The Financial Action Task Force (FATF) recently released new guidance on asset recovery that significantly advances how authorities worldwide should approach the recovery of criminal assets. The guidance provides a detailed roadmap covering everything from developing policy frameworks and conducting investigations to executing seizures and confiscations, and ultimately returning, repatriating, and using recovered assets. The Asset Recovery Guidance and Best Practices, issued in November 2025, comes at a critical time — FATF assessments show that more than 80% of jurisdictions are operating at low or moderate levels of effectiveness in asset recovery.
While the guidance covers all asset types throughout the entire seizure lifecycle, it pays specific attention to virtual assets (VAs), reflecting their growing role in both traditional finance (TradFi) and illicit activity. FATF is calling on jurisdictions to make asset recovery a policy and operational priority, using this new guidance to safeguard the integrity of the global financial system and improve outcomes for victims and communities. While virtual assets require specialized approaches, FATF notes they may actually be easier to trace and recover than traditional high-value assets when authorities have the right tools and training.
Chainalysis is proud to have contributed expertise that will support policymakers and investigators worldwide in strengthening their asset recovery frameworks and demonstrating that crime doesn’t pay. Our research shows a substantial VA seizure opportunity: more than $75 billion in on‑chain balances are linked to criminal activity overall.
In this blog, we’ll explore FATF’s key recommendations for virtual asset investigations, the practical tools and techniques authorities can deploy, and examples of successful cryptocurrency recoveries from around the world.
Key recommendations for virtual asset recoveries
1. Treat VAs as a distinct asset class
FATF recommends that authorities treat virtual assets as a distinct form of asset class throughout the entire recovery lifecycle — from identification and tracing through seizure, valuation, management, and ultimate disposal. This may require:
- legislative updates to explicitly empower authorities to seize, manage, and dispose of virtual assets effectively;
- clear domestic rules around VA seizure that investigators understand and can implement;
- and specialized procedures that account for the unique characteristics of VAs.
2. Build operational capacity from first contact
The guidance emphasizes that operational awareness is critical, especially for law enforcement’s “first contact” with VAs. Officers need training to recognize hardware wallets during searches; seed phrases in documents or digital files; exchange accounts and wallet applications on devices; and VA holdings across various platforms.
FATF specifically recommends that non-financial and non-money laundering personnel receive training on virtual assets, acknowledging that VAs can surface in any investigation.
3. Integrate blockchain analytics
Perhaps most significantly, FATF emphasizes that authorities should integrate blockchain analytics into VA investigations. The guidance notes that “public blockchains provide immutable, real-time ledgers that may support rapid tracing and recovery” and that “it is even possible that assets in virtual form might be easier to seize and track than traditional high-value goods.”
The report details how Chainalyis’ blockchain analysis tools have gained court acceptance, featuring the case study on the Bitcoin Fog investigation (U.S. v. Sterlingov). In that case, the U.S. District Court, in a Daubert hearing, validated techniques including clustering heuristics and transaction tracing, to find our tools to be “highly reliable” and admissible as evidence in court.
FATF’s guidance acknowledges a capacity gap across countries — some have built internal blockchain analysis capability, while others should consider contracting external providers. FATF advises that these costs can be justified given the value and success rate of virtual asset recoveries, and jurisdictions should invest proportionate to their VA exposure.
The lifecycle of a seizure
FATF’s guidance covers the full lifecycle of virtual asset seizures, from initial acquisition through long-term management and eventual liquidation. Understanding both the technical seizure methods and the ongoing custody challenges is critical for successful asset recovery.
1. Initial seizure
The guidance outlines three main pathways for seizing VAs:
- Direct acquisition of private keys: Obtaining the cryptographic private keys, including seed phrases, that control wallet access.
- Recovery from exchange-based wallets: Working with Virtual Asset Service Providers (VASPs) to freeze and recover assets held in custodial accounts.
- Freezing functionality via stablecoin providers: Leveraging centralized issuers’ technical ability to freeze, burn, or even reverse transfers based on legal orders.
On stablecoins specifically, FATF notes that issuers of centralized stablecoins “often retain the ability to freeze assets or even reverse transfers based on legal orders.” Centrally issued stablecoins typically include smart contract functions that allow issuers to freeze specific wallet addresses, permanently burn tokens, or in some cases reverse or reassign tokens — all pursuant to valid legal orders. Law enforcement agencies should make use of this ability.
2. Managing seized VAs
Once VAs are seized, proper management becomes critical. FATF advises best practices including:
- robust cybersecurity measures to protect against hacking and fraud, such as cold storage solutions;
- engaging vetted VA custodians, as self-custody might come with a certain degree of complexity;
- clear procedures and documentation from seizure through liquidation;
- and awareness of inherent risks from VAs, including asset price volatility, regulatory developments, and the specific characteristics of different token types; NFTs and meme coins, for example, may have very different liquidity profiles than major VAs.
When it comes time to liquidate seized assets, FATF recommends that asset managers “be sensitive to the liquidity of the market and not overloading it in a way that decreases the value of the asset. This may entail phased liquidations, so the market is not flooded all at once.”
Real-time public-private partnerships
The guidance encourages emerging public-private partnership (PPP) models aimed at “real-time crypto crime response.” While these partnerships facilitate rapid information sharing between law enforcement and the industry, they can also accelerate the move from detection to disruption of financial crime.
Operation Spincaster demonstrates how effective public–private partnerships can turn real-time insights into real-world impact: working side-by-side with 12 public sector agencies and 17 VA exchanges, Chainalysis helped identify illicit flows quickly to disrupt and prevent approval-phishing scams, coordinate freezes across platforms, and preserve high-quality evidence for follow-on action. Across the sprints, partners disseminated more than 7,000 leads tied to roughly $162 million in losses, leading to account closures, seizures, and intelligence to prevent future scams — including one case where a victim was warned in time to revoke on-chain approvals and avert a six‑figure theft.
What this means for agencies
FATF is pushing jurisdictions to strengthen asset recovery, building on its clear expectations for virtual assets and VASPs under Recommendation 15 (VASP licensing, supervision, and risk assessments) and Recommendation 16 (the Travel Rule for virtual assets). Crucially, FATF explicitly notes that, with the right tools and training, virtual assets can be easier to trace and recover than many traditional assets—a strong encouragement for agencies to accelerate virtual asset investigative capabilities, operationalize blockchain analytics, and integrate VA procedures into end‑to‑end asset recovery workflows.
How Chainalysis can help
The FATF guidance makes clear that effective virtual asset recovery requires the right tools, training, and operational capacity. Chainalysis provides solutions designed to support agencies throughout the entire asset recovery lifecycle:
Chainalysis Reactor and Wallet Scan enable investigators to quickly identify, trace, and attribute cryptocurrency transactions across multiple blockchains, providing the real-time intelligence needed for rapid seizure decisions.
Chainalysis Rapid helps law enforcement scale their crypto triage capabilities, allowing agencies to quickly assess whether cryptocurrency is involved in a case and prioritize investigations accordingly.
Our Asset Seizure Certification provides specialized training that equips investigators with the skills to recognize, seize, and manage virtual assets effectively — addressing the “first contact” capacity gap highlighted in the FATF guidance.
Want to learn more about how blockchain analytics supports asset recovery? Request a demo here.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.