RUSI warns UK crypto rules face FATF enforcement test in June

By Tom Whitfield

FATF assessors will visit the UK in June 2027, before the country’s mandatory crypto regime takes effect on October 25, 2027, according to a Royal United Services Institute report published Friday.

The London-based defense and security think tank’s taskforce called crypto a “material risk” for the UK and doubted the country could show adequate implementation when assessors arrive. The review will be the first UK mutual evaluation to consider crypto, with the UK’s FATF report due for agreement at the body’s February 2028 plenary.

What will FATF assess?

The Paris-based Financial Action Task Force sets global standards against money laundering and terrorist financing. Its mutual evaluations grade whether national rules work in practice, rather than merely confirming that laws and regulators exist on paper.

RUSI assembled the taskforce from experts in the private sector, law enforcement and civil society. It met in September, and the institute did not attribute its discussions to individual members. The group expects crypto enforcement to dominate the 2027 review and will meet again this month to examine trends from recent evaluations.

The June visit therefore arrives before the UK’s mandatory regime takes effect. RUSI’s central operational question is whether the Financial Conduct Authority and law-enforcement bodies can demonstrate adequate implementation before October 25, 2027.

The risk is already reflected in UK assessments. The City of London Police assesses that 66% of investment fraud in the UK involves crypto. The UK’s 2025 National Risk Assessment rated crypto money laundering high risk, up from medium in 2020.

The UK brought crypto firms under its money-laundering rules in 2020, and legislation passed in February created a statutory crypto regime. The Financial Conduct Authority set out which crypto activities it would regulate in April and finalized its rulebook in June, but the mandatory regime does not take effect until October 25, 2027.

The taskforce said the UK had moved more conservatively than Hong Kong, the European Union and Singapore. Its members were unanimous that FATF assessors would examine the gap between the transitional regime and adequate implementation during their June visit.

Where are the enforcement gaps?

The taskforce identified over-the-counter brokers as an early test. The National Crime Agency’s 2025 risk assessment estimated that these brokers are likely to launder hundreds of millions of dollars a year.

Police have also delivered a major result. The Metropolitan Police seized £5.5 billion, about $7.3 billion, in crypto linked to a Chinese professional money launderer sentenced in 2025. RUSI cited the seizure as evidence of what the UK criminal-justice system can achieve when it has sufficient capacity.

One taskforce member said the seizure had not been repeated in enough cases and that the UK had “barely scratched the surface” of crypto laundering. The group expects FATF to test whether enforcement results match the scale of the risk rather than rest on one headline case.

Could the rules push risk beyond the regulator?

The statutory regime resembles the EU’s Markets in Crypto-Assets Regulation and focuses on identifiable crypto firms. RUSI warned that this approach could push the highest-risk crypto activity outside the FCA’s perimeter, leaving law enforcement to trace assets the regulator cannot reach.

The taskforce cited Tether’s USDT as one example. A July 2025 Treasury report flagged extensive exploitation of the stablecoin by Russian-speaking laundering networks, while members doubted law enforcement had the capability and resources to keep pace.

That creates an operational split: the FCA supervises identifiable firms, while police must trace activity and assets outside the regulated perimeter. The taskforce’s warning concerns enforcement reach, not only the volume of rules.

Which resources could constrain enforcement?

RUSI praised the UK’s international cooperation, including Operation Destabilise, which targeted Russian-speaking networks converting street cash into crypto. It flagged the resourcing of the UK Financial Intelligence Unit and law enforcement’s economic-crime capacity as likely vulnerabilities.

FATF has been pressing countries more broadly on crypto enforcement. In July, it said nearly 93% of jurisdictions it surveyed had yet to apply its standards to qualifying DeFi platforms.

RUSI has previously argued that banning crypto privacy tools would be counterproductive. In August, it reported that North Korea increasingly laundered stolen crypto through criminal networks.

The next formal test arrives in June 2027, when FATF assessors will examine whether UK implementation matches the risk before the statutory regime starts on October 25, 2027.