Recognising the global shift toward digital finance, the government of Pakistan has recently initiated concrete steps to legalize cryptocurrency. This shift gained momentum following the Crypto Council’s resolution to develop a comprehensive regulatory framework aligned with international standards.
The decision comes at a time when the Financial Action Task Force (FATF), in its sixth targeted update published on 26 June 2025, has emphasized the urgent need for jurisdictions to implement robust Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) measures concerning Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs).
This FATF update serves as a pivotal guidepost for Pakistan as it endeavours to pose as a responsible participant in the global crypto ecosystem, echoing global expectations articulated in Recommendation 15 (R.15) and its interpretative note (INR.15), the bases for regulating this sector since 2019.
FATF’s latest report acknowledges progress made globally, including jurisdictions with materially significant VASP activity, those constituting approximately 98% of this market. The report reveals that 138 jurisdictions have been assessed under R.15 as of April 2025, of which only 1 jurisdiction is rated as fully compliant while 40 jurisdictions (29%) rated largely compliant, showing modest advancement from 2024.
FATF’s findings underline that despite significant regulatory developments, including Pakistan’s recent legal and institutional overtures, fundamental implementation gaps remain. FATF highlights the inability of many jurisdictions to identify natural or legal persons conducting VASP activities, lack of enforcement against offshore entities, and significant challenges in implementing Travel Rule which mandates the sharing of sender and receiver information during VA transfers. This Travel Rule has been legislated in 85 of 117 jurisdictions as of 2025, yet enforcement remains weak.
FATF particularly urges jurisdictions, including Pakistan, to formulate comprehensive risk assessments of VAs and VASPs. FATF’s 2025 report shows that only 76 percent of jurisdictions have completed such assessments. Despite this, a critical shortcoming remains in the operationalization of supervisory frameworks.
FATF calls for immediate actions such as licensing, risk-based supervision, and enforcement measures. In Pakistan’s case, the regulatory trajectory must include legislation that addresses both domestic and offshore VASP activity, integrating preventive mechanisms to mitigate risks related to money laundering (ML), terrorist financing (TF), and proliferation financing (PF).
The report also sheds light on emergent and growing risks. Democratic People’s Republic of Korea’s (DPRK) record-setting $1.46 billion theft from the VASP ByBit in 2025 and the subsequent laundering of funds through 125,000 Ethereum wallets exemplifies the scope of cross-border cyber exploitation.
Only 3.8% of these funds have been recovered, underlining the urgent need for enhanced asset recovery mechanisms. FATF’s report also reveals that US$51 billion in illicit activity from fraud and scams was conducted through virtual assets in 2024, and much of it involved stablecoins, which have grown to dominate the volume of on-chain illicit transactions.
FATF identifies the use of USDT on the Tron network as a preferred channel for criminal actors due to its transaction speed and anonymity-enhancing capabilities.
FATF’s recommendations for public authorities include five primary priorities. Firstly, jurisdictions must finalize ML/TF/PF risk assessments and implement mitigation strategies.
Secondly, jurisdictions must either fully regulate or clearly prohibit VAs and VASPs—with a caution that prohibition is often difficult to enforce effectively. Thirdly, regulatory frameworks must include licensing and identification mechanisms, including offshore VASPs. Fourthly, Travel Rule should be legislated and operationalized with urgency.
Lastly, regulators must monitor and address risks arising from stablecoins, DeFi arrangements, and fraud ecosystems involving AI-enabled frauds and unregulated wallets. For the private sector, FATF calls on VASPs to improve risk assessment capabilities, mitigate stablecoin-specific threats, and adopt measures that respond to scams such as address poisoning and pig butchering.
FATF also outlines its roadmap for the Virtual Assets Contact Group (VACG), which includes preparing targeted reports on DeFi, stablecoins, and offshore VASPs between October 2025 and June 2026. These reports will guide future regulatory calibrations.
The VACG is also tasked with maintaining the updated public table of jurisdictions with materially important VASP activity, which now includes nine additional non-FATF jurisdictions for 2025. FATF urges jurisdictions to designate unregulated VASPs as higher-risk and encourages adoption of 2021 updated guidance on a risk-based approach.
The current implementation status for Recommendation 15 shows improvement yet persistent challenges. Of the 138 jurisdictions assessed as of April 2025, 29% are rated largely compliant (up from 25% in 2024), 49% are partially compliant, and 21% remain non-compliant. Only one jurisdiction globally is rated fully compliant.
Within the Travel Rule domain, while 73% of jurisdictions have passed relevant legislation, only 41% have operationalized it through enforcement or supervision. FATF notes that the lack of coordination between jurisdictions remains a significant vulnerability given the borderless nature of VAs.
FATF’s annexed table reveals that countries like the Bahamas, Malta, and Luxembourg have achieved considerable implementation success. In contrast, countries such as Pakistan, which are in the process of formalizing legal and institutional measures, must accelerate their alignment with the FATF’s standards. As Pakistan advances toward regulating its crypto landscape, learning from these jurisdictions’ approaches especially around licensing, risk assessment, and enforcement will be essential.
Pakistan must address three immediate challenges for way forward. The first is technical: establishing clear and enforceable definitions for VAs and VASPs in domestic law that harmonize with FATF’s interpretive note.
The second is regulatory: building a risk-based framework that includes licensing requirements, identifies legal and natural persons operating VASPs, and implements the Travel Rule with enforceable supervision. The third is institutional: enhancing the capacity of regulators, law enforcement, and financial intelligence units to monitor, investigate, and prosecute crimes involving virtual assets.
Pakistan should also prioritize public-private partnerships with blockchain analytics firms, adopt cross-border cooperation protocols, and develop public registries for licensed VASPs. FATF’s support for technical assistance, as expressed in its engagement with VACG and Global Network, offers a valuable window for Pakistan to request targeted help in closing compliance gaps.
The government’s decision to legalize cryptocurrency is timely and strategically aligned with FATF’s global roadmap. However, without a technically sound and enforceable regulatory regime grounded in FATF’s Recommendation 15, Pakistan risks falling short of global compliance standards.
The country must now move swiftly to codify regulations, build institutional capacity, and participate in the international supervisory ecosystem for virtual assets. This will not only ensure FATF compliance but also position Pakistan as a credible and secure player in the global digital economy.
Copyright Business Recorder, 2025