Stablecoin Compliance: What Issuers, Exchanges, Wallets, and Payment Companies Need in 2026–2027

An exchange lists USDC. A payment company settles merchants in USDT. A fintech lets customers hold a dollar stablecoin. A company issues its own. A wallet lets users send all of the above.

Every one of them “works with stablecoins.” None of them has the same compliance obligations.

That is the practical problem this page addresses. Stablecoin compliance depends on what the business actually does with the stablecoin — issuing it, custodying it, transferring it, processing payments, or providing access to it — and on the jurisdictions involved. Stablecoin compliance depends on what a business does with the stablecoin and where that activity takes place, not simply on which token it uses.

Through 2026 and into 2027, stablecoins have also become their own regulatory layer rather than a sub-case of crypto rules: the US GENIUS Act, MiCA's ART and EMT regime, the UK's incoming FCA framework, Hong Kong's Stablecoins Ordinance, Singapore's proposed Payment Services Act amendments, the UAE's payment token regime, and FATF's sharpened focus on stablecoins and unhosted wallets. Those regimes sit at very different stages — some in force, some enacted but not yet effective, some still at consultation — and treating them as a single wave of “stablecoin regulation” is how compliance plans go wrong.

The same stablecoin can create different compliance obligations for an issuer, exchange, custodial wallet, payment processor, bank, or merchant.

Reserve and redemption rules, AML/KYC requirements, transaction monitoring, sanctions controls, and the Travel Rule solve different compliance problems and do not apply to every participant in the same way.

What Does Stablecoin Compliance Actually Include?

Stablecoin compliance is not one obligation. It is several distinct layers, and most businesses need some but not all of them.

Licensing and Authorization

The threshold question in any jurisdiction is who is permitted to issue, custody, transfer, convert, operate a platform, or provide payment services involving stablecoins — and under what authorization. The answer depends on the activity performed and where it is performed, not on the token.

Reserve, Redemption, and Disclosure Requirements

These are overwhelmingly issuer-level controls: what backs the token, how holders redeem at par, how reserves are segregated and attested, and what must be disclosed. They do not transfer automatically to an exchange, wallet or payment processor that merely handles the token.

KYC and KYB

Who the business must identify: its direct customers, corporate clients, merchants, beneficial owners, and — where required — counterparties. The scope follows the regulated relationship, which differs sharply between an issuer and a payment gateway.

AML Transaction Monitoring

What happens to funds after onboarding: source, destination, wallet risk, transaction patterns, exposure, sanctions, and suspicious activity. This is the layer that keeps working after the customer file is complete.

Sanctions Screening

A separate control from general AML risk scoring. A risk score is an analytical signal; a sanctions hit is a legal matter with its own handling requirements.

Travel Rule

Applies to in-scope transfers between in-scope service providers, according to each jurisdiction's implementation. It does not apply to every transfer in the world in the same way.

Recordkeeping and Reporting

The chain that has to hold together afterwards: customer → account → wallet → transaction → screening result → decision → report.

Stablecoin compliance is not one check. It is the combination of licensing, customer controls, transaction controls, sanctions, transfer-data requirements, and recordkeeping that applies to a specific business model.

Start With the Business Model, Not the Stablecoin

“Is USDT regulated?” is the wrong question. “What is our business doing with USDT?” is the right one.

The same stablecoin can create very different compliance obligations depending on whether a business issues it, holds it for customers, transfers it, accepts it as payment, or simply provides software that users control themselves.

The main compliance questions by business model:

• Stablecoin issuer — Can we issue at all? What reserve, redemption, AML, sanctions and monitoring duties apply?
• Exchange or trading platform — Can we list the asset? Who are our customers? Where do deposits and withdrawals come from?
• Custodial wallet — What custody, KYC, transaction monitoring and transfer rules apply to us?
• Non-custodial wallet software — Are we actually providing a regulated service, or only software?
• Payment gateway or processor — Who is the merchant? Who pays? Where are funds settled and paid out?
• Bank or fintech — What activity are we providing: custody, payments, conversion, settlement, issuance?
• Corporate treasury or merchant — Are we simply using stablecoins, or providing a regulated service to others?

