AML/KYC Compliance for Stablecoins

This section provides a regulator-grade comparative analysis of anti-money laundering (AML), know-your-customer (KYC), Travel Rule, sanctions screening, and related compliance requirements applicable to stablecoin issuers and service providers across all jurisdictions surveyed. It is intended for government regulators and policymakers designing or evaluating stablecoin-specific AML/CFT frameworks.

For the parallel analysis of AML enforcement in the crypto mining context, see crypto mining AML/KYC guidance.

1. Global AML Landscape by Regulatory Model

1.1 The FATF Baseline and Its Application to Stablecoins

The Financial Action Task Force sets the global AML/CFT standard through Recommendation 15 (New Technologies), its Interpretive Note (INR.15), and the October 2021 "Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers." The FATF classifies stablecoins as virtual assets (VAs) and applies the full VA/VASP framework to stablecoin issuers, custodians, exchanges, and intermediaries. The key principle is function-over-form: whether a stablecoin issuer is classified domestically as a VASP or as a financial institution, AML/CFT obligations attach regardless.

In March 2026, the FATF published its "Targeted Report on Stablecoins and Unhosted Wallets -- Peer-to-Peer Transactions," finding that stablecoins accounted for 84% of illicit virtual asset transaction volume in 2025. The report identified peer-to-peer transfers via unhosted wallets as the primary vulnerability and recommended that stablecoin issuers adopt technical controls including freeze/burn capabilities, deny-listing of high-risk addresses, and customer due diligence at redemption.

Source: FATF Targeted Report on Stablecoins and Unhosted Wallets (March 2026); FATF Updated Guidance for VA/VASP (October 2021)

1.2 Three Regulatory Model Types

Jurisdictions adopt one of three broad approaches to stablecoin AML/CFT regulation. These models determine the institutional architecture, supervisory relationships, and compliance obligations that apply:

Model A -- Integrated Financial Regulation (Stablecoin Issuers as Financial Institutions)

Under this model, stablecoin issuers are required to hold banking or equivalent financial institution licences and are subject to the same AML/CFT obligations as banks. The issuer falls within the existing financial institution supervisory apparatus.

Jurisdictions:

Japan (issuance restricted to banks, fund transfer service providers, and trust companies under the PSA),

Switzerland (fiat-backed stablecoins treated as deposit-taking, requiring a banking or FinTech licence under the Banking Act),

United States (under the GENIUS Act, Permitted Payment Stablecoin Issuers include insured depository institution subsidiaries, OCC-supervised federal nonbanks, and state-qualified entities -- all treated as financial institutions/MSBs subject to BSA/AML requirements).

Model B -- Dedicated VASP/CASP Regime

The issuer or service provider is licensed under a purpose-built virtual asset or crypto-asset framework with AML/CFT requirements layered on top. This model applies the FATF VA/VASP framework most directly.

Jurisdictions:

European Union (CASPs under MiCA, with AML/CFT under the Transfer of Funds Regulation and the AML Directive/Regulation),

Singapore (DPT service providers under the Payment Services Act, with AML/CFT under MAS Notice PSN02),

Hong Kong (licensed stablecoin issuers under the Stablecoins Ordinance (Cap. 656), effective 1 August 2025),

UAE (VARA-licensed entities in Dubai, FSRA-licensed in ADGM, CBUAE-licensed payment token issuers federally),

Bahrain (CBB SIO Module / CRA Module licensees),

South Korea (VASPs registered with KoFIU under VAUPA and the Specified Financial Transaction Information Act),

South Africa (CASPs registered as accountable institutions under FICA),

Nigeria (VASPs under SEC Nigeria and CBN frameworks),

Turkey (CASPs under Law No. 7518, with AML/CFT under MASAK).

Model C -- Emerging / Patchwork Regulation

No dedicated stablecoin AML/CFT framework exists; obligations derive from general financial services law or remain under development.

Jurisdictions:

Australia (ASIC INFO 225 financial-product positions; Tranche 1 PSP reform in exposure draft, consultation closed 9 April 2026),

India (VDA tax regime and PMLA reporting exist; comprehensive AML framework for crypto pending),

Brazil (BCB Resolutions 519/520/521 framework effective 2 February 2026, with phased Travel Rule implementation).

