TL;DR: FATF’s new asset recovery guidance says more than 80% of jurisdictions are still operating at low or moderate effectiveness, while Chainalysis says over $75 billion in on-chain balances is linked to criminal activity, underscoring a large recovery gap and a growing role for virtual assets. The practical shift is from ad hoc seizure to lifecycle governance, tracing, custody, and liquidation controls.
At a glance
What this is: FATF’s new asset recovery guidance reframes virtual assets as a distinct recovery class and calls for end-to-end lifecycle controls from tracing through liquidation.
Why it matters: For identity and security practitioners, it shows how recovery depends on governance, custody, and operational readiness, not just detection, especially when digital assets can move quickly across controlled platforms.
Context
Asset recovery is a governance problem as much as an enforcement problem. If jurisdictions cannot identify, control, and dispose of assets consistently, seizure efforts become fragmented and recovery outcomes depend on local capacity rather than policy design. Virtual assets intensify that challenge because they combine fast-moving value with technical custody mechanics that many teams do not train for.
The FATF guidance addresses that gap by treating virtual assets as part of the broader seizure lifecycle rather than as an exception. That matters for practitioners because the same controls that govern access, custody, evidence handling, and disposition in other high-risk environments now need to extend into crypto investigation workflows and public-private response models.
Key questions
Q: What breaks when virtual asset recovery is treated like traditional asset seizure?
A: Recovery breaks when authorities assume digital control works like physical possession. Virtual assets depend on keys, custodians, issuers, and blockchain evidence, so the seizure process must preserve chain of custody, prove control transfer, and anticipate cyber risk during holding and liquidation.
Q: Why does blockchain analytics matter for virtual asset seizures?
A: Blockchain analytics turns public ledger activity into traceable, explainable evidence that investigators can use to follow funds, cluster addresses, and support seizure decisions. It matters because recovery depends on both finding the asset and proving the path to it in a way that can stand up in court.
Q: What are the signs that seized virtual asset custody is failing?
A: Warning signs include undocumented transfers, unclear approval paths, reliance on ad hoc custodians, missing audit trails, and liquidation decisions made without attention to market liquidity. If access is not tightly authorised and every movement is not traceable, the custody process is already outside control.
Q: Which parts of FATF guidance should agencies prioritise first for virtual assets?
A: Agencies should prioritise first-contact recognition, legal authority for seizure and disposal, and operational capability to trace and secure assets after seizure. Those three areas create the biggest gap between policy intent and actual recovery outcomes, especially where virtual assets enter cases unexpectedly.
Technical breakdown
Why virtual asset recovery needs lifecycle governance
Asset recovery breaks when authorities treat seizure as a single action instead of a governed process. FATF’s guidance spans policy, investigation, seizure, confiscation, return, and liquidation because each stage has different evidentiary, custody, and legal requirements. Virtual assets make that more visible: the recovery path can involve private keys, custodial exchange accounts, or issuer-level freezing mechanisms, each with different operational dependencies. The key technical point is that control over the asset is not the same as control over the recovery process. Agencies need documented authority, traceability, and custody discipline across the full sequence, not just at the moment of seizure.
Practical implication: Practitioners should design recovery workflows as a lifecycle control, not an isolated enforcement action.
How blockchain analytics changes traceability and evidence handling
Blockchain analytics matters because public ledgers create a persistent transaction trail that investigators can follow if they know how to cluster addresses, trace flows, and attribute ownership. FATF points to court acceptance of those techniques in the Bitcoin Fog case, which shows that analytics can support both operational tracing and evidentiary defensibility. The technical value is not simply visibility. It is the ability to move from transaction data to legally usable investigative output, while preserving chain-of-custody and maintaining confidence in the analytic method. That combination is what makes virtual assets potentially easier to recover than some physical assets when capability exists.
Practical implication: Use blockchain analytics where you need both rapid tracing and court-defensible evidence.
What custody controls matter after seizure
Once virtual assets are seized, the security problem shifts from discovery to custody. FATF highlights cold storage, vetted custodians, and clear documentation because seized assets remain exposed to theft, fraud, volatility, and operational errors even after they are removed from the suspect. This is a governance issue with identity implications as well: whoever can move the assets holds effective control, so custody must be tightly bound to authorised access, procedural approval, and monitored handling. The guidance also notes that liquidation must account for market liquidity so recovery does not destroy value through poor timing or volume concentration.
Practical implication: Practitioners should bind post-seizure custody to strict access control and documented disposal authority.
Threat narrative
Attacker objective: The underlying adversary objective is to convert criminal proceeds into recoverable, controllable value faster than authorities can trace and immobilise it.
- Entry occurs when investigators identify virtual asset holdings through wallets, exchange accounts, seed phrases, or other indicators during first contact or follow-on tracing.
- Escalation occurs when authorities obtain the private keys, exchange cooperation, or stablecoin issuer controls needed to freeze or seize the assets.
- Impact occurs when seized assets are securely managed, liquidated with market sensitivity, and returned or repatriated without loss to theft, fraud, or poor handling.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Virtual asset recovery is now a lifecycle governance problem, not a one-off seizure problem. FATF’s guidance is important because it forces authorities to manage policy, investigation, custody, confiscation, and disposal as one continuous control chain. The practical consequence is that weak handoffs between legal authority, operational execution, and custody management become the real failure point. Agencies that treat recovery as an endpoint will continue to underperform.
