FATF and Stablecoins in 2026: Crypto’s New Money-Laundering Rail

For years the mental image of crypto crime was a Bitcoin address: an anonymous string of characters holding coins that could swing ten percent before lunch. That image is now out of date. According to the Financial Action Task Force, the global body that writes the rules governments use to fight money laundering, most on-chain illicit activity today runs on stablecoins, the dollar-pegged tokens that most users treat as boring plumbing. The analytics firm Chainalysis, whose data the FATF cites, puts the figure at 84% of all illicit transaction volume in 2025.

Bitcoin is trading near $77,000 as of 11 September 2026, and traders spend their days arguing over the next Federal Reserve meeting and the next inflation print, the kind of macro noise that fills our price-target coverage. The quieter, larger story sits one layer down, in the roughly $291 billion stablecoin market, where Tether’s USDT alone accounts for about $183 billion and Circle’s USDC another $74 billion. That plumbing has become the main rail for legitimate commerce and, increasingly, for laundering, sanctions evasion, and the financing of North Korean weapons programs.

Here is the tension this piece unpacks. FATF’s rulebook was built for a world of exchanges passing customer data to each other. Stablecoins broke that world, because value moves wallet to wallet with no exchange in the middle. So the rules have quietly leaned on the one control point that survives: a private issuer’s ability to freeze a wallet with a line of code. That works for USDT and USDC. It does not work at all for a new breed of coins engineered so that nobody can freeze them. The freeze button has become the rulebook, and the most interesting question in crypto compliance is what happens when someone builds a coin with no off switch.

FATF in one section: the global AML rule-setter

The Financial Action Task Force was founded in 1989 by the G7 in Paris and is housed at the OECD. It does not pass laws. It writes 40 Recommendations that its roughly 40 members and a Global Network of more than 200 jurisdictions are expected to translate into national rules, then grades them through peer reviews called mutual evaluations. Its real teeth are two lists: a black list of high-risk jurisdictions (currently North Korea, Iran, and Myanmar) and a grey list of countries under increased monitoring. Landing on either raises the cost of every cross-border transaction for an entire economy, which is how a body with no enforcement power makes non-binding standards bite.

Crypto entered this framework in October 2018, when FATF added the terms virtual asset and virtual asset service provider, or VASP, to its glossary. A VASP is any business that, for or on behalf of a customer, exchanges crypto for fiat or for other crypto, transfers it, holds or administers it, or provides financial services around a token issuance. In June 2019 an Interpretive Note to Recommendation 15 extended the so-called Travel Rule to these providers, requiring them to collect and pass on originator and beneficiary information for transfers, exactly as banks do for wire transfers.

One clarification matters for US readers, because it is the single most common mistake in this area. The authority that polices crypto anti-money-laundering compliance in the United States is not the Securities and Exchange Commission. It is FinCEN, the Financial Crimes Enforcement Network, together with OFAC for sanctions, both under the Bank Secrecy Act. The SEC handles the securities dimension and runs its own separate enforcement machine, but a stablecoin laundering case is FinCEN and OFAC territory. In the EU the equivalent job belongs to national financial intelligence units and, from 2026, to a new central authority called AMLA.

How stablecoins became crypto’s money-laundering rail

Criminals adopted stablecoins for the same reasons everyone else did. A launderer moving value across borders does not want the asset to drop fifteen percent while the money is in transit, so a token that holds a dollar peg is far more useful than volatile Bitcoin. Stablecoins settle in seconds, run around the clock, cost almost nothing to send on networks like Tron, carry deep liquidity, and are programmable. Somewhere around 2022 they overtook Bitcoin as the dominant illicit rail, and they have not looked back.

The scale is now hard to wave away. Chainalysis found that illicit addresses received at least $154 billion in 2025, up 162% year over year, though that still amounts to less than one percent of all on-chain volume. The surge was driven overwhelmingly by sanctioned entities, whose received value jumped 694% to roughly $104 billion. FATF’s own findings echo the pattern: its July 2026 update reported that terrorist organizations including ISIL and Al-Qaeda now favor stablecoins over Bitcoin for fundraising, and that North Korean and Iranian actors lean on them for cyber-heist laundering and proliferation financing.

