FATF Says Crypto Travel Rule Adoption Is Rising, But Enforcement Still Lags

The Financial Action Task Force says more jurisdictions are putting crypto rules into law, but enforcement remains the weak point.

In its Seventh Targeted Update on the implementation of FATF standards for virtual assets and virtual asset service providers, the global watchdog reported that 83% of surveyed jurisdictions have passed legislation to implement the Travel Rule. That is up from 73% in 2025.

On paper, that looks like progress.

But the report also says only 40% of jurisdictions with Travel Rule legislation have taken supervisory or enforcement actions. In other words, more countries have rules, but far fewer are actually policing them in a meaningful way.

That gap is now the core issue.

TL;DR

FATF says 83% of surveyed jurisdictions have passed Travel Rule legislation for crypto.
Only 40% of jurisdictions with those laws have taken supervisory or enforcement actions.
The report highlights risks tied to scam centers, DPRK cyber theft, DeFi, unhosted wallets, and freeze-resistant stablecoins.

Laws Are Spreading Faster Than Enforcement

The Travel Rule is one of the most important compliance standards in crypto.

It requires virtual asset service providers to collect and transmit originator and beneficiary information for qualifying transfers. In normal language, regulators want crypto intermediaries to know who is sending and receiving funds, especially when transfers cross regulated platforms.

For years, the industry argued about whether this could work in crypto.

Now, according to FATF, most surveyed jurisdictions have at least moved the rule into law. That is a major shift from the early days when many countries were still deciding whether to regulate VASPs at all.

But legislation is only the first step.

A rule that sits on the books without supervision does not change much. Exchanges, brokers, custodians, and payment firms need guidance, inspections, enforcement risk, and technical systems. Regulators need staff and tools. Cross-border cooperation needs to function.

FATF’s numbers show that implementation is still uneven.

Why The Enforcement Gap Matters

Crypto compliance has always had a weakest-link problem.

If one country has strict rules and another does not enforce anything, illicit actors can move through the weaker jurisdiction. That creates pressure on the whole system because crypto transactions are global by design.

This is especially relevant for scams, laundering networks, ransomware groups, and state-linked hacking operations.

FATF’s report flags organized crime-linked scam centers, DPRK cyber theft, unhosted wallets, DeFi, and stablecoins designed to resist freezing as areas of concern.

Those categories show how the risk picture is changing.

It is no longer only about rogue exchanges or obvious dark-market activity. It is about large scam compounds, sophisticated cyber operations, decentralized services, wallet infrastructure, and stablecoin designs that may limit the ability of issuers or intermediaries to freeze funds.

That is a much harder environment for regulators.

DeFi Remains The Hardest Fit

DeFi is one of the most uncomfortable parts of the FATF framework.

The Travel Rule assumes there is an intermediary that can collect and transmit information. In DeFi, that intermediary may not exist in the traditional sense. A protocol may be smart contracts, frontends, governance participants, developers, validators, relayers, or a mix of all of them.

Regulators then face a difficult question: who is responsible?

If a team controls a frontend, perhaps the frontend becomes the enforcement point. If a DAO governs parameters, perhaps governance participants face pressure. If users interact directly with contracts, enforcement becomes much harder.

FATF has been pushing countries to avoid letting “decentralized” labels become a loophole. But turning that principle into practical supervision is not simple.

That is why the enforcement gap matters even more in DeFi.

Stablecoins Are Under The Microscope

Stablecoins also stand out in the report’s risk list.

They are one of crypto’s strongest use cases, but also one of the easiest tools for moving value quickly across borders. USDT, USDC, and other stablecoins have become core settlement assets for traders, businesses, remittances, DeFi users, and, at times, illicit networks.

FATF’s concern around freeze-resistant stablecoins is notable because it focuses on control.

If a stablecoin issuer can freeze addresses, regulators may pressure issuers to act against illicit funds. If a stablecoin is designed to resist freezing or lacks a clear issuer control point, that enforcement route becomes weaker.

That raises difficult questions about censorship resistance, user protection, and law enforcement access.

Crypto users often value assets that cannot be easily frozen. Regulators worry that those same features can help criminals.

That tension is not going away.

The Next Phase Is Supervision

The headline number, 83% legislative adoption, shows that crypto regulation has become mainstream. The more important number may be 40% enforcement action.

That is where the next phase will happen.

Countries will be judged less on whether they wrote rules and more on whether they supervise firms, punish violations, and cooperate across borders. Exchanges and custodians will need stronger Travel Rule systems. DeFi frontends may face more scrutiny. Stablecoin issuers will remain under pressure.

For the industry, the message is clear enough.

The compliance debate has moved beyond whether crypto should be regulated. It is now about whether existing rules are being enforced consistently enough to satisfy global standard setters.

That may not be the story traders want to hear, but it is the story that will shape how exchanges, wallets, stablecoins, and DeFi protocols operate in the next market cycle.

This article is based on FATF’s Seventh Targeted Update on virtual assets and VASPs.

This article was written by the News Desk and edited by Samuel Rae.

This report is based on information released in disclosures at primary source documentation.