1.3 FATF Implementation Gap

The FATF's June 2025 Targeted Update found that only 33% of assessed jurisdictions (46 of 138) satisfactorily require VASPs to be licensed or registered. While 73% of surveyed jurisdictions (85 of 117) have passed Travel Rule legislation, 59% had yet to enforce it through supervisory actions. Only one jurisdiction was rated fully compliant with Recommendation 15.

Source: FATF Targeted Update on VAs and VASPs (June 2025)

2. Comparative Table -- AML/KYC Requirements by Jurisdiction

The table below consolidates VASP classification, Travel Rule thresholds, STR/SAR filing requirements, record-keeping periods, and sanctions screening obligations for all 18 jurisdictions and 6 international frameworks covered in this research series.

2.1 National Jurisdictions

2.2 International Frameworks

3. Travel Rule Implementation -- Deep Dive

3.1 The FATF Recommendation 16 Standard

The FATF Travel Rule (Recommendation 16, extended to VAs by INR.15) requires that originating VASPs obtain and transmit the following with each qualifying transfer:

• Originator information: Name, account number (wallet address), and physical address / national ID / customer ID / date and place of birth
• Beneficiary information: Name and account number (wallet address)

The FATF threshold is USD/EUR 1,000, below which countries may still require compliance on a risk basis. In June 2025, the FATF revised Recommendation 16 to expand the Travel Rule's objectives beyond ML/TF to explicitly include fraud prevention and proliferation financing.

Source: FATF Best Practices on Travel Rule Supervision (June 2025)

3.2 Threshold Divergence Across Jurisdictions

Five distinct threshold models have emerged:

Zero threshold (all transfers regardless of amount):

• Japan: No de minimis. Applied since 1 June 2023 under the APTCP. Japan was the first major developed country to implement the FATF Travel Rule for crypto transfers with zero threshold. The FSA designated five additional jurisdictions under APTCP travel-rule enforcement on 1 May 2026 (public comment closed 31 May 2026).
• European Union: The Transfer of Funds Regulation (Regulation 2023/1113), effective 30 December 2024, requires full originator and beneficiary information for every crypto-asset transfer regardless of amount when a CASP is involved. The European Banking Authority published final Travel Rule Guidelines on 4 July 2024.
• Singapore: MAS Notice PSN02 (revised 30 June 2025) requires CDD from the first dollar of DPT transactions, with no de minimis threshold for value transfers.
• South Korea: Moved to a zero-threshold Travel Rule in early 2026, eliminating the previous KRW 1,000,000 (approximately USD 750) minimum. The regime covers all transfers including stablecoins and unhosted wallets -- among the most aggressive globally.

FATF-aligned threshold (USD/EUR 1,000 equivalent):

• UAE (USD 1,000 or local equivalent, across ADGM, VARA, and CBUAE)

Stricter-than-FATF fixed threshold:

• Switzerland: CHF 1,000 threshold for transmission of sender/recipient data, with anti-circumvention measures for transactions linked within 30 days -- stricter than the FATF USD/EUR 1,000 standard.

Jurisdiction-specific transfer-limit model:

• Turkey: MASAK Circular No. 29 imposes stablecoin transfer limits of USD 3,000 per day and USD 50,000 per month, with the crypto Travel Rule fully implemented as of 25 February 2025.

Higher threshold:

• United States: USD 3,000 under the BSA (aligned to FATF Recommendation 16). The GENIUS Act directs FinCEN to write tailored AML rules for payment stablecoin issuers; the FinCEN/OFAC joint NPRM (8 April 2026) mandates AML/CFT and sanctions-compliance programmes but does not amend the existing threshold.

