FATF Warns Criminals Are Exploiting Regulatory Gaps in Virtual Assets

The Financial Action Task Force has published its seventh Targeted Update on the implementation of AML/CFT standards for virtual assets (VAs) and virtual asset service providers (VASPs), warning that regulatory gaps continue to expose the global financial system to increasingly sophisticated illicit finance risks.

Released on 16 July 2026, the report finds that while 83% of surveyed jurisdictions have now introduced legislation implementing the FATF Travel Rule, up from 73% in 2025, many countries are still struggling to translate legal frameworks into effective supervision, licensing, and enforcement.

According to FATF, organized crime groups are increasingly exploiting inconsistent regulation across jurisdictions to facilitate fraud, sanctions evasion, terrorist financing, cybercrime, and cross-border money laundering. The report notes that criminal use of virtual assets has become significantly more complex over the past year, driven by AI-enabled fraud, decentralized finance (DeFi), offshore VASPs, unhosted wallets, and the growing misuse of stablecoins.

Among the report’s key findings, FATF highlighted that a Cambodia-based financial services network allegedly laundered more than US$4 billion between 2021 and 2025 for organized crime groups and DPRK-linked cyber actors. It also referenced the dismantling of a €460 million cryptocurrency investment fraud network in Spain involving more than 5,000 victims, demonstrating the increasingly global nature of virtual asset-enabled financial crime.

The report further warns that illicit actors are adapting rapidly by using deepfakes, synthetic identities, AI-powered recruitment scams, and even developing proprietary stablecoins designed to resist asset freezing and seizure.

While acknowledging progress in implementing Recommendation 15, FATF stresses that regulatory frameworks alone are no longer sufficient. It calls on governments and the private sector to strengthen risk-based supervision, improve Travel Rule compliance, enhance cross-border cooperation, and address risks associated with stablecoins, offshore VASPs, DeFi platforms, and unhosted wallets.

The report also emphasizes that jurisdictions representing approximately 97% of the global virtual asset market have now taken steps toward regulating VASPs, making effective implementation across these markets critical to reducing global financial crime risks.

Why It Matters for Compliance

The latest FATF update reinforces that crypto compliance is entering a new phase focused on enforcement rather than relying solely on legislation. As criminals increasingly exploit regulatory inconsistencies and emerging technologies, financial institutions and VASPs will face greater expectations to strengthen AML controls, Travel Rule compliance, customer due diligence, and cross-border risk management.