FATF urges action to respond to emerging risks from Decentralised Finance

Paris, 21 July 2026 - In a new report, published today, the Financial Action Task Force (FATF) highlights the rapid growth of decentralised finance (DeFi) and how its unique features are being increasingly exploited by illicit actors, including fraudsters, ransomware operators, professional money laundering networks and proliferation financing actors.

Despite estimates indicating rapid growth in global use*, the FATF’s Targeted Report on Regulatory Challenges from DeFi highlights that almost 93% of the reporting jurisdictions (132 of 143) that responded to the Survey on the implementation of Recommendation 15 have not yet implemented the FATF Standards in relation to qualifying DeFi arrangements, and just two of 142 jurisdictions have actually licensed or registered a DeFi arrangement in practice**.

While the underlying decentralised technology in DeFi protocols offers opportunities for financial innovation, features such as permissionless access, rapid execution through automated smart contracts, cross-border reach, and the ability to conduct transactions without disclosing the user’s identity, can facilitate fast, complex and opaque financial transactions that can be exploited by criminals.

Illicit activity linked to DeFi arrangements often involves the use of sophisticated techniques such as chain-hopping, cross-chain bridges, decentralised exchanges, mixers and governance manipulation, enabling the layering and co-mingling of illicit funds within legitimate financial flows.

The report highlights examples of criminal exploitation of DeFi platforms including:

• Proliferation Financing: In April 2026 alone, two major cyberattacks on DeFi platforms attributed to the DPRK accounted for approximately 76% of all annual losses from virtual asset hacking incidents, with combined proceeds of over USD 570 million.
• Fraud and scams: the SafeMoon Token Scheme and the Forsage Case illustrate how criminals can exploit seemingly legitimate DeFi platforms to defraud investors and misappropriate funds.  By secretly retaining control over key technical functionalities of these platforms, perpetrators were able to manipulate operations and divert substantial amounts of virtual assets for personal gain.

In line with the FATF’s risk-based approach to fighting financial crime, the report underlines that jurisdictions with more significant DeFi activity should allocate more resources to understanding, supervising, and developing approaches to mitigate the illicit finance risks associated with DeFi arrangements.

Available data indicates that DeFi activity is currently highly concentrated, with North America and Europe accounting for approximately 60% of global transactions, whereas the Middle East and Africa together are estimated to contribute to less than 10%.

The top 20 DeFi protocols are estimated to represent more than 70% of total DeFi activity. Regulatory and supervisory efforts should take these market asymmetries into account and prioritise engagement with the largest and most systemically relevant DeFi protocols and associated stakeholders.

The report sets out key recommendations for jurisdictions, DeFi arrangements and financial institutions and VASPs. It also includes case studies of good practice, such as how jurisdictions have:

• assessed the risks linked to DeFi arrangements;
• advanced efforts to develop an appropriate and proportionate regulatory framework for DeFi arrangements, including through smart contract certification;
• enhanced domestic co-operation between financial regulators and law enforcement authorities to support the supervision of DeFi arrangements;
• conducted regulatory thematic workshops and established public-private partnerships to promote understanding of risks and compliance in DeFi and advance asset tokenisation through open and interoperable network standards.
• set up a dedicated cryptocurrency investigation team to analyse and investigate the misuse of DeFi protocols by illicit actors;  
• and shared information between financial intelligence units to detect cross-border DeFi-related risks, including through the Egmont Secure Web and FIU.net.

Notes to editors:

* According to DeFiLlama, Total Value Locked (TVL) stood at USD 86.644 billion as of 10 May 2026, compared with USD 46.86 billion on 10 May 2023.

** Findings are the result of the FATF’s survey on implementation of FATF Recommendation 15, published on 16 July 2026 in the FATF’s Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs.