What FATF’s 7th Crypto Compliance Report Card Means: Enforcement Must Catch Up With Legislation

Summary

• Laws are outpacing enforcement: While jurisdictions are increasingly adopting necessary regulations — from Travel Rule legislation to VASP licensing regimes — enforcement is lagging. The FATF’s message is unambiguous: the grace period for paper-only compliance is over.
• Freeze-resistant stablecoins are an emerging threat: Criminal networks are now issuing their own stablecoins — marketed as immune to asset freezing — specifically to undermine the programmable controls regulators have been counting on. The FATF flags this as a “significant and emerging risk.”
• Crime is converging and scaling with AI: Organised crime, fraud, DPRK proliferation financing, terrorist financing, and sanctions evasion are increasingly sharing infrastructure. AI is accelerating every stage, from deepfake-powered identity fraud to automated attacks on blockchain-based financial applications.
• Blockchain analytics is a regulatory baseline: The FATF’s recommendations to the private sector explicitly list wallet screening, blacklisting/whitelisting, blockchain analytics tools, and freezing/blocking capabilities as expected components of a compliant AML/CFT framework.

Where we stand: implementation progress and persistent gaps

Over seven years ago, the Financial Action Task Force (FATF) first outlined the steps nations should take to effectively monitor the virtual asset industry. The policymaking body’s package of recommendations (known as R.15) was to be regulators’ playbook to stop terrorist financers, money launderers, and other illicit actors from exploiting a fast-changing asset class. FATF adapted, too: it has repeatedly strengthened R.15 with new guidances that address emerging trends across crypto. A yearly report card tracks how well the global community is adopting R.15.

Released July 16, the latest report card — the 7th Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs — indicates the global community has made significant progress. But it also reveals a widening gap between legislation and practical enforcement.

The good news: jurisdictions are increasing their efforts. In the FATF’s survey of 147 jurisdictions, 86% have conducted VA/VASP risk assessments (up from 76% in 2025). 83% have passed Travel Rule legislation (up from 73%). Jurisdictions rated “Largely Compliant” rose from 29% to 34%. And among the 95 jurisdictions requiring VASP licensing, 81% are now conducting supervisory inspections (up from 73%) and 71% have taken enforcement actions. Those who have committed to licensing frameworks are increasingly following through.

But challenges remain. Sixty percent of jurisdictions with Travel Rule legislation have not yet taken any supervisory or enforcement action on it. And when the FATF assessed jurisdictions on their preventive AML/CFT measures, the controls meant to proactively stop illicit activity, only 13 out of 139 — fewer than 10% — fully met the standard. Prevention is the greatest area of untapped potential in the entire R.15 framework. Legislation is only as effective as its enforcement.

This is where the unique properties of blockchain technology become an advantage: unlike traditional financial systems, where transaction visibility depends on intermediary reporting after the fact, crypto’s on-chain transparency and sophisticated analytical tools lend themselves to genuinely preventive measures — screening, blocking, and flagging risks before funds move, not after. The tools to close this gap already exist, and deploying them at scale can create a fundamentally safer financial environment.

Persistent Challenges:

• Licensing vs. practice: according to the report, 73% require VASP licensing, but only 58% have actually issued one. Only 40% satisfactorily meet the criterion in mutual evaluations.
• Prohibition without enforcement: 23% of jurisdictions now prohibit VASPs (up from 11% in 2023), but have “not progressed” in enforcement. Prohibition without active monitoring creates a black hole where VA activity continues outside regulatory visibility.
• DeFi remains undefined: 93% of jurisdictions have not identified so-called qualifying DeFi arrangements, where there is an identifiable owner or operator which can make this arrangement subject to VASP regulation. Only four jurisdictions have imposed licensing requirements; two have licensed one; one has enforced. The FATF has published a Targeted Report on Regulatory Challenges from Decentralised Finance (DeFi) to provide further guidance.
• Stablecoin issuers tracked separately: The report’s annexed table with survey results now includes a column for stablecoin issuer licensing — reflecting the focus established in the FATF’s March 2026 stablecoin report, which we analysed at the time.

Emerging risks flagged by the FATF

The report flags five areas of escalating concern, many of which align closely with the trends we identified in our 2026 Crypto Crime Report:

