The Financial Action Task Force (FATF) has published a targeted report on decentralised finance (DeFi). The report finds that 132 of 143 surveyed jurisdictions have not implemented FATF standards for qualifying DeFi arrangements, with only 2 having licensed or registered such arrangements in practice. DeFi's total value locked reached USD 86.64 billion in 2026, an increase of approximately 85% since 2023, heightening its exposure to money laundering, terrorist financing and proliferation financing risks. The report finds that DeFi's unique features are increasingly exploited by fraudsters, ransomware operators, professional money laundering networks and proliferation financing actors, including Democratic People's Republic of Korea-linked groups whose two major attacks in April 2026 accounted for approximately 76% of annual virtual asset hacking losses. The report clarifies that FATF's Recommendation 15 applies where identifiable persons exercise control or sufficient influence over a DeFi arrangement, and sets out on-chain and off-chain indicators to assist jurisdictions in making that determination. It distinguishes three categories of arrangements: (1) centralised; (2) centralised where controllers cannot be readily identified and (3) truly decentralised. Financial institutions and virtual asset service providers interacting with DeFi arrangements are required to comply with Recommendations 10 and 13, and must refrain from interacting where those obligations cannot be met.