Threshold-based / partial / pending:

• United Kingdom (FATF Travel Rule applied to cryptoasset wire transfers under the MLR 2017),
  Canada (identifying information must accompany virtual-asset transfers above prescribed thresholds via FINTRAC),
  Australia (AUSTRAC implementing the FATF Travel Rule),
  South Africa (R5,000 under FIC Directive 9),
  Brazil (phased: Phase 1 self-declarations from 2 February 2026; full compliance from 2 February 2028),
  India (FATF-aligned for cross-border transfers; broader implementation pending)

3.3 Self-Hosted (Unhosted) Wallet Obligations

The treatment of transfers involving self-hosted wallets (non-custodial wallets not controlled by a VASP) varies materially:

The FATF's March 2026 report specifically called out the P2P stablecoin transfer vulnerability: transfers between unhosted wallets bypass all VASP-mediated controls. The report recommended that issuers implement smart contract-level controls (allow-listing, deny-listing) and that jurisdictions develop supervisory and law enforcement capacity for blockchain analytics.

Source: FATF Targeted Report on Stablecoins and Unhosted Wallets (March 2026)

3.4 Technological Solutions for Travel Rule Compliance

Multiple messaging protocols have emerged to facilitate Travel Rule compliance for stablecoin and crypto transfers:

The fragmentation of Travel Rule messaging protocols remains a significant implementation challenge. While interoperability between TRISA, OpenVASP, and Sygna Bridge has been achieved, no single protocol provides universal coverage. TRISA launched Envoy, a self-hosted open-source solution, in 2025 to accelerate adoption.

Source: Notabene Travel Rule Messaging Protocols; TRISA Regulator's Guide

4. Transaction Monitoring Requirements

4.1 Suspicious Transaction Reporting

All jurisdictions surveyed require stablecoin service providers to file suspicious transaction reports (STRs/SARs) with their national Financial Intelligence Unit (FIU). Key variations include:

Reporting thresholds for currency / large transaction reports (distinct from suspicious activity):

• United States: Currency Transaction Reports (CTRs) mandatory for transactions exceeding USD 10,000; FinCEN registration required within 180 days for covered issuers
• Canada: Large Cash Transaction Reports (LCTRs) and Large Virtual Currency Transaction Reports for transactions of CAD 10,000 or more (reportable within 5 business days)
• Brazil: Residents transacting via foreign/DeFi/P2P channels must report transactions exceeding R$30,000 monthly
• Most other jurisdictions: No fixed-amount threshold for STRs; suspicion-based reporting only

Reporting volume and trends: The

NYDFS Paxos/BUSD enforcement action (August 2025, USD 48.5 million settlement) revealed approximately USD 1.6 billion in suspicious transactions that went undetected, underscoring the consequences of inadequate transaction monitoring for stablecoin issuers.

4.2 Blockchain Analytics Requirements

No jurisdiction explicitly mandates the use of specific blockchain analytics tools by statute, but the practical requirement is near-universal:

• The FATF March 2026 report explicitly recommended that supervisory and law enforcement authorities develop "expertise in smart contract functionalities, cross-chain transaction mechanics, [and] blockchain analytics tools."
• The
  EU TFR requires CASPs to verify counterparty information -- practically achievable only through analytics platforms.
• Hong Kong's HKMA AML/CFT requirements for licensed stablecoin issuers (effective 1 August 2025 under the Stablecoins Ordinance, Cap. 656) require a risk-based approach to monitoring that necessitates blockchain analytics capabilities.
• US regulatory expectations, particularly from NYDFS and FinCEN, effectively require blockchain analytics as a component of an adequate AML programme (as demonstrated by the Paxos enforcement precedent).

Major providers include Chainalysis, Elliptic, TRM Labs, Scorechain, and Crystal Blockchain. Elliptic's platform encompasses over 100 billion data points mapping wallet addresses to real-world entities. The market has consolidated around stablecoin-specific risk management products that enable issuers to conduct counterparty due diligence on secondary market activity.

Source: Elliptic Stablecoin Risk Management; FATF Targeted Report (March 2026)

4.3 Real-Time vs. Post-Facto Monitoring

The FATF March 2026 report introduced a new concept of "secondary market monitoring" for stablecoin issuers -- the obligation to monitor how stablecoins are used after issuance, including in peer-to-peer transfers and cross-chain activity. This represents a significant expansion of the traditional AML monitoring perimeter.

