Stablecoins and AML: who owns the risk after you hit send?

Stablecoins are the most regulated corner of crypto. They have authorised issuers, reserve rules, redemption rights and, in the EU, the legal status of electronic money. They are also, according to the world’s anti-money laundering standard-setter, the criminals’ asset of choice.

That paradox sits at the centre of the biggest compliance question in digital finance right now. When a stablecoin leaves your platform, who is responsible for stopping dirty money: the issuer, the exchange, the fintech that integrated the rails, or the casino that accepted the deposit?

The short answer is that everyone owns the risk at their own boundary. The longer answer is that the boundary is moving. Regulators increasingly want issuers to reach into the secondary market, and in the EU, payments law has joined crypto law and AML law at the same table.

Why stablecoins became the AML problem of 2026

On 3 March 2026, the Financial Action Task Force (FATF) published its Targeted Report on Stablecoins and Unhosted Wallets. It counted more than 250 stablecoins in circulation by mid-2025, with a combined market capitalisation above USD 300 billion. It concluded that stablecoins are now the most popular virtual asset used in illicit transactions, citing analysis that they accounted for 84% of an estimated USD 154 billion in illicit virtual asset volume in 2025.

The report’s central finding is not that the tokens are flawed. It is that the gap between regulated firms is. FATF called peer-to-peer transfers through unhosted wallets a key vulnerability: value moves from one self-custodied wallet to another with no regulated intermediary in the middle to identify anyone, apply the Travel Rule or report suspicion.

FATF’s July 2026 update on virtual asset standards underlined the enforcement gap. Most surveyed jurisdictions now have Travel Rule legislation, but only a minority have taken any supervisory or enforcement action, and stablecoins, unhosted wallets, DeFi and offshore providers were flagged for more attention.

Criminals do not choose stablecoins because they are unregulated. They choose them because they are liquid, stable and fast, and because the dangerous part of the journey happens between regulated firms.

The global answer: make the issuer the chokepoint

If the risk lives in the secondary market, the one actor who can still touch every token is the issuer, through its smart contract. That is where policy is heading.

FATF encouraged issuers to implement technical measures to block, freeze and withdraw stablecoins at any time, alongside deny-lists and redemption controls. It stopped short of calling for blanket blacklisting, but the direction is clear.

The United States has gone further. Under the GENIUS Act, permitted payment stablecoin issuers are treated as financial institutions under the Bank Secrecy Act. In April 2026, FinCEN and OFAC proposed rules that would require issuers to maintain AML and sanctions programmes, to have the technical capability to block, freeze and reject transactions on both primary and secondary markets, and to comply with lawful orders to seize, freeze or burn tokens. Notably, FinCEN proposed not to impose suspicious activity reporting on secondary-market transactions, reasoning that a blanket duty would produce waves of defensive reports. The Act takes effect no later than 18 January 2027. At the time of writing, the AML and sanctions rules are still proposals.

The practical consequence for everyone else is significant: freezability is becoming a regulatory feature, not a design choice. A token without credible freeze and deny-list governance will be harder to justify in a risk assessment, and a token with it creates new operational questions for every firm that holds it.

The EU answer: regulate every gate

The EU takes a different route. Rather than relying on the issuer as the main chokepoint, it regulates each intermediary the token passes through.

• Issuance. Under MiCAR, an e-money token can only be offered to the public or admitted to trading if the issuer is an authorised credit institution or e-money institution. That makes the issuer an obliged entity under EU AML law from day one.
• Service providers. MiCAR’s transitional period ended by 1 July 2026 at the latest. Crypto-asset service providers without authorisation must stop serving EU clients, as ESMA reminded the market in April 2026.
• Transfers. The Transfer of Funds Regulation has applied to crypto-asset transfers since 30 December 2024, with no minimum amount between providers. For transfers above EUR 1,000 to or from a self-hosted wallet, the provider must assess whether its own customer owns or controls that wallet.
• Anonymity. From 10 July 2027, Article 79 of the AML Regulation (AMLR) prohibits credit institutions, financial institutions and CASPs from keeping anonymous accounts, including accounts that allow anonymisation through anonymity-enhancing coins.

