Why Generic Screening Fails Stablecoin Compliance Programs

Stablecoins have quietly become the dominant rail for illicit finance on-chain, and the compliance frameworks most firms have in place were not built for them. A designate-then-screen model, where a name hits a sanctions list and you screen against it, is necessary but structurally too slow for how stablecoin risk actually moves. The gap between when a bad actor starts using a token and when they appear on any list can be days, weeks, or longer. That window is where the exposure lives, and it is exactly where generic crypto accounting software and standard transaction monitoring leave organisations blind.

Stablecoins Are Traceable, But the Threat Moves Fast

Every stablecoin transaction is recorded on-chain. The flow of funds across blockchains can be followed, and every wallet interaction can be screened and assessed for risk signals. That traceability is a genuine compliance advantage over cash or even traditional wire transfers. The problem is that illicit actors know this and have adapted.

How Illicit Actors Exploit the Screening Lag

Elliptic's research points to two patterns that illustrate the timing problem clearly. First, IRGC-linked flows moved hundreds of millions in USDT through exchange platforms before those platforms or counterparties appeared on any sanctions list. Second, Russia's A7A5 ruble-backed stablecoin built what amounted to a parallel settlement system while operating entirely outside designated lists. In both cases, the activity was traceable in retrospect. But firms relying on list-based screening had no early warning.

North Korean actors add a speed dimension that makes the problem even sharper. When Lazarus Group or affiliated clusters steal stablecoins, they layer the funds through mixing services and cross-chain bridges within hours of a hack, long before any list is updated. By the time a designation is issued, the funds have already moved through multiple hops and the trail requires significant forensic work to reconstruct.

The practical implication for compliance teams is that reactive screening, even when it is well-configured and well-maintained, cannot close this timing gap on its own. Detection needs to move upstream, into the ecosystem itself, before a counterparty reaches a sanctions list.

Why the Risk Profile Differs by Institution Type

One of the more useful frameworks in Elliptic's analysis is the observation that stablecoin compliance obligations look very different depending on what type of organisation you are. A stablecoin issuer, a bank, and an exchange each face distinct exposure surfaces, and a generic compliance layer cannot be tuned precisely enough to serve all three.

Stablecoin Issuers: Ecosystem-Wide Visibility

An issuer's compliance challenge is structural. A stablecoin does not stay with the wallets it is originally issued to. It gets traded on secondary markets, bridged to other blockchains, deposited into DeFi protocols, and transferred peer-to-peer across thousands of wallets the issuer has never onboarded. Regulators are nonetheless beginning to expect issuers to have insight into those ecosystem-wide risk indicators and to design controls around them.

That regulatory expectation is codified in both the GENIUS Act in the United States and the Markets in Crypto-Assets Regulation (MiCA) in the European Union, as well as in FATF guidance. Issuers must be able to freeze wallets controlled by sanctioned parties, file Suspicious Activity Reports with supporting on-chain evidence, and reassess relationships with virtual asset service providers whose downstream activity presents unacceptable risk. Standard counterparty screening, which looks only at the wallets the issuer itself has onboarded, does not reach that far.

Effective issuer compliance requires asset analytics dashboards that surface risk exposure trends specific to the token's network, plus an alerting layer that can flag specific prohibited or high-risk transactions as they occur, not after a list update.

Banks and Financial Institutions: The Indirect Exposure Problem

Many banks assume stablecoin compliance is only relevant if they have an active crypto strategy. That assumption is increasingly wrong. Consider three scenarios that require no direct crypto activity on the bank's part: a corporate client receives a dollar payment that originated as USDT and was converted through an exchange; a fintech customer integrates stablecoin settlement into its payments product; a correspondent banking client provides services to institutions that interact with stablecoin infrastructure. In each case, the risk is real but invisible to traditional transaction monitoring.

