TL;DR: FATF's 2026 special report says stablecoins now account for 84% of illicit crypto transactions, and it pushes oversight beyond on- and off-ramps into the full circulation lifecycle, including P2P transfers and issuer-side freezing capability, according to Chainalysis and FATF. The compliance problem is no longer transaction entry points; it is continuous visibility across the asset lifecycle.
At a glance
What this is: Chainalysis summarises FATF’s move from exchange-point monitoring to full stablecoin lifecycle oversight, including P2P transfers, issuer controls, and on-chain tracing.
Why it matters: It matters because compliance teams and digital-asset operators now need governance across issuance, circulation, and redemption, not just customer onboarding and exit points.
By the numbers:
- Stablecoins accounted for 84% of illicit crypto transactions in 2025, according to Chainalysis research cited by Chainalysis.
Context
Stablecoin compliance is no longer just an on-ramp and off-ramp problem. FATF’s latest guidance pushes oversight into the circulation layer, where peer-to-peer transfers, non-custodial wallets, issuer controls, and transaction tracing determine whether risk can be seen and acted on.
For VASPs, issuers, and regulators, the governance gap is lifecycle visibility. A payment instrument that moves quickly across wallets and chains can evade point-in-time checks unless monitoring, screening, and response are designed around the asset’s full path, not a single transaction boundary.
Key questions
Q: What fails when stablecoin monitoring stops at the on-ramp?
A: Risk visibility collapses once assets move into P2P circulation or unhosted wallets, because no regulated intermediary is automatically in the transaction path. That leaves issuers, VASPs, and supervisors with incomplete provenance and slower intervention options. Effective control therefore requires lifecycle monitoring, not just exchange-based onboarding checks.
Q: Why do stablecoins increase AML and sanctions risk after the first transfer?
A: Because once funds leave a regulated venue, they can pass through wallets and layered transfers without a single intermediary responsible for full visibility. That makes multi-hop tracing essential for understanding origin, proximity, and whether an address is part of a broader illicit cluster.
Q: How do compliance teams know if lifecycle monitoring is actually working?
A: They should test whether investigators can trace a suspicious asset across several hops, identify high-risk counterparties, and trigger a documented response using both on-chain and off-chain evidence. If they cannot connect those steps reliably, the monitoring model is still perimeter-bound rather than lifecycle-based.
Q: Who is accountable when issuers can freeze or deny-list assets?
A: Accountability should sit with the issuer, the compliance function, and the approval chain that authorises intervention. If freeze capability exists, the organisation must define evidence thresholds, override rules, audit logging, and reversal authority before any incident occurs. Without that governance, technical control becomes discretionary power with weak oversight.
Technical breakdown
Why on-ramp screening no longer covers stablecoin risk
Traditional AML programmes focus on customer onboarding, exchange entry, and redemption because those are the easiest choke points to monitor. Stablecoins weaken that model because value can move directly between wallets without passing through a regulated intermediary. That creates a compliance gap where risk migrates into the circulation layer, including P2P transfers and non-custodial wallets. The relevant control problem is not whether a transaction exists, but whether the surrounding activity can still be attributed, traced, and risk-scored once the asset leaves a formal platform boundary.
Practical implication: Treat lifecycle tracing as a control requirement, not an enrichment step.
How issuer-side freezing changes the control model
When issuers can freeze or burn tokens, the compliance model becomes partly programmable. That shifts response from post-incident reporting to active intervention against identified high-risk addresses. But programmability also introduces governance questions: who authorises action, what evidence threshold is required, and how false positives are handled when on-chain data is incomplete or delayed. In practice, issuer controls only work when legal authority, decision rights, and technical execution are aligned. Without that alignment, freezing capability becomes a latent power rather than an operational safeguard.
Practical implication: Define freeze authority, evidence thresholds, and escalation paths before a high-risk address is detected.
Why multi-hop analysis is now central to stablecoin oversight
Multi-hop analysis traces funds across several transactions to expose the wider risk cluster around a wallet or transfer. That matters because a single hop rarely shows enough context to distinguish legitimate circulation from laundering, sanctions evasion, or layered obfuscation. For compliance teams, this is the difference between seeing a clean-looking receipt and understanding the origin, proximity, and behavioural pattern behind it. The governance issue is therefore not raw blockchain visibility, but whether monitoring can convert that visibility into defensible risk decisions across a chain of transfers.
Practical implication: Use multi-hop tracing to evaluate counterparties and exposure, not only the immediate sender and receiver.
NHI Mgmt Group analysis
Stablecoin lifecycle governance is becoming an identity and access problem as much as an AML problem: the key control issue is who can see, classify, and act on value as it moves through wallets, issuers, and exchanges. FATF’s shift shows that point controls are insufficient when the asset itself is programmable and continuously transferable. For practitioners, this means governance must extend from account opening to transaction lifecycle supervision.
