Stablecoin AML Compliance: What Banks Need to Know Now
Stablecoins have crossed $300 billion in collective market capitalisation, and banks are no longer watching from the sidelines. Settlement desks, custody offerings, and reserve services are being built around them right now. The financial crime risk is real, but according to Elliptic's latest analysis, it is manageable using frameworks banks already possess, with one critical addition: the ability to see what actually happens on-chain and verify it against what a counterparty claims. Firms looking to deploy robust crypto accounting software and AML controls need to understand exactly where stablecoin risk enters the institution and how to size the response.
Why Stablecoins Matter to Banks and Their Compliance Teams
The commercial case is straightforward. Cross-border settlements that clear in minutes rather than days, around the clock, represent a genuine upgrade on correspondent banking. A growing number of institutions want a share of that efficiency gain.
The problem is that the same properties that make stablecoins useful for legitimate payments also make them attractive for illicit finance. Elliptic's analysis is direct on this point: stablecoins have become the dominant rail for cryptoasset money laundering, and they appear with increasing frequency in sanctions evasion schemes, including those linked to Russia and Iran's central bank. That reality is a reason to manage the risk properly, not a reason to exit the market.
The Scale of the Shift
A $300 billion market cap does not sit still. It flows through correspondent accounts, reserve portfolios, VASP relationships, and increasingly, through retail customers whose wallets touch stablecoin rails. Every one of those channels is a potential entry point for financial crime risk, and compliance teams need to know which channel they are dealing with before they can calibrate the right control.
Three Channels Through Which Stablecoin Risk Reaches a Bank
Elliptic's framework identifies three distinct channels. Naming the right one is the starting point for a proportionate response.
Channel 1: The Issuer as Counterparty
Risk arrives here when a stablecoin issuer asks a bank to hold reserves or operate settlement accounts. The bank is effectively taking on a high-value correspondent-style relationship with an entity whose on-chain behaviour may or may not match what it says in its documentation. Traditional due diligence can assess the issuer's business model, governance structure, and stated controls. It cannot, on its own, tell you whether the token's wallet activity is consistent with those representations.
Channel 2: The Bank's Own Stablecoin Product
When a bank decides to offer stablecoin services directly, it inherits the design risks of the tokens it chooses to support. Key questions become: which stablecoins are permissible, which use cases are in scope, what monitoring thresholds apply, and under what circumstances should a transaction be escalated? The answers depend heavily on the design characteristics of each specific token.
Channel 3: Indirect Exposure Through Customers and VASPs
Elliptic flags this as the channel banks most often miss. Illicit actors have been documented using cash-to-stablecoin conversion steps several stages removed from the banking system. By the time stablecoin flows touch a bank's customer or a VASP in its correspondent network, the original source may be well obscured. The bank's task here is to map which customers and VASPs are sending or receiving stablecoins, identify the counterparties sitting behind those flows, and check how frequently they intersect with known money laundering, sanctions evasion, and fraud typologies.
Five Design Factors That Determine a Stablecoin's Risk Profile
Not all stablecoins carry the same risk. Elliptic's analysis points to five design-level factors that should inform how a compliance team assesses any given token before accepting it into a product, a reserve account, or a monitored flow.
1. Peer-to-Peer Circulation
The more freely a token circulates outside any regulated intermediary, the higher its risk profile. FATF's analysis has found that most illicit stablecoin activity now occurs in this secondary market, as tokens move between holders and across chains without an AML-obligated entity in the transaction path.
2. User Base and Jurisdiction
A stablecoin used primarily by institutional counterparties in lower-risk jurisdictions looks very different from one with broad retail adoption routed through high-risk VASPs. The geographic and counterparty profile of the user base is a material risk factor.
3. Regulatory Framework of the Issuer
A stablecoin issued under a formal regulatory regime, such as the US GENIUS Act or the EU's Markets in Crypto-Assets Regulation (MiCA), carries a categorically different risk profile from one issued with no meaningful oversight. The existence of a regulatory hook changes the enforcement landscape for both the issuer and the institutions that interact with it.
4. Smart-Contract Freeze and Block Capabilities
Some issuers build the ability to freeze or block tokens at the smart-contract level, which supports fraud recovery and sanctions compliance. Others deliberately do not. The latter carries higher residual risk, because the issuer cannot act unilaterally to reverse or block a transfer once it has been identified as problematic. For banks assessing issuer counterparties, this is a concrete technical due-diligence item, not an abstract policy question.
5. Wallet and Transaction Screening by the Issuer
Whether an issuer actively screens wallets and transactions and then enforces those results in its smart contracts changes how much risk its token carries into the broader market. An issuer that screens but does not enforce on-chain provides weaker protection than one whose controls are directly embedded in the token's logic.
Conducting Due Diligence on a Stablecoin Issuer
Existing correspondent banking frameworks are a valid starting point for assessing a stablecoin issuer as a counterparty. The gaps, however, are real and require additional capability.
What Traditional Due Diligence Covers
Business model, governance structure, stated AML and sanctions controls, and the regulatory status of the issuer can all be assessed using frameworks already in place at any regulated bank. These form the documentary layer of the assessment.