What alarms regulators is not just the volume but the professionalism. Chainalysis describes 2025 as the year crypto crime became industrialized, with organized groups running modular laundering supply chains and nation-state actors using the same stablecoin and exchange rails as legitimate businesses. That same industrialization is visible on the defensive side too, a theme we have traced in how attacks and defenses have both scaled up in 2026. When the criminals operate like a business, the compliance response has to operate like one as well.

From the Libra panic to a dedicated stablecoin report

FATF did not wake up to stablecoins in 2026. The story starts in October 2019, when Facebook’s proposed Libra project spooked finance ministers badly enough that the G20 formally asked FATF to study the money-laundering risks of what it carefully called so-called stablecoins. The following July, FATF delivered a report to the G20 that examined existing tokens such as Paxos and Dai alongside the proposed Libra and Gram, and flagged anonymity, global reach, and the ease of layering as the core vulnerabilities.

That report recommended dedicated guidance, which arrived on 28 October 2021. The updated risk-based approach covered stablecoins, DeFi, NFTs, peer-to-peer transfers, and unhosted wallets, and it made a consequential call about responsibility: the governance body or central developer of a stablecoin arrangement should generally be treated as a VASP, though, as Skadden noted at the time, that definition deliberately excludes people who only write the underlying software code. In other words, whoever sets the rules of the coin is on the hook; a pure coder is not.

After that came annual targeted updates through 2022, 2023, 2024, and 2025. But 2026 brought the two documents that reframed the whole debate: a dedicated Targeted Report on Stablecoins and Unhosted Wallets, published on 3 March, and the seventh Targeted Update on 16 July. The timeline below shows how the guidance moved from an afterthought inside a broader virtual-asset framework to a stand-alone priority.

Inside FATF’s March 2026 stablecoin playbook

The March 2026 report is the closest thing to a stablecoin playbook FATF has produced. It opens with the scale problem: more than 250 stablecoins in circulation and a market worth over $300 billion by the middle of 2025, a market that already carried 84% of illicit virtual-asset transaction volume. It then documents how money launderers, terrorist financiers, and state-linked cyber groups, from North Korea to Iran, have made stablecoins their preferred instrument for moving the proceeds of ransomware, phishing, and fraud, very often through unhosted wallets that no regulated intermediary ever touches.

The recommendations fall into three buckets. First, legal frameworks: governments should impose clear anti-money-laundering obligations on stablecoin issuers, intermediaries, and custodians, and require risk mitigation for transactions involving unhosted wallets. Second, technical capacity: supervisors and law enforcement need real expertise in smart-contract behavior, cross-chain transaction mechanics, and blockchain analytics, not just paper policies. Third, and most striking, innovative controls.

That third bucket is where the freeze button enters the rulebook. FATF pointed to jurisdictions that now require issuers to embed programmable controls directly into stablecoin smart contracts, so that freezing, deny-listing, or other mitigation can happen even in secondary markets after a coin has left the issuer’s hands. In effect, the world’s leading anti-money-laundering standard-setter is now endorsing on-chain monitoring and issuer-level intervention as a compliance backbone, an approach analytics firms and compliance vendors had urged for years as the old data-handoff frameworks fell behind.

Who is the VASP for a stablecoin?

To see why FATF has fallen back on issuer freezes, you have to understand what stablecoins break. The Travel Rule assumes two VASPs in every transaction: the sender’s exchange and the receiver’s exchange, handing identity data to each other like two banks clearing a wire. That model works when both ends of a transfer sit at regulated companies. It collapses the moment value moves from one self-hosted wallet to another, because there is no VASP in the middle to collect or pass anything.

FATF’s 2021 answer was to designate the arrangement’s governance body as a VASP. But apply that to USDT or USDC and the logic strains. Tether and Circle mint and redeem the tokens and can freeze them, yet they are not your counterparty when you send a stablecoin to a friend, a merchant, or a mixer. They do not see, gate, or approve each peer-to-peer transfer the way an exchange gates a withdrawal. So the entity FATF can point to as the responsible VASP is precisely the entity that sits outside most of the transactions it is supposed to police.

