Crypto compliance in 2026 is no longer waiting for rules. In the EU the MiCA transitional period ends on 1 July 2026, and most FATF members now have virtual asset laws on the books. The race that is still running is quieter: turning those laws into licences that exist in practice, supervision that actually inspects, and controls inside each business that would hold up if anyone looked. The FATF's own 2026 figures show that this part is lagging, and a lag in supervision is not the same thing as a lag in obligations.
Public debate still asks whether rules will come. The harder question for a crypto business is what to do in the years when the law is in force but the supervisor has not yet arrived.
Is crypto compliance still a question of new regulation?
Mostly not. The rulebook has been written. In the EU, the Markets in Crypto-Assets Regulation (MiCA) has applied to crypto-asset service providers since 30 December 2024, and its transitional period is closing. Globally, the FATF extended its standards to virtual assets years ago through Recommendation 15 (R.15), and the Travel Rule under R.16 applies the same payment transparency to crypto transfers that banks have lived with for decades.
The FATF's seventh targeted update on virtual assets, published on 16 July 2026, puts the legislative side in numbers: 91 of the 109 jurisdictions that answered the question have passed legislation implementing the Travel Rule, compared with 85 of 117 a year earlier (the two surveys had different respondent groups), and a further 11 report that implementation is under way. On paper, crypto compliance has caught up with the market.
The FATF's announcement of the report explains why that is not the end of the story: many jurisdictions are "yet to translate legal frameworks into effective supervision and enforcement in practice". That sentence is the subject of this column.
What did the end of the MiCA transition actually change?
It removed the last grey zone in the EU. The European Securities and Markets Authority set out the position in a statement of 17 April 2026: "The MiCA transitional period will officially expire across the EU on 1 July 2026. After this date, any entity providing crypto-asset services to EU clients without a MiCA licence will be in breach of EU law and must cease offering such services."
The statement is worth reading for what it asks of firms that are authorised, not only of those that are not. ESMA expects authorised providers to actively manage the migration of existing clients before the deadline and, in doing so, "to apply robust onboarding processes to ensure full compliance with applicable AML/CFT requirements". It also reminds the market that the ban on unauthorised third-country providers applies "in a business-to-business context" too.
National authorities are expected to verify wind-down plans, "take action against the unauthorised provision of crypto-asset services" and scrutinise client migration. ESMA places that action after the end of the transitional period. The legal status question now has an answer; the practical AML question is only starting.
What does the FATF 2026 update say about law versus practice?
It shows the gap from several angles, and each one points the same way.
- Technical compliance with R.15. Of 149 jurisdictions assessed as of April 2026, 51 are rated largely compliant, and only one is fully compliant. The rest are partially or not compliant.
- Licensing on paper and in practice. Among 130 respondents that do not prohibit virtual asset service providers, 95 require them to be licensed or registered, but only 76 have actually licensed or registered one. In 2025 the survey also counted 76, out of 117 respondents. In assessments, 59 of 149 jurisdictions satisfactorily require licensing or registration.
- The Travel Rule in supervision. Of the 91 jurisdictions with Travel Rule legislation, 55 have not yet issued findings or directives or taken enforcement or other supervisory action on Travel Rule compliance. The FATF itself calls the persistent gaps "a serious concern".
The report notes that survey answers and formal assessments do not always match. Even with that caveat, the direction is clear. Legislation is ahead of licensing, licensing is ahead of supervision, and supervision is ahead of enforcement.
Why is the crypto compliance race so quiet?
Because the signals that usually make compliance loud are missing. Enforcement actions, fines and inspection findings move boards and budgets. Where a supervisor has the law but not yet the capacity, those signals are rare, and a business can read the silence as safety.
That reading is, in our view, the most expensive mistake available in crypto compliance right now. Three things make it risky.
- Supervision looks backwards. When an inspection arrives, it asks what the firm did while the rules were in force, not what it planned to do once someone checked. A year of weak screening does not disappear because nobody asked about it at the time.
- Counterparties arrive first. Banks, payment partners and other exchanges run their own due diligence on crypto businesses, and they may ask for the policy, the risk assessment and the screening records long before a regulator does.
- Criminals look for the gaps. The FATF President's statement with the 2026 update describes criminal networks "taking advantage of gaps in countries' frameworks and uneven implementation of FATF Standards across jurisdictions". A business in a quiet jurisdiction is exactly where those flows try to land.
Where is the crypto compliance gap widest?
The 2026 update names the areas where lagging implementation matters most, and where a single business's controls do the most work.
- Stablecoins. According to the FATF, "most identified on-chain illicit activity now involves stablecoins", and the update describes a financial services conglomerate with links to criminal networks developing a proprietary stablecoin "designed to resist freezing and asset seizure".
- Unhosted wallets and peer-to-peer flows. Transfers between unhosted wallets never pass through a provider that would collect Travel Rule information, so the on-chain record is often the main evidence available.
