The Financial Action Task Force (FATF) has released its seventh compliance report card on virtual assets, warning that while global cryptocurrency legislation continues to advance, enforcement is failing to keep pace as criminal networks increasingly leverage artificial intelligence and issue their own "freeze-resistant" stablecoins to evade existing controls.

Published on July 16, the update evaluates how effectively nations have implemented the FATF's R.15 recommendations since their introduction over seven years ago. FATF standards are not themselves domestic law, but they shape national anti-money laundering and counter-terrorist financing regimes through peer reviews and mutual evaluations. According to analysis by Chainalysis, the watchdog's message is unequivocal: paper compliance alone is no longer sufficient.

Legislation Grows While Enforcement Stalls

On paper, progress appears substantial. Chainalysis reports that 86% of the 147 surveyed jurisdictions have completed virtual asset risk assessments, up from 76% in 2025. Travel Rule legislation now covers 83% of jurisdictions, compared to 73% a year earlier, and jurisdictions rated "Largely Compliant" have risen from 29% to 34%.

The Travel Rule requires virtual asset service providers, or VASPs, to collect and transmit identifying information about the originators and beneficiaries of qualifying transfers. That makes the gap between legislation and supervision especially important: rules that are not examined or enforced may do little to improve visibility into cross-border flows.

Among the 95 jurisdictions requiring VASP licensing, 81% now conduct supervisory inspections and 71% have taken enforcement action.

However, significant gaps persist beneath these figures. Sixty percent of jurisdictions with Travel Rule laws on the books have taken no supervisory or enforcement action under them. When the FATF assessed preventive AML and CFT measures, only 13 of 139 jurisdictions — fewer than 10% — fully met the standard.

Licensing outcomes tell a similarly uneven story. While 73% of jurisdictions require VASP licensing, only 58% have actually issued a license, and just 40% satisfactorily meet the criterion in mutual evaluations. Prohibition without follow-through is also spreading: 23% of jurisdictions now ban VASPs entirely, up from 11% in 2023, without corresponding gains in enforcement.

The FATF just dropped its 7th Crypto Compliance Report Card. The main takeaway is that global crypto laws are advancing, but enforcement is lagging. With criminals leveraging AI and issuing "freeze-resistant" stablecoins to evade controls, paper-only compliance is no longer…

— Chainalysis (@chainalysis) July 23, 2026

Freeze-Resistant Stablecoins Signal a New Threat

One case detailed in the report is particularly striking. A Cambodia-based conglomerate laundered at least $4 billion between August 2021 and January 2025, according to Chainalysis, linking organized fraud, underground banking, and blockchain-based money laundering. At least $37 million of those funds were traced back to DPRK cyber heists connected to weapons programs.

After a stablecoin issuer froze over $29 million belonging to that network, the group responded by launching its own USD-pegged token — marketed as immune to asset freezing — deployed across several public blockchains as well as a proprietary chain. The FATF warns that VASPs may no longer be able to rely on issuer-level freeze or burn functions as an effective safeguard.

That shift matters because regulated stablecoin issuers have historically been one point where sanctioned or stolen assets could be frozen after detection. A token designed and marketed to avoid that control reduces the effectiveness of issuer-level intervention and puts more pressure on exchanges, custodians, analytics providers, and supervisors to identify exposure before funds move further through the system.

Terrorist organizations including ISIL and Al-Qaeda are also shifting toward stablecoins over Bitcoin for fundraising and transfers, the report notes. Chainalysis data indicates that stablecoins now account for 84% of all illicit transaction volume tracked across the industry.

AI and Convergence Push Regulators to Adapt

The FATF describes artificial intelligence not as a standalone threat but as a structural factor amplifying money laundering, terrorist financing, and sanctions evasion risks. Cited cases include deepfake recruitment scams that stole over $1 million, AI-assisted development of smart-contract exploits, and the use of open-weight models to bypass commercial safety guardrails. Chainalysis separately identified AI impersonation scams as the fastest-growing fraud category over the past year.

The report also flags decentralized finance as a persistent regulatory blind spot, with 93% of jurisdictions having yet to identify qualifying DeFi arrangements that could fall under VASP rules. Offshore VASPs remain another significant gap, actively soliciting customers and advising VPN use to mask their operations.

For regulators and compliance teams, the report points to implementation quality rather than rulemaking volume as the next test. Looking ahead, the FATF's recommendations now list blockchain analytics, wallet screening, and blacklisting tools as baseline expectations for any compliant AML and CFT framework.