DeFi Compliance in 2026: The FATF Starts the Clock

Paris set a clock this week

The Financial Action Task Force closed its autumn plenary in Paris on Friday, 30 October, and for decentralized finance the headline is not a new rule. It is a deadline. For the first time, the body that writes the world’s anti-money-laundering standards has told the jurisdictions that host almost all of the planet’s crypto activity to close their implementation gaps on a fixed schedule, with a first round of results due in June 2027 and more in October 2027. The decision was aimed, in the FATF’s own language, at jurisdictions with materially important virtual-asset activity, and it covered both the countries and the virtual-asset service providers operating inside them.

The meeting was the first run by the FATF’s new president, the United Kingdom’s Giles Thomson, and it did two things that land squarely on crypto. It launched that accelerated review of how countries police virtual-asset businesses, and it adopted the first full evaluation of the United States in a decade. Markets barely blinked. Bitcoin traded around $77,000, its market value near $1.56 trillion. The stablecoin supply that now carries most illicit crypto value sat close to $293 billion, and the total value locked across DeFi protocols had slipped to roughly $85 billion, well below where it started the year after a late-October exchange breach rattled the sector, the fallout of which we traced in our look at MEV after the Binance hack.

None of this changes the law in any single country overnight. The FATF cannot fine anyone, arrest anyone or freeze a wallet. What it can do is grade governments and set the schedule they answer to. After a decade in which DeFi compliance in the United States was improvised one indictment at a time, that schedule is the story, and it is why a meeting most traders ignored may matter more to builders than any price candle this week.

What the FATF is, and what it is not

The FATF was set up by the G7 in 1989 to harmonize how governments fight money laundering, and later terrorist and proliferation financing. It has about 40 members and a Global Network of more than 200 jurisdictions that have agreed to follow its 40 Recommendations. Those Recommendations are soft law: influential, near-universally adopted, but not binding in the way a national statute is. No parliament votes on them, and no court enforces them directly.

Its power is indirect, and that is the whole trick. The FATF has no police force and no power to levy a fine. What it has is the mutual evaluation, a periodic peer review that scores each country, and two lists: a grey list of jurisdictions under increased monitoring and a black list that calls for countermeasures. The lists bite through markets rather than law. A downgrade can mean reduced inward investment, higher compliance and borrowing costs, slower cross-border payments and wholesale de-risking by banks that would rather drop a client than carry the risk. Governments move to avoid that reputational tax, which is why a non-binding standard ends up reshaping real rulebooks.

One point matters for every US reader trying to follow this. The Recommendations the FATF writes are implemented in America by FinCEN, which runs the Bank Secrecy Act and the anti-money-laundering regime, and by the Treasury’s Office of Foreign Assets Control, which runs sanctions. They are not implemented by the Securities and Exchange Commission. The SEC polices whether a token is a security; it is not the country’s money-laundering regulator. Conflating the two is the most common mistake in crypto-compliance coverage, and it matters here because the FATF’s deadline runs through the Treasury, not through the SEC’s rulemaking.

Recommendation 15, the rule that reached crypto

The rule that pulls crypto into all of this is Recommendation 15. The FATF added virtual assets and virtual-asset service providers to its glossary in October 2018 and issued the binding interpretive note in June 2019, extending the full anti-money-laundering toolkit (customer due diligence, record-keeping, suspicious-activity reporting and sanctions screening) to exchanges, custodians and other intermediaries. It is also where the Travel Rule comes from: the requirement that identifying information about the sender and the recipient travel alongside a transfer above a threshold, the same obligation that has governed bank wires for decades.

The scoreboard, almost six years on, is thin. Of the 149 jurisdictions assessed for technical compliance with Recommendation 15 as of April 2026, exactly one is rated fully compliant. About a third are largely compliant, and roughly a fifth are non-compliant. Travel Rule legislation is now on the books in 83% of surveyed jurisdictions, up from 73% a year earlier, but a law on the books is not the same as a supervised, enforced regime. Many countries passed the statute and then stalled, lacking the examiners, the data pipes and the political will to turn text into inspections. The FATF is increasingly candid that the distance between the two is where the risk now lives.

