Organised crime networks are moving billions of dollars in illicit funds through the virtual asset sector, exploiting inconsistent regulation and weak enforcement across jurisdictions, according to a report published by the Financial Action Task Force (FATF).
The FATF’s seventh targeted update on virtual assets and virtual asset service providers (VASPs) found that 83% of surveyed jurisdictions have now enacted Travel Rule legislation, up from 73% in 2025, while a further 11 jurisdictions said implementation was under way. The Travel Rule requires VASPs and financial institutions to collect and transmit originator and beneficiary information during transfers.
Despite that progress, the watchdog cautioned that legal frameworks have yet to translate into effective supervision and enforcement in many countries, leaving gaps that criminal groups are actively exploiting.
“This year’s targeted update makes clear that criminal networks continue to abuse virtual assets for illicit purposes and exploit their borderless nature to commit fraud and scams, evade sanctions and launder the proceeds of crime — taking advantage of gaps in countries’ frameworks and uneven implementation of FATF Standards across jurisdictions,” said FATF president Giles Thomson in the report. “Effective implementation of the FATF Standards can no longer be delayed.”
The report highlights a Cambodia-based financial services conglomerate that laundered at least US$4 billion in illicit proceeds between 2021 and 2025, serving as a conduit for both organised crime-linked fraud and cyber theft attributed to North Korea. The same infrastructure was used to process at least $37 million linked to North Korean state-sponsored cyberattacks, with proceeds assessed as supporting weapons and ballistic missile programmes.
In a separate case, Spanish authorities dismantled a cryptocurrency investment fraud network in June 2025 that allegedly laundered approximately €460 million from more than 5,000 victims worldwide, with support from Europol and counterparts in Estonia, France and the United States.
The report also flags the growing misuse of stablecoins, with criminal networks developing proprietary versions specifically designed to resist asset freezing by authorities. The misuse of artificial intelligence, including deepfakes and synthetic identities, to facilitate fraud, hacking and money laundering is also identified as an escalating risk.
Among jurisdictions assessed for compliance with Recommendation 15, 34% were rated largely compliant in 2026, up from 29% in 2025, while 22% remain non-compliant. Only one jurisdiction, the Bahamas, achieved full compliance.
The Cayman Islands is among the jurisdictions listed in the FATF’s updated table of territories with materially important VASP activity, rated largely compliant with Recommendation 15. According to its 2021 assessment, the jurisdiction has conducted a risk assessment, enacted licensing and registration requirements, required stablecoin issuers to register where applicable, conducted supervisory inspections, taken enforcement action and implemented the Travel Rule.
“Governments and the private sector must work together to strengthen preventive measures and close regulatory gaps, bolster cross-border co-operation and deny criminals the opportunity to exploit weak links in the global system,” Thomson said. “As criminal methods become more sophisticated, safeguards must keep pace with technological change and ever-evolving criminal tactics.”
