The organization reported that only 9% of countries were “substantially effective” in areas including having banks and VASPs verify users’ information.