The DeFi hole in the rulebook

The thinnest part of the scoreboard is decentralized finance, and the FATF has stopped pretending otherwise. In its July 2026 targeted report on DeFi, it restated the test it has leaned on since 2021: an arrangement is in scope of Recommendation 15 wherever a natural or legal person exercises control or sufficient influence over it, no matter how decentralized the marketing claims it to be. The report sorts the field into three buckets. Where controllers are identifiable, the arrangement is a service provider and owes the full set of obligations. Where it is effectively centralized but the controllers are hidden, it is still in scope and supervisors are told to go find them. Only where an arrangement is genuinely leaderless does it fall outside the service-provider rules, and even then residual-risk mitigation is expected.

What counts as control is concrete, not philosophical. The FATF points to concentrated governance-token holdings, admin keys and upgrade rights, the direction in which fees and treasury flows run, and influence over the development team and the front-end. By that measure a surprising amount of what calls itself decentralized has a controller somewhere. The numbers behind the report are why the plenary moved: by the FATF’s own survey, about 93% of jurisdictions had not implemented the standards for qualifying DeFi, and only two arrangements anywhere had been licensed or registered. The rule exists. Almost nobody has built the machinery to apply it, and the people who run DeFi protocols have spent that vacuum arguing, with some success, that the rule cannot apply to them at all.

What the plenary actually decided

Against that backdrop, the 28 to 30 October meeting produced a short list of decisions that matter to crypto, and they are best read together rather than as scattered press-release bullets. The headline for DeFi is the virtual-asset acceleration. Responding to the FATF’s own April 2026 ministerial declaration, the plenary launched a targeted review and an accelerated follow-up of implementation gaps, aimed at the jurisdictions with the most material crypto activity and covering the service providers inside them, with results due in June 2027 and again in October 2027.

Alongside it, the plenary approved a report elevating the fight against fraud and scam compounds to a global priority, agreed to introduce tailored assessments for low-capacity countries so scarce supervisory effort goes where risk is highest, adopted the mutual evaluations of the United States and Mexico, and removed four jurisdictions (Bulgaria, Cote d’Ivoire, the Democratic Republic of the Congo and Monaco) from its grey list. The black list, the small set of jurisdictions subject to a call for action, was left unchanged. Taken as a whole, the plenary did not rewrite the rules. It picked a smaller number of targets and set a faster clock.

Materially important: the markets the clock is set for

The acceleration is not aimed at everyone, and that is the part worth understanding. The FATF has built a category it calls materially important virtual-asset activity, and it maintains a table of the jurisdictions that qualify. That table covers a few dozen countries that together account for about 98% of global VASP activity. A jurisdiction lands on it by being a FATF member, by hosting service providers that control more than 0.25% of global virtual-asset trading volume, or by having a large user base and a top-30 ranking for adoption. In other words, the FATF stopped trying to fix the whole world at once and drew a ring around the markets where the money actually is.

What the acceleration changes for a business in one of those markets is the tempo. Instead of waiting years for a full mutual evaluation to come around, a materially important jurisdiction now faces a compressed follow-up: show the assessors a supervised, enforced regime for virtual-asset service providers, or carry a documented gap into the next plenary. For a provider on the ground, that translates into more frequent examinations, sharper questions about counterparties and the Travel Rule, and less tolerance for a licence that exists on paper but never gets inspected. The pressure is designed to roll downhill, from the capital to the compliance desk.

Inside that cohort the picture is better than the global average but still unfinished: about 76% have licensed or registered service providers, 84% run supervisory inspections, and 75% have taken some enforcement or supervisory action. The accelerated follow-up means these jurisdictions report back on shorter cycles and face a documented list of gaps rather than a polite recommendation to improve. The logic of targeting them is simple, and it is the same logic a bank robber once offered about banks. If you want to shrink the space illicit money can move through, you start where the money is. And the single largest of those markets is the United States, which makes the next decision from the plenary more than a formality.

The FATF just graded the United States

The plenary adopted the joint FATF, Asia/Pacific Group and Caribbean FATF mutual evaluation of the United States. It is the first full evaluation of the country in a decade; the last one landed in 2016, and a 2024 follow-up upgraded the US rating on beneficial ownership after the Corporate Transparency Act took effect. Assessment teams spent much of 2026 on the ground, meeting regulators, prosecutors, law enforcement and industry, scoring the country against the 40 Recommendations and the 11 effectiveness outcomes that sit alongside them.

