TL;DR: Stablecoins accounted for 84% of all illicit virtual asset transaction volume by 2025, and the FATF now urges monitoring across issuance, circulation, redemption, and P2P wallet activity, according to Chainalysis’ summary of the March 2026 targeted report. That shifts compliance from on-ramps alone to the full asset lifecycle, where visibility and enforcement capabilities now matter as much as traditional intermediary controls.
At a glance
What this is: Chainalysis reports that stablecoin monitoring is shifting from exchange-facing controls to lifecycle-wide AML expectations, driven by the FATF’s March 2026 report on stablecoins and unhosted wallets.
Why it matters: AML teams now need to govern risk across issuance, circulation, redemption, and peer-to-peer transfers because regulated intermediaries no longer see the whole asset path.
By the numbers:
- Stablecoins accounted for 84% of all illicit virtual asset transaction volume by 2025.
Context
Stablecoin AML is no longer just an on-ramp problem. The governance gap is that peer-to-peer transfers through unhosted wallets can move value outside the visibility of regulated intermediaries, which leaves issuers, VASPs, and supervisors with partial evidence when they need to assess risk.
In practical terms, that turns the stablecoin lifecycle into a compliance surface that spans minting, circulation, redemption, and secondary-market transfers. The article’s core point is that the control model has to follow the asset path, not stop at the first regulated touchpoint.
Key questions
Q: What breaks when stablecoin AML stops at the exchange layer?
A: When AML stops at the exchange layer, peer-to-peer transfers and unhosted wallets become blind spots. That creates a visibility gap where illicit value can move without immediate intermediary oversight, leaving issuers and VASPs unable to see the full risk path. The result is weaker attribution, slower intervention, and more fragmented reporting to supervisors.
Q: Why do unhosted wallets increase stablecoin AML risk?
A: Unhosted wallets increase risk because they remove the regulated intermediary that normally provides KYC, monitoring, and suspicious activity reporting. Without that control point, compliance teams must infer risk from transaction patterns, clustering, and upstream exposure rather than from a known customer relationship.
Q: How should teams use multi-hop analysis in stablecoin monitoring?
A: Teams should use multi-hop analysis to trace prior transactions far enough back to identify exposure to sanctioned, high-risk, or layered wallets. The point is to move beyond direct sender checks and capture the network context that often reveals concealment or laundering patterns.
Q: Who should be accountable for freeze and deny-list decisions?
A: Accountability should sit with the issuer or operating entity that controls the smart contract or enforcement layer, but the decision process should include compliance, legal, and audit oversight. The control only works if the authority to act, the evidence threshold, and the audit trail are all explicit.
Technical breakdown
Why secondary-market monitoring changes AML control design
A secondary market is any transfer environment where the asset changes hands without a regulated intermediary at the point of exchange. For stablecoins, that matters because peer-to-peer wallet activity can remove the usual KYC and suspicious activity reporting chokepoints. Once value moves through unhosted wallets, AML teams need a model that can join on-chain tracing, off-chain intelligence, and issuer governance. The technical challenge is not just visibility, but attribution across multiple hops and blockchain segments where risk can be fragmented across several counterparties.
Practical implication: Map monitoring and escalation logic to the whole transfer path, not only to exchange deposits and withdrawals.
How programmable controls extend compliance into the lifecycle
Stablecoins can carry enforcement logic in smart contracts, which means issuers may be able to freeze, burn, allow-list, or deny-list addresses when risk is identified. That changes the compliance model from after-the-fact reporting to active lifecycle intervention. The mechanism depends on governance over who can trigger those functions, under what evidentiary standard, and with what audit trail. Without that governance, programmability becomes a powerful but potentially inconsistent control surface rather than a reliable AML capability.
Practical implication: Define decision rights, approval thresholds, and logging for any freeze or deny-list action before relying on programmable controls.
Why multi-hop analytics are now a core AML capability
Multi-hop analysis looks back through prior transactions to identify exposure to high-risk counterparties or sanctioned clusters. In stablecoin environments, that matters because the direct sender may look clean while upstream links reveal layered activity. The article’s key governance point is that risk scoring must incorporate network context, not just the latest transaction. That requires tooling that can correlate addresses, detect clustering patterns, and preserve evidence for supervisors and law enforcement.
Threat narrative
Attacker objective: Move illicit value through the stablecoin ecosystem while reducing traceability and delaying intervention by compliance teams.
- Entry occurs through peer-to-peer stablecoin transfer via an unhosted wallet, which removes the transaction from immediate regulated-intermediary oversight.
- Layering follows as funds move through multiple hops, making direct counterparty checks insufficient to reveal upstream illicit exposure.
- Impact is regulatory and investigative opacity, because issuers, VASPs, and supervisors lose visibility into where risk enters and how it propagates across the asset lifecycle.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
- Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Lifecycle visibility is now the real AML control boundary. The FATF’s shift toward stablecoin lifecycle monitoring shows that on-ramp-centric compliance no longer matches how value moves in practice. When peer-to-peer transfers and unhosted wallets sit outside traditional intermediary control points, the governance question becomes whether the programme can trace risk across issuance, circulation, redemption, and secondary-market transfer. For AML teams, the actionable conclusion is to treat lifecycle visibility as a control objective, not a reporting enhancement.
Programmable enforcement changes the governance burden, not just the tooling stack. Freeze, burn, allow-list, and deny-list capabilities can reduce the speed and scale of illicit movement, but only if the organisation can define who authorises action and how those actions are audited. That is a governance issue as much as a technical one. For practitioners, the important shift is to align policy, evidence standards, and escalation paths before relying on smart-contract intervention.