5. Sanctions Screening

5.1 OFAC Requirements (United States)

The

GENIUS Act codifies comprehensive sanctions compliance obligations for Permitted Payment Stablecoin Issuers (PPSIs), requiring an effective sanctions compliance programme with procedures to screen for and block transactions involving sanctioned persons or countries. The OFAC SDN list is the primary screening instrument. The joint FinCEN/OFAC NPRM of 8 April 2026 would formalise mandatory AML/CFT and sanctions-compliance programme requirements for PPSIs; the FDIC subsequently approved a parallel illicit-finance NPRM (22 May 2026) for FDIC-supervised PPSIs.

Stablecoin issuers with on-chain freeze capabilities have become de facto sanctions enforcement agents:

• Circle (USDC): Proactively froze all USDC held in OFAC-designated Tornado Cash addresses during the sanctions period (August 2022 -- March 2025). Circle has frozen addresses linked to OFAC-sanctioned entities on multiple occasions.
• Tether (USDT): Froze USD 126 million in USDT across 4,163 addresses in 2025. Tether proactively executes freezing operations for all addresses appearing on the OFAC SDN list. In January 2026, Tether launched USAT, a GENIUS-compliant US-domestic stablecoin issued via Anchorage Digital Bank, coexisting with the global USDT token.
• Both issuers have been found to have missed at least 55 OFAC-designated addresses, highlighting the technical challenges of comprehensive on-chain sanctions screening.

Source: OFAC Sanctions Compliance Guidance for Virtual Currency Industry; Elliptic 2025 Regulatory Outlook: Stablecoins

5.2 The Tornado Cash Precedent

The Tornado Cash episode is the defining sanctions compliance case for the stablecoin sector:

• August 2022: OFAC designated Tornado Cash (a crypto mixing protocol) on the SDN list, alleging it facilitated laundering of over USD 7 billion, including funds stolen by the DPRK-linked Lazarus Group.
• November 26, 2024: The Fifth Circuit Court of Appeals ruled in Van Loon v. Department of the Treasury that Tornado Cash's immutable smart contracts are not "property" of a foreign national and cannot be blocked under the International Emergency Economic Powers Act (IEEPA).
• March 21, 2025: OFAC removed Tornado Cash from the SDN list.

Implications for stablecoin compliance: The ruling establishes that autonomous, immutable code cannot be sanctioned -- only persons and entities. Stablecoin issuers must still screen transactions involving sanctioned persons, but the precedent limits OFAC's ability to target decentralised protocols. The distinction between sanctioning an entity's property and sanctioning self-executing code is now legally established in the Fifth Circuit.

Source: Mayer Brown -- Fifth Circuit Tornado Cash Analysis; K2 Integrity -- Tornado Cash Delisting Implications

5.3 EU Sanctions Framework

The

EU operates its own consolidated sanctions regime, distinct from OFAC:

• CASPs under MiCA must screen all transactions against the EU consolidated sanctions list in real-time.
• On 23 October 2025, the EU's 19th sanctions package against Russia included the first-ever direct sanctioning of a cryptocurrency -- the A7A5 stablecoin, a ruble-pegged digital asset used to circumvent banking restrictions. The prohibition, effective 25 November 2025, bans all transactions involving the A7A5 crypto-asset.
• Tether (USDT) was delisted from major EU exchanges by 31 March 2025 due to non-compliance with MiCA's e-money token authorization requirements -- a distinct compliance issue from sanctions, but one that compounds sanctions screening challenges for EU-regulated entities.

Source: EU Council -- 19th Sanctions Package (October 2025); Scorechain -- EU Sanctions A7A5 Stablecoin

5.4 Privacy Coins and Mixer Interaction with Stablecoins

The intersection of privacy-enhancing technologies with stablecoins presents a distinct compliance challenge:

• Mixers/tumblers: Post-Tornado Cash, the legal status of mixing service sanctions remains uncertain. While OFAC delisted Tornado Cash, it simultaneously designated its co-founders (Roman Storm and Roman Semenov) as individuals. The distinction between sanctioning technology and sanctioning persons is now operative.
• Cross-chain bridges: Stablecoins bridged across chains may lose provenance data, creating gaps in transaction monitoring. The FATF March 2026 report specifically identified cross-chain activity as a vulnerability where "stablecoin issuers may face difficulties in controlling cross-chain activities."
• Practical response: Major stablecoin issuers (Circle, Tether, Paxos) implement address-level screening against sanctions lists. Addresses that have interacted with designated mixers or sanctioned entities may be flagged or frozen, though the Fifth Circuit ruling limits the scope of mixer-related freezes.