That leaves unhosted wallets and pure peer-to-peer flows as a structural blind spot, one FATF has flagged repeatedly. Self-custody is not illegal, and it is central to how crypto works; the same wallets that let a dissident hold savings beyond a hostile bank also let a launderer skip the KYC desk, a double-edged reality we explored in our look at whether consumer wallets can actually stop a drainer. When the data-handoff model has no one to hand off to, the only universal control point left in a centralized stablecoin is the issuer’s freeze switch. Which brings us to how that switch actually works.

The freeze button becomes the rulebook

A centralized stablecoin is not really a bearer instrument, whatever it looks like on-chain. Its smart contract typically includes an administrative function, a blacklist or freeze capability, that lets the issuer flag an address so it can no longer send or receive the token. In the most complete version, the issuer can also burn the frozen balance and reissue it elsewhere at the direction of a court. USDC calls this a blacklist function; USDT implements a comparable freeze and reissue. Either way, a single company holds a switch that can immobilize any holder’s funds anywhere in the world, instantly.

This is what compliance specialists mean by programmable compliance, and it is genuinely powerful. Freezing a wallet used to require serving a subpoena on a custodian and hoping the funds had not already moved. Now the funds can be locked in the time it takes to push a transaction, regardless of which exchange, bridge, or wallet holds them. FATF’s March report did not just tolerate this capability; it held it up as a model and nudged more jurisdictions to mandate it.

The trade-off is equally real. A freeze function turns a private company into something close to a global asset-seizure authority, exercising a power that normally belongs to courts and governments. It only exists for centralized issuers, and it directly contradicts the censorship-resistance that drew many people to crypto in the first place. Two very different companies now sit at the center of that contradiction, and they have chosen very different postures.

Tether’s shadow enforcement arm

Tether, the issuer of USDT, has leaned into the role of enforcer. In September 2024 it launched the T3 Financial Crime Unit alongside the Tron network and the analytics firm TRM Labs. By 2026 the unit reported it had frozen more than $450 million in illicit USDT across 23 jurisdictions on five continents, intercepting far more illicit value in 2025 than the year before. Crucially, T3 can act fast, often locking flagged funds within 24 hours of receiving credible intelligence, a speed no traditional asset-forfeiture process can match.

The headline example came in April 2026, when Tether froze roughly $344 million in USDT spread across two Tron addresses that OFAC and US investigators tied to Iran’s central bank, part of an effort to squeeze Tehran’s use of digital assets to mask cross-border payments. The tokens sat in wallets tied to Iranian sanctions-evasion infrastructure, and a follow-on freeze later in the year pushed the total blocked in that single campaign toward half a billion dollars.

The upshot is that a private stablecoin issuer now runs an enforcement operation whose reach rivals that of many national authorities, and it does so at a speed that reshapes how stolen or sanctioned funds get chased. That capability matters far beyond sanctions; it is increasingly central to the after-the-fact scramble to claw back stolen crypto, a race we have followed in our coverage of recovery efforts after major hacks. Speed, though, cuts both ways, and Tether’s biggest competitor has drawn the opposite lesson.

Circle, court orders, and the moral quandary

Circle, the issuer of USDC, has spent years demonstrating its freeze capability while insisting it should be used sparingly. In August 2022, after OFAC sanctioned the Tornado Cash mixer, Circle blacklisted 81 associated addresses and froze more than 75,000 USDC, an early proof that a stablecoin issuer would enforce sanctions on-chain. In May 2025 it froze tens of millions of dollars tied to the LIBRA memecoin scandal, and in March 2026 it froze 16 business hot wallets on the strength of a sealed civil lawsuit, only to reverse five of them, including one holding nearly 131,000 USDC, after a public backlash.