None of these produces an automatic legal conclusion. Classification follows actual activity and jurisdiction, and the same company can sit in two rows at once.

Stablecoin Rules by Major Market in 2026–2027

Where the six main markets stand, with each regime's status stated explicitly:

• United States — GENIUS Act enacted; the OCC's final implementing rule for permitted payment stablecoin issuers takes effect 18 January 2027. Focus: who may issue, reserves, redemption, AML and sanctions. Relevant to issuers, banks and platforms serving the US market.
• European Union — MiCA's ART and EMT provisions have applied since 30 June 2024 and are in force. Focus: issuer authorization, reserves, redemption, governance, disclosure. Relevant to issuers, offerors and CASPs.
• United Kingdom — FCA final rules published 30 June 2026; the authorization gateway runs 30 September 2026 to 28 February 2027, and the new regime commences 25 October 2027. Focus: qualifying stablecoin issuance within a broader crypto authorization regime. Relevant to issuers, custodians and platforms.
• Hong Kong — Stablecoins Ordinance (Cap. 656) in force since 1 August 2025; the HKMA's public register shows the first issuer licences taking effect 10 April 2026. Focus: licensing of fiat-referenced stablecoin issuers plus AML/CFT expectations.
• Singapore — framework still at proposal stage. MAS set out its policy framework earlier and consulted on amendments to the Payment Services Act to give it a legislative basis; that consultation closed 16 October 2026. Until the amendments pass, stablecoins sit under the existing digital payment token rules.
• UAE — CBUAE Payment Token Services Regulation (C 2/2024) in force since 31 August 2024. Focus: payment token issuing, conversion, and custody and transfer. Relevant to issuers and payment-token service providers.

Two cautions on reading that list. Dates with different legal weight are not interchangeable — “in force,” “enacted but not yet effective,” “final rule with a future effective date” and “consultation” are four different things. And a regime being in force somewhere says nothing about whether it reaches your business; that depends on where you are established, where you provide services, and where your customers are.

United States — GENIUS Act

The GENIUS Act is enacted law, and the framework for permitted payment stablecoin issuers moves into effect on 18 January 2027. The OCC issued its final implementing rule in October 2026 with that same effective date, covering permitted activities, reserve assets and redemption, risk management, audits and supervision, custody, applications and registration, and capital requirements.

One detail matters disproportionately for compliance teams: the OCC handled Bank Secrecy Act, AML and sanctions requirements through a separate rulemaking. So an issuer reading only the OCC's reserve and licensing rule has not yet seen its AML obligations. Those tracks should be checked for current final-versus-proposed status before any implementation decision.

What this is not is a fully operational regime throughout 2026. The law exists; the issuer framework starts in January 2027. For how this sits inside the wider US picture — state licensing, the SEC and CFTC, tax reporting — see how the GENIUS Act fits into US crypto regulation.

European Union — MiCA

MiCA's stablecoin provisions, covering asset-referenced tokens (ARTs) and e-money tokens (EMTs), have applied since 30 June 2024 — earlier than the rest of the regulation, and earlier than most other stablecoin regimes anywhere.

At a high level they impose issuer authorization, reserve and backing requirements, redemption rights, governance standards, disclosure obligations, and additional requirements for tokens classified as significant.

One distinction is worth stating plainly, because it causes real confusion: MiCA issuer requirements and AML/KYT controls are related but not the same regulatory layer. MiCA governs whether and how a token may be issued and offered; the EU's AML framework governs customer due diligence and transaction controls. Meeting one does not satisfy the other. For the ART and EMT detail, see MiCA requirements for stablecoins.

United Kingdom — Preparing for 2027

The UK is in the transition phase that most firms find hardest to plan around: the rules are final, but the regime has not started.

The FCA published its final rules on 30 June 2026. The authorization gateway opened on 30 September 2026 and closes on 28 February 2027, and the new regime commences on 25 October 2027. For qualifying stablecoin issuers the rules cover full backing on at least a one-to-one basis, permitted backing assets, statutory trust arrangements segregating reserves from the issuer's own funds, and fixed redemption timelines at par.

