The FATF's seventh Targeted Update shows Travel Rule laws in place across 93% of surveyed jurisdictions. The gap now is enforcement.

Eight years after the FATF extended its AML/CFT Standards to virtual assets, the annual check-in on the progress has arrived. On 15 July 2026, the FATF published its seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs), drawing on survey responses from 147 jurisdictions, 149 mutual evaluations and follow-up reports, and a year of Virtual Assets Contact Group work, including the December 2025 symposium.

The report’s headline figure is clear: 83% (91 of 109) of surveyed jurisdictions now have Travel Rule legislation in force, up from 73% last year. When adding in the 11 jurisdictions with legislation in progress, 93% (102 of 109) of surveyed jurisdictions have Travel Rule either in force or in progress, compared with a combined 85% in 2025.

For years, the sunrise issue was cited as a major compliance barrier: firms subject to the Travel Rule often struggled to comply when transacting with counterparties in jurisdictions where equivalent obligations did not yet apply, leaving compliant firms to absorb the operational burden and cost. The latest data shows that this legislative adoption gap is now closing. Travel Rule laws are largely in place; the more persistent challenge is no longer adoption, but effective supervision and enforcement.

Here are our takeaways.

1. The Travel Rule question changed from "is there a law" to "does anyone check"

Of the 91 jurisdictions with Travel Rule legislation in force, 55 (or 60%) have not issued a single finding, directive, or enforcement action on Travel Rule compliance. The FATF partially attributes this gap to timing, noting that many of the laws are recent and supervisory frameworks are still being established.  It also directs supervisors to its 2025 Best Practices in Travel Rule Supervision paper.

Yet, the report cautions that persistent gaps in Travel Rule implementation remain a serious concern, and jurisdictions with the rule on the books should rapidly operationalize supervision and enforcement.

Notabene's commentary:

The sunrise issue is entering a second phase. The original problem was counterparties with no legal obligation to comply. The new one is counterparties with a legal obligation, and nobody is checking whether they meet it. From the perspective of a compliance officer of a compliant firm, the two look identical: incomplete data, unanswered transfers, and costs concentrated on the firms taking the rule seriously.

Our advice to VASPs has not changed. Build to the rule, not to the enforcement posture. Enforcement shows up unevenly, without much warning, and sometimes through channels nobody planned for. Firms waiting for the first knock end up remediating under pressure instead of complying on their own schedule.

2. R15 Technical Compliance Is Improving—But Slowly

Technical compliance with FATF Recommendation 15 improved modestly in 2026. One jurisdiction was rated fully compliant in both 2025 and 2026. The share rated largely compliant increased from 29% in 2025 to 34% in 2026, while the share rated partially compliant fell from 50% to 43%. The proportion rated non-compliant remained broadly unchanged, rising slightly from 21% to 22%. Overall, the results point to gradual progress, but nearly two-thirds of assessed jurisdictions remain only partially compliant or non-compliant.

Notabene's commentary:

The increase in largely compliant jurisdictions is encouraging, but the fact that nearly two-thirds remain only partially compliant or non-compliant shows that uneven regulatory maturity will continue to create operational complexity for VASPs. Firms still need to manage inconsistent requirements, supervisory expectations, and counterparty readiness across markets. In practice, technical compliance scores are improving, but the cross-border compliance environment remains fragmented.

3. Risk assessments are being written, not used

86% of jurisdictions (124 of 145) report having conducted an ML/TF/PF risk assessment covering VAs and VASPs, up from 76% in 2025. However, the mutual evaluation results tell a different story: Only 48 of 149 (32%) assessed jurisdictions were found to meet or mostly meet the criteria that assess whether preventive and/or mitigation measures are implemented in line with the identified risks.

Notabene's commentary:

A document is not a control. Where implementation stalls is the distance between writing a risk assessment and using one to steer supervisory resources. FATF has flagged this same pattern across several consecutive updates. For jurisdictions looking for a place to start, the report points to the December 2025 VACG symposium materials and to a VA/VASP annex to the ML National Risk Assessment Guidance, expected later in 2026 (para. 11).

4. Prohibition of VA activities more than doubled since 2023

The share of jurisdictions prohibiting VASPs has risen steadily over the past four years, more than doubling from 11% in 2023 to 23% in the latest survey.

Although prohibition is permitted under the FATF Standards, it does not remove the need for active oversight. Jurisdictions must still identify prohibited virtual asset activity, detect VASPs operating illegally, and take appropriate supervisory or enforcement action. Without that capacity, a prohibition may simply push activity outside the regulated perimeter rather than eliminate it.