6. FATF Classification of Stablecoin Issuers -- VASP vs. Financial Institution

6.1 The FATF Position

The FATF's October 2021 guidance clarifies that stablecoin issuers may be classified as either VASPs or financial institutions under national law, and the AML/CFT framework applies in both cases:

• If the stablecoin issuer conducts one or more VASP activities (exchange, transfer, safekeeping, participation in issuance/sale), it is a VASP.
• If the stablecoin is structured as a security, deposit, or e-money under national law, the issuer may be a financial institution subject to the full suite of FATF recommendations applicable to financial institutions.
• The FATF explicitly states: the framework applies regardless of the label.

6.2 Jurisdictional Classification Divergence

This classification divergence has practical consequences for cross-border compliance: a stablecoin issuer classified as a "financial institution" in Japan may deal with a counterparty classified as a "VASP" in the EU, raising questions about mutual recognition of AML programmes and supervisory cooperation. The 2 June 2026 EBA-NYDFS memorandum of understanding on cross-border stablecoin supervision is an early attempt to bridge such gaps.

7. Record-Keeping Requirements

7.1 Comparative Analysis

The FATF baseline (Recommendation 11) requires maintenance of transaction records for at least five years. National implementation varies:

All jurisdictions require that records be sufficient to permit reconstruction of individual transactions, including originator/beneficiary information, transaction amounts, dates, and any supporting CDD documentation.

7.2 Stablecoin-Specific Considerations

On-chain transaction data is immutable and permanently available on public blockchains, which creates a unique compliance dynamic:

• On-chain records exceed the statutory minimum retention period by their nature.
• However, the off-chain CDD documentation (identity verification, source of funds, risk assessments) that gives meaning to on-chain addresses must be retained separately.
• Stablecoin issuers must maintain the linkage between on-chain addresses and off-chain customer identities for the full statutory period.

8. De-Risking and Banking Access Challenges

8.1 The Problem

De-risking -- the practice of financial institutions terminating or restricting business relationships with categories of clients perceived as high-risk -- has been a persistent barrier for stablecoin issuers and service providers. Despite regulatory progress, many stablecoin businesses face difficulty obtaining and maintaining banking relationships.

Key factors driving de-risking:

• Perceived AML/CFT risk: Banks view stablecoin issuers as high-risk clients due to pseudonymous transaction flows and cross-border exposure.
• Regulatory uncertainty: In jurisdictions where stablecoin regulation is still emerging (Model C jurisdictions), banks lack clear guidance on permissible relationships.
• Compliance cost: The cost of enhanced due diligence on stablecoin clients may exceed the revenue generated from the banking relationship.

8.2 Deposit Flight Concerns

The US Treasury estimates that up to USD 6.6 trillion in bank deposits could potentially be at risk from stablecoin adoption. Average US savings accounts pay 0.39% while crypto exchanges offer yields upwards of 3.5% on major stablecoins, creating competitive pressure that has complicated the bank-stablecoin issuer relationship.

8.3 Regulatory Responses

The GENIUS Act represents a deliberate attempt to resolve de-risking by establishing a clear federal regulatory track. By classifying compliant stablecoin issuers as PPSIs subject to bank-equivalent AML requirements, the Act aims to reduce the perceived risk that drives de-risking. (Note that the GENIUS Act was enacted on 18 July 2025 but is not yet effective -- the earlier of 18 January 2027 or 120 days after final implementing rules, none of which were final as of June 2026.)

Similarly,

Japan's bank-centric issuance model (restricting stablecoin issuance to banks, fund transfer service providers, and trust companies) effectively eliminates the de-risking problem by requiring issuers to already be within the banking system.

