FATF ¦ Targeted Update on Implementation of the FATF Standards on VAs and VASPs
Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers (June 2025)
In 2019, the Financial Action Task Force (FATF) extended its global standards on anti-money laundering and counter-terrorist financing (AML/CFT) to virtual assets (VAs) and virtual asset service providers (VASPs). This 2025 report provides the sixth targeted review of the implementation of Recommendation 15 (R.15) by FATF jurisdictions worldwide. The FATF Virtual Assets Contact Group’s (VACG) roadmap aims to increase compliance and implementation of these standards.
Since 2024, jurisdictions have made progress in regulating VAs and VASPs, including supervisory and enforcement actions. However, challenges persist in risk assessment, licensing, registration, and enforcement. The report also highlights the growing use of stablecoins and decentralized finance (DeFi) within illicit activities, underscoring the need for ongoing vigilance and adaptation of regulatory responses.
Jurisdictions’ Implementation of FATF Standards on VAs/VASPs (R.15)
Overall Implementation Status
As of April 2025, 138 jurisdictions have been assessed for compliance with FATF standards regarding VAs and VASPs. About 29% are largely compliant, an improvement from 25% in 2024, while 21% remain non-compliant, down from 25%. Only one jurisdiction, the Bahamas, is fully compliant.
Despite progress in international cooperation and information exchange, many jurisdictions struggle with conducting comprehensive risk assessments, identifying VASPs, and enforcing the Travel Rule — a key requirement demanding that VASPs share originator and beneficiary information during transfers.
Challenges in Risk Assessment
Three-quarters of surveyed jurisdictions have conducted ML/TF risk assessments covering VAs/VASPs, up from 71% in 2024. Yet, many find it difficult to translate these assessments into effective preventative actions or risk-based supervision. Only a minority have met FATF criteria for risk assessment and risk-based approach implementation.
Approaches to Regulating VAs and VASPs
There is an increasing number of jurisdictions deciding how to regulate their VA sectors. In 2025, 82% have chosen an approach — either permitting usage or prohibiting it fully or partially. Most jurisdictions (62%) permit VAs/VASPs, while the number of jurisdictions prohibiting them has risen steadily to 20%. Prohibition is more common in regions such as the Middle East, North Africa, and parts of Africa.
Partial prohibitions are becoming more frequent than full bans. Common partial restrictions include banning VAs as payment methods or for retail investment purposes.
However, enforcement of prohibitions remains difficult; only a small fraction of jurisdictions taking prohibition measures have taken supervisory or enforcement actions against illegal VASP activity.
Licensing, Registration, and Supervision of VASPs
Jurisdictions continue to improve legal frameworks requiring licensing or registration of VASPs. In 2025, 96 out of 117 respondents require licensing or registration, an increase from 82 in 2024. However, fewer have licensed or registered VASPs in practice (76 in 2025 vs. 69 in 2024), indicating operational challenges.
Supervisory inspections and enforcement actions are increasing but remain uneven. More than a third of jurisdictions extend licensing requirements to offshore VASPs — those not physically or legally located within their borders — reflecting efforts to mitigate risks from unregulated foreign entities.
Identifying natural or legal persons conducting VASP activities continues to be a major challenge for regulators.
Implementation of the Travel Rule
The Travel Rule requires VASPs to collect and transmit originator and beneficiary details for virtual asset transfers. By 2025, 73% of jurisdictions that regulate VASPs have enacted legislation implementing the Travel Rule, a rise from previous years.
Despite this progress, enforcement remains limited; most jurisdictions with legislation have yet to take significant supervisory or enforcement actions focused on Travel Rule compliance. Effective supervision remains a key area for improvement.
Emerging Risks: ML/TF/PF Threats
Use of Virtual Assets in Illicit Activities
Virtual assets are used extensively by criminals for money laundering (ML), terrorist financing (TF), proliferation financing (PF), fraud, scams, and theft. Notably, the Democratic People’s Republic of Korea (DPRK) remains highly active in stealing and laundering vast amounts of virtual assets. In 2025, the DPRK conducted the largest single theft ($1.46 billion worth) from the VASP ByBit through sophisticated hacking techniques involving unregistered VASPs and complex wallet networks.
