FATF: Delay No More in Effective Supervision and Enforcement amid Increasingly Complex VA Illicit Finance Risks
The Financial Action Task Force (FATF) published its seventh annual Targeted Update on Implementation of the FATF Standards on VAs and VASPs (Update) for 2026, providing a review of implementation of the standards including the Travel Rule and an update on emerging risks arising from the criminal exploitation, particularly on frauds and sanctions evasion.
As money laundering/terrorist financing typology continues to evolve amid emerging risks such as abuse of AI and decentralised finance (DeFi) protocols, FATF urges jurisdictions to rapidly operationalise implementation and enforcement of Travel Rule through effective supervision and enforcement in case of non-compliance. To this end, the Monetary Authority of Singapore just published an Information Paper on AML/CFT Supervisory Expectations for Digital Payment Token Service Providers (DPTSPs or VASPs), setting out its observations from recent inspections and its supervisory expectations for AML/CFT/CPF controls.
The FATF’s complete assessment covers 147 jurisdictions that responded to the survey out of a total of 205, outcomes from FATF’s Virtual Assets Contact Group (VACG) meetings and Symposium, and results from 149 FATF mutual evaluation reports and follow-up reports that assess jurisdictions’ VA regulations (R.15).
The annually updated table of jurisdictions with “materially important VASP activity” added two further jurisdictions (now 77), representing approximately 97% of the global virtual asset market. The FATF Update calls for full implementation of FATF standards thereby reducing the heightened financial crime risks.
Stablecoins remains a major emerging risk, with the Update noting the role of deliberate, purpose-built issuance of proprietary stablecoins to circumvent law enforcement intervention, in the VA-enabled fraud ecosystem. The stablecoins were also found to be the increasing favourite of terrorist groups over Bitcoin, coupled by other concealing techniques such as multi-hop transfers through VASPs and OTC brokers, and further pairing stablecoins with DeFi tools and unhosted wallets to circumvent compliance controls. Specifically, the pseudonymous nature of unhosted wallets enables threat actors to obscure attribution through layered unhosted wallets transactionally distant from Travel Rule-covered wallets, with risks further compounded on a cross-border basis given the near-instant settlement of stablecoins across jurisdictions.
The Update identified offshore VASPs (oVASPs) to be a main risk of global illicit finance. Because these borderless platforms operate outside effective oversight, they have become the go-to vehicles for organised crime networks, cyber-thieves, and "pig-butchering" scammers looking to launder dirty money, with some involving the use of nested and intermediated arrangements. To fight back, the FATF notes that over a third of regulated jurisdictions are aggressively expanding their perimeters—forcing offshore VASPs targeting local users to register domestically or face enforcement.
DeFi remains largely uncharted regulatory waters, with the Update noting that only less than 30% of jurisdictions surveyed have assessed or are in the process of conducting a risk assessment that look into DeFi-related risks. Only 7% (or 10 out of 142 jurisdictions) have identified DeFi arrangements operating in their territory that qualify as VASPs under FATF standards. While 31% of jurisdictions reported that their risk mitigation measures apply to DeFi arrangements, only two jurisdictions have actually licensed or registered DeFi arrangements in practice.
The Update also highlighted the persistent Travel Rule supervision and enforcement gaps, despite some progress since the 2025 Update. About 60% of the 91 jurisdictions (60%; 55 of 91) that have passed legislation implementing the Travel Rule have not yet issued findings or directives or taken enforcement or other supervisory actions against VASPs focused on Travel Rule compliance. More jurisdictions have identified their regulatory approach to VAs - including the option to partially/fully prohibit VA. Of the 21 jurisdictions explicitly prohibiting VAs (17 jurisdictions in 2025), 16 reported having taken supervisory or enforcement actions (9 jurisdictions in 2025).
