Stablecoin AML: What Compliance Teams Actually Have to Do

There is a number in the Financial Action Task Force's most recent assessment that should change how compliance teams think about stablecoin counterparties. Of 149 jurisdictions assessed against Recommendation 15, the FATF standard covering virtual assets, one is fully compliant. Fifty-one are largely compliant, 64 are partially compliant, and 33 are non-compliant. And of the 91 jurisdictions that have passed Travel Rule legislation, 55 have taken no supervisory or enforcement action on it. So "our counterparty operates in a Travel Rule jurisdiction" tells you considerably less than it sounds like. The law being on the books and the law being enforced are different facts, and in most places only the first is true.

This article sets out what the obligations are, where the gaps sit, and what to establish before approving a stablecoin flow. It describes regulatory requirements. It is not legal or compliance advice, and the position in any specific jurisdiction should be confirmed with your own advisers.

What AML obligations apply to stablecoin payments?

Stablecoin payments are not a separate regime. Where a business is a regulated financial institution or a virtual asset service provider, the existing AML framework applies. The asset being transferred does not create an exemption.

FATF Recommendation 15 extends the anti-money-laundering and counter-terrorist-financing standards to virtual assets and VASPs. It requires jurisdictions to assess the risks virtual assets present, to license or register VASPs, and to supervise them for AML purposes. The obligations that reach a compliance team are familiar in kind and different in execution:

Customer due diligence on originating and beneficiary parties, to the standard the institution's own licence requires.

The Travel Rule, requiring originator and beneficiary information to travel with transfers between VASPs above applicable thresholds.

Transaction monitoring, adapted to on-chain activity rather than account-based flows.

Sanctions screening, which for virtual assets means screening wallet addresses as well as names.

Risk assessment and record keeping, documented to the same standard as any other payment channel.

What changes is not the obligation. It is the evidence available to discharge it, and how far the counterparty on the other side can be relied on.

Where does the Travel Rule apply, and where is it enforced?

This is where the framework and the reality diverge, and it is the most useful thing for a compliance team to understand.

The FATF's seventh targeted update, published 16 July 2026, surveyed 147 jurisdictions. Eighty-three percent now have Travel Rule legislation in force, 91 of the 109 jurisdictions answering that question, up from 73% the previous year.

Legislation is a discrete, visible act. Enforcement is not. Fifty-five of those 91 jurisdictions have issued no findings or directives, and taken no supervisory or enforcement action, specifically on the Travel Rule.

FATF's framing is direct. Its president described implementation as something that can no longer be delayed, while noting that organised crime continues to use virtual assets to commit fraud, evade sanctions and launder proceeds across borders.

What this means in practice. A counterparty VASP registered in a jurisdiction with Travel Rule legislation may never have been examined on it. The registration tells you the law exists. It does not tell you the counterparty complies, or that anyone has checked. That shifts weight onto your own counterparty due diligence, because the supervisory assurance a compliance team might reasonably assume is, in roughly half of cases, absent.

What does transaction monitoring look like for stablecoin flows?

Monitoring on-chain activity differs from monitoring account-based payments, and it cuts both ways.

What is harder. There is no account history in the conventional sense, no relationship manager, no statement. A counterparty address may have no identifiable owner. Typologies differ from fiat - mixing services, chain-hopping, rapid consolidation across many addresses - and a programme calibrated for wire transfers will not detect them.

What is easier. The transaction record is public and permanent. Where a fiat payment is visible only to the institutions that touched it, an on-chain transfer can be traced backwards through its entire history. Address clustering and risk scoring can establish exposure to sanctioned entities, darknet markets or known fraud proceeds with a confidence that has no fiat equivalent.

The practical question is whether monitoring covers the on-chain leg at all, or stops at the fiat boundary. A programme that screens the fiat settlement and treats the preceding stablecoin transfer as out of scope has a gap, and it is the gap a supervisor will find first.

Screening at the right points means the sending address before acceptance, the receiving address before release, and the transaction itself against the institution's own risk model. Not only the named parties.

How should a compliance team assess a counterparty VASP?

