FATF Opens Crypto Hub Review With No Names and a June 2027 Deadline

The world's money laundering watchdog is auditing crypto hubs. It won't say which ones. The findings arrive in June 2027.

That silence is the story. FATF published the review without a jurisdiction list, and the omissions matter more than anything in the announcement. Markets price names. Regulators price uncertainty. Guess which one a compliance officer at a mid-tier exchange can actually act on.

The timeline

Start in June 2019. FATF rewrote Recommendation 15 and told member states to license virtual asset service providers, supervise them, and pass the travel rule. Two years later, in October 2021, the guidance expanded to cover DeFi, NFTs and stablecoins. Then came the targeted updates. 2023. 2025. Each one reported the same structural gap. Legislation moves. Enforcement lags.

The travel rule itself is unglamorous. Transfers above USD/EUR 1,000 carry originator and beneficiary data. Counterparty wallets above that line get verified. It's plumbing, and plumbing is where the failures show up.

The numbers are consistent across those updates. Roughly three quarters of surveyed jurisdictions have travel-rule laws on the books. Fewer than a third have begun enforcing them against real flows. The data is unambiguous. Passing a statute is easy. Staffing a supervisor is expensive.

Now the fifth round of mutual evaluations, which opened in 2024 and runs through 2032, folds crypto into the wider country scorecard on a full effectiveness basis. That's the machinery behind this review. Peer reviewers instead of self-assessments. Evidence from supervisors instead of press releases from trade bodies.

And the clock. Plenary sessions are already set for February, June and October 2027. The crypto findings land in the middle slot. Any jurisdiction hoping to clean up before a public grade gets roughly seven months from today to do it.

The impact

First order effect. Nobody knows if they're on the list, so everyone with a licence at risk has to assume they're. That's a budget problem before it's a market problem.

Second order effect. The vendors win. Chain analytics, travel-rule messaging, wallet screening, all of it picks up demand from fear alone. You don't need a naming to sell software into a review you can't see.

Third, and this is where it gets structurally interesting. Correspondent banking. Lenders already treat VASP exposure as a de-risking trigger. A pending FATF review hands a compliance committee a reason to write no in a credit memo, and writing no costs nothing. So the funding basis for exchanges domiciled in small jurisdictions widens. Basis points, nothing dramatic, but it compounds quarter after quarter.

According to on-chain flows, deposit routing reacts to regulatory headlines within 72 hours, and it usually reacts sideways. Users shuffle between venues inside the same jurisdiction. They don't leave the asset. Worth remembering for anyone bracing for a price shock from a document with no names in it.

History rhymes here. The 2019 rewrite didn't crash anything. It repriced who could keep a bank account. The 2021 DeFi guidance didn't crash anything either. It pushed yield products offshore. Both times the trading layer adapted and the plumbing layer paid.

So who loses? Small jurisdictions with real volume and thin supervisory capacity. They get graded on effectiveness they can't staff. Who wins? Jurisdictions that built registries early, and the large venues that can absorb audit costs because they priced this in two cycles ago.

Here's the uncomfortable part. Some of the loudest crypto-friendly regimes are the most exposed. Friendly to capital isn't the same as equipped to supervise it. A registration portal isn't a supervisory programme, and FATF grades the second thing.

The outlook

Watch February 2027. The plenary outcome language will hint at scope. Cross-reference any jurisdiction mentioned in the effectiveness discussion against the volume table. That's your shortlist.

Then June 2027. Two possible outcomes. Public findings naming jurisdictions with remedial action plans, or a general statement with case studies and no names attached. The second is worse for markets. Ambiguity gets priced at the worst case by every risk committee that has to sign something.

After that comes the grey list. Placement isn't a fine. It's a signal that triggers enhanced due diligence across every counterparty at once. Not speculation. Arithmetic. A grey-listed jurisdiction watches correspondent relationships get repriced and stablecoin rails go cautious. That mechanism bites harder than any enforcement action on the books.

One more thing. DeFi. The 2021 guidance already extended expectations to protocols and the 2025 updates kept the pressure on. If a jurisdiction hosts the front end, the foundation, or a meaningful share of the validator set, a reviewer can construct a supervision claim. Does anyone seriously believe the we're-just-code defence survives an effectiveness interview? It hasn't survived one yet.

So the practical read for the next seven months. If you operate somewhere with a registry and no supervision staff, treat June 2027 as a hiring deadline, not a lobbying one. Compliance capacity is the only thing a peer reviewer can count.

FATF hasn't named the hubs. Every hub should assume it's on the list anyway. That's cheaper than being surprised.