The stakes are easy to underrate, because the United States is not going on any list. Large, systemically central economies almost never do; the grey list is built for jurisdictions whose weaknesses threaten the system from the edges. What the US faces instead is reputational and diplomatic pressure. The 2016 evaluation praised American enforcement muscle while flagging gaps in how the country supervised non-bank financial businesses and collected beneficial-ownership information, and a decade on the obvious new frontier is virtual assets. A country that files aggressive crypto enforcement actions but supervises the sector unevenly is exactly the profile the effectiveness outcomes are built to catch.

The full report, with its detailed ratings, does not publish until December 2026, after a quality and consistency review, so anyone quoting US grades today is guessing, and this piece will not. What is already known is the shape of the consequence. Under the FATF’s current round, every evaluation now ships with a timebound Roadmap of Key Recommended Actions, giving the country three years to fix what the assessors flag. For crypto that is the live wire. The United States is the most materially important virtual-asset market on the FATF’s own map, so whatever the report says about how money transmitters are licensed and how virtual-asset businesses are supervised becomes a three-year to-do list, arriving in the same quarter the SEC’s crypto rulemaking is in motion. A weak grade will not put the United States on a grey list, the consequences of that are reserved for far more troubled systems, but it will shape what the Treasury has to show by the end of the decade, and it feeds straight into the acceleration review the same plenary just launched. We mapped the agency side of that story in our look at SEC crypto enforcement after the comment window.

Why none of this is a statute

The American answer to all of this is still not a law. The CLARITY Act, the market-structure bill that would have written a statutory decentralization test and divided jurisdiction between the SEC and the CFTC, failed its Senate cloture vote 49 to 50 on 15 September, eleven votes short of the sixty it needed, and died for the year. Section 604, the provision that would have shielded non-controlling developers from money-transmitter classification, died with it. The one piece of US crypto law that is both on the books and binding is the GENIUS Act, and that governs stablecoins, not protocols.

So compliance is written by agencies under the authority they already have. The SEC under Chair Paul Atkins has a Regulation Crypto Assets proposal whose public comment window closed on 20 October, its centerpiece a Rule 400 safe harbor for investment-contract tokens, and a separate crypto-custody proposal for investment advisers and funds whose comments are due 7 December. Atkins has drawn one bright line through all of it. “The right to have self-custody of one’s private property is a foundational American value that should not disappear when one logs onto the internet,” he said at an SEC roundtable on DeFi. But the FATF’s deadline does not run through the SEC. It runs through FinCEN and OFAC, the Bank Secrecy Act and the sanctions list, which is the part of the US rulebook that gets measured in Paris, and the part that no amount of rulemaking at the securities regulator can satisfy.

Who is on the hook when it is just code

Because you cannot serve a subpoena on a smart contract, the control test has always landed on people and companies, and the US record is now detailed enough to read as a map. The Tornado Cash cases set the outer edges. In Van Loon v. Treasury, the Fifth Circuit held in November 2024 that immutable smart contracts are not property that OFAC can sanction, and the Treasury delisted the protocol in March 2025. Yet Roman Storm, one of its developers, was convicted in August 2025 of conspiring to run an unlicensed money-transmitting business; the jury hung on the money-laundering and sanctions counts, and his retrial is set for 26 April 2027 before Judge Katherine Polk Failla. The line the Justice Department draws, in the words of criminal-division head Matthew Galeotti, is that “merely writing code without ill intent is not a crime.” The flip side, which the Storm case is testing, is that operating a service around the code, an interface, a relayer, a fee, is conduct.

The other precedents fill in the middle of the map. The CFTC won a default judgment against the Ooki DAO in June 2023, treating the DAO as a legal person and its governance-token voters as its members, imposing a $643,542 penalty and ordering the website offline. Front-ends have folded fastest: Uniswap Labs screens addresses and tokens with TRM Labs, leaving the contracts open while the hosted interface complies. Liquidity providers and relayers remain largely untested. The through-line is consistent, and it is the same one the FATF’s control test encodes: liability follows control and profit, not the label on the website. That is why the FATF can press on supervision without first winning a global argument about what decentralization means. Supervisors do not have to define the ideal; they only have to find the controller.

