FATF calls for global action as DeFi growth heightens risks

The Financial Action Task Force (FATF) is urging governments and the private sector to strengthen oversight of decentralised finance (DeFi), warning that the sector’s rapid growth is creating new opportunities for money laundering, ransomware, fraud and proliferation financing.

In a report, the global anti-money laundering watchdog said DeFi’s expansion, coupled with increasing institutional participation, has heightened risks to the international financial system. While decentralised technologies offer financial innovation, features such as permissionless access, automated smart contracts, pseudonymity and cross-border reach are increasingly being exploited by criminal networks.

FATF President Giles Thomson said regulators must prevent emerging technologies from becoming safe havens for illicit finance while allowing legitimate innovation to continue.

“We must stop emerging technologies being exploited by criminals trying to launder dirty money, whilst also supporting their wider adoption for legitimate purposes. Today’s report sets out practical recommendations to help jurisdictions and the private sector strengthen their defences against criminal abuse of DeFi arrangements whilst supporting responsible financial innovation,” Thomson said.

He added that “strong co-operation and information sharing, particularly through public-private partnerships, is critical to sharpening the global response to this emerging technology and protecting the integrity of the international financial system.”

According to the report, by May 2026, the total value locked (TVL) in DeFi protocols reached $86.644 billion, an increase of approximately 85 per cent compared to 2023. It says that professional investors and regulated entities increasingly use DeFi for cross-border payments, transaction transparency, and easy access to global customers. However, the report warns that this growth “amplifies the risk that DeFi may be misused to co-mingle illicit funds with legitimate assets”.

The FATF noted that DeFi activity remains highly concentrated, with North America and Europe accounting for approximately 60 per cent of global transactions, while the Middle East and Africa together contribute less than 10 per cent. It added that the 20 largest DeFi protocols account for more than 70 per cent of total activity, making them a priority for regulatory oversight.

The report says that illicit actors exploit “pseudonymity, permissionless access, smart contract automation, composability and cross-border reach” to facilitate “rapid, complex and opaque financial transactions.” Professional money laundering networks employ “sophisticated layering techniques designed to obscure transaction trails and bypass centralised exchanges.”

The report highlights the April 2026 exploit of Drift Protocol, in which DPRK-linked actors stole $285 million in approximately 12 minutes. The stolen assets were then “intentionally comingled with large pools of unrelated or legitimate assets to further conceal their origin.”

Separately, FATF said two DPRK-linked cyberattacks on DeFi platforms in April 2026 generated more than $570 million in proceeds, accounting for around 76 per cent of all annual virtual asset hacking losses. The report also cites the SafeMoon Token Scheme and the Forsage case as examples of criminals exploiting seemingly legitimate DeFi platforms while secretly retaining control over key technical functions.

Although many projects market themselves as decentralised, the FATF found they often “retain identifiable controllers who benefit from the underlying business activity.” Indicators of control include governance token concentration, administrative privileges, upgrade authority, significant economic benefits and influence over protocol development.

The report identifies three categories of DeFi arrangements: those with identifiable controllers, those where controllers are obscured by pseudonymity or other factors, and genuinely decentralised protocols. It clarifies that FATF Recommendation 15 applies to the first two categories whenever a natural or legal person exercises “control or sufficient influence” over the arrangement.

The FATF recommends that authorities use blockchain analytics tools to trace transactions across multiple blockchains and map relationships between wallets, entities and protocols.

The report further states that financial institutions and virtual asset service providers interacting with DeFi arrangements should comply with FATF recommendations covering new technologies, customer due diligence and correspondent banking. Where compliance cannot be achieved, they should refrain from engaging with those DeFi arrangements.