FATF Will Start Auditing Crypto Rulebooks in 2027, and Almost Nobody Passes Yet

The Financial Action Task Force is putting crypto regulators on notice. After its Oct. 28-30 plenary in Paris, the global watchdog said it will run a targeted review of anti-money-laundering controls in the jurisdictions that matter most for crypto — and the first results land in June 2027, with more to follow in October.

The reason is stark. Of 149 jurisdictions assessed as of April 2026, exactly one fully complied with Recommendation 15, the FATF standard that applies its rules to virtual assets and the companies that move them. Sixty-four were partially compliant, 33 were non-compliant, and 51 were largely compliant — roughly 43%, 22% and 34% respectively.

The FATF says the review will prioritize places with materially important activity by virtual asset service providers. Selection will lean on objective criteria tied to where each jurisdiction currently sits in its assessment. The task force didn't name names or say how many jurisdictions it will pull in, and it's pairing the review with training and capacity-building for those involved.

The gaps it's chasing are practical, not theoretical: turning risk assessments into real controls, actually running licensing and registration regimes, identifying who operates the VASPs, and supervising them on a risk basis. In other words, writing the rule was the easy part.

The Travel Rule tells the same story. Under it, VASPs and financial institutions must collect, keep and securely pass along details about the people sending and receiving transfers. In the 2026 survey, 91 of 109 jurisdictions had passed Travel Rule legislation — 83% of those surveyed. But 55 of those 91, or 60% of jurisdictions with the law on the books, had issued no findings or directives and taken no supervisory or enforcement action on it.

At the same plenary, countries agreed to coordinate against virtual-asset financial crime, fraud and scams included. The targeted review slots into that bigger push as a focused assessment and support process. It isn't an immediate rule change, and it isn't an enforcement action — it's a date on the calendar.