The control points the deadline will squeeze

A deadline to supervise service providers runs into an awkward fact: most DeFi has no obvious provider to supervise. So the pressure lands where it always has, on the handful of control points every application leans on. The fiat on-ramp is where know-your-customer checks and the Travel Rule already bite hardest, because converting dollars to tokens runs through a regulated business. The hosted front-end is a legal entity even when the protocol behind it is not, and Europe has gone furthest here: ESMA’s 30 September response to the MiCA review proposed a new regulated DeFi-access service for firms that provide access to protocols, and warned against what it called decentralisation washing.

The front-end is the choke point regulators understand best, because it behaves like any other website operator. It has a company behind it, a domain, terms of service and, usually, revenue. That is why the first compliance moves in DeFi were not protocol changes but interface changes: address screening, token delistings, geo-blocks on sanctioned regions. The contract keeps running for anyone who can call it directly, but the overwhelming majority of users arrive through the hosted interface, so controlling the interface controls the traffic. A deadline to supervise service providers is, in practice, a deadline to decide which interfaces count as one.

The settlement asset is a control point by design. The GENIUS Act, signed in July 2025 and taking effect in January 2027, requires payment-stablecoin issuers to hold the technical capability to freeze, seize or burn tokens on a lawful order, and 84% of illicit crypto value now moves in stablecoins. Compliance reaches DeFi through the money itself, whatever the protocol’s governance looks like, which is the quietest and most powerful lever of all. The last point is the unhosted wallet, where the Travel Rule asks the regulated counterparty to collect extra information on transfers to and from self-custody; that is where the hardware you hold meets the rule you do not control, a tension we unpacked in our comparison of Ledger, Trezor and Tangem. The FATF’s deadline does not invent any of these choke points. It tells supervisors in the markets that matter to finish wiring them up.

Fraud, scam compounds and the AI problem

The plenary’s other headline was not crypto-specific, but it routes straight through crypto. The FATF approved a report making fraud and scam compounds, the industrial pig-butchering operations run out of Southeast Asia, a global priority, and Thomson was blunt about where the trend is going. “Sadly, I fear the worst is still yet to come,” he told reporters as the meeting closed. Those compounds cash out through crypto, overwhelmingly through stablecoins, and the FATF’s seventh targeted update flagged the growing misuse of artificial intelligence, through deepfakes, synthetic identities and AI-assisted recruitment scams, to defeat the identity checks that are supposed to catch them.

This is where DeFi sits in the FATF’s mental model: not usually the crime, but the laundering layer the proceeds pass through. Chainalysis put total illicit crypto value at $154 billion in its 2026 report, up 162% year on year, with sanctioned-entity volume up 694%, even as illicit flows stayed under 1% of all on-chain volume. The identity side of that fight is why so much compliance money is now chasing proof-based tools, from on-chain attestations to the zero-knowledge machinery we examined in our piece on zk-ML, which can let a user prove an attribute without handing over a document a scammer could forge. It is also why the wallet-targeting wave of this autumn, which we covered in October’s wallet-security story, worries supervisors as much as any protocol exploit: the weakest link is rarely the contract, it is the human at the keyboard.

Does any of it work?

The question the deadline does not answer is whether the regime it accelerates actually prevents crime. Coin Center’s Peter Van Valkenburgh has argued for years that the existing anti-money-laundering system does “remarkably little to prevent illicit finance,” at a cost he puts north of $26 billion a year in the United States, against a United Nations estimate that roughly 0.2% of criminal proceeds are ever seized. The counter-argument has force too: blockchains are more transparent than the cash and shell-company systems that came before them, illicit activity is a sub-1% share of volume, and traced on-chain flows have fed real seizures and prosecutions.

Those seizures are not hypothetical. Investigators have used the permanence of the ledger to unwind thefts that would have vanished in a cash economy, tracing stolen funds through mixers and across chains to the exchanges where they finally touch identity. That is the strongest case for the regime: the same transparency that makes crypto feel surveilled is what lets a prosecutor follow the money. The weaker case is everything that never reaches that choke point, the value that stays on freeze-resistant rails, moves peer to peer, or cashes out through a jurisdiction that never built the supervision the FATF keeps asking for.

