA/VASPs is essential. Risk assessments must cover domestic VASPs, offshore VASPs, stablecoin issuers, DeFi, non-custodial wallets, emerging industry technologies, and new criminal business models.

3.1.2 Establish a Complete VASP Regulatory Framework

- Licensing/Registration Mandate: Local VASPs, compliant stablecoin issuers, and regulated DeFi platforms must hold licenses; cross-border offshore service providers must also be mandatorily registered when meeting specified criteria.

- Regularized regulatory inspections: Dual-track on-site and off-site reviews to verify implementation of AML compliance measures such as the Travel Rule and KYC, and provide corrective guidance to institutions.

- Illegal business penalty mechanism: Establish procedures to identify and penalize individuals and enterprises operating unlicensed virtual asset businesses.

3.1.3 Strengthen cross-border public-private collaboration to establish channels for freezing and recovering illicit assets

Establish formal and informal cross-border, cross-departmental information-sharing channels to quickly identify criminal actors and illicit funds; improve the legal framework for swiftly freezing and seizing stablecoins and crypto assets to combat offshore and DeFi-related cross-border illicit funds.

3.2 Compliance Obligations for VASPs, Stablecoin Issuers, and Compliant DeFi

3.2.1 Establish a comprehensive AML/CFT compliance system and strictly enforce the Travel Rule.

Continuously and dynamically assess your business risks, with a focus on monitoring stablecoins, non-custodial wallets, offshore service providers, and emerging risks related to DeFi.

- Integrated risk management tools: Know Your Customer (KYC), on-chain wallet screening, blacklists and whitelists, and asset blocking and freezing functions that can be rapidly updated to counter new fraud and money laundering techniques;

Proactively cooperate with regulators and industry peers by sharing characteristics of suspicious transactions and risk alert signals, and assist in law enforcement investigations and evidence collection.

3.2.2 Implement targeted control measures for high-risk scenarios

Enhance monitoring of non-custodial wallet transactions and perform enhanced due diligence (EDD) on high-risk wallet transactions;

- Deploy on-chain monitoring and blockchain analysis tools (such as Beosin KYT) to automatically identify and alert on suspicious activities including large fund transfers and layered money laundering; analyze and trace over 120 complex cross-chain protocols and mixer transactions to assess money laundering risks associated with DeFi protocols, cross-chain bridges, and mixers;

- Conduct rigorous due diligence on offshore VASPs, identify offshore platform accounts disguised as retail users, restrict high-risk partnership channels, and monitor fiat on-ramp and off-ramp channels connected to unlicensed offshore platforms.

The FATF’s seventh targeted update report indicates progress in global virtual asset regulation, but core risks such as enforcement gaps, regulatory vacuums in DeFi, offshore platform arbitrage, and vulnerabilities in stablecoins and peer-to-peer self-custody wallets persist. The report emphasizes a fundamental logic: virtual assets are borderless, and a regulatory gap in any jurisdiction is a vulnerability in the global financial system. For jurisdictions with significant VASP activities, the FATF calls for accelerated implementation of R.15. Jurisdictions that have not yet started should prioritize risk assessments and the establishment of legal frameworks; those with existing progress should prioritize substantive regulatory actions. Amid the continued expansion of the global virtual asset market and increasingly sophisticated criminal methods, the pace of regulation must match the evolution of risks—this is both the FATF’s call and a practical requirement for the global virtual asset financial security framework.

Report link: https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-updated-virtualassets-vasps-2026.html

Beosin, among the world’s first blockchain security companies specializing in formal verification, offers a comprehensive “security + compliance” ecosystem. With offices in over 10 countries and regions, Beosin provides end-to-end blockchain compliance and security services, including pre-launch code audits, real-time security monitoring and threat blocking, asset recovery, virtual asset anti-money laundering (AML), and regulatory-compliant assessments tailored to local requirements. Please reach out to us via the WeChat public account message box.