FATF Flags Offshore Crypto Gaps in Global Crime Networks

The headline is blunt: offshore blind spots are still letting organized crime push large volumes through crypto rails. That is the core message from the latest Financial Action Task Force update on virtual assets and VASPs.

Regulators have more laws on the books, but the follow-through is uneven. Criminals go where the checks are lightest, then hop across borders before anyone can join the dots.

If you operate a venue, custody desk, OTC line, or even a DeFi-facing frontend, this is a moment to tune your controls. The direction of travel is clear, and the cases cited are not rounding errors.

Point Details Offshore gaps persist FATF warns criminals route funds through jurisdictions with weak oversight, then back into better-policed markets. Travel Rule laws up, actions lag 83% of surveyed jurisdictions now have Travel Rule legislation, but only ~40% have taken supervisory or enforcement steps to verify compliance (Comsure). Billions laundered Case studies include a Cambodia-based network moving at least USD 4 billion and a Spanish takedown tied to ~€460 million, showing scale of abuse (AML Intelligence). Cross-border bottlenecks Incompatible Travel Rule tooling and inconsistent KYC laws create a sunrise problem that criminals exploit. VASPs on the hook Expect more cross-border information sharing demands, counterparty due diligence, and penalties for weak controls.

What FATF flagged in July 2026

FATF’s Seventh Targeted Update on virtual assets and VASPs, published on July 16, 2026, reads like a progress report with red ink in the margins. The headline number looks good at first glance: 91 of 109 surveyed jurisdictions, roughly 83 percent, have passed Travel Rule laws. But the body text undercuts the comfort. Only around 40 percent of those with laws have taken supervisory or enforcement action to verify that VASPs are complying in practice. Both points come straight from the July update summary (Comsure).

Then there are the cases. The update highlights large scale laundering through crypto channels. One example cites a Cambodia-based financial services group that helped move at least 4 billion dollars between 2021 and 2025. Another describes a Spanish Guardia Civil operation in June 2025 that broke up a crypto fraud network tied to roughly 460 million euros. The point is not that crypto is uniquely criminal. It is that gaps across borders are still big enough to drive a truck through, and professional networks are doing just that (AML Intelligence).

The update is not only about enforcement theater. It is a nudge to supervisors to close the practical holes: data sharing between VASPs, consistent KYC thresholds, fit-for-purpose licensing, and clear expectations for high risk flows like OTC brokers, P2P hubs, and cross-chain bridges.

Where offshore gaps feed the flow

Criminal networks do not need no-questions-asked banks anymore. They need a handful of weak links stitched together across borders. The pattern usually looks like this:

• Onboard in a light touch jurisdiction with fast KYC and limited source-of-funds checks.
• Move into liquid rails, often stablecoins or major layer-1 assets, to minimize slippage and fees.
• Hop chains or segments via OTC brokers, cross-chain liquidity, or mixers to break heuristics.
• Exit where controls are light, or re-enter a strong jurisdiction after enough distance is created.

Each step by itself might not light up a dashboard. In combination, and at scale, you start to see the signature: velocity across time zones, repetitive off-hours bursts, and counterparties that never quite match the name on the account. Offshore venues with thin compliance teams are the favorite staging grounds. The FATF update effectively says the industry is still underestimating how reliable this machine has become in the wrong hands (Comsure).

Travel Rule: adoption vs real enforcement

On paper, the world moved. Most surveyed jurisdictions now have Travel Rule laws that require VASPs to share originator and beneficiary info for qualifying transfers. In practice, it is messy.

• Interoperability is uneven. Different vendors, formats, and message triggers mean a VASP can be compliant at home but blind on inbound transfers.
• Supervision is thin. Only about 40 percent of jurisdictions with Travel Rule statutes have taken steps to test or enforce actual compliance so far (Comsure).
• Sunrise problem remains. Early adopters cannot always exchange data with late or partial adopters, so criminals route through the shadows.

Pro tip: If you are a VASP, map your top 25 counterparties by volume and test Travel Rule messaging both ways, including fallbacks for unregistered addresses and non-responsive VASPs. Do not wait for a letter from the supervisor.

How criminal networks actually move funds

Typologies get abstract fast, so let’s make it concrete. Here is a quick comparison of common patterns and what usually gives them away.

Typology How it works Red flags Offshore OTC layering Use thinly supervised OTC desks to net flows off exchange books, often in stablecoins. Repeated round sums, short settlement cycles, counterparties with no public footprint. Exchange chain hop Withdraw to a fresh address, bridge to another chain, re-deposit at a different venue. Rapid cross-chain moves, new wallets with immediate high velocity, mismatched KYC geographies. Merchant front Register as a payment processor or merchant aggregator to justify high inbound volume. Low real commerce footprint, recycled invoices, customer names that never repeat. P2P wash corridor Peer networks cycle funds through informal changers across several hubs. Concentrated time-of-day bursts, recurring handle names, identical memos or refs. Gambling and gaming loop Deposit on gambling sites, play minimal, withdraw to new addresses. High deposit to bet ratio, multiple small withdrawals to fresh wallets, region mismatches.

None of these, on their own, prove anything. But taken together, and at the scales cited by FATF, they sketch the pipeline that moved billions in recent cases (AML Intelligence).

Expect supervisors to ask for proof that you can detect and disrupt these flows, not just list the rules you follow.

What VASPs should do now

If you are running an exchange, wallet, broker, or custodian, the to-do list is not glamorous, but it is straightforward.

