The Financial Action Task Force has called for faster intervention by crypto service providers and financial institutions to stop funds linked to scam compounds being moved beyond reach. New operational principles released on November 5 put early preservation of money and cooperation across borders at the centre of the response.

The FATF report says the first 24 to 72 hours after detection or reporting are particularly important for tracing and preserving assets. Providers receiving, holding or transferring the funds may be able to intervene before investigators have assembled a complete case.

Those interventions remain subject to domestic law, safeguards and reliable information. The report sets out operational recommendations, rather than creating a universal power for exchanges or stablecoin issuers to freeze funds.

Tracing a wallet is only part of the investigation

FATF warns against attributing a wallet to a scam network solely from activity visible on a blockchain. Investigators should document how they link addresses, identify an organisation or classify risk, using methods that can be tested and supported by evidence outside the blockchain.

That supporting material can include customer checks and Travel Rule information held by virtual asset service providers, records of conversion between conventional money and crypto, communications and corporate information. The aim is to connect apparently separate payments to the people and infrastructure behind an operation.

The report also asks investigators to look for funds pooled from several victims or campaigns. Shared wallets and intermediaries may reveal a wider laundering network that survives even when one scam site is shut down.

This is a different policy response from consumer warnings such as New Zealand's warning about crypto storage advertised as an alternative to banking. FATF is addressing the operational links between providers and authorities once suspicious flows are identified, as well as earlier opportunities to disrupt scams.

Fast holds need a lawful route

Available responses may include recalling or holding a payment, restricting an account or wallet, or temporarily preserving assets while formal freezing or restraint procedures follow. Where domestic law permits, action need not wait for final attribution, a completed investigation or the filing of a suspicious transaction report. Reporting duties still apply.

FATF says contact with an identifiable crypto service provider or centralised stablecoin issuer can help where that intermediary has customer information or technical control over the asset. The recommendation does not assume that every provider can stop every transfer.

For cross-border cases, the report calls for contact points and agreed procedures before an emergency arises. These should identify the legal authority for a request, who may make it, the level of evidence required and any provider-specific thresholds or information requirements.

Closing a suspicious account is not enough, FATF says. Relevant information should be retained and tracing or preservation considered before or alongside closure, so that activity is not simply displaced to a replacement account or company.

Canada's separate Bill S-8 proposal concerning crypto ATMs illustrates another policy approach to risks at the point where money enters crypto services. The FATF recommendations instead concentrate on connecting the wider financial trail and preserving funds across providers and jurisdictions.

India's complaint systems feature in the report

The report cites the Indian Cyber Crime Coordination Centre, or I4C, as an example of connected anti-scam infrastructure. It describes a financial-fraud reporting system linked to the National Cybercrime Reporting Portal that connects complaints with financial institutions and virtual asset service providers to support tracing and freezing.

It also describes Sahyog as supporting requests for information from virtual asset service providers, and Samanvaya as supporting links between cases across states. These are examples of existing Indian arrangements in the report, not new rules announced for India on November 5.

For victims, the report favours reporting channels that capture transaction and wallet details, communications and loss information, even when the person cannot identify the criminal network. Information should be retained when immediate recovery is impossible, so it can be used if funds later reach a provider or authority able to act.

FATF also cautions against judging success only by accounts closed or assets frozen. The test is whether losses are prevented, recovered money reaches victims and the criminal network loses capabilities it cannot readily replace. Evidence of lasting effectiveness remains limited and uneven, the report acknowledges.

In its November 5 announcement, FATF said it would work with public and private sector participants through February 2027 on solutions to cyber-enabled fraud. The next phase concerns how these responses can work at scale, rather than a promise that any individual crypto loss will be recovered.