That reversal captures Circle’s stance. Speaking in Seoul on 13 April 2026, chief executive Jeremy Allaire said the company would not freeze USDC without a court order, arguing that blacklisting decisions should not be made at a company’s discretion in the heat of an exploit. Circle, he said, has a very, very clear performance obligation under the law, and USDC should be understood as a regulated financial product subject to legal process, not a real-time intervention tool. When Circle declined to freeze funds during the Drift exploit, Allaire framed it as a genuine moral quandary rather than a simple compliance call.

Not everyone is persuaded. The on-chain investigator ZachXBT has argued that Circle’s caution let more than $420 million in illicit funds slip away since 2022, time that a faster freeze might have saved. The disagreement is the whole debate in miniature: should the fastest available tool for stopping crime be wielded on suspicion, or only after a judge signs off? The two largest stablecoin issuers have landed on opposite answers, as the scorecard below shows.

The counter-move: stablecoins built not to freeze

If the freeze button is the enforcement lever, the obvious criminal counter-move is to build a coin without one. FATF’s July 2026 update warned that this is already happening, noting that some criminal networks have begun issuing proprietary stablecoins designed to resist freezing and seizure, and that compliance teams may no longer be able to rely on issuer-level freeze or burn mechanisms as a safeguard. The report even described the trigger: after a third-party issuer froze more than $29 million in one network’s wallets, that network launched its own dollar-pegged token marketed as immune to asset freezes.

That network is the Cambodia-based Huione Group, and the token is USDH. FinCEN found Huione to be a primary money-laundering concern under Section 311 of the USA PATRIOT Act, issuing a final rule effective 17 November 2025 that cut the group off from US correspondent banking. FinCEN said Huione laundered at least $4 billion between 2021 and 2025, served as a critical node for North Korean cyber-heist proceeds, and offered USDH precisely because it was unfreezable even upon a lawful request from law enforcement. Announcing the broader crackdown, Treasury Secretary Scott Bessent said Huione had established itself as the marketplace of choice for malicious cyber actors like the DPRK and criminal syndicates, who have stolen billions of dollars from everyday Americans.

The other case study is geopolitical. A7A5 is a ruble-pegged stablecoin launched in January 2025 by the Russian firm A7, part-owned by the sanctioned, defense-linked bank Promsvyazbank. Elliptic reported that A7A5 was used to move more than $100 billion in under a year, mostly swapped into USDT on the Kyrgyzstan-based Grinex exchange, functioning as a ruble safe harbor that let sanctioned Russian businesses touch global dollar liquidity only for the moments a transaction required it. Western authorities responded: OFAC sanctioned the A7A5 token along with the owners of Garantex and its successor Grinex in August 2025. The pressure worked. Elliptic later documented how sanctions strangled the token, with daily volumes collapsing about 96% from their peak and Grinex suspending operations after a hack drained tens of millions in early 2026.

The lesson of both cases is that when the freeze switch disappears, enforcement falls back on older, blunter tools: cutting the coin off from banks, sanctioning the people and exchanges around it, and starving it of the fiat on-ramps it needs to be useful. That works, but slowly, and only against issuers with a real-world footprint to attack.

The US answer: GENIUS and the FinCEN rulebook

The United States has tried to get ahead of the compliant end of the market with the GENIUS Act, its first federal framework for payment stablecoins, enacted in 2025. The law treats permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act, which means the anti-money-laundering obligations that already bind banks now bind stablecoin issuers directly, rather than reaching them only through the exchanges that list their tokens. That framework set the reserve and issuance rules for payment stablecoins; the anti-money-laundering layer arrived separately.

On 10 April 2026, FinCEN and OFAC jointly issued a proposed rule spelling out what those obligations look like in practice. Issuers would have to run AML and counter-terrorist-financing programs similar, though not identical, to the programs FinCEN already requires of the eleven existing categories of BSA financial institution, plus, for the first time mandated by statute, a dedicated sanctions-compliance program. In practice, that turns sanctions screening into a legal duty for stablecoin issuers rather than a voluntary best practice. The comment period closed on 9 June 2026, and the rules would take effect twelve months after they are finalized.