The practical consequence of those dates is that firms intending to be authorized have a closing application window well before the regime they are applying under takes effect. The UK stablecoin regime is not already fully applicable in 2026. For the wider authorization picture, see UK stablecoin and crypto authorization rules.

Hong Kong — Licensed Fiat-Referenced Stablecoin Issuers

Hong Kong's Stablecoins Ordinance (Cap. 656) took effect on 1 August 2025, making the issuance of fiat-referenced stablecoins a licensed activity supervised by the HKMA. The regime also reaches issuance outside Hong Kong where the token references the Hong Kong dollar, and restricts who may offer these stablecoins locally.

Licensed issuers face reserve segregation, redemption at par, and explicit AML/CFT expectations including customer due diligence, ongoing monitoring, transfer checks and counterparty due diligence.

Worth noting for anyone assessing counterparties: the regime being in force is not the same as a populated market. The HKMA's public register of licensees shows the first licences taking effect on 10 April 2026, so the licensed issuer population is small and recent.

Singapore — Stablecoin Framework Still Moving Into Legislation

This is the market most often described inaccurately, so the status needs stating carefully.

MAS set out its single-currency stablecoin policy framework earlier, but that framework was policy rather than legislation. In September 2026 MAS consulted on amendments to the Payment Services Act 2019 intended to give it a statutory basis, including a licence class for stablecoin issuance. That consultation closed on 16 October 2026, and MAS has signalled a further consultation on the detailed subsidiary legislation.

Until the amendments pass, stablecoins continue to be dealt with under the existing digital payment token provisions of the Payment Services Act. It is wrong to say Singapore's stablecoin regime has been fully in force since 2023, and the legislative outcome should be re-checked before relying on any of this.

UAE — Payment Tokens and Multiple Regulatory Perimeters

The UAE has more than one relevant perimeter, and conflating them is a common error.

The CBUAE Payment Token Services Regulation (C 2/2024) has been in force since 31 August 2024. It regulates three activities carried out by way of business: payment token issuing, payment token conversion, and payment token custody and transfer.

Other virtual-asset activities can fall under different perimeters, including Dubai's VARA regime. So VARA is not the regulator for all stablecoin activity in the UAE, and a VARA licence does not answer a CBUAE payment-token question. For the Dubai VASP context specifically, see AML requirements for crypto businesses operating under VARA.

What FATF Expects From the Stablecoin Ecosystem

FATF is a global standard setter, not a national law — and that distinction does real work here.

In its targeted report on stablecoins and unhosted wallets, published 3 March 2026, FATF focused on stablecoin misuse, unhosted wallets, peer-to-peer transactions, secondary-market risk, cross-chain activity, AML/CFT/CPF controls, and the need for stronger monitoring and public-private cooperation. Its Seventh Targeted Update, later in 2026, noted that most identified on-chain illicit activity now involves stablecoins and flagged unhosted wallets as a priority action area — along with the emerging risk of a stablecoin designed to resist freezing and asset seizure.

FATF recommendations do not themselves create a directly enforceable licensing requirement for every private business. They are implemented through national law and regulation. FATF recommendations establish global AML/CFT standards, but specific stablecoin obligations become enforceable through national laws and regulations. Reading FATF as a forecast of where national rules are heading is useful; reading it as a rulebook that binds you directly is not. See how FATF's crypto standards are implemented by jurisdictions.

Stablecoin Compliance for Issuers

Depending on the jurisdiction, the issuer layer can include authorization or a licence, reserve management, redemption, asset safeguarding, governance, disclosures, customer due diligence for direct customers where applicable, an AML/CFT programme, sanctions controls, transaction and ecosystem monitoring, suspicious activity reporting, and technical controls such as freeze or burn where required or supported.

Two boundaries matter more than the list. Issuer obligations do not automatically become obligations of every exchange or merchant using that stablecoin — a payment company settling in USDC does not inherit Circle's reserve duties. And the direct issuance and redemption relationship is different from a secondary-market holding relationship: it is not the case that every stablecoin holder must be KYC'd by the issuer.

Reserve and redemption requirements primarily concern stablecoin issuers, while exchanges and payment companies have their own customer, transaction, sanctions, and transfer-data obligations.

