FATF Says Crypto Laws Are Being Passed and Not Enforced

More countries than ever have written crypto into their anti-money-laundering law. Far fewer have done anything with it, and organised crime groups are moving billions of dollars through the difference.

That is the finding of the Financial Action Task Force's seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers, which assesses how far jurisdictions have got with Recommendation 15 — the standard that extended global AML and counter-terrorist-financing rules to crypto.

The headline number, and the one underneath it

Eighty-three per cent of surveyed jurisdictions have now passed legislation implementing the Travel Rule, up from 73% a year earlier, with a further 11 reporting that implementation is under way. On its own that reads as steady progress.

The qualifying figure is the one that matters. Of the jurisdictions that have passed Travel Rule legislation, only around 40% have taken any supervisory or enforcement action to check that virtual asset service providers are actually complying. Almost half have done nothing at all.

A rule that nobody examines is not a control. It is a statement of intent that appears in a compliance table.

Where the gaps are

The FATF finds that jurisdictions continue to struggle simply to identify who is conducting VASP activity within their borders — a prerequisite for licensing, registration or supervision of any kind. Many have legal frameworks that have not been translated into effective practice.

Three specific gaps recur:

Offshore providers. Jurisdictions continue to report difficulty mitigating the risk of VASPs operating from outside their reach, an issue the FATF examined in a separate report earlier this year.

Decentralised finance. Assessing and mitigating risk around DeFi arrangements remains largely unsolved, and the FATF warns this may become an increasingly significant gap as regulated entities — banks and licensed VASPs alike — expand their own engagement with those platforms.

Prohibition regimes. Countries that have banned virtual assets outright are finding that a ban is only as good as the enforcement behind it. Prohibition is permitted under the FATF Standards, but the report notes its effectiveness depends entirely on robust supervision — which is the same capability the permissive jurisdictions are also missing.

What the criminals did with the gap

The report sets out how virtual-asset-enabled crime has become more complex and more interconnected, spanning scam centre operations run by organised crime groups, so-called pig-butchering fraud, cyber theft attributed to North Korea, terrorist and proliferation financing, sanctions evasion and cross-border laundering.

Two cases illustrate the scale. A financial services conglomerate based in Cambodia is assessed to have laundered at least $4bn in illicit proceeds between 2021 and 2025 — servicing both organised-crime fraud schemes and DPRK-linked cyber theft through the same infrastructure. And in June 2025 Spain's Guardia Civil, working with Europol, dismantled a cryptocurrency investment fraud network alleged to have laundered around €460m from more than 5,000 victims worldwide.

The FATF also flags the growing misuse of artificial intelligence across fraud, hacking and laundering — deepfakes, synthetic identities and AI-enabled recruitment scams — and a marked increase in the illicit use of stablecoins. Most identified on-chain illicit activity now involves stablecoins rather than volatile tokens, which is unsurprising: someone laundering proceeds wants the value to hold between the crime and the cash-out.

One detail in that section deserves attention on its own. The report describes an emerging risk of a financial services conglomerate with links to criminal networks developing a proprietary stablecoin designed specifically to resist freezing and asset seizure — an issuer building the countermeasure into the product.

Concentration is the argument for acting

The report includes an updated table of steps taken by jurisdictions with materially important VASP activity. That group accounts for roughly 97% of the global virtual asset market.

That concentration is the practical case for prioritisation. Full implementation by a comparatively small number of jurisdictions would address the overwhelming majority of global exposure, which is why the FATF says it will continue outreach to those countries — particularly the lower-capacity ones — rather than pursuing uniform progress everywhere at once.

The FATF president's warning

"This year's targeted update makes clear that criminal networks continue to abuse virtual assets for illicit purposes and exploit their borderless nature to commit fraud and scams, evade sanctions and launder the proceeds of crime — taking advantage of gaps in countries' frameworks and uneven implementation of FATF Standards across jurisdictions," said FATF President Giles Thomson.

"Effective implementation of the FATF Standards can no longer be delayed. Governments and the private sector must work together to strengthen preventive measures and close regulatory gaps, bolster cross-border co-operation and deny criminals the opportunity to exploit weak links in the global system. As criminal methods become more sophisticated, safeguards must keep pace with technological change and ever-evolving criminal tactics."

What happens next

The update was published at the start of the United Kingdom's FATF presidency, which has committed to tackling fraud and accelerating work on virtual assets.

Its priority actions are aimed at both public authorities and industry: strengthen risk-based supervision and enforcement, improve Travel Rule implementation in practice rather than on paper, deepen cross-border co-operation, and address the risks arising from stablecoins, offshore VASPs, unhosted wallets and DeFi.

None of that is new as a list. What has changed is the evidence base behind it — a second consecutive year in which the legislative numbers improved, the enforcement numbers did not, and the case studies grew larger.