FATF VASP Targeted Update July 2026: What Accounting Firms and CFOs Must Act On Now
On 16 July 2026, the Financial Action Task Force published its latest targeted update on how jurisdictions and virtual asset service providers are implementing the FATF Standards on Virtual Assets and VASPs. Alongside the report, FATF refreshed its scorecard table tracking Recommendation 15 implementation across FATF member jurisdictions and those with materially significant VASP activity. For accounting firms, auditors, and CFOs with digital asset exposure, this publication is an active compliance signal that demands a structured response.
What FATF Has Published and Why It Matters Now
The report, formally titled Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers, is part of FATF's ongoing monitoring cycle. These updates are not routine housekeeping. They feed directly into the mutual evaluation process and influence how jurisdictions are rated on technical compliance and effectiveness. A poor showing in the underlying data can accelerate a jurisdiction's move to enhanced follow-up or, in more serious cases, the FATF grey list.
The Recommendation 15 Scorecard
Recommendation 15 is the FATF standard that requires countries to regulate and supervise VASPs for AML and counter-terrorist financing purposes, applying the same risk-based approach required of other financial institutions. The updated scorecard table maps the concrete steps taken by FATF member jurisdictions and those with material VASP activity toward meeting that requirement.
The scorecard is granular. It distinguishes between jurisdictions that have enacted legislation, those that have issued regulations but not yet commenced supervision, and those that remain at an earlier stage. For compliance professionals advising clients operating across borders, the table is a primary reference point when assessing the regulatory environment in each market where a client holds a licence or routes transactions.
Japan's Position and the FSA's Role
Japan's Financial Services Agency published this update on its website, signalling the FSA's intent to keep domestic stakeholders informed of the international standard-setting context. Japan has long held a relatively advanced position on VASP regulation, having introduced registration requirements for crypto asset exchange service providers under the Payment Services Act. The FSA's decision to formally announce the FATF publication reflects the agency's view that Japan's own compliance trajectory is directly bound to the FATF monitoring cycle.
For firms operating in Japan or servicing Japanese-domiciled clients, the FSA's public engagement with this report is a reminder that FATF findings will likely inform forthcoming supervisory priorities and any revisions to FSA guidance on AML obligations for crypto businesses.
AML and KYC Implications for Accounting Firms and Auditors
Accounting firms providing outsourced compliance, audit, or advisory services to VASP clients carry real exposure when FATF signals implementation gaps. The targeted update creates several concrete tasks.
Reassess the Risk Profile of Each VASP Client
Firms should map each VASP client to its home jurisdiction and check where that jurisdiction sits on the updated Recommendation 15 scorecard. A client licensed in a jurisdiction that has not yet completed legislative transposition of FATF standards carries a higher inherent AML risk profile than one operating under a fully supervised regime. This affects the firm's own client due diligence obligations and the risk rating it assigns to that engagement.
When the risk profile changes, engagement terms, documentation standards, and escalation protocols should be reviewed accordingly. This is not a theoretical exercise. Accounting firms and their partners carry professional liability if they continue servicing high-risk clients without updating their own AML procedures to reflect the changed environment. FATF's seventh targeted update on crypto compliance set the baseline for that analysis, and this July 2026 report extends it.
Travel Rule and Transaction Monitoring Obligations
A recurring focus of FATF's VASP monitoring is the Travel Rule, the requirement that originating VASPs pass originator and beneficiary information to the receiving institution for transfers above threshold amounts. The targeted update cycle tracks whether jurisdictions have implemented the Travel Rule in binding law and whether VASPs are operationally compliant.
For auditors reviewing a VASP client's compliance framework, the FATF update provides a benchmarking context. If a client is operating in a jurisdiction the scorecard identifies as having incomplete Travel Rule implementation, auditors should examine whether the client has adopted voluntary compliance measures, documented its approach, and considered the counterparty risk posed by receiving VASPs in other jurisdictions with weak implementation.
DeFi and Unhosted Wallets Remain on the FATF Agenda
FATF has consistently maintained that VASPs with centralised control over ostensibly decentralised protocols remain subject to Recommendation 15. Accounting firms advising clients involved in decentralised finance structures should treat the scorecard update as a trigger to revisit whether any product or service offered by those clients has acquired characteristics that bring it within the VASP definition under the relevant jurisdiction's law. FATF's guidance on centralised elements in DeFi as regulated VASPs remains the authoritative reference for that analysis.
CFO-Level Considerations: Licensing, Counterparty Risk, and Group Reporting
CFOs at digital asset businesses face a distinct set of pressures when FATF publishes a targeted update. The scorecard is increasingly referenced by institutional counterparties, banking partners, and investors during due diligence. A VASP operating in a jurisdiction that scores poorly may find it harder to maintain correspondent banking relationships or to onboard institutional clients who carry their own AML obligations.
