Cryptoasset Financial Crime: FATF 2026 Update Explained

Cryptoassets sit in an awkward place for financial crime teams. Many firms deal with them indirectly, through customers, counterparties or payments, yet the typologies change quickly. In July 2026 the Financial Action Task Force (FATF) published its seventh targeted update on how countries are implementing its standards on virtual assets and virtual asset service providers (VASPs). This guide summarises the update's main findings and what they mean for compliance teams and advisers. It supports our course overview on financial crime risk in cryptoassets, and it builds on the FATF Recommendations explained elsewhere on this site.

What the update measures

According to the report, 149 jurisdictions had been assessed against Recommendation 15, the FATF standard on virtual assets, as of April 2026, and 147 of 205 jurisdictions in the FATF Global Network responded to a survey. The report notes that survey responses are self-reported and unverified, and it infers that the 58 jurisdictions that did not respond have made no progress.

The travel rule

The travel rule requires VASPs to pass identifying information about the sender and recipient along with virtual asset transfers. FATF reports that 83 percent of the 109 jurisdictions surveyed on this point (91) have passed travel rule legislation, up from 73 percent (85 of 117) in 2025, and that 11 more are in the process of doing so. However, 60 percent of the jurisdictions with legislation (55 of 91) have not yet issued findings, directives or enforcement actions on compliance. The report's key findings section describes this gap as "almost half", which does not match the 60 percent in its body text, so readers should treat the enforcement gap as large rather than precise.

How countries rate on Recommendation 15

As of April 2026, FATF reports one jurisdiction as compliant, 34 percent (51) as largely compliant, 43 percent (64) as partially compliant and 22 percent (33) as non-compliant. For comparison, the 2025 figures were 29 percent largely compliant, 50 percent partially compliant and 21 percent non-compliant. Only 40 percent (59 of 149) met or mostly met the criterion on licensing or registration, and only 48 met or mostly met the criterion on risk assessment and a risk-based approach.

Illicit finance examples the report cites

• Organised crime groups, including Cambodia-based scam centres, generate multi-billion dollar annual proceeds from pig-butchering fraud, according to authorities and international organisations the report cites, including the UN Office on Drugs and Crime.
• A Cambodia-based conglomerate laundered at least 4 billion US dollars between August 2021 and January 2025, according to competent authorities citing a US Treasury action, of which at least 37 million came from North Korean cyber heists.
• Spain's Operation Borrelli involved about 460 million euros laundered from more than 5,000 victims, according to Europol.

Stablecoins and unhosted wallets

The report says legitimate stablecoin issuers typically keep the technical ability to block, freeze or burn tokens on request from authorities, and describes a USD-pegged token marketed as immune to freezing that was issued by the Cambodia-based conglomerate. It reports that a third-party issuer froze over 29 million dollars linked to that group. On peer-to-peer transfers through unhosted wallets, the report calls it a structural gap that no regulated intermediary is involved and so no obliged entity files suspicious transaction reports. It also reports that 88 percent of the jurisdictions that rated peer-to-peer risk (58 of 66) rated it high.

What FATF recommends to the private sector

The report's recommendations for firms include maintaining AML and counter-terrorist financing programmes that cover know-your-customer checks, wallet screening, blacklisting and whitelisting and freezing capability, and updating them quickly as typologies change. It recommends monitoring unhosted wallet transactions with enhanced due diligence for higher-risk activity, using blockchain analytics to spot rapid transfers, applying enhanced due diligence to offshore VASPs and to those posing as retail users, assessing DeFi exposure including protocols, bridges, mixers and cross-chain tools, and sharing typologies and red flags with authorities.

Practical steps for firms and advisers: our suggestions

These steps are our suggestions, not statements in the report. Ask whether your customer risk assessment says anything about cryptoasset exposure, and if so whether staff know what to do with it. Check how your firm identifies payments to or from VASPs, and what extra information it requests. Do not treat a regulated VASP counterparty as low risk by default; the report shows enforcement is uneven. For structured training, browse our CPD courses.

What we could not confirm

We read a copy of the 2026 report hosted by the Financial Intelligence Analysis Unit of Malta, not the FATF-hosted file, and we did not review the separate FATF report on stablecoins and unhosted wallets it refers to. We have not covered UK or Irish crypto regimes, the EU Markets in Crypto-Assets rules or national travel rule implementation. The figures are FATF's and its sources', and some, such as the 60 percent gap, conflict with other parts of the report. This post is general information, not legal advice.