Harden the Travel Rule pipeline

• Run bilateral Travel Rule tests with your top counterparties. Track rejection and retry rates, message coverage, and false positives.
• Set clear fallback decisions for non-responsive counterparties: block, hold, or enhanced due diligence with time limits.
• Store message proofs. When an audit lands, screenshots and logs beat policy slides.

Turn risk scoring into decisions

• Do not stop at address risk. Score the relationship: venue risk, tool maturity, and past Travel Rule responsiveness.
• Escalate when velocity and geography do not match the profile, even if the onchain trail looks clean.
• Use sampling. Pull 50 high value transfers per month and hand review end to end.

Tighten OTC and cross-chain exposure

• Register or whitelist OTC counterparties. Require named traders, not just desk aliases.
• Flag withdrawals to new wallets that immediately bridge. Add a hold and a second factor for review.
• Document why you allowed exceptions. If it is not written, it did not happen.

Coordinate with supervisors before problems

• Send a quarterly memo on Travel Rule metrics, typology hits, and staffing. It shows you know your own shop.
• Share red flag patterns that hit often. You may get better clarity on how to handle them next time.

Mistakes to avoid:

• Assuming your vendor covers counterparties you have never tested.
• Letting legal own the narrative while ops lacks the logs and queries to back it up.
• Ignoring small tickets. Networks test you at 500 dollars before they send 500,000.

Signals for traders and funds

This is not financial advice, but there are practical things market participants can watch. Policy shifts hit liquidity before they hit headlines.

• Withdrawal friction at tier two venues. Extra holds and document requests often precede formal action.
• Stablecoin corridor noise. When compliance tightens in one hub, spreads widen in off-hours and P2P desks get busy.
• Counterparty outreach. If exchanges start asking you to validate Travel Rule data for inbound transfers, it is a sign enforcement pressure is up.
• Region specific alerts. Public advisories about high risk jurisdictions tend to be followed by more account reviews.

None of this means bans are coming. It does mean your operational calendar should include more compliance downtime, and your treasury playbook should plan for sponsor bank questions on large flows.

Policy knobs that could close the gaps

FATF does not write national law, but its signals drive what supervisors ask for. A few levers stand out.

• Mutual recognition for Travel Rule messaging. If two jurisdictions accept the same payload format and controls, VASPs can avoid duplicate work and fewer transfers fall through the cracks.
• Public counterparty registries. A simple, up to date list of licensed VASPs and their Travel Rule endpoints makes routing faster and safer.
• Risk based thresholds that reflect crypto reality. Set limits that catch high risk flows without forcing retail drips through enterprise onboarding.
• Clear guidance on DeFi touchpoints. Frontends, routers, and custody bridges need bright lines on where VASP obligations bite.
• Joint investigations on typologies cited by FATF. The cases out of Cambodia and Spain suggest where coordination pays off (AML Intelligence).

One more lever is boring but powerful: resourcing. Many supervisors simply do not have enough technical staff to test Travel Rule plumbing. Without that, the law on paper stays on paper.

What this means for crypto builders

If you are shipping wallets, bridges, or exchange infrastructure, expect these asks to show up in RFPs and diligence calls:

• Native Travel Rule support with multiple message networks and clear fallbacks.
• Audit grade logging. Every decision needs a machine readable trail.
• Chain analytics hooks that are explainable to non-analysts. Buttons that say why, not just red or green.
• Geofencing and sanctions controls that are easy to configure and test.

It is not glamorous, and it will not be in the demo day clip, but this is the plumbing buyers will pay for in the next 12 months. The FATF update is basically a shopping list for compliance buyers, and the 83 percent number is the tell that procurement cycles are starting (Comsure).

If you want more tracking like this, Crypto Daily covers the practical side of crypto policy and market structure without the fluff. You can drop in at Crypto Daily any time.

Frequently Asked Questions

What exactly is the Travel Rule in crypto?

It is a requirement for VASPs to transmit originator and beneficiary information for qualifying transfers, similar to what banks do for wire payments. The point is to help trace funds across borders and reduce blind spots when value hops between service providers.

Why does FATF say enforcement is lagging?

Passing a law is easier than making it work. Jurisdictions need supervisors, tech standards, and test programs. According to the July 2026 update, only about 40 percent of places with Travel Rule laws have started supervisory or enforcement actions to confirm compliance.

How are offshore gaps actually used by criminals?

They route through lightly supervised venues to create distance, then re-enter stricter markets after enough hops. Case studies in the FATF update include multi-billion dollar laundering schemes that took advantage of these seams between jurisdictions.

Does the Travel Rule apply to DeFi?

FATF focuses on service providers. If there is a natural or legal person offering exchange, custody, or transfer services, obligations likely attach. Purely software protocols are a gray area in some places, but frontends and custodial bridges can bring activity under VASP rules depending on local law.

What should exchanges do if a counterparty will not share Travel Rule data?

Have a written fallback. Many VASPs either block or hold such transfers and run enhanced due diligence. Document the decision and communicate the standard to users so there are no surprises.

Will tighter enforcement hurt liquidity?

Short term, some corridors may slow as controls tighten. Over time, clearer rules tend to support deeper institutional liquidity because counterparties can explain and evidence their compliance to banks and auditors.

How soon could we see more action?

There is no single date, but updates like the one FATF issued in July 2026 usually precede new guidance, joint actions, or audits in the following quarters as supervisors respond to high profile cases and adoption gaps.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.