There are signs, however, that jurisdictions adopting prohibitions are becoming more active in enforcing them. In the latest survey, 16 of the 21 jurisdictions explicitly prohibiting VAs and VASPs reported taking supervisory or enforcement action against operators acting illegally—approximately 76%. That compares with 9 of 17 jurisdictions, or 53%, in 2025. The increase indicates that prohibition regimes are becoming more operational, although their effectiveness still depends on whether authorities can consistently identify and sanction activity taking place outside the legal perimeter.

Notabene's commentary:

A prohibition nobody enforces is an unregulated market. Transactions keep flowing, no entity holds a license, and no Travel Rule data moves. For VASPs in permitting jurisdictions, this creates a quiet exposure: inbound flows from prohibited markets arrive with no compliant counterparty on the other side. Risk teams should treat prohibition jurisdictions as a distinct counterparty class, not an empty set.

5. Criminals are now building infrastructure because compliance is working

The report's most telling case study involves a Cambodia-based financial services conglomerate found to have laundered at least USD 4 billion between August 2021 and January 2025, including at least USD 37 million tied to DPRK cyber heists funding weapons programs.

A third-party stablecoin issuer froze more than USD 29 million in a wallet linked to the group. The group's response was to issue its own USD-pegged stablecoin, marketed as immune to freezing and deployed across multiple public blockchains plus a proprietary chain.

The freeze worked. Issuer-level controls did exactly what they were designed to do, and the criminals left the regulated asset entirely.

Notabene's commentary:

Two things worth noting. First, compliance controls shape criminal behavior, which is the whole point of having them. Second, the FATF now says openly what this case implies: obligated entities should not lean on issuer-level freeze and burn capability as a universal safeguard, because the highest-risk assets are increasingly issued by parties outside any oversight. Where the issuer is the adversary, controls have to live at the transaction and counterparty level.

The same section documents ISIL and Al-Qaeda shifting from Bitcoin toward stablecoins, paired with rotating wallet addresses, micro-split transfers, and OTC brokers with minimal customer due diligence. Stablecoin misuse is no longer an "emerging risk" in FATF language. This is a documented typology with named actors.

6. The regulatory perimeter is shifting from incorporation to activity

Offshore VASPs remain, in the FATF's words, a significant challenge. 39 of 114 jurisdictions with licensing frameworks (34%) now extend licensing or registration to offshore VASPs based on activity anchors: targeted marketing, onboarding of residents, and use of domestic payment rails. Some go further and require a local compliance officer with unrestricted access to customer data and enough seniority to act independently.

The report also walks through nested arrangements in which offshore VASPs open accounts on licensed platforms, posing as retail users, then push through illicit volumes far beyond anything retail. The FATF's private sector recommendations answer this directly: enhanced due diligence on offshore VASPs, detection of misrepresented accounts, restricting or exiting higher-risk relationships, and monitoring fiat on-ramp and off-ramp activity linked to weakly supervised platforms.

Notabene's commentary:

Activity-based licensing is expanding the regulatory perimeter beyond where a VASP is incorporated to where and how it operates. The nested VASP typology places a corresponding burden on regulated platforms: the risk may sit inside a customer account that is presented as retail but is, in practice, being used to provide virtual asset services at scale. Firms need controls capable of identifying when account behavior, transaction volumes, and payment flows are inconsistent with the stated profile.

7. DeFi Oversight Remains at an Early Stage

The 2026 survey points to limited regulatory engagement with DeFi. Only 18% of responding jurisdictions have assessed DeFi-related risks, while a further 9% are in the process of doing so. At the same time, 93% have not identified any DeFi arrangements operating in their territory that would qualify as VASPs under the FATF Standards. Although 31% reported that their existing risk-mitigation measures apply to DeFi arrangements, implementation remains rare: only four jurisdictions have imposed licensing or registration requirements, and just two have licensed or registered a DeFi arrangement in practice. Overall, the data suggests that most jurisdictions remain at an early stage of identifying, assessing, and supervising DeFi-related activity.

Notabene’s commentary:

Regulatory uncertainty around DeFi is not merely a product of technological complexity; it reflects limited assessment and policy implementation at the jurisdictional level. 82% percent of jurisdictions have not completed an assessment of DeFi-related risks, and 69% have not applied risk-mitigation measures to DeFi arrangements. For regulated firms, this creates uncertainty over which arrangements authorities may classify as VASPs and what obligations apply when interacting with them. Until more jurisdictions take a clear stance, firms will need to manage DeFi exposure against an uneven and still-developing compliance landscape.

