Six years after the FATF brought virtual-asset service providers inside the global AML framework, most of the world has still not finished implementing it.
The July 2026 targeted update gives the numbers plainly. Of 149 jurisdictions assessed as at April 2026, one — a single jurisdiction — is fully compliant with Recommendation 15, the standard covering virtual assets. That was also true in 2025.
FATF does not name that jurisdiction. The update reports the ratings in aggregate; the per-jurisdiction ratings behind them come from mutual evaluation and follow-up reports, published separately. Nor is the answer simple to reconstruct from those, because a compliant rating awarded before 2019 was awarded against the older R.15, which said nothing about virtual assets.
That is worth sitting with rather than treating as a gap in the reporting. The identity is not the number that matters. What matters is that six years in, full compliance is rare enough to be a single case.
Below that, 34% are largely compliant (51 jurisdictions), up from 29% a year earlier. 43% are partially compliant (64), down from 50%. And 22% are non-compliant (33), essentially unchanged from 21%.
So the direction is right and the pace is slow: six years after the standard arrived, around two thirds of assessed jurisdictions are partially compliant or worse.
For a compliance officer, the useful part is not the score. It is which parts jurisdictions are failing.
FATF names four: conducting risk assessments, licensing or registering providers, supervising them, and implementing the Travel Rule. The Travel Rule is the requirement that identifying information about the originator and beneficiary travels with a transfer, the way it does in correspondent banking. FATF has flagged it as a persistent challenge across successive updates.
Two risk themes run through the rest of the document and both matter more than the compliance scores.
The first is stablecoins moved through unhosted wallets. A stablecoin sitting in a wallet nobody administers is, from a supervisory standpoint, value in motion with no intermediary to ask. The update flags this specifically, alongside over-the-counter brokers and regionally based service providers.
The second is offshore providers exploiting regulatory arbitrage — firms that position themselves in whichever jurisdiction is furthest behind on that 34% figure. This is the practical consequence of uneven implementation. Where the standard is unevenly applied, the activity does not stop; it relocates. That is not a hypothetical risk, it is the mechanism the update describes.
What follows for a Cyprus business is straightforward enough.
If you take payment in virtual assets, or hold them, or have counterparties who do, the question is no longer whether the sector is regulated. It is whether the specific provider in the chain sits in a jurisdiction that has done the work. That is now a documented, published, per-jurisdiction fact rather than a matter of impression.
If you are onboarding a client whose wealth came through virtual assets, the source-of-funds work is the same discipline as always, with one addition: the chain of custody may run through a provider in a jurisdiction with no effective supervision. The absence of a red flag there is not evidence of anything.
And if you are a provider yourself, the four gaps FATF lists are a serviceable self-audit. Risk assessment, registration, supervision, Travel Rule. Being able to show your position on each is worth more than being able to cite the regime you are in.
None of this requires waiting for the next set of rules. The standard has existed since 2019. What the July update measures is how much of the world has caught up with it — and the honest answer is a third.
Not legal advice. Verify against the primary source before acting.
FIRMCY screens names against all of the lists above — plus a worldwide PEP database and adverse media — with fuzzy matching and an audit-ready report for every check. New organisations get 100 free credits, no card required.
Start screening free Free PEP & sanctions check FATF high-risk countries Weekly AML briefing Live on Telegram ↗