Sign In Get Started

Crypto Crime Volumes Surge as FATF Enforcement Lags Behind

Crypto▼ Bearish

Crypto Crime Volumes Surge as FATF Enforcement Lags Behind

2026-07-26 17:32 UTCBy AlphaScala Research DeskSource reporting: Crypto EconomyEditorial standards

Crypto Crime Volumes Surge as FATF Enforcement Lags Behind

Click a ticker for a live chart

Illicit crypto transactions hit $154B in 2025, up 162% from 2024. Stablecoins account for 84% of flows. FATF flags gaps in travel rule enforcement and DeFi oversight.

Continue with

Dartmouth crypto ETF value falls 15% to $12.4M; shares unchanged

What is Bitcoin and how does it work?

July 16, 2026 – The Financial Action Task Force published its seventh update on virtual asset standards Tuesday. The report shows a growing gap between legislative progress and actual enforcement.

Illicit crypto addresses received at least $154 billion in 2025, according to Chainalysis data cited in the report. The $154 billion is a 162% jump from 2024. TRM Labs, using a different methodology, put the figure at $158 billion. Either way, the total has crossed into the hundreds of billions.

Stablecoins now dominate that flow. Chainalysis said stablecoins accounted for 84% of the $154 billion in illicit transactions. TRM Labs reported that illicit entities received $141 billion in stablecoins last year, the highest figure in five years.

Regulators have been busy. As of April 2026, 51 of 149 assessed jurisdictions – 34% – were rated “substantially compliant” with FATF standards, up from 29% in 2025. Eighty-three percent of surveyed jurisdictions have adopted laws to implement the travel rule, with another 11% in the process. The share of jurisdictions that completed virtual asset risk assessments rose to 86% from 76%.

Yet those numbers mask a deeper problem. The FATF stressed that “significant gaps” persist in converting risk assessments into concrete action. Of the 91 jurisdictions that have legislated the travel rule, 55 – 60% – have not issued a single supervisory finding, directive, or enforcement action related to travel rule compliance. The law exists. No one is checking it.

Licensing tells a similar story. Seventy-three percent of jurisdictions require licenses for virtual asset service providers. Only 58% have granted any. Barely 40% fully meet the standards in mutual evaluations.

Prohibition is not working either. Twenty-three percent of jurisdictions have banned VASP operations, up from 11% in 2023. The FATF said those bans face ongoing challenges in identifying and sanctioning unauthorized providers. Banning is not the same as regulating.

Enforcement is shifting in focus. CertiK’s April 2026 report showed AML compliance has displaced securities violations as the primary regulatory risk for crypto firms. The U.S. Department of Justice and FinCEN imposed $900 million in AML-related fines in the first half of 2025. Over the same period, SEC cryptoasset fines fell 97% year-over-year to $142 million. OKX paid $504 million in February 2025. KuCoin paid $297 million in January 2025. Both settlements related to operating without a license and violating the Bank Secrecy Act. In Europe, AML fines surged 767% in the same half.

Criminals adapt faster than regulators. The FATF highlighted a case where a major stablecoin issuer froze more than $29 million belonging to a criminal group. The group responded by creating its own dollar-pegged stablecoin, marketed as immune to freezes, deployed across multiple public chains and on a proprietary chain. The FATF warned that authorities can no longer take for granted the ability to freeze or destroy assets at the issuer level.

DeFi remains a regulatory void. The FATF's July 21 report said that nearly 93% of surveyed jurisdictions have not yet applied FATF standards to DeFi arrangements that meet the criteria. Of 142 jurisdictions, only 26 have conducted risk assessments, 4 have established licensing rules, and only 2 have registered or licensed relevant platforms. Total value locked in DeFi hit $86.6 billion in 2026, up roughly 85% from 2023. The gap between that volume and regulatory coverage is wide.

Artificial intelligence compounds the problem. The FATF cited the use of deepfakes and synthetic identities that scale up criminals' operational capacity.

For compliance teams, the message is straightforward. The FATF said the travel rule problem is no longer whether the law exists but whether anyone is checking it. When a counterparty has a legal obligation and no oversight, or has no obligation at all, the practical effect is the same: incomplete data, unresponsive answers, and costs concentrated on the entities that do comply.

Stablecoin issuers, the FATF recommended, should build freeze and blacklist capabilities into smart contracts from launch, not as after-the-fact patches. DeFi projects with identifiable controllers – concentration of governance tokens and administrative privileges – already fall under FATF standards, the report made clear, regardless of decentralization claims.

The FATF also flagged that jurisdictions with significant VASP activity, which concentrate roughly 97% of the global virtual asset market, largely determine the overall risk level. Operators need substantial compliance presence in those key jurisdictions, not offshore structures designed to evade regulation.