Legislation is running ahead of enforcement, and the distance between them is measured in hours, not legislative sessions.
On 16 July 2026 the Financial Action Task Force published its seventh targeted update on the implementation of Recommendation 15, the annual assessment of how well the global network has translated its virtual asset standards into working supervision. Most of the coverage has focused on the compliance scoreboard. The sentence that matters more sits in the recommendations, where the FATF calls on jurisdictions to develop adequate operational infrastructure, legal frameworks, and protocols involving public authorities and private-sector partners to enable the rapid tracing, freezing and seizure of illicit virtual assets.
That is a request for operational capability, not a request for another memorandum of understanding. FATF President Giles Thomson put it plainly in the accompanying statement: “Effective implementation of the FATF Standards can no longer be delayed. Governments and the private sector must work together to strengthen preventive measures and close regulatory gaps.” We’ve been arguing this position, usually to rooms that treated public-private cooperation as an information-sharing courtesy. The FATF has now placed it in the operational core of R.15.
What the FATF actually found: legislation is running ahead of enforcement
The legislative picture keeps improving. 83% of surveyed jurisdictions have passed Travel Rule legislation, up from 73% in 2025, with a further 11 reporting implementation under way. 86% have completed VA/VASP risk assessments, up from 76%. The share rated largely compliant on R.15 rose from 29% to 34%.
The enforcement picture has barely moved. Around 60% of jurisdictions with Travel Rule legislation have taken no supervisory or enforcement action on it at all. Of the jurisdictions requiring VASP licensing, a substantial share have never issued a licence. And when the FATF assessed preventive AML/CFT measures, the controls designed to stop illicit activity before it settles, only 13 of 139 jurisdictions fully met the standard. Fewer than one in ten.
The prohibition cohort is the part that should worry compliance teams most. Roughly a quarter of jurisdictions now prohibit VASP activity outright, up sharply since 2023, and the FATF finds they have not progressed on identifying or sanctioning illicit VASP activity. Prohibition without supervision doesn’t remove virtual asset activity from a jurisdiction. It removes the jurisdiction’s visibility into it, pushing volume toward P2P transfers through unhosted wallets and offshore VASPs, which is precisely where the report flags the sharpest risk growth.
Why the enforcement gap is a clock problem
We’d argue the gap between legislation and enforcement is a mismatch of clocks rather than an administrative backlog, and that most policy responses to this report will miss it for that reason.
Supervisory regimes operate on legislative and budgetary time, measured in quarters and parliamentary sessions. Laundering operates on block time. In active casework we routinely watch stolen funds move through a nested account at a centralised exchange, convert to stablecoins, bridge to a second chain, and enter a privacy protocol inside a single working day. The FATF’s own case evidence shows the same tempo at scale: a Cambodia-based financial services conglomerate that laundered at least USD 4 billion between 2021 and 2025, serving organised crime fraud and DPRK-related cyber theft through shared infrastructure, and a cryptocurrency investment fraud network dismantled by the Spanish Guardia Civil in June 2025 after moving roughly EUR 460 million from more than 5,000 victims.
No public supervisor, however well resourced, can be reached, briefed, and moved to action inside that window on every incident. The private sector can, because it already sits at the choke points where funds land.
Freeze-resistant stablecoins remove the fallback compliance teams were relying on
The most consequential technical finding in the report is easy to skim past. Most identified on-chain illicit activity now involves stablecoins, and the FATF documents a criminal-linked conglomerate developing a proprietary USD-pegged stablecoin explicitly designed to resist freezing and seizure, issued across multiple public chains and a proprietary one, launched after a third-party issuer froze tens of millions in its wallets.
Read that alongside how recoveries actually work today. In the Swiss investment fraud case our team closed this year, the recovery ran issuer-first: we traced the stolen funds through multiple addresses and chains to holdings custodied by Tether and Bitfinex, Tether froze the USDT at address level, Bitfinex held USD 10.5 million pending the criminal proceeding, and the Schwyz Public Prosecutor’s Office carried it through to a burn-and-remint that returned the value to the victim. That’s one of the largest crypto seizures in Swiss history, and issuer-level freeze capability was load-bearing throughout.
Now assume that lever degrades. If a meaningful share of illicit volume migrates to issuers engineered not to freeze, the remaining enforcement surface is the counterparty: the exchange, the bridge, the OTC desk, the DEX front end where the funds have to touch a service to become useful. Acting there requires a distribution channel into hundreds of compliance teams, in the language they can act on, at three in the morning. Building that channel is a private-sector job, and very few organisations have built one.
The protocol FATF asked for is not the MOU most partnerships produce
Public-private partnership in this sector usually means a quarterly forum, a typologies briefing, and a signed information-sharing arrangement. Useful, and structurally too slow for the thing FATF is describing. The report asks for protocols enabling rapid tracing, freezing and seizure. A protocol is a defined trigger, a defined recipient, a defined evidence format, a defined response time, and an audit trail that survives a defence challenge.
What that looks like in practice, from our own operations: Recoveris is the only blockchain investigative firm admitted to the VerifyVASP network, which lets us broadcast validated freeze requests across 190+ VASPs from a single case file, alongside membership of IVAN, the Illicit Virtual Asset Notification network connecting US federal agencies with 35+ partner organisations, and the Crypto Defenders Alliance. In our deployments with a global centralised exchange, that machinery achieves up to around a 27% freeze rate, with typical turnaround under 12 hours against a 24-hour service window.
Freezing is a probabilistic outcome that depends on which service the funds reach and how fast the request lands. It rises with speed and with the number of counterparties you can reach simultaneously, and it collapses to near zero once assets clear into non-cooperative infrastructure. Any partner quoting materially higher without describing the case mix behind it is showing you a filtered sample.
What compliance teams and investigators should do before the next incident
Three things, ordered by how much they change outcomes.
First, pre-wire the escalation path. Decide now which external investigator receives an incident, what data they get, and who authorises it. The organisations that lose the freeze window almost always lose it to internal approvals, not to the attacker.
Second, stop treating issuer-level freeze as the plan. Map which of your exposure sits in assets whose issuers will act, and build counterparty-level reach for the rest. The FATF has told you directly that issuer freeze and burn mechanisms may not remain a reliable compliance safeguard.
Third, hold your evidence to the standard the receiving party needs, not the standard your internal review accepts. A freeze request that arrives without a coherent transaction chain, a case reference, and a chain-of-custody record gets triaged to the bottom of a compliance queue, which in practice is the same as being refused.
The short version
FATF has told governments that crypto legislation stops counting unless someone enforces it, and that enforcement now depends on private-sector partners who can trace and freeze stolen assets quickly. Speed is what decides outcomes: funds clear through exchanges, bridges, and privacy protocols within hours, while supervisory processes run on quarters.
That leaves a job only private-sector investigators can do, reaching hundreds of exchanges and issuers directly while the assets are still somewhere reachable. Partnership is what an institution can execute at 3am on a Saturday, and everything else is a document.
If your platform, client, or investigation needs the freeze window held open, immediate forensic intervention is what determines whether assets are still reachable when the paperwork arrives.