Programmable freeze capability creates a new accountability boundary: if issuers can freeze or burn assets, they inherit a control obligation that looks closer to privileged access governance than simple payment processing. The concern is not the existence of the capability but the decision structure around it, including authority, evidence, and challenge mechanisms. Practitioners should treat this as a high-risk control domain requiring explicit lifecycle oversight.
Multi-hop tracing is now the practical expression of risk-based monitoring: one-hop monitoring only answers who touched a transfer first, while the current threat model depends on whether the wider exposure network can be reconstructed. This is where compliance teams need a named operating concept: circulation-layer visibility gap. It describes the blind spot that appears when monitoring stops at the regulated perimeter instead of following the asset through the market. Practitioners should build controls around that gap.
VASP governance will increasingly be judged by lifecycle completeness, not just onboarding quality: FATF’s direction implies that good KYC at the door is no longer enough if the same asset can move through opaque downstream channels. That widens the compliance perimeter and increases the value of continuous analytics, response authority, and documented escalation. Practitioners should reframe oversight as an end-to-end assurance problem.
What this signals
Circulation-layer visibility gap: stablecoin governance now depends on seeing risk after the first transaction, not just at customer entry. That changes the operational centre of gravity for compliance teams, because the difficult part is proving that wallet-to-wallet activity can still be evaluated in context.
FATF’s direction makes continuous analytics and response authority part of the control stack, especially where non-custodial wallets and programmable issuer actions are involved. Practitioners should expect lifecycle monitoring to become a baseline expectation rather than a specialist enhancement.
For practitioners
- Map the stablecoin lifecycle Document where issuance, transfer, redemption, freezing, and monitoring controls sit across your operating model so that no stage falls outside ownership.
- Extend screening beyond counterparties Evaluate non-custodial wallet activity, P2P transfers, and multi-hop exposure instead of limiting risk review to onboarding and cash-out points.
- Define issuer intervention governance Set evidence thresholds, approval chains, and challenge procedures for freeze or burn actions before those powers are needed in production.
- Operationalise traceability workflows Combine on-chain analytics with off-chain context so investigators can move from suspicious transfer to defensible enforcement or remediation action.
Key takeaways
- Stablecoin AML control is shifting from point-in-time onboarding checks to continuous supervision across issuance, circulation, and redemption.
- The main governance gap is no longer transaction entry, but visibility across P2P transfers, non-custodial wallets, and multi-hop activity.
- Issuers and VASPs will need documented response authority, traceability workflows, and clear accountability for asset freezing or risk containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0 and CSA Cloud Controls Matrix set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Stablecoin issuer controls and monitoring depend on tightly governed access and action rights. |
| GV.RM-01 — Risk Management Strategy | The article is fundamentally about expanding risk governance from transaction points to lifecycle oversight. | |
| Recommendation — Apply PR.AA-05 to restrict who can authorise, execute, and review freeze or burn actions. Use GV.RM-01 to embed lifecycle monitoring into enterprise risk decisions and control ownership. | ||
| MITRE ATT&CK | TA0009;TA0010 — Collection; Exfiltration | Multi-hop laundering and circulation obfuscation map to adversary collection and exfiltration behaviour. |
| Recommendation — Map suspicious transfer chains to TA0009 and TA0010 to hunt for layered movement and exit patterns. | ||
| CSA Cloud Controls Matrix | DSP — Data Security & Privacy | Blockchain analytics and risk visibility are data-governance controls in a cloud-delivered compliance stack. |
| Recommendation — Use DSP to govern how transaction data is collected, analysed, retained, and escalated across the compliance workflow. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Issuer intervention and monitoring require controlled access to sensitive operational actions and evidence. |
| Recommendation — Apply A.5.15 to define who may view, approve, and execute stablecoin intervention controls. | ||
Key terms
- Stablecoin Lifecycle Monitoring: Monitoring stablecoin activity across issuance, circulation, transfer, and redemption rather than only on- and off-ramps. In practice, it combines blockchain analytics, risk scoring, and intervention logic so compliance teams can track exposure even when no single intermediary owns the full transaction path.
- Multi-hop Tracing: Multi-hop tracing is the analysis of several linked transactions to understand how value moves across wallets, entities, and chains. In compliance work, it helps reveal the broader risk context behind a transfer, including indirect exposure to sanctioned or illicit clusters.
- Non-Custodial Wallet Access: Non-custodial wallet access means the user controls the keys or seed phrase needed to access funds, rather than relying on the service provider. It is intended to limit operator control over assets. If a platform can still move funds through an internal recovery path, the non-custodial claim deserves scrutiny.
- Issuer Freeze Capability: Issuer freeze capability is the technical ability for a stablecoin issuer to prevent further movement of tokens associated with a wallet or address. It is a high-risk control because it combines operational authority, governance approval, and legal defensibility in one action.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management in the context of modern security programmes. It helps practitioners connect access control discipline to the broader governance decisions their environments depend on.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org