Stablecoin Compliance for Exchanges and Custodians

The exchange and custodian layer centres on customers and flows rather than reserves: customer KYC and KYB, sanctions and PEP screening, stablecoin listing due diligence, issuer and asset risk assessment, deposit wallet screening, withdrawal address screening, transaction monitoring, suspicious activity detection, source-of-funds escalation, Travel Rule compliance where applicable, and recordkeeping.

One point is specific to stablecoins and routinely missed. The question is not only which stablecoin but which network. USDT on Tron, on Ethereum and on other chains is the same nominal asset in a different transaction environment, with different counterparty populations and different risk exposure — which is why why USDT TRC-20 payments need additional AML screening is a separate question from whether USDT is acceptable at all.

Stablecoin Compliance for Wallet Providers

“Wallet provider” covers two fundamentally different regulatory positions, and collapsing them produces wrong answers in both directions.

Custodial Wallets

A custodial provider controls the customer account and, in substance, the assets. Depending on the jurisdiction that can bring KYC, custody requirements, transaction monitoring, sanctions controls, Travel Rule obligations and reporting.

Non-Custodial Wallet Software

A non-custodial provider is not automatically a custodian. The question is whether the provider controls assets or provides a regulated service, or whether the user retains sole control — and the answer turns on function, jurisdiction and actual control rather than on the label.

Both extremes are wrong. Non-custodial wallets do not have zero compliance obligations everywhere, and not all wallet software is a regulated VASP. This is a question for legal analysis of the specific product, not a category assumption.

Stablecoin Compliance for Payment Gateways and Processors

A stablecoin payment flow runs merchant → payer → incoming stablecoin → settlement → merchant payout, and the compliance stack has to connect every point in it: merchant KYB, payer transaction risk, the receiving wallet, settlement, and the payout destination.

The structural difference from an exchange is that a gateway has two sets of relationships — the merchant it onboards and the payers it does not — and only one of them is its customer. For the full workflow, see AML controls for stablecoin payment gateways.

Stablecoin Compliance for Banks and Fintechs

A bank or fintech can hold, custody, convert, settle, offer payments, integrate a third-party stablecoin, or potentially issue one — and its obligations follow whichever of those it actually does.

What tends to be new for these institutions is third-party issuer due diligence. The practical questions:

• Who is the issuer?
• Where is the issuer authorized, and under which regime?
• What reserve and redemption rules apply to it?
• Which networks is the token supported on?
• Can the issuer take enforcement action on tokens, and under what conditions?
• What AML and sanctions controls does the issuer itself operate?
• What transaction monitoring does our own institution need, independently of the issuer's?
• Which Travel Rule obligations attach to our transfers?

The last two are the ones most often skipped, on the assumption that a regulated issuer carries the compliance burden for everyone downstream. It does not.

Stablecoin Risk Is Not Just Issuer Risk

Even a fully regulated stablecoin with a credible issuer produces transactions of wildly varying risk. Four separate layers are at work.

Asset / Issuer Risk

The issuer itself, its reserves, its redemption record, its sanctions policy, whether it has blacklist capability, and the jurisdiction it answers to.

Network Risk

One token can run on several blockchains, and the transaction environment differs by chain — different counterparty mixes, different service populations, different exposure profiles.

Counterparty Risk

Who the funds are actually going to or coming from: an exchange, a merchant, an OTC desk, a self-hosted wallet, or a sanctioned or illicit entity.

Transaction History and Exposure

Direct and indirect links to scams, hacks, sanctioned entities, darknet markets, mixers, stolen funds and other high-risk services.

A regulated stablecoin is not the same thing as a low-risk transaction. That single sentence resolves most of the confusion in this area: the token's regulatory status and the transaction's risk profile are independent variables. A compliance team should approve a stablecoin together with its supported networks and use cases rather than treating the token name alone as the full risk assessment.

Secondary-Market and Unhosted-Wallet Risk

An issuer may know its direct customer at the point of issuance and redemption. What happens in between is the harder problem.