Where Blockchain Analytics Adds the Critical Difference
The documentary layer cannot confirm whether on-chain activity matches what the issuer claims. Blockchain analytics tools fill this gap by allowing a bank to monitor the issuer's actual wallet behaviour, verify the counterparties involved in the token's flows, and identify exposure to sanctioned or high-risk actors. This is not a supplementary check; Elliptic's analysis positions it as the essential addition to what would otherwise be a standard high-risk correspondent review. If the on-chain reality diverges from the stated risk profile, the bank has grounds to act before a problem reaches its own balance sheet or accounts.
This matters directly for firms building out digital asset accounting software stacks: the data flowing from blockchain analytics into an accounting system needs to be reliable and continuously reconciled, not a one-time snapshot taken at onboarding.
Accounting and Tax Implications for B2B Practitioners
Compliance teams and CFOs operating in this space face obligations that extend beyond AML into the accounting and reporting layer. Several points are worth flagging for accounting firms and finance teams.
Reserve Account Treatment
When a bank holds stablecoin reserves on behalf of an issuer, the accounting classification of those reserves under IFRS or US GAAP requires careful analysis. Whether the arrangement gives rise to a liability on the bank's balance sheet, and under what conditions those assets might be subject to consolidation, depends on the specific contractual terms and the level of control exercised over the reserve assets.
Transaction Monitoring Data as an Audit Trail
Blockchain analytics outputs are increasingly relevant to audit. For accounting firms working with clients who hold or transact in stablecoins, the on-chain transaction record provides a verifiable audit trail that supplements, and in some respects exceeds, what is available in traditional ledger environments. Firms building crypto bookkeeping software integrations need to ensure that this data is captured, timestamped, and retained in a way that satisfies both the AML record-keeping requirements and the accounting evidence standards expected by auditors.
Sanctions Exposure as a Financial Reporting Risk
If a firm's stablecoin holdings or flows are found to have intersected with sanctioned counterparties, the financial reporting consequences can be significant: asset freezes, regulatory fines, and potential restatement requirements. Elliptic's analysis specifically calls out dollar stablecoin holders and issuers as needing active detection and response capabilities for links to sanctioned jurisdictions. For CFOs, this means that the sanctions risk management programme is not separable from the financial close process.
For context on how stablecoin freeze mechanisms have already produced litigation, see our earlier coverage of the Tether USDT freeze linked to a Brazil enforcement action, which illustrates how issuer-level controls can produce downstream legal and accounting consequences for counterparties. The EU's regulatory angle is also relevant here: our piece on how EU lawmakers are embedding crypto into the anti-corruption strategy shows the direction of travel for firms operating under MiCA.
What a Proportionate Control Framework Looks Like
Elliptic's guidance converges on a practical principle: the controls should match the channel. An issuer-as-counterparty relationship warrants ongoing on-chain monitoring, not just initial due diligence. A bank's own stablecoin product requires documented criteria for which tokens are supported, which use cases are permitted, and how monitoring thresholds are calibrated to the design factors above. Indirect exposure through customers and VASPs requires transaction monitoring that can surface stablecoin flows even when no stablecoin product is offered directly.
The common thread across all three channels is that documentary controls alone are not sufficient. The on-chain verification layer is what gives a bank confidence that what it is told matches what is actually happening. Banks and compliance teams that build this capability are in a position to capture the commercial opportunity without taking on unmanaged financial crime risk. Those that rely on documentation alone are exposed in the channel they most frequently overlook: indirect exposure through customer and VASP flows.
Source: Elliptic
Frequently Asked Questions
What makes stablecoins a higher financial crime risk than other cryptoassets?
Stablecoins combine near-instant, low-cost cross-border settlement with fiat-pegged value stability. Those features make them efficient for legitimate payments, but the same efficiency applies to illicit transfers. FATF's analysis has found that most illicit stablecoin activity now occurs in the secondary market, where tokens move between holders without an AML-obligated intermediary involved in the transaction.
How should a bank assess a stablecoin issuer it wants to hold reserves for?
Start with existing high-risk correspondent due diligence: business model, governance, stated AML and sanctions controls, and regulatory status. Then add blockchain analytics to verify that the issuer's actual on-chain behaviour matches those representations. On-chain monitoring should continue after onboarding, not stop at it.
What is indirect stablecoin exposure and why do banks miss it?
Indirect exposure arises when a bank's customers or VASP counterparties send or receive stablecoins, even if the bank has no direct stablecoin product. Illicit actors have been documented converting cash to stablecoins several steps removed from the banking system, meaning the exposure can reach a bank without an issuer or a product being directly involved. It is the channel most frequently overlooked because it does not appear in standard product risk assessments.
Does the EU's MiCA regulation change the stablecoin risk picture for European banks?
Yes, materially. A stablecoin issued under MiCA carries a different regulatory risk profile from one issued outside any supervisory framework, because the issuer is subject to authorisation, reserve requirements, and ongoing supervision by an EU competent authority. Banks in the EU, or dealing with EU-issued stablecoins, should factor the issuer's MiCA status into their counterparty risk assessments and update that status as the supervisory landscape evolves.
What accounting records should firms keep for stablecoin transactions to satisfy auditors?
Firms should retain on-chain transaction records with timestamps, wallet addresses, transaction hashes, and the blockchain analytics outputs used to assess counterparty risk at the time of each transaction. This data supports both AML record-keeping obligations and the audit evidence requirements under IFRS and US GAAP. Ensuring that crypto bookkeeping software captures and preserves this data in a structured, retrievable format is essential before any audit cycle begins.