In 2019, the Financial Action Task Force (FATF), the global money laundering and terrorist financing watchdog, extended its global standards on anti-money laundering and counter-terrorist financing (AML/CFT) to apply to virtual assets (VAs) and virtual asset service providers (VASPs).
On June 26, 2025, the watchdog published its sixth annual targeted review of implementation of these standards also known as Recommendation 15.
Let’s unwrap the key findings from the report, progress made by different jurisdictions including India, and also its recommendations to both the private and public sectors in regulating and supervising VASPs for AML/CFT purposes.
| First things first. What are the FATF Standards on VAs/VASPs?
The FATF Recommendations, also referred to as standards, provide a comprehensive framework of measures to help countries tackle illicit financial flows. Out of the 40 standards, Recommendation 15 pertains to new technologies and VA/VASPs. |
Here’s the criteria for assessment under this standard with respect to VA/VASPs:
| 15.3 | Risk assessment and application of a risk-based approach |
| 15.4 | Licensing/Registration of VASPs |
| 15.5 | Identification of natural persons or legal entities that conduct VASP activities |
| 15.6 | Supervision/Regulation of VASPs to ensure AML/CFT compliance |
| 15.7 | Establishment of guidelines which assist VASPs in AML/CFT compliance |
| 15.8 | Sanctions compliance |
| 15.9 | Preventative AML/CFT measures including the Travel Rule |
| 15.10 | Targeted Financial Sanctions compliance |
| 15.11 | International cooperation |
For each standard there are 4 possible levels of compliance:
- Compliant (there are no shortcomings)
- Largely compliant (there are only minor shortcomings)
- Partially compliant, and (there are moderate shortcomings)
- Non-compliant (There are major shortcomings)
Jurisdictions’ Implementation of FATF Standards on VAs/VASPs (R15)
As of April 2025, 138 jurisdictions have been assessed for compliance with the FATF standards for VAs and VASPs. 29% of jurisdictions are now largely compliant (LC) with the FATF’s requirements for VA/VASPs compared to 25% in 2024. The proportion of jurisdictions not compliant (NC) with the requirements has also decreased from 25% to 21%. Around 49% of the jurisdictions are partially compliant (PC). Only 1 jurisdiction is fully compliant (C ) with R15.
The results of the FATF’s March 2025 survey show that three quarters of respondents (76%; 124 of 163 jurisdictions) reported having conducted an ML/TF risk assessment for VA/VASP risks. This is an increase from 71% in 2024. However, while many jurisdictions have conducted a risk assessment, challenges still remain implementing preventative and/or mitigation measures.
Notably, an increasing number of jurisdictions have identified how they want to regulate the VA sector, increasing to 82% (134 of 163 jurisdictions) in 2025 compared to 73% in 2024 (108 out of 147). Most jurisdictions (62%; 101 of 163 respondents) have decided to permit the use of VAs and the operation of VASPs. However, a minority of jurisdictions (18%) continue to report that they have not yet decided if and how to regulate the sector.
A prohibition approach appears to be more common in certain regions. The survey responses show that members of MENAFATF (Middle East and North Africa region) and ESAAMLG (Eastern and Southern Africa region) have more commonly chosen a partial or total prohibition approach compared to members of other FATF-Style Regional Bodies.
Jurisdictions have continued making progress in licensing or registering VASPs, both in law and in practice. 96 of 117 respondents excluding those that prohibit or plan to prohibit VASPs fully report that they require VASPs to be licensed or registered. This demonstrates a notable increase from 82 respondents that reported requiring VASPs to be licensed or registered in 2024.
However, several jurisdictions do not yet have operational licensing or registration frameworks. The number of respondents that report having licensed or registered a VASP in practice in 2025 demonstrates more muted progress – rising to 76 in 2025 compared to 69 in 2024.
Travel Rule Implementation
The Travel Rule applies the FATF’s payment transparency requirements (FATF Recommendation 16) to the VA context. The Travel Rule requires VASPs and financial institutions to obtain, hold, and transmit specific originator and beneficiary information immediately and securely when transferring VAs.
For the 2025 survey, 73% of respondents (85 of 117 jurisdictions, excluding those that prohibit or plan to prohibit VASPs explicitly) have passed legislation implementing the Travel Rule. An additional 14 of 117 jurisdictions reported being in the process of implementing the Travel Rule. It is likely that the 42 of 205 jurisdictions that did not respond to the FATF’s survey have not implemented the requirements, indicating that global implementation still remains incomplete.
A majority of the 85 jurisdictions that have passed legislation implementing the Travel Rule (59%; 50 of 85) have not yet issued findings or directives or taken enforcement or other supervisory actions against VASPs focused on Travel Rule compliance. This likely reflects that many jurisdictions have only recently enacted Travel Rule legislation and are currently focused on establishing supervision frameworks in this new area.
