The Financial Action Task Force (FATF) released its seventh targeted update on the implementation of standards for virtual assets and virtual asset service providers (VA/VASPs) on July 16, saying 83% of the 109 surveyed jurisdictions, or 91 jurisdictions, have now enacted the Travel Rule into law. That was up from 73% in 2025.
FATF said total coverage reaches 93%, or 102 out of 109 jurisdictions, when another 11 jurisdictions still moving through the legislative process are included. Its implementation ratings also improved. The share rated “Largely Compliant” rose to 34% from 29% in 2025, while the share rated “Partially Compliant” fell to 43% from 50%.
Legal coverage widened, but implementation remains uneven
FATF said the passage of legislation does not mean jurisdictions are enforcing the rules effectively. In many places, legal requirements have not yet been converted into practical supervisory and enforcement capacity. The report pointed to persistent gaps in technical connectivity for cross-border information sharing, consistency in regulatory enforcement, and meaningful engagement with virtual asset service providers, or VASPs.
In FATF’s view, the next phase is less about whether a jurisdiction has passed a law and more about whether those rules can actually reduce friction in cross-border asset transfers.
Stablecoins were the central warning in the report
FATF said most identified illicit on-chain activity now involves stablecoins, a deterioration from its 2025 report. It said use of stablecoins is expanding among Democratic People’s Republic of Korea (DPRK) actors, terrorist financiers and cross-border drug trafficking groups.
The report also highlighted an emerging threat: some criminal networks have started developing their own purpose-built stablecoins. FATF said these products are designed to bypass the freezing and asset seizure mechanisms used by issuers such as Circle and Tether on suspicious addresses. That, the report said, means blacklist-based controls from centralized issuers alone are no longer enough to cover the full stablecoin money-laundering risk surface.
DeFi assessments remain limited
Decentralized finance, or DeFi, was identified as another structural gap. FATF said only 18% of the 109 surveyed jurisdictions had completed a DeFi-related risk assessment, while another 9% were still conducting one. Put another way, close to three-quarters of jurisdictions still have no established DeFi oversight framework.
The report listed offshore VASPs and DeFi platforms as major regulatory gaps at present. FATF urged jurisdictions to accelerate substantive implementation of Recommendation 15, its anti-money laundering and counter-terrorist financing standard for virtual assets, rather than stopping at formal rulemaking.