The Financial Action Task Force published its Seventh Targeted Update on virtual assets and virtual asset service providers on July 16, 2026. The report shows 83% of surveyed jurisdictions — 91 out of 109 — have passed Travel Rule laws. But only about 40% of those with the laws on the books have actually taken supervisory or enforcement action to verify compliance. The gap comes as new cases highlight how criminals exploit weak oversight: a Cambodia-based financial services group helped move at least $4 billion via crypto between 2021 and 2025.
Travel Rule adoption vs. enforcement
The Travel Rule requires VASPs to share customer information during transactions. Most countries have adopted the legal framework, but enforcement is another story. The FATF found that interoperability issues, inconsistent KYC thresholds, and a lack of supervision are holding back real implementation. Without checks, the rule exists on paper but doesn't stop illicit flows.
The Cambodia case and a Spanish takedown
The report cites a Cambodia-based financial group that moved at least $4 billion through crypto over four years. It's a textbook example of the pattern: onboard in a light-touch jurisdiction, convert to stablecoins, hop chains via OTC desks or mixers, then exit in a weak or strong market. Separately, a Spanish Guardia Civil operation in June 2025 dismantled a crypto fraud network tied to roughly €460 million. Both cases show how criminal networks route funds through jurisdictions with weak oversight before moving them into better-policed markets.
Red flags and the typical laundering playbook
The FATF outlined common red flags for laundering: velocity across time zones, repetitive off-hours bursts, and mismatched counterparty names. The typical pattern starts with onboarding in a lightly regulated jurisdiction, then moving to liquid assets like stablecoins, then chain-hopping through OTC desks or mixers, and finally exiting in either a weak or strong jurisdiction. The report makes clear that these aren't sophisticated schemes — they're repeatable and detectable if supervision exists.
What VASPs face next
VASPs are expected to face increased cross-border information sharing demands, counterparty due diligence requirements, and penalties for weak controls. The FATF's update signals that enforcement is the next frontier. With only 40% of jurisdictions actively checking compliance, the pressure is on regulators to move from passing laws to enforcing them. The Cambodia case and the Spanish operation are likely just the beginning of what gets uncovered when oversight catches up.
