FATF Targets Cryptocurrency Oversight and Scam-Compound Financing in October 2026 Plenary

The Financial Action Task Force (FATF) has announced a series of initiatives aimed at strengthening global oversight of virtual assets, disrupting the financial networks supporting online scam compounds and addressing persistent weaknesses in national anti-money laundering and counter-terrorist financing (AML/CFT) frameworks. The decisions followed the FATF Plenary held in Paris from 28 to 30 October 2026 and were highlighted by South Korea’s Financial Services Commission (FSC) on 2 November.

A central development is the launch of a targeted review of jurisdictions with significant virtual asset service provider (VASP) activity and outstanding weaknesses in implementing FATF standards. The initiative focuses on Recommendation 15, which addresses risks arising from new technologies and establishes expectations for the regulation and supervision of virtual assets and service providers.

The review will examine whether countries are effectively implementing requirements concerning VASP licensing and registration, supervision, anti-money laundering controls and the Travel Rule. The emphasis is on practical effectiveness rather than simply whether legislation and regulatory frameworks have been introduced. The FATF intends to assess whether national authorities can supervise providers effectively and whether controls are operating as intended.

Initial findings from the targeted review are expected in June 2027, with further findings scheduled for October 2027. These dates concern the FATF's review process and do not establish new compliance deadlines for financial institutions or cryptocurrency businesses.

The initiative reflects continuing concerns about uneven implementation of international standards across the virtual asset sector. While many jurisdictions have introduced licensing and registration regimes, weaknesses remain in supervisory capacity, enforcement and oversight of offshore providers. Differences between national frameworks can create opportunities for criminals to move funds through platforms and jurisdictions with less effective controls.

The FATF's July 2026 targeted update had already highlighted persistent implementation gaps, particularly in the supervision of virtual asset service providers and the application of the Travel Rule. The October initiative is intended to examine these issues more closely in jurisdictions where virtual asset activity is particularly significant.

South Korea is among the countries preparing to demonstrate the effectiveness of its domestic framework. Its implementation of Recommendation 15 was not assessed during the previous fourth-round mutual evaluation, and the authorities intend to use the new review to examine the operation of their regulatory arrangements ahead of the fifth assessment round.

The country's own regulatory reforms illustrate the direction of travel. In August 2026, the FSC announced measures intended to strengthen VASP registration requirements, customer due diligence and virtual asset transfer controls. The proposed changes include extending Travel Rule requirements to domestic transfers below the previous KRW 1 million threshold, subject to the relevant commencement provisions, as well as additional controls concerning overseas providers. These are South Korean measures and should not be confused with universal FATF transaction thresholds.

A second major development was the FATF's approval of a report examining financial flows into, through and out of scam compounds. These operations have become an increasingly significant form of organised crime, combining online fraud with complex financial arrangements designed to move and conceal illicit proceeds.

The report examines how scam compounds generate revenue, transfer funds and access financial services. Such operations frequently rely on networks of intermediaries, money laundering service providers, cryptocurrency channels and cross-border payment arrangements. The FATF's work seeks to improve understanding of these financial structures and support coordinated action against the networks that facilitate them.

The issue extends beyond financial fraud. International investigations have linked scam operations to human trafficking, forced criminality and organised crime. Individuals recruited or trafficked into scam compounds may be compelled to conduct online fraud against victims in other countries. This creates an important distinction between the organisers and beneficiaries of these operations and individuals who may themselves be victims of exploitation.

The FATF report was approved during the October Plenary, with publication scheduled for the following week. Its adoption should therefore be distinguished from the date on which the report becomes publicly available.

The Plenary also resulted in changes to the FATF's monitoring lists. Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco were removed from the list of jurisdictions under increased monitoring after the FATF recognised that they had made sufficient progress in addressing their agreed action plans.

Their removal means that they are no longer subject to the FATF's increased-monitoring process. It does not, however, establish that all financial crime risks have been eliminated or that financial institutions should automatically discontinue controls previously applied to individual customers or business relationships.

Following the changes, 18 jurisdictions remained under increased monitoring: Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, the British Virgin Islands and Yemen.

The FATF also maintained its separate calls for countermeasures in relation to North Korea and Iran, while Myanmar remains subject to enhanced due diligence proportionate to the risks identified. These categories have different implications and should not be treated as interchangeable. In particular, the FATF's call for countermeasures against North Korea and Iran is distinct from its enhanced due diligence approach to Myanmar.

Vietnam also remains under increased scrutiny. The FATF expressed concern about the country's limited progress in addressing outstanding deficiencies and indicated that further action could be considered if tangible improvements were not demonstrated by February 2027. The outstanding issues include virtual asset supervision, beneficial ownership transparency, suspicious transaction reporting, financial intelligence and the investigation and prosecution of money laundering.

The Plenary additionally adopted the fifth-round mutual evaluation reports for Mexico and the United States, with publication expected in December 2026. Discussions surrounding the evaluations highlighted the importance of effective supervision of designated non-financial businesses and professions, including lawyers and accountants, as well as reliable beneficial ownership information.

South Korea also used the meetings to highlight its experience in addressing online scams and improving cooperation between financial institutions, telecommunications companies and investigative authorities. Its Financial Intelligence Unit described domestic information-sharing arrangements and the importance of rapid intervention when suspicious transactions are identified. The Korean delegation also supported stronger international cooperation and the exchange of financial intelligence through the FATF network.

For financial institutions, the latest developments underline the need to assess whether existing AML/CFT controls adequately address risks associated with virtual assets, offshore providers and organised online fraud. Cryptocurrency exchanges and other VASPs should review their licensing and registration arrangements, customer identification procedures, Travel Rule controls and due diligence on counterparties. They should also ensure that decisions to permit, restrict or escalate transactions are supported by documented risk assessments.

Banks and payment providers with exposure to cryptocurrency businesses should consider the wider transaction chain, including the identity of counterparties, ownership structures, geographical connections and the economic purpose of transfers. The use of a regulated exchange does not, by itself, eliminate the risks associated with the source or destination of funds.

The developments concerning scam compounds also reinforce the importance of identifying connected transaction patterns rather than examining individual payments in isolation. Fraud proceeds may move through several accounts, payment providers, cryptocurrency wallets and jurisdictions before reaching their ultimate beneficiaries. Effective monitoring and information-sharing arrangements can help identify these connections and support timely intervention.

The October Plenary does not introduce an immediate, universal set of new obligations for every financial institution. Rather, it signals the FATF's intention to place greater emphasis on the practical effectiveness of virtual asset supervision and on disrupting the financial infrastructure supporting organised online fraud. For compliance teams, the priority is to ensure that emerging international standards and risk assessments are reflected in internal controls, while distinguishing between formal regulatory requirements and recommendations arising from the FATF's ongoing work.

By fLEXI tEAM