FATF 2023/24 report: crypto compliance risks & gaps

The Financial Action Task Force (FATF) recently released its 2023/24 annual report, shedding light on the global state of compliance for Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs). 

While progress has been made, the findings are clear: most jurisdictions are still failing to fully implement FATF’s standards, leaving gaps for financial crime. 

• 75% of jurisdictions remain non-compliant with Recommendation 15 

• Slow implementation of the Travel Rule continues to pose risks 

• DeFi, stablecoins, and unhosted wallets add new compliance challenges 

As FATF transitions to new leadership under Elisa de Anda Madrazo, the next two years will be critical in shaping the future of virtual asset regulation. 

We break down the report’s key insights, its implications for compliance teams and regulators, and what the future holds for crypto AML efforts. 

In his report, outgoing Singaporean President T. Rajah Kumar spoke about the progress made by FATF on fighting money laundering and terrorism financing. These achievements covered four broad themes: 

1. Advancing global asset recovery efforts
Singapore’s leadership has enhanced global asset recovery by prioritizing the swift confiscation of illicit proceeds and strengthening FATF standards. Collaboration with INTERPOL further improves international cooperation and financial crime prevention.

2. Strengthening compliance with FATF Standards regarding Virtual Assets, VASPs and Beneficial Ownership
Many countries have yet to fully implement FATF’s requirements on virtual assets (VAs) and virtual asset service providers (VASPs), creating loopholes for criminals and terrorists. 
To accelerate compliance, FATF published a list of key jurisdictions and their progress while advocating for global implementation at major forums like the G20 and G7. 
Additionally, FATF has strengthened beneficial ownership transparency, leading to increased commitments from countries to establish registries that combat financial crime more effectively.

3. Addressing new threats to the global financial system
The FATF, in collaboration with global organizations, identified key risks like cyber fraud, ransomware, and illicit trade. Its reports raised awareness and drove action to combat evolving financial crimes.

4. Deepening global collaboration on financial crime
The FATF strengthened its partnership with FATF-Style Regional Bodies (FSRBs) by increasing support, institutionalizing leadership meetings, and integrating FSRB representation. These efforts enhanced global AML, CFT, and counter-proliferation financing (CPF) effectiveness through training and collaboration. 

Crystal Intelligence is positioned to provide insights into most of these themes, specifically the second, as they relate to VAs and VASPs.  

Here we examine the FATF’s integration of VAs and VASPs into its monitoring and evaluation orbit and how it has performed, both since inception and during 2023/24. 

We will further look at both what the future might hold, and how and why it is important to all our industry’s participants. Compliance officers, regulators, and investigators will benefit from learning about the recent past, present, and future of integrating virtual assets into the global financial system safely and combating financial crime on the blockchain. 

Progress on FATF’s Recommendation Virtual Assets and VASPs in 2023/24 

When discussing the FATF’s progress on advancing its standards for VAs and VASPs since 2019, FATF President Kumar referred to two reports published in 2024: 

The survey entitled Status of Implementation of Recommendation 15 by FATF Members and Jurisdictions with Materially Important VASP Activity was published in March 2024.  

The survey collected yes/no responses from all FATF members, emphasizing their responsibility to take a leading role in combating Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT). It also included responses from 20 other jurisdictions with significant Virtual Asset Service Provider (VASP) activity, assessing their implementation status regarding Recommendation 15 through a series of nine questions. 

These 20 non-FATF jurisdictions were evaluated based on two criteria:  

• trading volume, set at 0.25% of global trading,  

• and virtual asset participation, which required more than one million users.  

Notably, eleven jurisdictions met the first criterion, five met the second, and only four met both criteria.  

Above: A sample of the collection of responses from FATF members 

The ‘5th targeted update on jurisdictions’ report was published in July 2024. Its findings were sobering: 

• While progress in implementing Recommendation 15 was evident in some jurisdictions, global adoption is still stalling, although the number of jurisdictions registering or licensing VASPs has increased since 2023. 

• By April 2024, 130 FATF mutual evaluations had been completed. Of these, 75% were partially or wholly non-compliant, indicating little progress since the previous assessment in 2023. 

• The number of respondents to the 2024 survey dropped from 151 in 2023 to 147 in 2024, and 29% of them have not done VA risk assessments. Meanwhile, 75% have done inadequate risk assessments. 

• Progress in implementing the Travel Rule has been slow. Of the surveyed jurisdictions that permit or partially prohibit Virtual Asset Service Providers (VASPs), 30% have not yet implemented the Travel Rule. Additionally, 32% of high-risk jurisdictions without explicit prohibitions have also not implemented the Travel Rule. 

• Despite implementing the Travel Rule, only 26% of jurisdictions have taken supervisory or enforcement actions against VASPs for compliance. 