Call for Actions
As VA-enabled illicit activity has become more complex and convergent, the FATF Update urges various public and private sector stakeholders to take immediate actions, including the following -
For public sector
● Understand and comprehensively assess the ML/TF/PF risks posed by VAs and VASPs (even where choosing to prohibit VASPs)
● Adopt a robust supervisory framework for VAs and VASPs, including stablecoin issuers and qualifying DeFi arrangements
● Enhance international and public-private cooperation to investigate and seize illicit assets
For private sector
● Establish robust AML/CFT/CPF compliance frameworks and implement the Travel Rule in line with the requirements of R.15, including acquiring robust risk understanding and putting in place controls that can be swiftly updated to respond to emerging ML/TF/PF trends and typologies.
● Stronger partnerships with the public sector to identify, investigate and prosecute illicit activity by sharing typologies, red flags, good practices, and ensuring that they can provide tactical and operational assistance in the course of law enforcement investigations.
● Conduct enhanced due diligence of oVASPs, detect accounts used by oVASPs that misrepresent themselves as retail users, restrict or exit higher-risk relationships, and monitor fiat on/off-ramp activity linked to unlicensed or weakly supervised offshore platforms
● Assess risks arising from DeFi activities, including exposure to protocols, bridges, mixers, cross-chain tools, and apply appropriate AML/CFT/CPF measures to mitigate those risks.
VerifyVASP’s Commitments to Robust Travel Rule and VASP Regulation Implementation
At VerifyVASP, the purpose-built Travel Rule solutions are intended to bridge implementation challenges faced by VASPs and competent authorities.
1. Verified Network Architecture – Effective Travel Rule implementation starts at the counterparty layer due diligence, similarly to the establishment of correspondent banking relationship under FATF Recommendation 13.
Our Verified Network architecture maintains a list of verified VASPs (as highlighted by our company name VerifyVASP) as a membership structure, keeping verified and current documental proof of our members’ information at the legal entity level required to facilitate counterparty due diligence (including KYB and a comprehensive questionnaire adapted from the Wolfsberg Counterparty Due-Diligence Questionnaire for the Virtual Assets industry).
This focus on counterparty due-diligence has proven to be effective in mitigating risks of oVASPs faced by our Members. In practice, regulated domestic exchanges within our Verified Network are able to influence oVASPs to tighten up their standards (as shown in the image below) in order to maintain a counterparty relationship. Examples of this include
● Leveling up their KYC processes to ensure better quality data used in Travel Rule verifications.
● Delisting Anonymity Enhanced Coins (AEC) or implementing risk mitigants in relation such as blocking it for customers of a certain jurisdiction or disallowing the on and off ramping for AECs.
● Deeper participation in public-private partnership by responding to regulatory enquiries, investigation or asset recovery.
2. VerifyName – A scalable solution that VASPs can implement to comply with the Travel Rule with a non-obliged counterparty VASP, providing critical Enhanced Due Diligence (EDD) by verifying that the originator and beneficiary identities match. As an effective risk mitigant, the solution strictly allows only 1st-party transactions and provides wallet and name screening, which dramatically reduces impersonation scams and fraudulent VASP activities among our members.
3. VerifyWallet - a scalable solution that VASPs can implement to verify that their customers have control over self-hosted wallets using key signing technologies within the VASPs own secured environment.
4. Law Enforcement Solutions (LES) – Verified and secure Travel Rule data brings value to supervision and enforcement. LES is an AI-driven tracing tool offered to the public sector (Law Enforcement Agencies, Financial Intelligence Units, and Regulators) for effective and quick tracing by combining blockchain data with VerifyVASP's verified transactional information accumulated through objective-based Travel Rule compliance.
5. Public Private Partnerships (PPP) – VerifyVASP is an active participant in various PPPs established internationally and regionally to jointly combat illicit activity in the industry.
As a company built for the purpose of Travel Rule and the wider need of VASP compliance, VerifyVASP upholds the gold standard of Travel Rule compliance, and has been iterating the Verified Network architecture along the development of the digital assets markets, having regularly audited ourselves against FATF standards and other international best practices. As a global leader in Travel Rule solution, we remain ever committed to helping our Network of over 150 and growing VASPs across the globe to comply with FATF standards, thereby making the digital asset ecosystem a safer place.