The Financial Action Task Force has warned that crypto-enabled illicit finance is becoming more complex and interconnected as criminal networks exploit gaps and uneven implementation across national anti-money laundering and counter-terrorist financing frameworks.
The Paris-based intergovernmental body, which has 40 member jurisdictions, set out the warning in its seventh annual update on virtual assets and virtual asset service providers. FATF extended its AML/CFT standards to virtual assets and VASPs in October 2018, but its latest assessment says many jurisdictions have yet to convert legislation into effective regulation, licensing, registration, supervision and enforcement.
Implementation of the FATF Travel Rule has continued to expand. The rule requires virtual asset businesses to collect, verify and transmit information about the originator and beneficiary of virtual asset transfers. In the update dated 16 July, 83% of surveyed jurisdictions had passed implementing legislation, up from 73% in 2025, while a further 11 jurisdictions reported that implementation was under way.
The higher level of legislative adoption has not removed the practical control gaps identified by FATF. Authorities continue to report difficulties identifying people and entities conducting VASP activities, while offshore providers continue to present risk-mitigation challenges. FATF also highlighted risk assessment and mitigation problems around decentralised finance as regulated financial institutions and VASPs expand their engagement with DeFi platforms.
Those issues were examined in a 47-page FATF report on offshore virtual asset service providers published in March 2026 and a 49-page report on regulatory challenges from decentralised finance published on 21 July.
The criminal activity identified in the annual update includes organised crime-linked scam centres, pig-butchering fraud, North Korea-related cyber theft, terrorist and proliferation financing, sanctions evasion and cross-border money laundering. FATF also described the growing use of artificial intelligence in virtual asset-related fraud, hacking and money laundering, including deepfakes, synthetic identities and AI-enabled recruitment scams.
Stablecoins now account for most identified illicit on-chain activity, according to FATF, and their use by illicit actors has continued to increase since the organisation’s 2025 update. The risks were addressed in a 42-page FATF report on stablecoins, unhosted wallets and peer-to-peer transactions published on 3 March 2026.
Examples cited by FATF include a Cambodia-based financial services conglomerate that laundered at least $4 billion in illicit proceeds between 2021 and 2025. Spain’s Guardia Civil also dismantled a cryptocurrency investment fraud network in June 2025 that allegedly laundered approximately EUR 460 million from more than 5,000 victims worldwide.
FATF president Giles Thomson said criminal networks were exploiting the borderless nature of virtual assets to commit fraud, evade sanctions and launder criminal proceeds. Thomson is also HM Treasury’s director for economic crime and sanctions, with responsibility for UK AML/CFT policy and the Office for Financial Sanctions Implementation.
The UK assumed the two-year FATF presidency on 1 July and is preparing for an on-site assessment in 2027, following its previous assessment in 2018. The evaluation will focus on the effectiveness of the UK’s AML/CFT framework, placing implementation, supervision, enforcement and cross-border cooperation at the centre of the country’s next regulatory test.