- Offshore providers. Jurisdictions report difficulty mitigating the risk of providers that serve their residents from elsewhere, and the FATF asks regulated firms to detect accounts used by offshore providers that misrepresent themselves as retail users.
- DeFi, bridges and cross-chain tools. Only four jurisdictions have imposed licensing or registration requirements on DeFi arrangements, and just two have licensed or registered one in practice, which leaves the exposure to be managed by the regulated firms that interact with them.
None of these gaps closes because a law was passed. Each is closed, or left open, by what a regulated business checks before accepting funds and keeps watching afterwards.
What does FATF now expect from the private sector?
The recommendations to businesses are specific. The 2026 report asks virtual asset service providers, including stablecoin issuers and qualifying DeFi arrangements, to make sure that their AML/CFT controls, "including KYC, wallet screening, blacklisting, and, where appropriate, whitelisting mechanisms as well as freezing and blocking capabilities adequately mitigate identified risks and can be swiftly updated to respond to emerging ML/TF/PF trends and typologies".
On monitoring, providers are asked to apply enhanced due diligence to higher-risk unhosted wallet activity, to "identify suspicious patterns in VA transactions and detect rapid transfer of VAs using transactions monitoring and blockchain analytics tools", to run enhanced due diligence on offshore providers and to assess exposure to protocols, bridges, mixers and cross-chain tools.
Read together with the supervision figures, the message for crypto compliance is plain: the standard-setter is not waiting for every supervisor to catch up. A business that meets this description now is ahead of its inspection; one that waits is betting the inspection will be lenient about the past.
How can a business stay ahead of its supervisor?
By running crypto compliance as if the inspection were already scheduled: a short list done consistently, not a long list promised.
- Write the risk assessment down. Customers, products, channels, jurisdictions, and the stablecoin and unhosted wallet exposure the FATF flags.
- Screen before value moves. Check the sending or receiving address before funds are credited or released, not after the fact.
- Keep monitoring. Counterparty addresses change risk over time; a clean result last quarter is not a clean result today.
- Keep the record. For each decision: what was checked, when, what came back and who decided. Under R.11, records are kept for at least five years.
- Know who your counterparties are. For EU services, ESMA points to its interim MiCA register as the place to check whether a provider is authorised.
- Treat the Travel Rule as its own workstream. Exchanging originator and beneficiary information with other providers is a separate function from address screening, and a licensed firm has to cover both.
Where does AMLOfficer fit, and where does it not?
AMLOfficer covers the on-chain screening and monitoring part of that crypto compliance list. It is an aggregator of four AML providers in one interface, including BitOK, Global Ledger and Beosin. The providers you select run in parallel, and each returns its own risk level out of four (Low, Medium, High and Severe) with the risk categories it found, so a disagreement between providers is visible in the report. Monitoring runs 24/7: the triggers are already set up on the providers' side, and you only choose which providers watch an address; checks run from the web application, the Telegram mini app and the AML API. For ongoing coverage, see transaction monitoring.
The boundaries matter as much in a column about regulation as anywhere. AMLOfficer delivers the risk signal; the decision to accept, hold or refuse, and any freeze, stays with your business. It does not perform KYC, it is not a Travel Rule solution, it does not replace a legal or compliance team, and no screening result is a licence or a regulatory opinion. For a view of how the platform is organised, see the AML compliance software overview, or run an AML check on an address your business already deals with.
MiCA, FATF and crypto compliance: common questions
What does ESMA expect from authorised firms after the MiCA deadline?
In its statement of 17 April 2026, ESMA expects authorised providers to manage the migration of existing clients and to apply robust onboarding processes to ensure full compliance with AML/CFT requirements. National authorities are expected to act against unauthorised crypto-asset services.
What is the FATF targeted update on virtual assets?
It is the FATF's yearly review of how jurisdictions implement Recommendation 15 on virtual assets. The seventh update, published on 16 July 2026, covers licensing, supervision, the Travel Rule and emerging risks such as stablecoins.
How many jurisdictions have implemented the Travel Rule?
In the FATF's 2026 survey, 91 of 109 jurisdictions reported passing Travel Rule legislation, and 11 more reported that implementation is under way. Of the 91, 55 had not yet taken supervisory or enforcement action focused on Travel Rule compliance.
If supervision is weak where we operate, can crypto compliance wait?
It is a risky bet. Supervision assesses what a firm did while the rules applied, and banks and partners run their own due diligence. Obligations apply from the day the law does, not from the first inspection.
What does FATF expect crypto businesses to do now?
The 2026 report asks providers to understand their own risk, keep KYC, wallet screening and blacklisting controls up to date, apply enhanced due diligence to higher-risk unhosted wallet activity and offshore providers, and use transaction monitoring and blockchain analytics to detect suspicious patterns.
Does AMLOfficer make a business compliant with MiCA or FATF standards?
No. AMLOfficer provides on-chain screening and monitoring with several providers and a record of each check. Licensing, KYC, the Travel Rule and the compliance decisions themselves stay with the business and its advisers.
