FATF tightens crypto standards as stablecoins dominate illicit flows

What happened

At its plenary from 17 to 19 June 2026, the Financial Action Task Force (FATF), the global standard-setter for anti-money laundering (AML), approved its seventh targeted update on implementation of the FATF Standards on virtual assets (VAs) and virtual asset service providers (VASPs). A VA is a digital representation of value that can be traded or transferred. A VASP is a business that exchanges, transfers, or holds those assets for customers.

The update puts stablecoins at the centre. FATF reported that stablecoins numbered more than 250 by mid-2025, with a combined market capitalisation exceeding USD 300 billion. FATF said stablecoins accounted for 84 percent of illicit virtual asset transaction volume in 2025. That 84 percent figure is FATF’s assessment, not an independently verified fact.

FATF also released best practices for supervising the Travel Rule. Under the Travel Rule, originator and beneficiary information must travel with a transfer so each side can identify who sent and who received the funds. FATF said the rule is adopted or in process across 99 jurisdictions. The status of Recommendation 15 implementation, covering members and jurisdictions with materially important VASP activity, is to be updated and published in 2026.

Why it matters

The headline signal is concentration. When one instrument class carries the share of illicit volume that FATF attributes to stablecoins, supervisory attention follows the money, and so should monitoring resources. This is analysis, not a FATF directive. The direction of travel is clear.

A Travel Rule adopted or in process in 99 jurisdictions is wide coverage on paper. Coverage is not the same as enforcement. The open question is data quality: whether originator and beneficiary fields actually arrive complete, accurate, and matched on both sides of a transfer, or whether they are dropped at the first non-compliant counterparty.

The forthcoming Recommendation 15 status report will expose which jurisdictions with significant VASP activity still lag. Firms operating across those gaps inherit the exposure, because a transfer is only as transparent as its weakest leg.

Practitioner angle

For VASPs and the banks that service them, treat this update as a prompt to re-baseline crypto controls now, ahead of the 2026 status report.

• Treat stablecoin flows as a priority monitoring surface. Tune transaction-monitoring rules and typologies specifically to stablecoin movement rather than folding it into generic crypto coverage.
• Verify Travel Rule data on both sides of a transfer. Check that originator and beneficiary fields are present, complete, and matched on inbound and outbound legs, and flag counterparties that routinely send incomplete data.
• Review unhosted-wallet and peer-to-peer exposure. Confirm your controls and risk appetite for transfers to and from wallets outside any VASP, where Travel Rule data may not exist.
• Map your screening and onboarding to Recommendation 15 expectations, so you can show a supervisor where your controls already meet the standard and where remediation is in progress.

The single most important action: identify every counterparty that fails to send complete Travel Rule data on stablecoin transfers, and decide this quarter whether to remediate, restrict, or exit each relationship.