Regulators are already responding. In September 2025, the New York Department of Financial Services issued guidance to all New York banking organisations engaged in or considering virtual currency activity. That guidance set specific expectations covering wallet screening, source-of-funds verification, and ecosystem monitoring. Other jurisdictions are moving in the same direction.

For banks serving stablecoin issuers directly, there is a second layer beyond their own customer screening: the issuer's own ecosystem. Issuer due diligence (IDD) capabilities give banks ongoing visibility into an issuer's wallet behaviour, counterparty risk across the issuer's network, and concentrations of activity in high-risk jurisdictions. With the GENIUS Act establishing ongoing monitoring obligations for banks that hold issuer reserves or provide banking services to issuers, that kind of continuous visibility becomes an operational requirement, not just a best practice.

Exchanges: Catching Behavioural Patterns, Not Just Names

Exchanges face a different set of stablecoin-specific patterns that generic screening tools were not designed to detect. Four are worth flagging explicitly.

• Rapid mint-burn cycles: large volumes of stablecoins are minted, moved through intermediary wallets, and burned within hours, exploiting the gap between minting and sanctions screening.
• Cross-chain movement: USDT is bridged from Ethereum to TRON to a less-monitored network, breaking the tracing chain at each hop and making provenance reconstruction harder.
• Concentration patterns: a disproportionate share of a stablecoin's volume flows through wallets in jurisdictions with weak AML enforcement.
• Peel chains: large stablecoin balances are broken into smaller amounts and distributed across dozens of wallets before being consolidated at an off-ramp.

Each of these patterns is designed to create breaks in the tracing chain. Any gap in cross-chain coverage is a gap in the compliance program, and stablecoin laundering is deliberately structured to find and exploit those gaps.

Accounting and Tax Implications for Firms

For Accounting Firms and CFOs

The compliance obligations described above generate significant accounting work. Freeze events, SAR filings, and issuer relationship reassessments all require contemporaneous documentation, and that documentation needs to be audit-ready. Firms using crypto accounting software to manage digital asset positions need to ensure that their software can capture the on-chain evidence trail that regulators and auditors will expect to see, not just the settlement amounts.

For CFOs at institutions with stablecoin exposure, the indirect exposure scenarios are particularly relevant. If a corporate treasury holds stablecoins as a liquidity tool or accepts stablecoin settlements, the accounting treatment needs to reflect not just the fair value of the asset but also the AML screening status of the counterparties involved. Any freeze or enforcement action affecting a stablecoin position will also require disclosure assessment under applicable financial reporting standards.

Banks that provide services to stablecoin issuers will need to document their IDD processes as part of their own internal controls framework. As GENIUS Act obligations crystallise, auditors will look for evidence that ongoing monitoring of issuer ecosystems is embedded in operational workflows, not treated as a one-time onboarding exercise.

For Individual Filers and Smaller Operators

For individual taxpayers or smaller operators transacting in stablecoins, the compliance picture looks different but is not irrelevant. If funds received as stablecoin payments pass through wallets that later attract enforcement scrutiny, the individual may face source-of-funds questions from their exchange or bank. Keeping clean records of the origin and destination of stablecoin flows is not just good practice for tax reporting; it is increasingly a baseline expectation from regulated counterparties.

From a tax perspective, stablecoin transactions that look like simple transfers may still trigger reporting obligations depending on jurisdiction and structure. In the US, the IRS treats stablecoin-to-fiat conversions and stablecoin-to-crypto swaps as taxable events. Any position that is frozen by an issuer acting under regulatory direction creates additional complexity: the asset is neither realised nor freely disposable, and the tax treatment of that status is not yet settled in most jurisdictions. Filers in that situation should seek specific advice rather than applying standard disposal rules.

What Robust Stablecoin AML Requires in Practice

The picture that emerges from Elliptic's analysis points toward a set of capabilities that any serious stablecoin compliance program needs to have, regardless of institution type.