Source: Goldman Sachs Research -- Stablecoin Summer (August 2025); Oliver Wyman -- Will Stablecoins Disrupt Banking? (January 2026)

9. Cross-Border AML Coordination

9.1 Mutual Evaluation Findings

The FATF mutual evaluation process has produced findings directly relevant to stablecoin regulation:

• UAE: Placed on the FATF grey list in March 2022 due to strategic AML/CFT deficiencies, including in its virtual asset supervision framework. Removed on 23 February 2024 after implementing comprehensive reforms including the VARA licensing framework and enhanced AML/CFT controls for VASPs; the next mutual evaluation is expected in 2026.
• South Africa: Subject to enhanced monitoring (grey listed) since February 2023, in part due to inadequate supervision of VASPs and incomplete implementation of the Travel Rule. FIC Directive 9 (Travel Rule, issued 13 December 2024 and effective 30 April 2025) was a direct response to FATF pressure.
• Turkey: Subject to FATF monitoring; the crypto Travel Rule was fully implemented via MASAK on 25 February 2025, and CASP licensing under Law No. 7518 continues through the June 2026 incumbent-licensing deadline.
• Nigeria: FATF mutual evaluation identified gaps in VASP supervision; SEC Nigeria and the CBN have worked to address these through enhanced licensing requirements under the ISA 2025 and the Money Laundering (Prevention and Prohibition) Act 2022.

9.2 International Cooperation Mechanisms

The FATF March 2026 report recommended that jurisdictions establish "channels, MoUs and mechanisms that enable rapid information exchange, particularly in cases involving freezing or burning of stablecoins." Key existing mechanisms include:

• Egmont Group: Network of 170+ FIUs facilitating exchange of financial intelligence, including on virtual asset-related suspicious transactions.
• FATF mutual evaluation process: Creates binding expectations for implementation with grey-list consequences for non-compliance.
• FSB Recommendation 5: Requires global stablecoin (GSC) arrangements to implement AML/CFT measures consistent with FATF Standards, and expects cross-border cooperation among supervisors.
• Bilateral MoUs: The EBA and NYDFS signed a non-binding memorandum of understanding on cross-border stablecoin supervision on 2 June 2026. Singapore's MAS has signed cooperation agreements with multiple jurisdictions on digital asset supervision.

10. What Works / What Doesn't

10.1 Effective Approaches

Zero-threshold Travel Rule implementation (Japan, EU, Singapore, South Korea): Jurisdictions that have implemented the Travel Rule with no de minimis threshold eliminate a significant gap exploited by layering small transactions to avoid reporting. Japan's track record since June 2023 demonstrates operational feasibility, and South Korea's move to a zero-threshold regime in early 2026 (eliminating the prior KRW 1,000,000 floor) extends the model to one of Asia-Pacific's most aggressive implementations.

Bank-centric issuance models (Japan, Switzerland): Requiring stablecoin issuers to be licensed financial institutions ensures they enter the AML/CFT framework with pre-existing compliance infrastructure, supervisory relationships, and institutional culture. This approach eliminates the de-risking problem and reduces the "VASP supervision gap" that plagues many jurisdictions.

On-chain enforcement capabilities (US, via OFAC-responsive issuers): Circle and Tether's freeze/burn capabilities provide a sanctions enforcement mechanism that has no analogue in traditional finance. The ability to freeze specific on-chain addresses creates a compliance tool that is both more precise and faster than traditional asset freezing.

Risk-based regulation with clear designation (Singapore): The "MAS-regulated stablecoin" (Single-Currency Stablecoin) designation creates a two-tier market that incentivises compliance without banning non-compliant instruments. Combined with FATF-aligned AML/CFT requirements under PSN02 (revised 30 June 2025), this provides a market-driven path to compliance.

10.2 Approaches That Fall Short

High Travel Rule thresholds (US at USD 3,000): The US threshold is three times the FATF recommendation and permits significant transaction volume to flow without originator/beneficiary information. Given the FATF's finding that stablecoins now account for 84% of illicit VA transaction volume, this gap is material.

Delayed implementation (Model C jurisdictions): Australia and India lack operative stablecoin-specific AML frameworks as of June 2026, and Brazil's Travel Rule reaches full compliance only on 2 February 2028. These jurisdictions serve as potential conduits for regulatory arbitrage, as stablecoin activity migrates to the least-regulated environments.

