Mastercard Stablecoin Security: AML and Sanctions Screening for Stablecoin Payments
Mastercard announced on 19 October 2026 that it is launching a risk intelligence service called Stablecoin Security, designed to let banks and financial institutions assess fraud, sanctions, and financial crime risks in stablecoin payments before funds move on-chain. The announcement came at Money20/20 USA, with Borderless.xyz and Keyrails named as the first commercial partners. A global rollout is expected in 2027. For compliance teams and CFOs already grappling with how to bring stablecoin flows inside existing AML and sanctions frameworks, this is a significant development worth understanding now.
What Stablecoin Security Actually Does
The service sits upstream of a stablecoin payment, examining transaction context and on-chain data before funds settle. Mastercard delivers its findings through an API, so institutions can pipe the output into the fraud and compliance systems they already operate rather than building separate infrastructure. The result is a risk score that covers the origin of funds, potential links to scams, fraud typologies, and sanctions exposure.
Key capabilities at launch
Stablecoin Security draws on both traditional payment data and blockchain analytics to assess risk across the full stablecoin payment lifecycle. That dual-data approach is notable: many existing transaction monitoring tools operate in one domain or the other, not both simultaneously. Mastercard's model attempts to bridge that gap, recognising that stablecoin payments increasingly interact with fiat rails at both ends of a transaction.
The service is designed to be API-native. Banks receive the risk score through an existing integration point, meaning the operational lift to adopt it should be lower than deploying a standalone monitoring product. Institutions retain control over what they do with the score: block, hold for review, or pass through, depending on their own risk appetite and regulatory obligations.
The data behind the service
Mastercard cited a study examining 593 million stablecoin transfer events across 141 million transactions in 2025. A striking finding from that research was that nearly 60% of stablecoin transfer events occurred within complex, multi-step transactions rather than straightforward one-to-one transfers. That pattern matters for compliance teams because it means that a simple counterparty check on the sender and receiver is often insufficient; the intermediate hops carry risk too, and any effective screening tool needs to trace the full chain of custody.
Who the Partners Are and Why They Were Chosen
The choice of initial partners gives a clear signal about where Mastercard sees the near-term commercial opportunity for stablecoin compliance infrastructure.
Borderless.xyz
Borderless.xyz connects financial institutions with licensed stablecoin providers operating across more than 113 countries and 72 currencies. Its geographic breadth means it sits at precisely the kind of multi-jurisdiction junction where sanctions screening is most complex. Notably, Mastercard and Borderless.xyz had already announced a joint initiative in August 2026 involving additional partners focused on adding trust signals to stablecoin payment flows, so this Stablecoin Security integration is a natural extension of that relationship.
Keyrails
Keyrails focuses on high-value cross-border trade payments, with a particular emphasis on emerging markets. That use case carries elevated AML risk by default: higher transaction values, jurisdictions with variable AML frameworks, and correspondent banking gaps that stablecoins are increasingly being used to bridge. The inclusion of Keyrails suggests Mastercard is positioning this service for institutional trade finance flows, not just retail payments.
BVNK integration on the horizon
Mastercard completed its acquisition of BVNK in 2026, following an agreement announced in March of that year. Last week, the company disclosed its first major integration of BVNK, offering a unified account that combines fiat and stablecoin balances, real-time conversion, card spending, and local bank payouts through a single API. Mastercard has confirmed that BVNK will be brought into the Stablecoin Security framework in 2027, which would extend risk screening directly into that unified account infrastructure.
Rollout Timeline and Geographic Scope
The service will launch first in North America, with commercial availability expected globally in 2027. That sequencing is likely driven by regulatory readiness: the US is currently legislating for stablecoins through the GENIUS Act framework, which creates a clearer commercial environment for infrastructure that supports stablecoin compliance. For firms operating outside the US, 2027 is a realistic planning horizon.
Borderless.xyz's coverage of 113 countries and 72 currencies hints at the eventual geographic ambition. Whether the risk score itself will be calibrated for jurisdiction-specific sanctions lists beyond OFAC (for example, UN designations, EU consolidated lists, or the UK's OFSI list) is a question compliance teams should put directly to Mastercard when evaluating the service.
AML and Compliance Implications for Financial Institutions
For banks, payment service providers, and crypto-asset service providers, the arrival of a Mastercard-branded stablecoin screening layer has implications that go beyond a product decision.
How this fits existing BSA and AML obligations
US financial institutions subject to the Bank Secrecy Act and FinCEN's guidance on convertible virtual currencies are already expected to apply customer due diligence, transaction monitoring, and suspicious activity reporting to stablecoin activity where they have exposure. A pre-payment risk score that flags potential sanctions links or fraud patterns could support those obligations, but it does not replace them. The institution remains the responsible party for filing SARs, maintaining KYC records, and applying OFAC checks. A vendor-supplied risk score is an input to a compliance decision, not the decision itself.
