AML/CFT Updates
In June 2025, the Financial Action Task Force (FATF) published its sixth update on the global implementation of AML/CFT standards for virtual assets (VAs) and virtual asset service providers (VASPs) as a continuation of its efforts to bring more jurisdictions into compliance. This report is largely motivated by uneven adoption and rapid growth of crypto-related crime. The new report notes that, while many countries have now enacted AML/CFT rules for crypto, "jurisdictions continue to face challenges" in fully identifying and supervising VASPs. FATF emphasises that without consistent global standards, illicit use of VAs can quickly outpace regulation. This brings with it various implications, including:
- Travel Rule gaps: The update highlights mixed implementation of the FATF "Travel Rule" (originator/beneficiary information on cross-border transfers). According to the 2025 survey, 73% of respondent jurisdictions (85 of 117, excluding outright bans) have now passed Travel Rule legislation – up from 65 in 2024. In total, FATF reports 99 jurisdictions have either enacted or are drafting Travel Rule laws. However, enforcement remains weak. Many new laws have not yet been applied in practice. The report warns that "considerable gaps" persist and provides best practice guidance to help supervisors close them.
- VASP licensing and supervision Most countries now require VASPs to be licensed or registered. The update notes that 96 of 117 surveyed jurisdictions have licensing regimes in law (up from 82 in 2024). A large majority of those (83%) correctly apply requirements to VASPs located in their territory, and about 37% even extend licensing to foreign ("offshore") VASPs under certain conditions. Despite this legal progress, FATF finds that actual enforcement lags: only a minority of evaluated countries fully meet the licensing standard in practice. In particular, authorities "continue to struggle" to identify the real individuals or companies behind VASP activities.
- Decentralized platforms (DeFi): The report highlights gaps in how regulators handle decentralized finance. Around half of the most advanced jurisdictions now require certain DeFi arrangements to be treated as VASPs (i.e. licensed/registered). This is seen, for instance, when creators or operators retain sufficient control over a protocol. However, most countries still do not apply their AML/CFT framework to DeFi entities or are only beginning to study the issue. The FATF notes that regulators "continue to struggle" to bring DeFi into the perimeter of AML oversight. The update indicates that FATF will issue further guidance on DeFi in 2025/2026, including best practices and illicit-activity trends.
- Global AML/CFT risks: A core message is that weak implementation in any country creates worldwide vulnerabilities. Most of the VA market is concentrated in jurisdictions with "materially important VASP activity, so gaps in those countries threaten the entire system.
The June 2025 update reinforces the need for global AML/CFT to keep up with virtual asset innovation. The report highlights the importance of fixing loopholes in the Travel Rule, ensuring that VASPs are adequately licensed and supervised and that oversight is extended to DeFi and offshore providers.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