Voluntary compliance without supervision: The FATF's June 2025 finding that 59% of jurisdictions with Travel Rule legislation had yet to enforce it demonstrates that legislation without supervisory capacity is insufficient. Laws on paper without inspections, enforcement actions, and penalties have limited deterrent effect.

Fragmented Travel Rule messaging protocols: The existence of multiple incompatible messaging protocols (TRISA, OpenVASP, Sygna, TRUST, VerifyVASP) creates friction and potential gaps in information transmission. While interoperability progress has been made, no universal standard exists.

11. Recommended Framework

Based on the comparative analysis of 18 jurisdictions and 6 international frameworks, the following elements constitute a robust AML/KYC compliance framework for stablecoin issuers and service providers:

11.1 Classification and Licensing

1. Classify stablecoin issuers as either financial institutions or VASPs under national law -- the classification itself matters less than ensuring AML/CFT obligations attach. Ambiguity in classification is the primary risk factor.
2. Require licensing or registration before any stablecoin issuance or service provision. The FATF finding that only 33% of jurisdictions satisfactorily implement this basic requirement is the single largest global gap.
3. Apply the full suite of FATF Recommendations (10-21, 26-35) to licensed entities, with enhanced due diligence requirements for cross-border activity.

11.2 Travel Rule

1. Implement the Travel Rule with no de minimis threshold for stablecoin transfers. The Japan, EU, Singapore, and South Korea model is more protective than the FATF baseline and reflects the higher risk profile of stablecoin-mediated transfers.
2. Mandate interoperable Travel Rule messaging -- require that licensed entities use protocols that interoperate with at least two other major messaging standards.
3. Establish clear obligations for self-hosted wallet transfers -- require CDD for the VASP-side of any transfer involving an unhosted wallet, with risk-based assessment of wallet provenance.

11.3 Transaction Monitoring and Sanctions

1. Require real-time sanctions screening against national and international sanctions lists before or at the point of transaction execution.
2. Require blockchain analytics capability as a component of the AML programme. While specific vendors should not be mandated, the capacity to trace on-chain transaction flows and identify counterparty risk must be demonstrated.
3. Require stablecoin issuers to maintain freeze/burn capabilities and to exercise them upon lawful instruction from competent authorities. The FATF March 2026 report's recommendation of deny-listing and allow-listing should be considered as supervisory tools.
4. Require secondary market monitoring -- stablecoin issuers should be expected to monitor how their stablecoins are used in secondary circulation, not only at issuance and redemption.

11.4 Reporting and Record-Keeping

1. Require suspicious transaction reporting to the national FIU with no threshold -- suspicion-based, not amount-based.
2. Mandate minimum 5-year record retention for all CDD documentation and transaction records, including the linkage between on-chain addresses and verified customer identities.
3. Establish cross-border information-sharing agreements with jurisdictions where major stablecoin issuers are domiciled (US, Singapore, Hong Kong, Bermuda, UAE).

11.5 Supervision and Enforcement

1. Allocate dedicated supervisory resources to stablecoin and VASP oversight. The FATF's finding of a supervision gap is the most critical implementation challenge globally.
2. Conduct thematic examinations focused on stablecoin AML controls, following the NYDFS model that produced the Paxos/BUSD enforcement action.
3. Publish enforcement outcomes to create deterrence effects. The USD 48.5 million Paxos/BUSD settlement and the USD 1.6 billion in undetected suspicious transactions illustrate the scale of compliance failure that supervision can uncover.

12. Decision Matrix

The following matrix enables regulators to assess their jurisdiction's AML/KYC readiness for stablecoin oversight:

Verification Notes

This is a refresh synthesis. All jurisdictional facts in this document are mirrored from the canonical per-jurisdiction fact matrix (.claude/stablecoin-fact-matrix.json), which is the verified source of truth for this run. No web searches were performed in this pass; aggregates such as "18 jurisdictions" and the retention-period and threshold tables are derived directly from the matrix. Items the matrix records as "NOT VERIFIED" are reflected honestly below.

Key Facts Mirrored from the Fact Matrix (as of 4 June 2026)

Items Reflected as NOT VERIFIED in the Matrix