After issuance the token can move peer-to-peer, enter self-hosted wallets, cross bridges, be swapped, enter DeFi protocols, and pass through OTC and P2P services — all without the issuer having a customer relationship with anyone involved. This is where secondary-market monitoring becomes a genuine compliance question rather than a theoretical one.

Stablecoin compliance increasingly extends beyond issuance and redemption because tokens continue circulating through exchanges, self-hosted wallets, bridges, DeFi protocols, payment systems, and cross-border transfers. FATF strengthened its focus on P2P stablecoin transactions through unhosted wallets in 2026 — but FATF showing regulatory direction and recommending that jurisdictions consider stronger controls is not the same as a requirement that every issuer worldwide monitor every wallet. The specific legal obligation depends on domestic implementation.

On the obfuscation side of this, AMLBot's research on how stablecoins move through privacy protocols shows what the secondary-market flows actually look like.

Stablecoin KYC and KYB: Who Actually Needs to Be Verified?

“Stablecoins require KYC” is too compressed to be useful. The obligation attaches to a relationship, not to a token.

How it actually distributes:

• Issuer → direct issuance and redemption customer — customer due diligence obligations where the regime imposes them.
• Exchange → its own customer — the exchange verifies the person or entity holding the account.
• Payment gateway → merchant — KYB on the business it onboards.
• Custodial wallet → wallet customer — KYC on the account holder.
• P2P recipient at a self-hosted wallet — not automatically anyone's customer, and not automatically subject to another participant's KYC.

KYC follows the regulated customer relationship; it does not automatically attach to every holder of a token. KYC follows the regulated customer relationship; it does not automatically attach to every holder of a stablecoin.

For businesses building that layer, AMLBot provides automated KYC and KYB verification for individual and corporate onboarding.

Stablecoin Transaction Monitoring: What Needs to Be Screened?

Monitoring is not a single check at a single moment. It runs across three stages.

Before Transaction

The customer or merchant is known, the relevant wallet is screened, sanctions are checked, the counterparty is attributed where possible, and the asset and network are on the approved list.

At Transaction

Amount, wallet, counterparty, direct and indirect exposure, behaviour, transaction pattern, and cross-chain context where relevant.

After Transaction

Re-screening as exposure changes, new risk exposure, sanctions list changes, behavioural alerts, case review, and reporting.

KYC answers who the customer is; stablecoin transaction monitoring answers what is happening with the funds. Stablecoin transaction monitoring should assess the wallet, network, counterparty, transaction history, and risk exposure rather than relying only on the identity of the token issuer.

For continuous application of these controls, AMLBot offers real-time stablecoin transaction monitoring.

Does the Travel Rule Apply to Stablecoins?

Potentially yes — where the transfer and the service providers involved fall within the relevant jurisdiction's Travel Rule regime.

What determines it: whether the transfer is between in-scope service providers, whether a self-hosted wallet is on either end, the applicable threshold, the jurisdiction, and the specific data each side must transmit and hold.

The Travel Rule can apply to stablecoin transfers when the relevant service providers and transactions fall within a jurisdiction's Travel Rule regime, but it does not apply identically to every stablecoin transfer worldwide. It is not the case that every USDT transaction requires Travel Rule data. For the jurisdiction-level picture, see stablecoin Travel Rule requirements by jurisdiction.

Where a business needs KYC/KYB, transaction screening and transfer-data workflows to operate together rather than as separate systems, the AMLBot Travel Rule Suite covers that combination.

Sanctions, Blacklists, and Stablecoin Freeze Controls

Three different things get used as synonyms here, and they are not interchangeable:

• Sanctions screening — the compliance team checking persons, entities, wallets and exposure against sanctions regimes.
• AML risk score — an analytical risk signal produced by blockchain analytics.
• Issuer blacklist or freeze — a technical control available to certain centrally issued tokens, exercised by the issuer.

A blockchain analytics provider can identify sanctions or illicit exposure, but it does not control the stablecoin smart contract and cannot independently freeze USDT or USDC. A blockchain analytics provider can identify sanctions or illicit exposure but cannot independently freeze USDT or USDC.