Upstream Risk Detection

Monitoring needs to happen at the ecosystem level, identifying emerging risk signals before they reach a scale that attracts enforcement attention. That means behavioural pattern detection, not just list matching. It means continuous monitoring of wallet clusters associated with high-risk jurisdictions, mixing activity, and rapid cross-chain movement, even when none of those wallets has yet been designated.

Cross-Chain Provenance

Any break in the tracing chain is a break in the compliance program. Effective coverage needs to follow assets as they move across bridges, decentralised exchanges, and wrapping protocols, maintaining complete provenance at every hop. Coverage of 64 or more blockchains is the kind of scope that stablecoin laundering patterns demand; narrower coverage creates exploitable blind spots.

Audit-Ready Documentation

Regulators and auditors are not just asking whether screening happened. They are asking whether there is a structured, documented path from risk identification to decision. Compliance workflows need to generate that documentation automatically at each stage, from the initial flag through the investigation to the final disposition. That is what turns a monitoring capability into an evidence trail that holds up under regulatory scrutiny.

Firms that treat stablecoin AML as an extension of their existing fiat compliance program are likely to find that the fit is poor. The timing gaps, the cross-chain complexity, and the ecosystem-wide obligations that regulators are beginning to impose all point in the same direction: stablecoin compliance requires purpose-built tooling and a framework designed around how stablecoin risk actually behaves, not how traditional financial crime was monitored a decade ago.

For accounting firms and CFOs advising clients with stablecoin exposure, the practical starting point is a gap analysis: map the client's actual stablecoin touchpoints, including indirect ones, against the monitoring and documentation capabilities currently in place. The NYDFS guidance from September 2025 and the GENIUS Act framework together provide a useful benchmark for what regulators expect to see, even in jurisdictions where specific rules have not yet been finalised.

Source: Elliptic

Frequently Asked Questions

Why is a designate-then-screen model insufficient for stablecoin compliance?

List-based screening only catches known bad actors after a designation has been issued. Stablecoin-specific threats, such as IRGC-linked exchange flows and North Korean laundering operations, move through the ecosystem and then disappear into bridges and mixers before any list is updated. The timing gap between illicit activity and designation is where the exposure lives.

Do banks need stablecoin AML controls even if they have no direct crypto strategy?

Yes. Indirect exposure arises when corporate clients receive payments that originated as stablecoins, when fintech partners integrate stablecoin settlement, or when correspondent banking clients serve institutions connected to stablecoin infrastructure. The NYDFS September 2025 guidance specifically addresses banking organisations engaged in or contemplating virtual currency activity, a scope that catches many institutions that do not think of themselves as crypto firms.

What does the GENIUS Act require of banks serving stablecoin issuers?

The GENIUS Act establishes ongoing monitoring obligations for banks holding issuer reserves or providing banking services to stablecoin issuers. That includes continuous visibility into the issuer's wallet behaviour, counterparty risk across the issuer's network, and concentrations of activity in high-risk jurisdictions, not just a one-time onboarding check.

How should a CFO account for a stablecoin position that has been frozen by an issuer?

A frozen stablecoin is neither realised nor freely disposable, which creates accounting ambiguity. The asset likely cannot be derecognised until the freeze is resolved, but it may also need to be impaired or reclassified depending on the duration and the probability of recovery. The tax treatment is similarly unsettled in most jurisdictions. CFOs facing this situation should seek specific legal and accounting advice rather than applying standard disposal rules.

What cross-chain patterns should compliance teams flag in stablecoin monitoring?

Four patterns warrant particular attention: rapid mint-burn cycles designed to exploit screening gaps; cross-chain bridging across Ethereum, TRON, and less-monitored networks to break the tracing chain; concentration of volume through wallets in weak-AML jurisdictions; and peel chains where large balances are fragmented across dozens of wallets before consolidation at an off-ramp. Each is designed to create breaks in provenance, and effective monitoring needs to maintain tracing continuity across all hops.