On 16 July 2026, the Financial Action Task Force (FATF) published a targeted update on implementation of the FATF standards on Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs).

Background

This targeted update assesses progress and remaining gaps in the implementation of Recommendation 15 (R.15) across the FATF Global Network, following the extension of the FATF’s anti-money laundering and the combatting the financing of terrorism standards for VAs and VASPs.

Summary

FATF set out the following key findings:

  • There has been some improvement in the implementation of R.15 since 2025. More jurisdictions reported having conducted VA/VASP risk assessments but effectively using these assessments to inform risk-based preventive, mitigation, supervisory and enforcement measures continue to be a challenge for many jurisdictions.
  • Jurisdictions are increasingly determining how to regulate their VA/VASP sector, but significant gaps remain. More jurisdictions have identified their regulatory approach, including by permitting VA/VASP activity or adopting full or partial prohibitions. However, further analysis is needed to understand the extent to which these frameworks have been effectively operationalised.
  • Jurisdictions taking a prohibition approach have not progressed in taking supervisory or enforcement actions to sanction VASPs operating illegally within their jurisdictions. The use of prohibition frameworks, while allowed by the FATF Standards, can represent significant risks to the VASP and global financial system if not enforced effectively.
  • Progress has continued in licensing and registering VASPs, including in supervisory inspections and enforcement actions. Nevertheless, further progress is needed in licensing and registration in practice, and jurisdictions continue to face difficulties in identifying natural or legal persons that conduct VASP activities. Offshore VASPs also remain a significant challenge, with more than a third of jurisdictions with licensing or registration frameworks applying a broader approach to require certain offshore VASPs to be licensed or registered.
  • Jurisdictions have made progress on implementing the Travel Rule. However, enforcement experience remains limited, with almost half of jurisdictions that have introduced Travel Rule legislation not yet having taken Travel Rule-related supervisory or enforcement action.
  • Similar to findings in previous Targeted Update reports, identifying individuals or entities exercising control or sufficient influence over DeFi arrangements continues to be challenging.
  • Since 2025, VA-enabled illicit activity has become more complex and convergent, including through Organised Crime Groups-linked scam centre operations.