8. Inside the annex: what the data from 69 materially important jurisdictions shows

Annex A tracks every FATF member plus jurisdictions with materially important VASP activity, defined as trading volume above 0.25 % of the global total or a top 30 ranking by VA ownership and adoption. Together, these 69 jurisdictions handle roughly 97% of the global VA market. The table is therefore a useful snapshot of implementation across the markets that matter most, but FATF is explicit that it is based largely on self-reported information and is not, by itself, an assessment of either illicit-finance risk or effective compliance.

On paper, implementation is advanced. Excluding the six jurisdictions that fully prohibit VASP activity, 39 of the remaining 63 report completing every applicable step tracked in the annex: conducting a risk assessment, establishing a licensing framework, bringing qualifying stablecoin issuers within scope, conducting or planning inspections, taking supervisory or enforcement action, and enacting the Travel Rule. Yet these self-reported milestones do not consistently align with FATF ratings. Several jurisdictions reporting a nearly complete framework remain rated Partially Compliant or Non-Compliant, illustrating the distinction between having the formal components of a regime and implementing them to the standard tested through a mutual evaluation.

However, the ratings also need to be read with caution because they do not all describe the same point in time. Six jurisdictions in the annex—Greece, Panama, Portugal, the Republic of Korea, Saudi Arabia, and Spain—have not been assessed against the revised Recommendation 15. Among the 63 jurisdictions with a rating, 31 were last assessed in 2022 or earlier. FATF itself warns that these ratings may not reflect developments reported in the 2026 survey. A recent self-reported reform can therefore sit beside an older weak rating without either data point necessarily being wrong. Belgium illustrates this mismatch particularly clearly. It reports a risk assessment, licensing rules, stablecoin coverage, inspections, and an enacted Travel Rule, but no enforcement action—and holds a 2025 Non-Compliant rating.

The data from materially important virtual asset markets closely mirrors the broader survey findings: Travel Rule adoption is now approaching near-universal coverage. Among the 63 jurisdictions that do not fully prohibit VASP activity, 55 (87%) have enacted the Travel Rule and a further four are in progress, bringing enacted or pending coverage to 94%. This is broadly consistent with the overall survey result, where 94% of responding jurisdictions had Travel Rule legislation either in force or under development, reinforcing that the legislative sunrise gap is closing both globally and across the markets that account for the vast majority of virtual asset activity. Only Argentina, Cambodia, Colombia, and Vietnam report neither an enacted nor an in-progress Travel Rule framework.

The table also shows that different parts of the regulatory perimeter are developing at different speeds. Eleven jurisdictions report that they do not require stablecoin issuers to be licensed or registered when they qualify as VASPs under the FATF Standards. Eight of those jurisdictions already have the Travel Rule in force. This means transaction-transparency obligations may be established even where the treatment of qualifying stablecoin issuers remains incomplete. It is an important qualification to the broader implementation story: Travel Rule adoption is approaching universality in major markets, but adjacent licensing frameworks have not advanced in lockstep.

Notabene's commentary:

The annex shows that the main compliance challenge is shifting. Across jurisdictions representing 97% of the virtual asset market, the Travel Rule legislative gap is close to being resolved: 94% of jurisdictions that permit at least some VASP activity have rules either enacted or in progress. The next differentiators are whether those rules are operational, how supervisors interpret and enforce them, and whether adjacent parts of the regulatory perimeter—including stablecoin issuers licensing and offshore VASPs—are treated consistently. For compliance teams, the annex is a valuable starting point for jurisdictional risk analysis.

Where this leaves the industry

Seven updates in, the direction is clear. The standards are established and legislative adoption is accelerating. The remaining constraint is operational: effective supervision, consistent enforcement, reliable identification of both customers and counterparties, and a more level cross-border compliance environment.

For compliance teams, the report points to a practical agenda. Firms should strengthen monitoring of higher-risk unhosted wallet activity, apply enhanced due diligence to offshore VASPs, detect accounts being used to conceal nested VASP activity, assess exposure to DeFi protocols, bridges, mixers, and cross-chain tools, and treat counterparty reachability as a core control rather than a network metric.

Strong internal controls are necessary, but they are not sufficient. Travel Rule compliance is inherently bilateral: a transfer can only be completed compliantly when the institution on the other side can be identified, reached, and trusted to exchange the required information. FATF’s data shows that the legislative gap is closing, but supervisory maturity and operational readiness remain uneven. The next phase of implementation will therefore be defined less by whether jurisdictions have rules on the books, and more by whether those rules contribute to a level playing field that reduces friction in cross-border value movement.

Source: FATF (2026), Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs, FATF, Paris.

‍