On 16 July 2026, the Financial Action Task Force (FATF) published its seventh targeted update on the implementation of Recommendation 15 in the area of virtual assets and virtual asset service providers (VASPs). The document does not introduce a separate new set of mandatory rules, but shows how countries are implementing existing FATF standards and what gaps remain in regulation, supervision, and enforcement.
Why FATF standards matter in practice
FATF is an intergovernmental body that sets international standards on combating money laundering, terrorist financing, and the financing of proliferation of weapons of mass destruction. FATF recommendations do not replace national legislation and, as a rule, do not create direct private-law obligations for companies. States implement these standards through their own laws, licensing procedures, and supervisory mechanisms.
At the same time, a national system's non-compliance with FATF standards may be taken into account during mutual evaluations and enhanced monitoring procedures. For cross-border crypto businesses, FATF standards also carry contractual and compliance significance: banks, exchanges, and other regulated counterparties may require confirmation of proper KYC procedures, sanctions screening, transaction monitoring, and Travel Rule information transfer.
Key findings of the FATF update
In the 2026 survey, 83% of respondents — 91 of 109 jurisdictions — reported adopting legislation implementing the Travel Rule for VASPs. In 2025, this figure was 73% — 85 of 117 jurisdictions. A further 11 of 109 respondents in 2026 indicated they were in the process of implementing the relevant requirements.
These results should not be conflated with mutual evaluation data. As of April 2026, FATF had analysed published assessments of 149 jurisdictions on Recommendation 15: one jurisdiction was rated fully compliant, 51 largely compliant (34%), 64 partially compliant (43%), and 33 non-compliant (22%). Adopting Travel Rule legislation therefore does not yet mean the system is fully operationally capable.
FATF separately highlights the difficulty of identifying individuals and legal entities that actually provide VASP services without the required registration or licence. Almost half of the jurisdictions that have already introduced Travel Rule legislation have not yet demonstrated supervisory or enforcement action directly related to compliance with this rule.
Risks FATF is focusing on
The report describes the growing sophistication of criminal use of virtual assets, including the “industrialisation” of fraud by organised criminal groups. Among the higher-risk areas, FATF names stablecoins, P2P transfers via unhosted wallets, offshore VASPs, OTC brokers, cross-chain tools, and certain DeFi models.
Estimates by private analytics firms are not FATF statistics and depend on their own methodology. For example, in January 2026 Chainalysis estimated that funds stolen through crypto fraud in 2025 amounted to at least $17 billion. Such figures should be used with a clear indication of the source and its methodological limitations.
The Travel Rule in the European Union
Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets has applied since 30 December 2024. It covers transfers of crypto-assets where the originator's, beneficiary's, or an intermediary CASP has a registered office in the European Union, subject to the exceptions established by the Regulation.
For crypto-asset transfers, the Regulation sets no general minimum threshold: the information requirements apply regardless of the amount and regardless of whether the transfer is domestic or cross-border. This differs, for example, from the current US federal rule, under which the Travel Rule generally applies to fund transfers of $3,000 or more.
The absence or incompleteness of the required data does not always mean an automatic termination of the relationship. The beneficiary CASP must act on a risk-based basis: reject or return the transfer, or request the missing information. If another CASP systematically fails to provide the required information, possible consequences include rejecting future transfers, restricting, or terminating the business relationship.
Article 37(2) of the Regulation provided for the European Commission to prepare a separate risk assessment of transfers to or from self-hosted addresses and transactions with entities not established in the Union. The possibility of further amendments to the Regulation should not be presented as an already established prohibition: new restrictions can only arise from the adoption of the relevant legal acts.
FATF's “grey” and “black” lists
As of 19 June 2026, Kuwait, Papua New Guinea, Bosnia and Herzegovina, and Iraq were added to the list of jurisdictions under increased monitoring (the so-called “grey list”) during 2026. Algeria and Namibia were removed from this list in June 2026. Ukraine is not on the current “grey list.”
Inclusion of a country on the “grey list” does not mean that FATF requires automatic application of enhanced due diligence (EDD) to every client or every transaction linked to that jurisdiction. FATF explicitly calls for a risk-based approach and for jurisdiction-related information to be taken into account in an individual risk assessment.
A different approach applies to high-risk jurisdictions for which FATF has issued a call for action. As of 19 June 2026, this list includes Iran, the Democratic People's Republic of Korea, and Myanmar. For such jurisdictions, FATF calls for enhanced due diligence and, in the most serious cases, countermeasures.
Significance for Ukraine
Ukraine is a jurisdiction assessed by MONEYVAL — the FATF-style regional body within the Council of Europe system. Draft Law No. 10225-d on regulating the circulation of virtual assets was adopted by the Verkhovna Rada of Ukraine in its first reading on 3 September 2025 and, as of the preparation of this material, is being prepared for its second reading.
Until the final version of the law is adopted, it is not possible to state in advance exactly what the authorisation conditions, transition periods, and full list of obligations for Ukrainian service providers will be. At the same time, for companies planning cross-border activity, compatibility with foreign CASP procedures, proper counterparty identification, sanctions screening, transaction monitoring, and readiness to transmit Travel Rule data where required by applicable law are already practically important.
Practical steps for crypto businesses
Identify the jurisdictions of operation and compile a separate matrix of applicable FATF, TFR, MiCA, AML/CFT legislation, and sanctions regimes. Verify technical and organisational readiness for secure Travel Rule data transfer. Introduce a procedure for verifying the licensing or registration status of other VASPs/CASPs and assessing the quality of their AML/CFT controls.
Apply risk-based measures to transfers involving self-hosted or unhosted wallets, without replacing individual risk assessment with an automatic ban. Regularly track updates to FATF lists and document how jurisdictional risk is factored into due diligence procedures. Distinguish between binding legal obligations, FATF recommendations, anticipated legislative changes, and the company's own voluntary internal standards.
Conclusion
FATF's seventh targeted update does not create a standalone new crypto business regulatory regime, but confirms the general direction of AML/CFT requirements: from formal adoption of rules to verification of their practical implementation. For businesses, the key factor is no longer just having internal policies in place, but the ability to demonstrate that procedures actually work and are technically compatible with regulated counterparties.
Disclaimer. This material is of a general informational and analytical nature, does not constitute individual legal advice, and does not take into account the specifics of a particular jurisdiction, business model, or transaction.
Sources: FATF — Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs (16 July 2026); FATF — The FATF Recommendations; Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets; FinCEN — Funds “Travel” Regulations: Questions & Answers; FATF — Jurisdictions under Increased Monitoring (19 June 2026); FATF — High-Risk Jurisdictions subject to a Call for Action (19 June 2026); Verkhovna Rada of Ukraine — Draft Law No. 10225-d record card; Council of Europe — MONEYVAL: Ukraine; Chainalysis — 2026 Crypto Crime Report: Scams.