Blockchain analytics is becoming an evidentiary control, not just an investigative aid. The article’s strongest signal is that authorities need tools that can support both tracing and courtroom scrutiny. That shifts the control discussion from simple visibility to repeatable, defensible methods. For practitioners, the question is whether analytic output can survive challenge and support chain-of-custody, not merely whether it can identify flows.
Virtual asset custody should be governed like privileged access. Whoever can move a seized wallet, freeze a token, or liquidate recovered assets effectively holds a privileged function over state-controlled value. That creates a familiar identity and access problem in a new domain: authorisation, auditability, and offboarding matter just as much as technical possession. Agencies should treat post-seizure control as high-risk access management, not administrative handling.
Recovery capability will increasingly separate jurisdictions that can operationalise FATF guidance from those that only adopt it on paper. FATF is signalling that effectiveness depends on training, tooling, and cross-agency coordination, especially where virtual assets are concerned. The policy direction is clear: recovery maturity will be measured by whether authorities can identify, control, and dispose of assets consistently across cases. The practitioner conclusion is straightforward: build operational depth before the next seizure event tests it.
Public-private response models are becoming part of financial crime containment. The guidance and the article’s operational examples show that real-time cooperation can shorten the gap between detection and freeze actions. That does not remove the need for legal process, but it does change how quickly value can be preserved. Teams should expect more reliance on coordinated response workflows rather than purely post-event investigations.
What this signals
Virtual asset recovery maturity will increasingly be judged by operational discipline, not by the existence of policy alone. The agencies that can move from detection to custody and disposal with clear authority will preserve more value than those that rely on case-by-case improvisation. For practitioners, the test is whether seizure workflows work under pressure, not whether guidance exists on paper.
The identity and access lesson is straightforward: control over a seized wallet is a privileged function. Recovery programmes should treat wallet access, exchange coordination, and issuer freeze actions as high-risk authorisation events, with approval, logging, and offboarding discipline to match. That framing makes the control model more familiar to IAM and PAM teams.
FATF Recommendation 15 and Recommendation 16 remain the most relevant policy anchors for virtual asset recovery operations. Practitioners should align investigative procedures and VASP engagement with those obligations so tracing, travel-rule handling, and freeze activity do not become disconnected workstreams.
For practitioners
- Define a virtual asset recovery lifecycle Map authority, evidence handling, seizure, custody, liquidation, and return into one documented process so each stage has a named owner and control point.
- Train first-contact teams on virtual asset indicators Teach officers and investigators how to recognise hardware wallets, seed phrases, exchange accounts, and wallet applications during searches and device review.
- Operationalise blockchain analytics for tracing and evidence Establish workflows that turn transaction tracing, clustering, and attribution into outputs that can support both investigations and court use.
- Harden post-seizure custody controls Use cold storage, vetted custodians, and documented access approval for seized virtual assets, with monitoring that tracks every transfer and disposal action.
- Coordinate freeze and liquidation playbooks with counterparties Pre-arrange response steps with exchanges, custodians, and stablecoin issuers so valid legal orders can be executed without avoidable delay or value loss.
Key takeaways
- Virtual asset recovery fails when jurisdictions manage seizure as an event rather than as a controlled lifecycle that spans tracing, custody, and disposal.
- FATF’s guidance arrives against a backdrop in which more than 80% of jurisdictions are still operating at low or moderate effectiveness in asset recovery.
- Agencies that combine blockchain analytics, trained first-contact teams, and disciplined custody controls are better positioned to preserve value and return assets successfully.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0 and CIS Controls v8 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Virtual asset custody depends on tightly governed transfer permissions and approvals. |
| Recommendation — Apply PR.AA-05 to tightly govern who can move, freeze, or dispose of seized virtual assets. | ||
| CIS Controls v8 | CIS-5 — Account Management | Seized asset custody requires controlled accounts, approvals, and auditable ownership. |
| Recommendation — Use CIS-5 to manage privileged access to seized wallets and recovery platforms. | ||
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | Virtual asset theft and recovery both depend on access to keys and movement of value. |
| Recommendation — Map wallet theft and tracing scenarios to TA0006 and TA0010 to improve detection and response. | ||
| GDPR | Art.32 — Security of Processing | The article touches investigative handling and secure custody, which depend on disciplined protection of sensitive records and systems. |
| Recommendation — Apply Art.32-style security controls to protect investigative data and recovery workflows from misuse. | ||
Key terms
- Virtual Asset Recovery: Virtual asset recovery is the process of identifying, tracing, seizing, managing, and disposing of digital assets linked to criminal activity or legal dispute. It requires both legal authority and technical control over keys, custodians, and transaction evidence.
- Blockchain Analytics: Blockchain analytics is the use of transaction tracing, wallet screening, and risk scoring to understand how crypto assets move across addresses and services. In compliance programmes, it supports source-of-funds checks, sanctions screening, and escalation decisions, but it only becomes effective when the output drives an actual control action.
- Custodial Freeze Control: A mechanism that allows a central issuer, exchange, or custodian to restrict movement of an asset under legal or operational authority. For virtual assets, this control can preserve value and prevent dissipation, but it also creates a high-trust access point that must be tightly governed.
- First-Contact Recognition: The ability of an investigator or operator to identify virtual asset indicators at the moment they first encounter a case, device, or suspect environment. It is a practical capacity issue, not a theoretical one, because missed recognition can allow assets to move before they can be controlled.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle control. It helps security and identity practitioners build the governance discipline needed for high-risk access and credentialed systems.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org