The reverse error matters too. Issuer blacklist capabilities do not replace KYC, sanctions screening, transaction monitoring, suspicious-activity reporting, or Travel Rule controls — an issuer's ability to freeze a token is not a compliance programme for anyone else handling it.

On who holds which power, see who can actually freeze USDT or USDC; for what issuer action looks like in real on-chain data, AMLBot's analysis of USDT and USDC freeze activity.

What Stablecoin Compliance Records Should a Business Keep?

The record has to connect the customer to the decision. In practice that means retaining the customer or business ID, KYC/KYB status, assigned risk level, the stablecoin, the blockchain, the source wallet, the destination wallet, the transaction hash, the amount, the screening result, the sanctions result, counterparty attribution, Travel Rule information where applicable, the alert or case, the compliance decision, supporting documents, any reporting or escalation, the timestamp, and the policy or rule version applied.

A company should be able to reconstruct why a stablecoin transaction was allowed, reviewed, rejected, or escalated. If that reconstruction requires someone's memory, the record is incomplete.

Stablecoin Compliance Checklist by Business Type

Which controls are generally relevant to which model:

• Licensing assessment — Issuer: yes. Exchange/custodian: yes. Payment gateway: yes. Bank/fintech: yes. Non-custodial software: depends on activity.
• KYC / KYB — Issuer: direct customers. Exchange/custodian: customers. Payment gateway: merchants and customers as applicable. Bank/fintech: customers. Non-custodial software: depends.
• Sanctions screening — Issuer: yes. Exchange/custodian: yes. Payment gateway: yes. Bank/fintech: yes. Non-custodial software: depends.
• Wallet and transaction screening — Issuer: increasingly relevant and jurisdiction-specific. Exchange/custodian: core control. Payment gateway: core control. Bank/fintech: depends on product. Non-custodial software: depends.
• Travel Rule — Issuer: depends on role and jurisdiction. Exchange/custodian: often relevant. Payment gateway: depends on regulated role. Bank/fintech: depends. Non-custodial software: not automatically.
• Reserve and redemption — Issuer: core control. Exchange/custodian: no. Payment gateway: no. Bank/fintech: only if issuing. Non-custodial software: no.
• Asset and issuer due diligence — Issuer: internal governance. Exchange/custodian: yes. Payment gateway: yes. Bank/fintech: yes. Non-custodial software: product dependent.
• Audit trail — Issuer: yes. Exchange/custodian: yes. Payment gateway: yes. Bank/fintech: yes. Non-custodial software: depends.

“Yes” means generally relevant to that business model, not universally mandatory in every jurisdiction. This is a planning aid, not a legal determination.

What Compliance Teams Should Build Before Adding Stablecoins

Step 1 — Define the Activity

Precisely which of these the company does: issue, custody, transfer, convert, accept, settle, list, or provide software.

Step 2 — Map Jurisdictions

Where the company is established, where the service is provided, where customers are located, where the issuer is located, and where transaction counterparties are located.

Step 3 — Approve Stablecoins and Networks Separately

Not “USDT = approved," but a specific token on specific supported networks, with a named issuer and a risk policy attached.

Step 4 — Define Customer and Merchant Verification

The KYC and KYB scope that follows from the actual customer relationships, not from the token.

Step 5 — Implement Wallet and Transaction Monitoring

Incoming and outgoing, where each is relevant to the business model.

Step 6 — Add Sanctions Controls

As a distinct control. A generic AML risk score is not a sanctions programme.

Step 7 — Map the Travel Rule Workflow

By jurisdiction and transfer type, including what happens with self-hosted wallet counterparties.

Step 8 — Define Escalation

Alert, manual review, hold, reject, SAR or STR, and escalation to an issuer or exchange where applicable.

Step 9 — Maintain an Audit Trail

Every decision reconstructable after the fact, including which policy version applied at the time.

Emerging Stablecoin Compliance Issues to Watch in 2027

Current rules and regulatory direction are different things, and this section is the second kind. Worth tracking: secondary-market monitoring expectations, unhosted wallet risk, cross-chain issuance, recognition of foreign stablecoins, multi-jurisdiction issuance structures, freeze-resistant stablecoin designs, AI-agent payments, institutional stablecoin settlement, and stronger operational testing of transaction controls.