Licensing Strategy and Jurisdiction Selection
If a VASP is evaluating where to establish or expand its regulatory footprint, the updated Recommendation 15 scorecard is a useful input. Jurisdictions that have completed full legislative implementation and are subject to active supervision are generally lower risk from a banking relationship perspective, even if the regulatory burden is higher. CFOs should ensure their compliance teams have reviewed the scorecard and documented how it has informed any jurisdiction selection decisions made during the current financial year.
Group AML Policies and Subsidiary Oversight
For groups with VASP subsidiaries in multiple jurisdictions, the FATF update is a prompt to check whether group-wide AML policies remain adequate in light of any scorecard changes. Where a subsidiary operates in a jurisdiction that has moved backward on implementation, the group may need to impose enhanced controls at the subsidiary level and ensure those controls are documented in the group's own AML risk assessment.
CFOs should also consider the financial statement disclosure implications. If a material subsidiary is licensed in a jurisdiction newly flagged as having significant implementation gaps, the group may face disclosure obligations relating to regulatory risk in its financial statements, depending on the applicable accounting standards and the materiality of the exposure.
Practical Next Steps for Compliance Teams
The FATF publication is available directly from the FATF website. Compliance teams should work through a structured checklist when responding to this type of update.
Recommended Actions
First, locate the updated Recommendation 15 scorecard table and identify every jurisdiction relevant to the firm's or client's operations. Second, compare the current scorecard position against the previous iteration to identify any changes. Third, update internal AML risk assessments and client risk ratings to reflect any changes. Fourth, document the review and the rationale for any risk rating adjustments. Fifth, where counterparty VASPs are involved, assess whether those counterparties are licensed in jurisdictions that score adequately on the scorecard and flag any gaps to senior management.
For firms using digital asset accounting software to manage transaction flows and produce AML-relevant records, this is also a good moment to verify that the software is capturing the data points required for Travel Rule compliance and that the audit trail is complete and exportable for regulatory review. Robust crypto bookkeeping software that supports multi-jurisdiction compliance workflows can significantly reduce the manual burden of this process.
Broader Context: The FATF Monitoring Cycle and Its Escalation Logic
FATF's targeted updates on VASPs sit alongside the standard mutual evaluation process. Countries that consistently score poorly on Recommendation 15 in targeted updates are more likely to face accelerated follow-up requirements in their mutual evaluations. In extreme cases, persistent non-compliance can lead to listing on FATF's grey list, which carries significant reputational and operational consequences for any financial institution or VASP operating in that jurisdiction.
Understanding this escalation logic matters for risk professionals. It means that a jurisdiction scoring as partial or non-compliant today may face formal FATF action within the next evaluation cycle. Businesses and their advisers should model that scenario when assessing medium-term regulatory risk, rather than treating today's scorecard as a static snapshot.
For accounting firms advising clients in the Asia-Pacific region, Japan's active engagement with the FATF process is also relevant context. The FSA's formal announcement of the FATF publication signals that Japanese regulators are watching implementation trends closely, both domestically and in the markets where Japanese-licensed VASPs operate. Compliance programmes that align with FATF standards are, in practice, aligning with what the FSA will expect to see in its own supervisory reviews.
FAQ
What is the FATF Recommendation 15 scorecard?
The scorecard is a table published by FATF that tracks the steps taken by FATF member jurisdictions and jurisdictions with significant VASP activity toward implementing Recommendation 15. Recommendation 15 requires countries to regulate and supervise VASPs for AML and counter-terrorist financing purposes. The table distinguishes between jurisdictions at different stages of legislative and supervisory implementation.
How often does FATF publish targeted updates on VASPs?
FATF has published these targeted updates periodically as part of its ongoing monitoring of how jurisdictions are translating the FATF Standards on Virtual Assets into domestic law and practice. The July 2026 report is the latest in that series. The frequency reflects FATF's view that the VASP sector is evolving rapidly and requires closer-than-usual monitoring between formal mutual evaluations.
What does this mean for accounting firms that have VASP clients?
Accounting firms should review the updated scorecard to assess the regulatory environment in each jurisdiction where their VASP clients operate. If a client's home jurisdiction scores poorly, the firm should consider updating the client's risk rating, reviewing engagement terms, and ensuring that its own AML procedures reflect the heightened risk. The update is also relevant when conducting AML audits or compliance reviews for those clients.
How does the FATF update affect CFOs at digital asset businesses?
CFOs should treat the scorecard as an input into licensing strategy, counterparty risk assessment, and group AML policy reviews. Banking partners and institutional investors increasingly reference FATF compliance data during due diligence. A poor jurisdiction score can affect access to correspondent banking and the ability to onboard institutional clients. CFOs should also consider whether any scorecard changes require updated regulatory risk disclosures in financial statements.
Where can compliance teams access the full FATF report?
The full report is available from the FATF website. Japan's FSA has also published a formal announcement linking to the report, which is accessible via the FSA's international relations section at the URL referenced below. Compliance teams should access the primary FATF document directly rather than relying on summaries.
Source: Japan Financial Services Agency