In March 2026 the FATF published its Targeted Report on Stablecoins and Unhosted Wallets: Peer-to-Peer Transactions. Its central finding is uncomfortable for exchanges and custodians. The money laundering risk in stablecoins concentrates after issuance, as tokens move between holders, hop across chains and pass through unhosted wallets where no obliged entity sees the transfer. For many illicit flows, the CASP is the only regulated touchpoint in a long chain of peer-to-peer hops, and it usually sees only the last one.
Seven months on, the report has become a reference point for EU authorities. AMLA cited it in its 7 October 2026 response to the Commission's MiCA review, and the indicators it lists are a practical starting point for monitoring rules.
The scale of the problem
The numbers in the report explain the attention. By the end of June 2025 there were 259 stablecoins in circulation, and their combined market capitalisation passed USD 300 billion later that year. The report cites a Chainalysis estimate that stablecoins made up 84% of illicit virtual asset transaction volume in 2025, often routed through unhosted wallets with layering designed to hide the origin of funds.
The FATF also notes that only a limited number of jurisdictions have frameworks written for the specific features of stablecoins. AMLA's MiCA paper adds an enforcement example: the US Treasury's December 2024 action against the TGR Group, a network the Treasury said helped Russian elites use dollar-backed stablecoins to evade sanctions.
What the FATF expects from VASPs
The report's recommended practices for the private sector are concrete. Paraphrased, they include:
- limiting the value customers can send to unhosted wallets;
- applying enhanced due diligence to transactions involving unhosted wallets;
- using blockchain analytics to risk-rate the counterparties behind those wallets;
- applying CDD at issuance and redemption across stablecoin arrangements.
It also describes jurisdictions that require issuers to build programmable controls into stablecoin contracts, so tokens can be frozen or deny-listed in secondary markets. For a CASP, that turns issuer cooperation into a live mitigation tool, provided the compliance team knows which issuer to contact and how quickly it acts.
Indicators worth turning into rules
The report's annex of risk indicators is its most useful part for a monitoring team. Several translate directly into detection logic:
| FATF indicator | What it means in practice |
|---|---|
| Unhosted wallets several hops away from Travel Rule-covered wallets | Counterparty risk depends on the path, so the direct counterparty score alone is insufficient |
| Frequently changing wallets that share artefacts (QR codes, domains, change addresses) | Clustering across fresh addresses, common in fraudulent donation and payment schemes |
| Deposits from wallets or instruments not demonstrably owned by the customer | Ownership evidence gaps at the point of deposit |
| Funds arriving after multiple rapid wallet-to-wallet transfers | Layering immediately before the regulated touchpoint |
| Counterparties with unverifiable beneficial ownership | Escalation trigger for EDD |
| Refund loops: goods bought with stolen identities, refunds paid in stablecoins to third-party wallets | Typology linked to drug trafficking organisations |
The first indicator is the one most monitoring stacks miss. A static exposure score on a fresh unhosted address says very little, because the address has no history. What matters is how far it sits from a Travel Rule-covered or attributed VASP wallet, and what lies on the path in between. Measuring that distance requires tracing. Interpreting it requires context: who the customer is, what the Travel Rule message says, and whether the pattern fits the account's expected activity.
The EU legal layer
Three instruments meet in a stablecoin transfer.
The TFR (Regulation (EU) 2023/1113) has applied since 30 December 2024. CASP-to-CASP transfers carry originator and beneficiary information with no minimum threshold. For transfers above EUR 1,000 to or from a self-hosted address, the CASP must take adequate measures to assess whether the address is owned or controlled by its customer (Articles 14(5) and 16(2)).
The AMLR adds Article 40 from 10 July 2027: a risk assessment and at least one mitigating measure for every self-hosted transfer, whatever the amount. AMLA guidelines on those measures are due by the same date.
MiCA governs which stablecoins a CASP may touch. Under Articles 16(1) and 48(1), ARTs and EMTs may only be offered or admitted to trading where the issuer meets MiCA's conditions. The Commission's answer in ESMA Q&A 2404 and ESMA's statement of 17 January 2025 required platforms to stop listing non-compliant tokens, while leaving mere custody and transfer possible. That residual space is now under pressure. In its 30 September 2026 response to the MiCA review, ESMA asked for an express rule barring CASPs from providing any licensable service for non-compliant ARTs or EMTs, and AMLA asked for consistent EEA treatment of tokens that continue to circulate or are intermediated by CASPs. If the Commission follows, custody and transfer of those tokens could become restricted too.
Five controls for the next quarter
1. Hop distance as a risk feature. For stablecoin transfers involving unhosted addresses, compute the distance to the nearest Travel Rule-covered or attributed VASP wallet in both directions, and feed it into alert scoring.
2. Standardised ownership evidence. Decide how your firm proves control of a self-hosted address above EUR 1,000 (signed message, small verification transfer, or wallet connection proof), and store the evidence with the transfer record so it can be produced on request.
3. Cross-chain continuity. A large share of stablecoin flow moves between Ethereum, TRON and Solana through bridges and swaps. An investigation that stops at a chain boundary loses the trail exactly where launderers expect it to.
4. A token inventory with MiCA status. List every stablecoin you custody or transfer, its issuer, its MiCA authorisation status and whether the issuer can freeze. That inventory answers the ESMA and AMLA questions above and tells your team who to call when a freeze is needed.
5. One case view. The Travel Rule payload, the KYC and screening record and the on-chain path belong in the same case. When they sit in three systems, analysts reconcile them by hand, and the reasoning behind the decision rarely survives into the audit trail.
Where Avus fits
Avus runs an agentic investigation on every alert. It follows funds across hops and chains, including the stablecoin rails on Ethereum, Solana and TRON, and assembles Travel Rule data (through integrations such as Notabene and 21 Analytics), KYC and screening results, internal records and blockchain analytics into a single case. Analysts can redirect the investigation mid-case when a lead looks promising.
The result is a case file that explains, in order, why a stablecoin transfer was cleared, held or reported. With stablecoins carrying most illicit crypto volume and supervisors reading the FATF annex, that explanation is what a compliance team will be asked for.
Sources
- FATF, "Targeted Report on Stablecoins and Unhosted Wallets: Peer-to-Peer Transactions", 3 March 2026
- BlockSec, "FATF stablecoin report: a shift to secondary-market compliance", 27 March 2026
- Isle of Man GSC summary of the FATF report, 28 April 2026
- Walkers, "The FATF's Targeted Report on Stablecoins and Unhosted Wallets", 14 April 2026
- Regulation (EU) 2023/1113 (TFR)
- Regulation (EU) 2024/1624 (AMLR), Art. 40
- ESMA Q&A 2404 and public statement on non-MiCA-compliant ARTs and EMTs, 17 January 2025
- AMLA, "AMLA identifies AML/CFT priorities for the review of MiCA", 7 October 2026
- RegReportingDesk, "AMLA MiCA review response: five AML/CFT gaps", 8 October 2026
This article is for information only and does not constitute legal advice.