• Industrialised fraud: Cambodia-based scam centres and pig-butchering operations have become “significant generators of illicit proceeds.” A single Cambodia-based conglomerate laundered at least USD 4 billion (Aug 2021–Jan 2025), serving as a node connecting organised crime fraud, underground banking, and VA-based laundering. At least USD 37 million of that was attributed to DPRK cyber heists supporting WMD programmes. Spain’s Operation Borrelli dismantled a separate EUR 460 million investment fraud network affecting 5,000+ victims worldwide. Our own data shows that scam activity reached roughly USD 17 billion in 2025, with pig-butchering remaining the most financially devastating category.
• Proprietary “freeze-resistant” stablecoins: After a third-party issuer froze over USD 29 million in its wallets, the same conglomerate launched a USD-pegged stablecoin “marketed as immune to asset freezing,” issued across multiple public blockchains and a proprietary chain. The FATF warns that VASPs “may be unable to rely on issuer-level asset freeze/burn mechanisms as a compliance safeguard” and calls for stablecoin issuance to be subject to robust AML/CFT requirements. Terrorist organisations including ISIL and Al-Qaeda also increasingly favour stablecoins over Bitcoin for fundraising and transfer. This is consistent with our findings that stablecoins now account for 84% of all illicit transaction volume.
• AI as an amplifier: the FATF frames AI not as a standalone technical risk but as “a structural factor that can amplify ML/TF and sanctions-evasion risks.” Cases include deepfake recruitment scams (>USD 1M stolen), AI-assisted smart-contract exploit development, and the use of open-weight models to bypass commercial AI safeguards. Our Crypto Crime Report found that AI impersonation scams were the fastest-growing fraud subcategory in the past year.
• Convergence of PF, TF, and sanctions evasion: These “should not be viewed as isolated risks, but as interconnected activities enabled by common digital asset rails.” The DPRK exploits not just VASPs and DeFi protocols but third-party infrastructure including the network nodes and multi-party security systems they depend on.
• Offshore VASPs and P2P gaps: Offshore VASPs actively solicit customers, advise VPN use, and can misrepresent themselves as retail users through nested accounts. 88% of jurisdictions rate P2P via unhosted wallets as high risk, but only 23% collect metrics to measure it.

Recommendations for jurisdictions and supervisors

The report lays out three clear priorities for the public sector.

1. Know your risks, even if you’ve chosen to ban VASPs. Banning activity is not enough to ensure compliance — only an effective monitoring regime can accomplish that. The FATF is telling every jurisdiction, even those that have banned VASPs, to assess its VA/VASP exposure comprehensively. Domestic VASPs, offshore VASPs serving local customers, stablecoin issuers, DeFi arrangements, P2P activity, and emerging business models must all be accounted for.
2. Move from framework to action. Jurisdictions are expected to operationalise their supervisory regimes — not just have them on paper. That means licensing VASPs, stablecoin issuers, and qualifying DeFi arrangements; conducting real on-site and off-site inspections; and actively identifying and sanctioning entities operating without a licence. The gap between having a licensing requirement and actually issuing licences is one the FATF wants closed.

This shift has a practical prerequisite: supervisors themselves need to leverage on-chain data. Credibly auditing VASPs for compliance requires regulators to understand what’s happening on-chain. Regulators who lack the tools to assess risk, trace flows, and evidence their findings will struggle to demonstrate the effective implementation the FATF is now demanding.

3. Collaborate on tracing and seizing illicit assets. The FATF calls on jurisdictions to develop “adequate operational infrastructure, legal frameworks, and protocols involving public authorities and private-sector partners to enable the rapid tracing, freezing and seizure of illicit virtual assets.” In other words, public-private partnerships are essential for effective enforcement.

Chainalysis is deeply engaged in this area. We have supported public-private partnerships across multiple jurisdictions — including initiatives like Operation Spincaster, which brought together law enforcement, exchanges, and blockchain analytics to disrupt crypto scams and protect victims. Operation Spincaster disseminated 7,000 leads representing $162 million in losses. These tips led to account seizures and even stopped a would-be victim from engaging in a scam that might have drained them of six figures in crypto.  We welcome the FATF’s emphasis on these models; we are committed to actively expanding them.

What the private sector needs to do now

The FATF’s recommendations to VASPs, stablecoin issuers, and qualifying DeFi arrangements (paragraphs 5-6) are the most operationally specific to date. They set clear expectations for the capabilities of compliant entities:

• Wallet screening, blacklisting, and whitelisting — plus freezing and blocking capabilities that can adapt to emerging threats
• Enhanced due diligence for unhosted wallet transactions — particularly where wallet activity is higher-risk
• Transaction monitoring and blockchain analytics — to spot suspicious patterns and detect rapid movement of funds in real time
• Counterparty due diligence on offshore VASPs — including the ability to detect when a VASP is masquerading as a retail user through a nested account
• DeFi exposure assessment — understanding your risk from protocols, bridges, mixers, and cross-chain tools

The direction is clear: robust blockchain analytics is a baseline for effective compliance.

How Chainalysis can help

Improving enforcement requires public and private sectors to strengthen their technical expertise in blockchain analytics. Chainalysis builds the platform to accomplish this, from wallet screening and transaction monitoring to cross-chain tracing and counterparty risk assessment. Our efforts with law enforcement, regulators, VASPs, financial institutions, and stablecoin issuers in over 100 countries operationalises the obligations outlined in this report.

We also provide an edge against future-forward threats. As illicit actors increasingly weaponise AI for fraud and KYC bypass, our AI-powered detection capabilities (Alterya) help identify and stop these attacks before funds disappear.

To learn more about how we can support your organisation, get in touch with our team.

Looking ahead

Rather than introducing new standards, the 7th Targeted Report is a demand that existing standards be enforced. The private sector must adopt the technical capabilities needed to make enforcement effective. The FATF will continue monitoring implementation with “particular attention to jurisdictions with significant VASP sectors,” using its full toolkit of assessments, risk analysis, and capacity building.

The tools to meet these evolving expectations exist today. All VA industry participants should move quickly to implement them.

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.