Given the enforcement gap, counterparty due diligence carries more weight here than in most payment channels.

Establish the licence, the activity and the register. Not "they are regulated" but which entity holds which authorisation, for which activity, verifiable on which public register. Virtual asset licences are activity-specific, an entity licensed for one activity is not thereby licensed for another.

Establish whether they can actually exchange Travel Rule data. Legislation in their jurisdiction does not mean operational capability. Ask which protocol or standard they use, whether they can both send and receive, and what happens when the counterparty on the far side cannot reciprocate.

Establish their supervisory history. Have they been examined? By whom, and when? In a jurisdiction with Travel Rule legislation but no enforcement activity, the answer may be that nobody has looked.

Apply extra scrutiny to offshore and unregistered providers. FATF flags offshore VASP oversight as a persistent gap. A counterparty operating from a jurisdiction with limited supervisory capacity presents a different risk profile regardless of how its documentation reads.

Document the assessment. The file should record registration status, jurisdiction, demonstrated Travel Rule capability and the basis on which the relationship was approved. That file is what a supervisor will ask for.

What changes with self-hosted wallets?

Transfers involving wallets not held at a regulated institution are treated differently, and the distinction is operational as well as legal.

A transfer between two VASPs has an identifiable counterparty institution, which is what makes Travel Rule data exchange possible. A transfer to or from a self-hosted wallet - one the holder controls directly, with no custodial intermediary - has no counterparty institution to exchange data with.

That does not remove the obligation. It changes how it is met: typically through direct screening of the address, collection of information about the wallet's controller, and risk-based assessment of the transfer. Thresholds and specific requirements vary by jurisdiction, and this is an area where frameworks differ materially.

The operational consequence is usually discovered rather than planned for. These are two processing paths with two timescales. A transfer from a regulated institution can often clear programmatically; one from a self-hosted wallet may need manual review. A business designing a customer-facing flow should know which path a transfer will take, and what the customer is told while it happens.

What do the UAE and Bahrain frameworks require?

Both jurisdictions regulate virtual asset activity and require licensed providers to maintain AML programmes consistent with FATF standards.

In Bahrain, crypto-asset services are regulated by the Central Bank of Bahrain under Volume 6 of the CBB Rulebook, which sets licensing categories and the associated AML and compliance obligations.

In Dubai, virtual asset activity is licensed by the Virtual Assets Regulatory Authority. Licences are granted per activity, and VARA's compliance and risk management rulebook sets AML requirements for licensed VASPs.

One UAE constraint sits outside the AML framework but reaches the same decision. Under the Central Bank of the UAE's Payment Token Services Regulation, a merchant in the UAE may accept a virtual asset as payment only if it is a Dirham Payment Token issued by a licensed issuer, or a Foreign Payment Token from a registered issuer used to purchase a virtual asset or virtual asset derivative.

As at September 2026, one foreign payment token held CBUAE registration - USDU, issued by ADGM-licensed Universal Digital. Neither Tether nor Circle held registration. Four dirham-pegged tokens were licensed or approved: AE Coin, Zand AED, DDSC, and RAKBANK AED on an in-principle basis.

A compliance function assessing a stablecoin flow for a UAE-domiciled entity is therefore answering two separate questions: whether the AML controls are adequate, and whether the payment is permitted at all. Registration status changes as issuers apply - confirm the current position with the CBUAE and with your own advisers.

What to establish before approving a stablecoin flow

Six questions, in the order a compliance function would reasonably ask them.

Is the payment permitted in this jurisdiction, for this purpose? In the UAE this precedes every AML question. A flow that is not permitted does not become permitted through good controls.

Which entity holds which licence, for which activity, on which register? Verify it rather than accepting it.

Can the counterparty exchange Travel Rule data in practice, not just in principle? And what happens when the far side cannot?

Does monitoring cover the on-chain leg, or stop at the fiat boundary? This is the most common gap.

What is the process for a transfer from a self-hosted wallet - screening, review window, escalation, and what the customer sees?

Who has examined the counterparty, and when? In roughly half of Travel Rule jurisdictions, the answer is nobody.