Sanctions screening: what the API score cannot do alone
OFAC compliance requires that institutions maintain their own sanctions screening programmes. Using a third-party risk intelligence feed to supplement that programme is acceptable practice, but regulators expect institutions to understand the methodology behind any tool they rely on. Compliance officers evaluating Stablecoin Security will want written documentation from Mastercard covering which sanctions lists the service screens against, the frequency of updates, and the methodology for assigning risk scores across multi-hop transactions. That documentation will also be necessary for satisfying internal audit and examiner requests.
The multi-hop problem and what it means for monitoring
The finding that nearly 60% of stablecoin transfer events occur within multi-step transactions is a compliance wake-up call. Traditional transaction monitoring built for two-party bank transfers can miss risk that accumulates across intermediate addresses. Institutions that currently rely on checking only the direct counterparty in a stablecoin payment should review whether their existing systems capture intermediate on-chain hops. This is especially relevant for institutions holding stablecoin balances on behalf of clients or executing cross-border payments via stablecoin rails.
Accounting and Reporting Considerations
The commercial availability of a pre-payment risk screening service also has implications for how stablecoin transactions are recorded and reported, particularly as accounting standards for digital assets continue to develop.
For accounting firms and CFOs
When a risk score triggers a payment hold or block, the accounting treatment of any funds already in transit or held in a stablecoin wallet pending clearance needs to be considered. If a payment is delayed because it is under AML review, the question of when revenue or a liability is recognised depends on the terms of the underlying contract and the applicable accounting framework. Under IFRS 9 and US GAAP ASC 310, receivables recognition generally follows transfer of control, but a compliance hold introduces uncertainty that may need to be disclosed. Firms using crypto accounting software to record stablecoin flows should ensure that flagged or held transactions are categorised separately until they are cleared or reversed, so the audit trail reflects the actual settlement timeline.
For institutions that process stablecoin payments at volume, the output of a service like Stablecoin Security could also be relevant to going concern disclosures and operational risk disclosures. If a significant proportion of payment volume is being scored and a material share held, that is a business risk worth quantifying in financial statements and board reporting.
Record-keeping for flagged transactions
Any transaction that receives a high-risk score and is subsequently blocked or reported as a suspicious activity needs to be documented in a way that satisfies both the regulator and the auditor. Firms should establish a clear data flow from the API output through to the SAR filing record and the corresponding entry in the digital asset accounting ledger. Gaps in that chain create reconciliation problems and, in an examination, evidentiary problems. Good digital asset accounting software will allow firms to attach compliance metadata, including risk scores and hold decisions, to individual transaction records.
What Firms Should Do Before the 2027 Commercial Launch
The 2027 global rollout gives compliance and finance teams roughly a year to prepare. That time is worth using deliberately.
Steps for compliance teams
First, map current stablecoin payment flows to understand where multi-hop transactions are occurring and whether existing monitoring captures intermediate addresses. Second, assess whether current sanctions screening programmes explicitly cover stablecoin transfers, including the intermediate wallets, and document that assessment. Third, engage with Mastercard's partner programme to obtain technical documentation on the API, the risk score methodology, and the sanctions list coverage, so that any future adoption can be evaluated against your own BSA/AML programme's standards rather than accepted at face value. Fourth, review vendor management policies to confirm that a third-party risk intelligence feed of this kind requires its own due diligence file, including the provider's own regulatory status and data security practices.
Steps for finance and accounting teams
Update your stablecoin transaction recording procedures to include a category for payments under compliance review. Liaise with your crypto accounting software provider to confirm that the system can handle held or pending stablecoin transactions without prematurely recognising them as settled. Review disclosure language in financial statements to ensure that AML-related payment holds, if they occur at material scale, are captured in operational risk disclosures. If you are working with Borderless.xyz or Keyrails today, ask those counterparties directly about their planned integration timeline and what data they will share back to the institution alongside the risk score.
Source: The Block
Frequently Asked Questions
What is Mastercard Stablecoin Security?
It is a risk intelligence service that assigns a risk score to stablecoin payments before they settle on-chain. It checks transaction context and blockchain data for links to fraud, scams, and sanctions violations, and delivers the score via API so institutions can feed it into existing compliance systems.
When will Stablecoin Security be commercially available?
The service is launching first in North America, with global commercial availability expected in 2027. Borderless.xyz and Keyrails are among the first partners announced at launch.
Does using this service satisfy a bank's OFAC or BSA obligations?
No. A third-party risk score is a compliance input, not a substitute for an institution's own sanctions screening programme, customer due diligence, or suspicious activity reporting obligations. Institutions remain fully responsible for their own AML and OFAC compliance regardless of what tools they use.
Why does the multi-hop transaction finding matter for compliance teams?
Because nearly 60% of stablecoin transfer events in 2025 occurred within multi-step transactions, a counterparty check on the direct sender and receiver is often insufficient. Risk can accumulate at intermediate addresses, and monitoring systems built for two-party bank transfers may not capture it. Institutions need to confirm their tools are tracing the full on-chain path.
How should accounting teams record stablecoin transactions that are held pending a risk review?
Transactions under compliance review should be categorised separately in the digital asset ledger and not recognised as settled until the hold is lifted. Good crypto accounting software will allow compliance metadata such as risk scores and hold decisions to be attached to individual records, preserving an audit trail that satisfies both the regulator and the external auditor.