On 21 July 2026, the Financial Action Task Force (FATF) published its Targeted Report on Regulatory Challenges from Decentralised Finance. The report updates the FATF's 2021 guidance on virtual assets and Virtual Asset Service Providers (VASPs). It reflects substantial growth and structural change in the DeFi sector since that guidance was published. The report is a regulatory document, not a binding standard. FATF guidance directly influences national AML/CFT legislation across the 40 FATF member jurisdictions and their international partners.
The report is grounded in FATF Recommendation 15, which requires member jurisdictions to regulate virtual asset activities and VASPs to counter money laundering and terrorist financing. A survey of 143 jurisdictions found that 132 (approximately 93%) have not implemented Recommendation 15 as it applies to qualifying DeFi arrangements. Only two of 142 surveyed jurisdictions have licensed or registered a DeFi arrangement in practice. The FATF identifies the absence of a clearly responsible person or entity in many DeFi protocols as the primary obstacle to applying the Recommendation's standards. This structural characteristic prevents the direct identification of a VASP subject to registration and compliance obligations.
Virtual asset exchanges, DeFi protocol operators, and financial institutions transacting with DeFi platforms are the principal addressees of the FATF's recommendations. The report calls on jurisdictions to develop criteria for determining whether control or sufficient influence exists over a DeFi arrangement so that a responsible entity can be identified and held to VASP obligations. Financial institutions and regulated VASPs are advised to apply enhanced due diligence when transacting with DeFi platforms in non-compliant jurisdictions. In April 2026, two cyberattacks on DeFi platforms attributed to the Democratic People's Republic of Korea generated combined proceeds exceeding USD 570 million. This represented approximately 76% of all annual virtual asset hacking losses at that point, cited in the report as evidence of acute and ongoing risk.
The report does not designate specific DeFi protocols as VASPs. Whether automated market makers, decentralised lending protocols, and governance token holders bear VASP obligations under national law remains for each jurisdiction's competent authority to determine. The FATF acknowledges that regulatory divergence across jurisdictions creates arbitrage that illicit actors exploit. The report does not announce a revised Recommendation 15 or a new binding standard. Supplementary guidance may follow, but no timeline is given.
Licentium advises crypto and digital asset businesses on FATF compliance obligations, VASP registration procedures, and AML/CFT programme design across multiple jurisdictions. Contact us to discuss your exposure under evolving DeFi regulatory standards and jurisdiction-specific Recommendation 15 implementation. Work we undertake includes VASP classification analysis, AML/CFT policy drafting, travel rule compliance, and virtual asset regulatory strategy.
Source: FATF, Targeted Report on Regulatory Challenges from Decentralised Finance, 21 July 2026