The Financial Action Task Force (FATF) has released its sixth targeted review of global implementation of anti-money laundering standards for virtual assets and virtual asset service providers. The June 2025 report reveals gradual progress in regulatory development, but highlights significant enforcement gaps and emerging threats that demand urgent attention from both public and private sectors.
Implementation Progress
Overall Compliance Status
- 29% of assessed jurisdictions are largely compliant (LC) with R.15 (up from 25% in 2024)
- 49% remain partially compliant (PC)
- 21% are non-compliant (NC) (down from 25% in 2024)
- Only 1 jurisdiction achieved full compliance
Risk Assessment
- 76% of surveyed jurisdictions (124 of 163) have conducted ML/TF risk assessments for VAs/VASPs (up from 71% in 2024)
- However, only 40 of 138 assessed jurisdictions adequately met risk assessment requirements
Regulatory Approaches
- 82% of jurisdictions have determined their regulatory approach (up from 73% in 2024)
- 62% permit VA/VASP operations
- 20% have chosen prohibition (up from 14% in 2024)
- 48% of prohibiting jurisdictions use partial prohibition rather than full prohibition
VASP Licensing/Registration
- 96 jurisdictions require VASP licensing/registration
- 76 jurisdictions have actually licensed/registered VASPs in practice (up from 69 in 2024)
- 37% of jurisdictions apply licensing requirements to offshore VASPs
Travel Rule Implementation
- 73% of applicable jurisdictions (85 of 117) have passed Travel Rule legislation
- 59% of jurisdictions with Travel Rule legislation have not yet taken enforcement actions
- 14 additional jurisdictions are in the process of implementing Travel Rule
Emerging Risks & Threats
DPRK Activities
- DPRK conducted the largest single VA theft in 2025: $1.46 billion from ByBit
- Only 3.8% of stolen funds recovered
- Used sophisticated social engineering and complex transaction patterns (35 Bitcoin wallets, 125,000 Ethereum wallets)
Stablecoins
- Majority of on-chain illicit activity now involves stablecoins
- Criminals leverage anonymity-enhancing tools and dormant VASP accounts
- $30 trillion in stablecoin volume growth (May 2024-2025)
Fraud & Scams
- Approximately $51 billion in illicit on-chain activity from fraud/scams in 2024
- Significant growth in “scam-as-a-service” professionalization
- Continued rise of “pig butchering” investment scams
DeFi Challenges
- 48% of advanced jurisdictions require certain DeFi arrangements to be licensed as VASPs
- 75% of these jurisdictions have not identified any unregistered DeFi entities
- Only 4 jurisdictions have registered/licensed DeFi entities as VASPs
Key Recommendations
For Jurisdictions
- Urgently conduct risk assessments and implement mitigation measures
- Develop clear regulatory approaches (permit or prohibit)
- Operationalize Travel Rule with effective supervision and enforcement
- Monitor stablecoin and DeFi risks and develop appropriate frameworks
- Enhance international cooperation for asset recovery
For Private Sector
- Implement appropriate risk mitigation measures aligned with R.15
- Address stablecoin, fraud, and DPRK-related risks
- Engage with Travel Rule implementation guidance and best practices
Next Steps
- FATF will produce targeted reports on stablecoins, offshore VASPs, and DeFi (October 2025-June 2026)
- Next Targeted Update scheduled for 2026
- Continued outreach and technical assistance for jurisdictions with materially important VASP activity
The report emphasizes that while progress has been made, the borderless nature of virtual assets means regulatory gaps in any jurisdiction create global vulnerabilities, particularly given the scale of DPRK activities, fraud networks, and terrorist financing through VAs.
Read the full FATF report: Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers
