The Riffle
The Financial Action Task Force (FATF) has published its 2026 Targeted Update on the Implementation of Recommendation 15, assessing how jurisdictions across the globe are implementing anti-money laundering (AML), counter-terrorist financing (CFT) and counter-proliferation financing (CPF) standards for virtual assets (VAs) and virtual asset service providers (VASPs). While the report acknowledges steady progress in regulatory adoption, it also highlights that practical implementation remains inconsistent across many jurisdictions.
The latest update reflects the evolving nature of financial crime within the virtual asset ecosystem. Organised criminal groups, terrorist organisations and sanctioned entities are increasingly leveraging stablecoins, decentralised finance (DeFi), artificial intelligence (AI) and offshore VASP structures to facilitate illicit financial activity. FATF therefore shifts its focus from legislative progress towards operational effectiveness, supervision and cross-border enforcement.
Key Highlights
Greater Regulatory Adoption, But Compliance Remains Uneven
More jurisdictions are strengthening their virtual asset frameworks, with FATF reporting improvements in overall compliance ratings. However, only one jurisdiction is currently fully compliant with Recommendation 15, while many remain partially compliant or non-compliant, highlighting that regulatory maturity continues to vary significantly across the global network.
Travel Rule Implementation Has Outpaced Enforcement
Although most jurisdictions have now introduced Travel Rule legislation, FATF observes that supervisory activity has not kept pace. Many regulators have yet to conduct inspections or take enforcement action, suggesting that operational implementation remains at an early stage.
Financial Crime Is Becoming More Sophisticated
The report notes that organised crime groups are increasingly using virtual assets for large-scale fraud, money laundering and cross-border criminal activity. FATF also highlights growing links between cybercrime, proliferation financing and the misuse of virtual assets, reinforcing the need for stronger international cooperation.
Stablecoins, Unhosted Wallets and DeFi Present New Challenges
Stablecoins are increasingly being used by illicit actors, while peer-to-peer transactions through unhosted wallets continue to present significant AML risks. FATF also identifies AI-enabled fraud and decentralised finance as emerging areas where regulatory frameworks are still developing.
Offshore VASPs Continue to Exploit Regulatory Arbitrage
Offshore VASPs remain a key concern, with some firms operating across jurisdictions without appropriate licences or attempting to circumvent local regulatory requirements. FATF calls for stronger supervision to address these cross-border risks.
Focus Shifts Towards Effective Supervision
Rather than introducing entirely new standards, FATF is encouraging jurisdictions to strengthen licensing oversight, improve enforcement of the Travel Rule, enhance transaction monitoring and expand cooperation between regulators and the private sector.
What This Means for the Virtual Asset Industry
The 2026 update demonstrates that the conversation has moved beyond whether virtual assets should be regulated. The focus is now on how effectively regulatory frameworks operate in practice.
As supervisory expectations continue to evolve, licensed VASPs will increasingly be expected to demonstrate robust governance, effective Travel Rule compliance, comprehensive transaction monitoring, enhanced due diligence for higher-risk activities, and strong controls around stablecoins, unhosted wallets and offshore counterparties.
For firms operating internationally, regulatory convergence remains a work in progress. Businesses should therefore expect continued differences in supervisory expectations across jurisdictions while preparing for greater scrutiny of cross-border activities and increasingly sophisticated AML/CFT obligations.
The Riffle Takeaway
FATF’s 2026 update signals that the conversation around virtual asset regulation is no longer centred on introducing new rules—it is now focused on demonstrating effective implementation. As jurisdictions strengthen supervision and enforcement, VASPs will be expected to move beyond technical compliance and establish mature governance, robust AML/CFT controls and effective monitoring frameworks. Firms that proactively adapt to these evolving expectations will be better positioned as regulatory scrutiny continues to intensify globally.