Multi-hop analysis is becoming a minimum viable detection capability for stablecoins. Simple direct-counterparty checks miss the risk that sits several transactions upstream, which is exactly where layering and concealment patterns often appear. The named concept here is secondary-market visibility gap: the distance between where regulated controls operate and where illicit value actually moves. AML teams should close that gap by treating upstream exposure as a first-class signal.
Issuer accountability is expanding from customer onboarding to ecosystem stewardship. The article reflects a broader market expectation that issuers cannot limit their obligations to primary mint-and-redeem relationships. They are increasingly expected to understand circulation risk across the asset’s wider path and to act when systemic misuse becomes visible. The practitioner takeaway is that governance models must match the asset’s actual operating boundary, not the narrow perimeter of the issuer’s direct customers.
This is an AML governance problem with direct identity and access implications. Stablecoin controls increasingly depend on who can act on behalf of the issuer, who can trigger enforcement, and how wallet identities are associated with risk signals. That makes access control, approval workflow design, and auditability part of the AML architecture. For identity and compliance teams, the key task is to govern decision authority over the lifecycle controls themselves.
What this signals
Secondary-market visibility gap: stablecoin programmes now need to close the distance between where compliance can see activity and where the asset actually moves. That means tracing risk across unhosted wallets, multiple hops, and issuer-controlled intervention points before an alert becomes an enforcement decision.
AML teams should expect lifecycle monitoring to converge with identity governance in practice, because the people and systems allowed to trigger freezes, deny-listing, or escalation become part of the control plane. The operational question is no longer whether blockchain analytics exist, but whether authority, evidence, and auditability are aligned.
The strongest programmes will treat on-chain intelligence, off-chain investigation, and issuer action as one workflow rather than three separate functions. That is the difference between seeing suspicious activity and being able to do something defensible about it.
For practitioners
- Map monitoring to the full stablecoin lifecycle Extend AML coverage across issuance, circulation, redemption, and peer-to-peer transfers, not just exchange on-ramps and off-ramps.
- Define governance for programmable enforcement Document who can trigger freeze, burn, allow-list, or deny-list actions, what evidence is required, and how every action is logged for audit.
- Implement multi-hop risk scoring Score transactions using prior-hop exposure, clustered wallets, and sanctioned-address adjacency so upstream risk informs current decisions.
- Join on-chain and off-chain evidence Correlate blockchain analytics with case notes, customer due diligence, and supervisor reporting so alerts have enough context to support escalation.
Key takeaways
- Stablecoin AML is shifting from exchange-centric controls to lifecycle-wide monitoring because peer-to-peer transfers can bypass the usual regulated visibility points.
- The regulatory signal is that issuers and VASPs need multi-hop analytics, off-chain enrichment, and defensible intervention authority, not just transaction screening.
- The practical test is whether your programme can trace, score, and act across issuance, circulation, redemption, and secondary-market transfers without losing auditability.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Stablecoin enforcement depends on governed authority to trigger lifecycle actions. |
| DE.CM-01 — Monitoring for Anomalous Events | Lifecycle monitoring requires continuous detection of unusual wallet and transfer patterns. | |
| GV.RM-01 — Risk Management Strategy | The article is about moving AML controls to a lifecycle-wide risk strategy. | |
| Recommendation — Apply PR.AA-05 to define and restrict who can initiate freeze, burn, or deny-list actions. Use DE.CM-01 to monitor stablecoin flows for anomalous secondary-market activity. Use GV.RM-01 to align stablecoin AML monitoring with enterprise risk appetite and escalation. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Auditability is central when compliance actions affect stablecoin transactions. |
| AC-6 — Least Privilege | Enforcement functions should be tightly scoped to authorised roles. | |
| Recommendation — Apply AU-6 to review and explain freeze, deny-list, and transaction-monitoring decisions. Use AC-6 to limit who can execute stablecoin enforcement actions and related approvals. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The article discusses illicit value movement and concealment through transaction paths. |
| Recommendation — Map illicit stablecoin movement to TA0006 and TA0010 when tracing laundering and transfer patterns. | ||
| GDPR | Art.5 — Principles relating to processing of personal data | Wallet and customer intelligence may involve personal data in compliance workflows. |
| Recommendation — Apply Art.5 principles to limit personal data use in wallet-risk investigations. | ||
Key terms
- Stablecoin Lifecycle Monitoring: Monitoring stablecoin activity across issuance, circulation, transfer, and redemption rather than only on- and off-ramps. In practice, it combines blockchain analytics, risk scoring, and intervention logic so compliance teams can track exposure even when no single intermediary owns the full transaction path.
- Unhosted Wallet: A wallet that is controlled by the user rather than by a custodian or exchange. In governance terms, the organisation cannot rely on an intermediary's identity controls and must instead verify wallet control directly before permitting regulated transfers.
- Multi-hop Analysis: A tracing method that looks backwards through several prior transactions to assess provenance and exposure. It helps investigators identify layering, linked addresses, and risk clusters when direct counterparties do not provide enough context on their own.
- Secondary Market: A secondary market is the environment where an asset is transferred after its initial issuance or primary sale. For stablecoins, it includes peer-to-peer circulation outside direct issuer or exchange workflows, which is where many monitoring gaps appear.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management through an identity-security lens. It helps practitioners connect control design to the access and accountability problems that recur across modern security programmes.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org