The licensing trap most firms missed

There is one more gate, and it catches firms by surprise. MiCAR deems e-money tokens to be electronic money, which makes them funds under payments law. In a June 2025 no-action letter, the European Banking Authority said that transferring or holding e-money tokens on behalf of clients can be a payment service under PSD2, and gave the market until 2 March 2026 to adjust. Its February 2026 opinion confirmed a broad reading. Since March, a CASP running payment-like stablecoin flows without payment services coverage faces the risk of being told to stop and offboard clients.

This matters for AML as much as for licensing. A flow run without the right permission is itself a control failure, and it usually means the payments-specific controls, such as fraud reporting, were never built.

Who owns what: a responsibility map

Where firms actually fail

In practice, the same weaknesses appear again and again.

1. Treating stablecoins as cash-like and low risk. Price stability says nothing about the origin of funds. FATF’s data says the opposite.
2. Travel Rule gaps. Counterparties that cannot receive data, transfers that time out, and no clear policy on what happens when information is missing.
3. Self-hosted wallet checks as a tick-box. A screenshot or a customer declaration does not prove control. Message signing or a test transfer does.
4. Screening only one hop. Checking the direct counterparty address while ignoring indirect exposure, cross-chain bridges and swaps that break the trail.
5. No playbook for issuer freezes. An inbound token is frozen after you credited the customer. Who reconciles it, who tells the customer what, and does it trigger a suspicious activity review?
6. The licensing blind spot. Running e-money token transfers as a CASP without checking the payment services position after March 2026.

The blueprint: a defensible stablecoin AML programme

This is how we would build it, in order.

1. Keep a token due diligence register

For every token you list, accept or pay out in, record the issuer, its authorisation status, the chains supported, reserve and redemption arrangements, and its freeze and deny-list policy and track record. Treat bridged and wrapped versions as separate tokens: they may not carry the issuer’s controls or its legal status.

2. Classify every flow

Map each stablecoin flow, from deposit to transfer, conversion and payout, against MiCAR and PSD2, and record who holds which permission. Review it whenever the product changes. This document will be one of the first things a supervisor asks for.

3. Screen at the boundary, with depth

Screen inbound and outbound addresses for sanctions and risk exposure, including indirect exposure and cross-chain hops. Set thresholds that route high-risk hits to trained analysts, and record why each one was released or escalated.

4. Run the Travel Rule properly

Do due diligence on counterparty providers, test interoperability with your main counterparties, write down your missing-information policy, and verify self-hosted wallets with methods that prove control. Watch for transfers split to stay under the EUR 1,000 line.

5. Write the freeze playbook

Decide in advance how you handle tokens frozen by an issuer, whether on your platform or on the way in: accounting, customer communication, return or retention, and suspicious activity assessment. Practise it before you need it.

6. Monitor stablecoin typologies

Calibrate monitoring for patterns that matter in stablecoins: rapid conversion to fiat, layering through swaps and bridges, mule wallets, peer-to-peer over-the-counter activity and repeated small transfers to self-hosted addresses. Generic fiat rules miss most of them.

7. Prove it works

Report stablecoin-specific metrics to your MLRO and board, and have the programme independently tested before your supervisor does it for you.

The provocative question: is a freezable stablecoin still crypto?

Purists argue that a token its issuer can freeze is just a bank balance on a blockchain. Regulators would answer that this is precisely the point. For regulated businesses the debate is becoming academic: the market is splitting into compliant payment rails with governance attached, and everything else.

The strategic question is which side your business model lives on. If you want banking partners, payment licences and EU clients, your stablecoin programme has to be built for the compliant side, and documented as if a supervisor will read it tomorrow.

What to do before mid-2027

• Before the end of 2026: build the token register, classify every flow under MiCAR and PSD2, and close known Travel Rule gaps.
• Before 18 January 2027: if you serve US persons with payment stablecoins, confirm how your issuers and partners are preparing for the GENIUS Act.
• Before 10 July 2027: prepare for the AMLR, including the ban on anonymity-enhancing coins, and align onboarding and monitoring with AMLA’s standards.

If you are building or repairing a stablecoin programme, our MiCAR Authorisation and AML Operations teams do this work every day.