• Terrorist groups, scammers and other criminals still use VAs to fund the proliferation of weapons of mass destruction. The Democratic Peoples’ Republic of Korea (DPKR) continued its campaign of theft, extortion and money laundering via VAs. Militant groups in Syria and Asia have also used crowdfunding through cryptocurrencies to raise capital for their activities. 

• Private sector stakeholders highlighted rising ML, TF, and PF risks from stablecoins and DeFi hacks, alongside emerging risk mitigation using smart contracts. Jurisdictions reported regulatory progress, including AML/CFT measures, Travel Rule enforcement, and risk assessments on DeFi and unhosted wallets. 

The FATF’s 5th targeted update then made 13 recommendations on how to proceed in integrating VAs and VASPs into the global financial system: eleven for the public sector across four issues and two for the private sector on one issue.

The issues were as follows: 

Recommendations for the Public Sector concerning Virtual Assets and VASPs: 

• Jurisdictions should assess ML and TF risks related to VAs and VASPs and implement mitigation measures. They must establish clear regulatory approaches, supervise VASPs, and enforce compliance through monitoring and sanctions. 

• Jurisdictions should mitigate ML, TF, and PF risks by enforcing R.15, licensing or registering VASPs, and conducting supervision. They should also address risks from offshore VASPs and implement appropriate mitigation measures. 

• Jurisdictions should urgently implement the Travel Rule through legislation and enforce compliance effectively. They should maintain and publicize VASP registration information for AML/CFT purposes. Additionally, engaging with VASPs will ensure their compliance tools meet FATF requirements. 

• Jurisdictions should monitor stablecoin adoption, assess illicit finance risks, and implement appropriate risk mitigation measures, and should also monitor DeFi risks, identify VASPs, establish regulations, enforce compliance, and share best practices with VACG members. Furthermore, they should monitor unhosted wallets, including peer-to-peer (P2P) transactions, assess ML/TF/PF risks, and share their experiences of data collection and risk mitigation. 

Recommendations for the Private Sector concerning Virtual Assets and VASPs:

• VASPs and Travel Rule compliance tool service providers should review their tools and products to ensure that they are fully compliant with the FATF recommendations. They should also enhance compatibility between tools to more effectively implement the travel rule, and improve sanction screening, transaction monitoring, and suspicious transaction detection. 

• Because of ongoing ML, TF, and PF risks, the private sector should ensure its R.15 compliance with the right risk identification and mitigation tactics and use a risk-based approach. This should apply to stablecoins, DeFi, NFTs, and unhosted wallets, including P2P transactions. They should also engage openly with the public sector.  

Progress on worldwide R.15 implementation is set to be published later in 2025. 

How Virtual Assets and VASPs fit into the FATF’s strategic priorities for 2024 to 2026 

Under the leadership of Mexico’s Elisa de Anda Madrazo until 2026, FATF members endorsed four main strategic priorities for the course of her presidency: 

• Improving the peer review process’ effectiveness: The mutual evaluations should be completed more punctually and with a risk-based approach, as should be follow-ups, and reviewers should receive better training. 

• Building a stronger global network: The FATF intends to create a stronger, more inclusive institutional framework with increased global assessment support, particularly for low-capacity countries. 

• Implementing more effective AML/CFT standards worldwide: Training on asset recovery and beneficial ownership standards will be enhanced, and risk awareness on TF, PF and sanctions evasion will be improved. 

• Responding to technological developments in the global financial system: The FATF will support the implementation of the Global Standards on Virtual Assets, update payment transparency protocols, and increase information sharing, enhance personal data protection, and focus on building more, better partnerships. 

The FATF strategic priorities for 2024-2026, which can be viewed here. 

Areas of concern that must be addressed 

Crystal Intelligence congratulates former FATF President T. Rajah Kumar on his accomplishments during his tenure.  

However, there are areas of concern in the report that need urgent attention: 

The slow global adoption of Recommendation 15 must be addressed promptly, as this could significantly reduce the risks associated with terrorism financing, money laundering and proliferation financing within the global financial system. 

In his piece, Crypto’s Future: Reflections and Predictions for 2025, Navin Gupta, CEO of Crystal Intelligence, highlighted the impact of artificial intelligence (AI) in the industry. He noted that “the integration of AI into blockchain intelligence has enhanced the cryptocurrency industry’s ability to ensure trust and transparency.”  

We hope the FATF will recognize AI’s role in both facilitating and combating financial crime when it releases its R.15 implementation update later this year. 

While the February 2025 FATF plenary discussed several vital issues related to money laundering, the financing of terrorism, and proliferation, Crystal Intelligence looks forward to future plenaries which include discussions on virtual assets as part of the public agenda.