To assist global implementation of the Travel Rule, the FATF has also published Best Practices on Travel Rule Supervision today. This report provides examples of good practices that jurisdictions may consider when developing their supervisory frameworks.
The report highlights emerging risks arising from the criminal exploitation of virtual assets including:
- The use of stablecoins by various illicit actors, including Democratic People’s Republic of Korea (DPRK) actors, terrorist financiers, and drug traffickers, has continued to increase since the 2024 Targeted Update, and most on-chain illicit activity now involves stablecoins. Mass adoption of stablecoins or VAs more broadly could amplify illicit finance risks, particularly with uneven implementation of the FATF Standards for VAs/VASPs.
- The DPRK this year carried out the largest single VA theft in history, stealing $1.46 billion from the VASP ByBit. Only 3.8% of the stolen funds have been recovered, highlighting the need to address asset recovery challenges and improve international co-operation.
- The FATF also noted the significant uptick in the use of VAs in fraud and scams, with one industry participant estimating that there was approximately $51 billion in illicit on-chain activity relating to fraud and scams in 2024.
The report also includes status of implementation of recommendation 15 by FATF members and jurisdictions with materially important VASP Activity, where India’s progress is captured.
(Read our earlier blog on India’s FATF Mutual Evaluation here)
Finally, what are the Recommendations for the Public and Private sectors?
| Recommendations for the Public Sector | ||
|---|---|---|
| Risk assessment and policy approach to VASPs | Jurisdictions that have not yet done so should identify and assess the ML, TF, and PF risks associated with VAs and VASPs and implement risk mitigation measures without delay. Jurisdictions should develop and implement their approaches to VA/VASPs, by either permitting the use of VA and VASPs or prohibiting (fully or partially) the use of VA and VASPs. Jurisdictions should note that it can be very challenging to effectively implement a complete prohibition and therefore this approach should be considered carefully, including in terms of required resources to enforce against prohibition breaches. |
|
| Licensing/registering and supervising VASPs | Jurisdictions should take immediate action to mitigate ML, TF, and PF risks related to VAs and VASPs, including by ensuring full implementation of R.15. This should include licensing and registering VASPs in practice, identifying natural persons or legal persons that conduct VASP activities, and applying a risk-based approach to the supervision of VASPs in line with the identified risks.
In developing a licensing or registration framework, jurisdictions are encouraged to consider risks associated with stablecoins and offshore VASPs. |
|
| Implementation of the Travel Rule | Jurisdictions that have not yet introduced legislation or regulation to implement the Travel Rule should urgently do so.
Jurisdictions that have introduced the Travel Rule should rapidly operationalise it, including through effective supervision and enforcement in case of non-compliance. |
|
| Addressing emerging and increasing risks related to stablecoins and DeFi | In light of the continued increased use of stablecoins by illicit actors, like other virtual assets, jurisdictions should monitor market developments, assess the illicit finance risks, and take appropriate risk mitigation measures. Jurisdictions should assess and monitor illicit finance risks associated with DeFi arrangements, identify entities that could fall into the definition of VASPs, develop a regulatory framework to capture responsible entity(ies), and take supervisory and enforcement action as appropriate.
Jurisdictions should monitor market developments and assess ML/TF/PF risks, particularly in relation to large scale thefts and money laundering through VAs and the rise in existing and new types of fraud and scams. Jurisdictions should also implement risk mitigation measures for transactions with unhosted wallets that are commensurate with their risk assessment. Given that the DPRK conducted the largest theft of VAs in 2025, supervisors and investigators should enhance public-private sector collaboration and international cooperation to improve R.15 implementation and to address challenges in recovering the stolen funds. Supervisors and investigators should take effective countermeasures to address the increased professionalisation of scammers, including through the establishment of scam-as-a-service activity and scam types in the virtual asset ecosystem. |
|
| Recommendations for the Private Sector | |
|---|---|
| Risk assessment | VASPs should ensure they have appropriate risk identification and mitigation measures in place in line with R15 and should adopt other risk-based measures, as appropriate. This should include consideration and mitigation of risks associated with stablecoins, the increase in different types of fraud and scams including investment and romance scams (in particular investment scams commonly referred to as “pig butchering”) and large-scale hacks such as those conducted by the DPRK. |
| Travel Rule | The private sector may refer to the Best Practice in Travel Rule Supervision paper for further guidance specially about examples of engagement such as: • industry engagements which led to industry initiatives to advance Travel Rule compliance • the creation of dedicated working groups and supporting capacity building in the private sector, and • ongoing engagement with private sector and expansion of existing public/private partnerships. |
FATF will produce targeted papers on stablecoins, offshore VASPs, and DeFi between October 2025 and June 2026. It will also publish the next targeted update in 2026 on jurisdictions’ progress implementing R15, and regulatory policies and responses to emerging VA risks and developments.
