FATF Travel Rule Update: Laws Pass, Enforcement Lags

The Financial Action Task Force (FATF) seventh Targeted Update on virtual assets, published on 16 July 2026, finds that legal frameworks for crypto anti-money laundering are spreading faster than their enforcement. Of the jurisdictions that answered the 2026 survey, 83% reported having passed legislation that implements the FATF Travel Rule, up from 73% in 2025. Yet almost half of the jurisdictions with such legislation have not taken a single Travel Rule-related supervisory or enforcement action. For crypto businesses, the question is shifting from whether a rule exists to whether counterparties can show it works in practice.

What the FATF update measures

The report assesses how jurisdictions apply Recommendation 15 (R.15), the FATF standard that extends anti-money laundering and counter-terrorist financing rules to virtual assets and virtual asset service providers (VASPs). It covers the 205 jurisdictions of the FATF Global Network, and 147 of them responded to the 2026 survey. For the 58 that did not respond, the FATF infers that no progress on R.15, including Travel Rule implementation, has been made. According to the FATF, jurisdictions with materially important VASP activity account for about 97% of the global virtual asset market.

The Travel Rule: laws are spreading, enforcement lags

The Travel Rule requires VASPs to pass originator and beneficiary information along with qualifying virtual asset transfers, so that the information travels with the payment. The 2026 findings are:

Indicator (FATF 2026 Targeted Update)	Reported figure
Jurisdictions in the FATF Global Network	205
Jurisdictions that answered the 2026 survey	147
Respondents that passed Travel Rule legislation	83% (73% in 2025)
Jurisdictions with Travel Rule legislation in progress	11
Jurisdictions with Travel Rule legislation that have not yet taken a related supervisory or enforcement action	Almost half

In the European Union, the framework for information accompanying transfers of funds and certain crypto-assets is set out in Regulation (EU) 2023/1113, published in the Official Journal on 9 June 2023.

SignorCrypto analysis: A law shows that a jurisdiction has made a rule-making decision. It does not show that originator and beneficiary data move reliably between counterparties. The gap the FATF describes is operational, so a firm should assess counterparties on their supervisory record as well as on their legal status.

Stablecoins and unhosted wallets

The FATF says most identified on-chain illicit activity now involves stablecoins, and that misuse by North Korea-related actors (DPRK) and terrorist financiers has continued to rise since its 2025 update. The report also describes an emerging case in which a financial services conglomerate with links to criminal networks is developing a proprietary stablecoin designed to resist freezing and asset seizure. The FATF's targeted report on stablecoins and unhosted wallets, published on 3 March 2026, covers peer-to-peer risks in more detail.

SignorCrypto analysis: Freezing and seizure are among the few tools that authorities and issuers can use against illicit flows. A stablecoin built to resist them would weaken those tools. Exchanges and payment firms may therefore need controls that do not rely only on the issuer's cooperation. The FATF does not quantify how common such designs are today.

Offshore VASPs and DeFi: the hardest gaps

The FATF reports that more than a third of jurisdictions with licensing or registration frameworks apply a broader approach that requires certain offshore VASPs to be licensed or registered. Offshore operators outside effective oversight remain a significant challenge, as the FATF's separate report on offshore VASPs also highlights.

DeFi is the most persistent gap. Of 142 jurisdictions that answered the question, 44 (31%) said their risk mitigation measures apply to DeFi arrangements. Only four have imposed licensing or registration requirements on them, and two have actually licensed or registered such arrangements. The core difficulty is identification: the FATF says it remains hard to identify the persons or entities that exercise control or sufficient influence over DeFi arrangements.

What the update does not change

It assesses implementation of existing standards and sets priority recommendations. It does not create new binding obligations for firms; those depend on national law.
Its figures come from a self-reported survey, and the 58 non-respondents are treated as making no progress by inference. That is a methodological choice that readers should keep in mind.
The illicit-finance cases it cites are illustrations, not a global estimate of criminal proceeds.

Practical checks for crypto firms

Map the jurisdictions your transfers touch, including where counterparties are licensed and whether any are offshore.
Check how counterparty VASPs exchange Travel Rule data, and what your process does when that data is missing or incomplete.
Treat stablecoin freezing, unhosted-wallet transfers and DeFi exposure as separate risk categories.
Ask which regulator has taken Travel Rule-related action, not only which law has been passed.

FAQ

What is the FATF Travel Rule? It is the requirement for VASPs to pass originator and beneficiary information with qualifying virtual asset transfers, as part of the FATF's R.15 standard.

How many jurisdictions have passed Travel Rule legislation? In the 2026 survey, 83% of respondents reported having passed such legislation, up from 73% in 2025. Only 147 of the 205 jurisdictions in the FATF Global Network answered the survey.

Does the FATF report create new obligations? No. It assesses progress on the existing R.15 standard and sets out priority actions for public and private sectors.

Sources

If your team is mapping Travel Rule data flows into onboarding, monitoring or payment systems, contact SignorCrypto to discuss the technical architecture and delivery scope before you commit to an approach.