In brief
- Stablecoins are the most popular virtual assets used in illicit transactions, the Financial Action Task Force said in its latest report.
- P2P transfers via unhosted wallets represent a key vulnerability in the stablecoin ecosystem, the global AML watchdog noted.
- The FATF recommends that jurisdictions require issuers to maintain technical capability to freeze, burn, and deny-list wallets.
Peer-to-peer stablecoin transfers have become a “key vulnerability” contributing to money laundering, terrorist financing, and sanctions evasion, according to a report by the Financial Action Task Force (FATF), an intergovernmental body established by G7 countries to set global anti-money laundering standards.
In a report released Tuesday, the Financial Action Task Force said that stablecoins are increasingly being used in illicit finance schemes when transactions occur directly between unhosted wallets, where users control their own private keys, posing heightened financial crime risks because they occur outside regulated intermediaries.
“Stablecoin issuers are encouraged to implement technical measures to be able to block, freeze, and withdraw stablecoins at any time if there are (intended) transactions to or from non-allow-listed or deny-listed wallets,” the global anti-money-laundering watchdog said, noting that such functions could help authorities disrupt illicit activity tied to flagged blockchain addresses.
Stablecoins and regulators
The warning comes amid rising regulatory concern over the growth of stablecoins and their increasing use across the digital asset ecosystem.
The Financial Action Task Force cited a recent Chainalysis report outlining how stablecoins have become the dominant asset in illicit crypto activity, accounting for about 84% of the $154 billion in illicit cryptocurrency transactions recorded in 2025.
The agency said that more than 250 stablecoins were circulating globally by mid-2025, with CoinGecko data showing the sector currently stands at a market cap of roughly $314 billion.
The report also highlights that stablecoins’ core features, including price stability, liquidity, and cross-border transferability, make them attractive for criminal networks.
Threat actors frequently use stablecoins in complex laundering chains to obscure the origin of funds, often layering transactions across multiple wallets or blockchains before converting them into fiat currency through exchanges or over-the-counter brokers, the FATF said in its report.
“Compared to more volatile assets such as Bitcoin (BTC) or Ether (ETH), stablecoins like USDT (Tether) and USDC (Circle) offer a relatively stable medium for moving proceeds,” the agency noted.
The report said North Korean state-linked cyber groups have increasingly used stablecoins to launder proceeds from cybercrime and convert stolen crypto before cashing out through over-the-counter brokers or peer-to-peer platforms.
Meanwhile, Iranian actors, including those linked to the Islamic Revolutionary Guard Corps, have leveraged stablecoins and other virtual assets to finance proliferation activities, obtain drone components and high-tech equipment, and transfer funds to sanctioned groups in the region, according to the watchdog.
The FATF and stablecoins
The new findings build on earlier warnings from the FATF about the expanding role of stablecoins in illicit finance.
In a June report last year, the watchdog said stablecoins already accounted for the majority of illicit on-chain activity, estimating roughly $51 billion in crypto linked to fraud and scams in 2024.
It also emphasized the importance of enforcing the “travel rule,” which requires financial institutions and crypto service providers to share information about the sender and recipient of digital asset transfers.
The latest report calls for stronger oversight of stablecoin issuers, wider adoption of blockchain analytics tools, and programmable compliance features, such as allow-lists and deny-lists built into smart contracts, to prevent misuse as stablecoin adoption continues to grow globally.
Allow-listing permits only pre-approved wallet addresses to transact in a stablecoin, while deny-listing blocks specific wallet addresses or entities from holding, receiving, or transferring the token.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