On the agentic side, AML responsibility in AI-agent stablecoin payments covers the question of who owns compliance when a payment is initiated by software rather than a person.

Conclusion

There is no single stablecoin compliance checklist that works for every business. The required controls depend first on what the business does, then on where it operates and which stablecoin flows it handles.

The working order: classify the activity → identify the jurisdictions → verify customers and businesses → assess the token and the network → monitor transactions → apply sanctions and Travel Rule controls → document the decisions.

Two of those steps are where most teams need tooling rather than policy. If the gap is customer and merchant verification, that is a KYC/KYB problem. If it is wallet and transaction controls, that is a monitoring problem. They are solved separately.

FAQ

What Is Stablecoin Compliance?

Stablecoin compliance is not one regulation. It is the set of requirements covering authorization, KYC and KYB, AML, sanctions, transaction monitoring, the Travel Rule, reserve and redemption rules for issuers, and reporting and recordkeeping. Which of those apply depends on the business's role in the stablecoin flow and the jurisdictions involved.

Do Stablecoin Issuers Need KYC?

Often, for regulated customer relationships — but not every holder of a stablecoin is automatically the issuer's direct KYC customer. The distinction that matters is between someone issuing or redeeming directly with the issuer, who may be a customer, and a secondary-market holder who acquired the token elsewhere and has no relationship with the issuer at all.

Do Exchanges Need AML Monitoring for USDT and USDC?

Yes, where the applicable obligations require it. A stable asset price does not mean low AML risk — the two are unrelated. Exchanges still need to assess the wallet, the counterparty, sanctions exposure, transaction history and behavioural risk, because a regulated stablecoin can carry exposure to scams, hacks or sanctioned entities like any other asset.

Does the Travel Rule Apply to Stablecoin Transfers?

It can. Whether it does depends on the jurisdiction, the transfer type, whether the parties involved are regulated service providers in scope, and the applicable thresholds and required data fields. It is not correct that every stablecoin transfer worldwide falls under the Travel Rule, and self-hosted wallet counterparties are treated differently again.

Is USDT or USDC Automatically Compliant Because the Issuer Can Freeze Tokens?

No. Issuer freeze capability is a technical control held by the issuer, not a compliance programme for anyone else. It does not replace KYC, wallet screening, transaction monitoring, sanctions controls, Travel Rule obligations or reporting duties — all of which remain the responsibility of each business handling the token.

What Is the Difference Between Stablecoin Issuer Compliance and Exchange Compliance?

An issuer's obligations centre on issuance, reserves, redemption, governance and its own AML and sanctions duties. An exchange's centre on customer KYC, listing and asset risk, transaction monitoring, sanctions screening, transfers and the Travel Rule. They overlap on AML and sanctions but address different parts of the same flow, and neither inherits the other's duties.

Are Non-Custodial Wallets Subject to the Same Stablecoin Rules as Custodial Wallets?

Not automatically. Regulatory treatment depends on control over assets, the services actually provided, and the jurisdiction. A custodial provider holding customer assets sits in a different position from software where the user retains sole control — but neither extreme conclusion, that such software is always regulated or never regulated, holds universally.

Is the GENIUS Act Already in Effect?

The Act is enacted law, while the core issuer regime and the OCC's final implementing rule take effect on 18 January 2027. Bank Secrecy Act, AML and sanctions requirements were addressed through a separate rulemaking, so those tracks should be checked independently for their current status before relying on them.

How Does MiCA Regulate Stablecoins?

MiCA distinguishes asset-referenced tokens (ARTs) from e-money tokens (EMTs) and imposes issuer-specific requirements covering authorization, governance, reserves, disclosure and redemption. Those provisions have applied since 30 June 2024. MiCA governs issuance and offering; the EU's AML framework governs customer and transaction controls separately.

What AML Controls Should a Stablecoin Payment Company Have?

Depending on its regulated role and jurisdiction: merchant KYB, KYC where applicable, wallet screening on incoming payments and payout destinations, transaction monitoring, sanctions screening, Travel Rule workflows where in scope, a suspicious activity process, and an audit trail connecting each decision to the evidence behind it.