Both can be true at once, and the displacement problem sits underneath them. As issuers freeze more aggressively, determined actors migrate to freeze-resistant rails, so a deadline tends to raise the cost of compliance for the honest builder faster than it raises the cost of crime for the committed launderer. The FATF’s own scoreboard, almost six years into Recommendation 15, is one fully compliant jurisdiction out of 149. An accelerated timetable is partly an admission that the first attempt did not take, which is not the same as proof that the second one will. What the clock does guarantee is motion: supervisors with a reporting date tend to produce enforcement, if only to have something to report.

Europe’s clock runs to the same month

The European Union is not waiting for the FATF. MiCA regulates crypto-asset service providers and issuers rather than autonomous protocols, but ESMA’s 30 September response to the MiCA review asked Brussels for a new DeFi-access licence, powers to block fraudulent sites and freeze crypto assets, and that same warning against decentralisation washing. The MiCA review consultation closed on 30 September, and the European Commission’s reports under Articles 140 and 142 are due by 30 June 2027, the month the FATF’s first acceleration results land.

For a protocol that serves users everywhere, two of the three largest rule-making blocs now carry a mid-2027 checkpoint on decentralized finance, and they are converging on the same instinct: regulate the access point, the interface and the settlement asset, because the code itself sits beyond reach. The difference is procedural. Europe is building a statute slowly, through consultations and codified powers; the United States, with CLARITY dead, is improvising through agencies and case law. The FATF review will grade both against the same yardstick, which means the US cannot simply point to its lighter-touch instinct as compliance. Effectiveness, not ideology, is what the assessors score.

What it means for builders, front-ends and users

For builders, the control test is the thing to internalize, because it is now the organizing idea of global crypto anti-money-laundering. Admin keys, upgrade rights, a fee switch pointed at a treasury you steer, concentrated governance tokens: each is a control indicator that can make you the service provider the deadline is about. Minimizing control is no longer only a decentralization ideal; it is a compliance posture, and the most defensible one available while the law is unsettled. The projects most exposed are not the genuinely leaderless ones but the ones that market decentralization while a small team quietly holds the keys.

For front-ends, the lesson is that a hosted interface is a legal entity, and address screening and geo-blocking are the surfaces regulators reach first; the EU’s DeFi-access idea is the template other blocs will borrow. For users, the practical reality is unchanged by anything that happened in Paris. Self-custody is protected in US rhetoric, but identity attaches at the on-ramp and the off-ramp, and moving a balance to or from an unhosted wallet increasingly draws extra questions. You can hold your own keys. Turning crypto into spendable money still runs through a gate, and that gate is where the clock the FATF just started will be read. The next two readings are already on the calendar, in June and October 2027.

Frequently Asked Questions

What did the FATF decide about crypto at its October 2026 plenary?

It launched an accelerated review of how jurisdictions with materially important virtual-asset activity implement the FATF Standards for service providers, with results due in June and October 2027, approved a report making fraud and scam compounds a global priority, and adopted the mutual evaluations of the United States and Mexico.

Is DeFi now banned under the FATF rules?

No. The FATF does not ban DeFi or write binding law. Its control-or-influence test brings a DeFi arrangement into anti-money-laundering scope only where a person exercises control or sufficient influence over it, and genuinely leaderless protocols fall outside the service-provider rules, though some residual-risk mitigation is still expected.

What does the FATF’s evaluation of the United States mean?

The plenary adopted the US mutual evaluation, and the full report with ratings publishes in December 2026 alongside a three-year roadmap of recommended actions. It grades US anti-money-laundering effectiveness, which is implemented through FinCEN and OFAC rather than the SEC, and it shapes what the Treasury has to address by the end of the decade.

Who is legally responsible for complying in DeFi?

Responsibility follows control and profit. Developers who operate a service, as in the Tornado Cash case, DAOs with governance-token voters, as in the CFTC’s Ooki case, and front-end operators who host an interface have all been treated as on the hook, while passive liquidity providers and relayers remain largely untested.

Does any of this make crypto safer from money laundering?

It is contested. Illicit activity is under 1% of on-chain volume and blockchain transparency aids investigations, but critics argue the regime seizes only a tiny fraction of criminal proceeds at high cost, and value keeps migrating to freeze-resistant tools as issuers tighten their controls.

Anneke de Vries covers regulation and policy for HOGE Wire.