Criminals also increasingly use virtual assets in coordinated international money laundering networks that move illicit funds without physical cash transfers.
Fraud and Scams
Fraudulent activities involving virtual assets are growing rapidly, with an estimated $51 billion in illicit on-chain activity related to scams in 2024 alone. The sector faces increasing professionalization of scammers, including scam-as-a-service models and emerging scam types such as address poisoning and approval phishing. The use of artificial intelligence technologies like chatbots and deepfakes further exacerbates risks.
Terrorist Financing
Terrorist organizations continue to use virtual assets for fundraising and fund movement due to their anonymity and speed. Although traditional methods remain dominant among terrorists, virtual assets present additional challenges to detection and prevention.
Stablecoins
The use of stablecoins by illicit actors has grown significantly since 2024. Stablecoins now represent most illicit on-chain activity due to their low volatility, efficiency, liquidity, and low transaction costs. Criminals combine stablecoins with anonymity-enhancing tools such as mixers and bridges to layer illicit funds.
Stablecoin issuers have developed programmable smart contracts enabling freezing or blocking capabilities to mitigate illicit finance risks. Such tools are variably used depending on issuer policies. Public blockchain data remains valuable for monitoring but must be complemented by strong compliance measures due to challenges like real-time attribution and increased anonymity tools.
The FATF plans a targeted report on stablecoins in early 2026 to guide authorities on mitigating associated risks.
Decentralized Finance (DeFi)
Identifying control or influence over DeFi arrangements remains difficult for regulators. Approximately half of jurisdictions that regulate VASPs require certain DeFi arrangements to be licensed or registered if control is established. However, many jurisdictions find it challenging to identify unregistered DeFi entities qualifying as VASPs.
Supervisory or enforcement actions against DeFi entities remain limited. Regulatory challenges persist due to the decentralized nature of these platforms.
The FATF intends to release a specific report on DeFi by mid-2026 addressing these challenges.
Recommendations
For Public Sector
Jurisdictions should promptly conduct comprehensive ML/TF/PF risk assessments related to VAs/VASPs and implement appropriate risk mitigation measures tailored to their national context.
Regulatory approaches should be clearly defined — whether permitting or prohibiting VA/VASP use — and enforcement frameworks must be appropriately resourced.
Licensing or registration regimes should be fully operationalized, including for offshore VASPs where applicable.
Urgent implementation and effective supervision of the Travel Rule across all jurisdictions are critical for global AML/CFT efforts.
Emerging risks from stablecoins and DeFi require continuous monitoring, risk assessment, and regulatory adaptation including enhanced public-private sector collaboration for addressing large-scale thefts and professional scams.
For Private Sector
VASPs should maintain robust risk management frameworks aligned with FATF standards, including enhanced measures against emerging threats such as stablecoins misuse and sophisticated scams like “pig butchering”.
Private actors are encouraged to engage actively with regulators on Travel Rule compliance best practices and participate in collaborative efforts to improve transparency and enforcement effectiveness.
Next Steps for FATF and VACG
Between October 2025 and June 2026, FATF will produce targeted reports on stablecoins, offshore VASPs, and DeFi. Continued outreach will focus on critical implementation challenges like risk assessment, regulatory decisions on VA/VASP use, identification of operators, and Travel Rule operationalization.
The next Targeted Update will be published in 2026 with updated compliance tables reflecting jurisdictional progress and responses to emerging risks.
Annex: Status Table Overview
The annex provides an updated table listing FATF members and other jurisdictions with materially important VASP activities. The table summarizes their progress on:
- Conducting risk assessments covering virtual assets
- Enacting legislation regulating or prohibiting VA/VASP use
- Licensing or registering VASPs
- Supervisory inspections or enforcement actions
- Implementing the Travel Rule legislation
Most jurisdictions have enacted legislation regulating VAs/VASPs with varying degrees of implementation success. Some non-FATF jurisdictions recently met criteria for inclusion based on trading volume or user base.
Dive deeper
- FATF ¦ Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers ¦ Link