The limit of this approach is the same perimeter problem that runs through the whole subject. A robust US rulebook binds Circle, domestic issuers, and any offshore issuer that wants access to the American market. It does nothing to a freeze-resistant token minted by a sanctioned entity that never intends to touch a US bank. Rules can make the legitimate stablecoin economy some of the most closely watched money ever created, and still leave a criminal fringe operating on coins that were designed from the start to ignore them.

The EU net and the grey list

Europe is building a denser net, and readers in EU editions should note that the lead authorities there are national financial intelligence units and the new AMLA, not a US-style markets regulator. The Transfer of Funds Regulation, the bloc’s version of the Travel Rule, came into force on 30 December 2024 with no minimum threshold, so even small crypto transfers between providers must carry identity data. The broader Anti-Money-Laundering Regulation takes full effect on 10 July 2027 and bans anonymous crypto accounts and privacy coins outright. Supervising it all, the Anti-Money-Laundering Authority, or AMLA, is standing up in Frankfurt and will directly oversee up to 40 of the highest-risk crypto firms from 2028.

It is worth keeping two European rulebooks separate, because they are often conflated. MiCA governs who may issue a stablecoin in the EU, what reserves they must hold, and how they behave in the market; it is a prudential and market-conduct regime. The anti-money-laundering obligations sit elsewhere, in the AMLR and the Transfer of Funds Regulation. A firm can hold a MiCA license and still fall foul of AML rules, and vice versa.

Behind all of these national and regional rules stands FATF’s real source of leverage. It cannot fine anyone, but it can grey-list a jurisdiction that fails to supervise its virtual-asset sector, and a grey listing raises the friction and cost of every cross-border payment for that entire economy. As of the June 2026 plenary the black list held North Korea, Iran, and Myanmar, and the grey list ran to roughly two dozen jurisdictions. That threat, more than any single recommendation, is why governments race to show FATF they are implementing the standards, even when the standards are hard.

What it means when the freeze button is the rulebook

Step back and the shift is clear. FATF’s original design told exchanges to collect and pass identity data, a model borrowed straight from correspondent banking. Stablecoins broke that model, because their value moves wallet to wallet with no exchange in the loop. So the 2026 guidance has quietly re-centered enforcement on the one control point that survives when the intermediaries vanish: the issuer’s ability to reach into the smart contract and freeze. Programmable compliance is no longer a fringe idea; it is fast becoming the expectation.

The result is a barbell. At one end, compliant stablecoins like USDC and USDT are turning into some of the most surveilled and seizable money in history, with private issuers running enforcement operations that rival national authorities. At the other end, a criminal fringe is migrating to coins such as USDH and A7A5 that are engineered to have no off switch at all, forcing regulators back to the slower work of sanctions and banking chokepoints. FATF’s own president, Giles Thomson, framed the stakes plainly when the July update landed, saying that criminal networks continue to abuse virtual assets for illicit purposes and exploit their borderless nature to commit fraud and scams, evade sanctions and launder the proceeds of crime, taking advantage of gaps in countries’ frameworks and uneven implementation of FATF Standards across jurisdictions.

What to watch from here: whether FinCEN and OFAC finalize their stablecoin rule on schedule, how aggressively AMLA uses its direct-supervision powers from 2028, whether Washington reaches for more Section 311 chokepoint actions against offshore issuers, and, above all, whether FATF’s next update pushes programmable freezes from a recommendation toward a hard requirement. The freeze button has become the rulebook. The unresolved question, the one that will define crypto compliance for the rest of the decade, is what enforcement looks like when the button is deliberately left out.

Frequently Asked Questions

Are stablecoins really used for money laundering more than Bitcoin?

Yes. FATF and the analytics firm Chainalysis both report that stablecoins accounted for about 84% of illicit crypto transaction volume in 2025, overtaking Bitcoin. Criminals favor them for the same reasons ordinary users do: a stable dollar value, fast cross-border settlement, and deep liquidity.

Can a stablecoin issuer freeze my money?

If you hold a centralized stablecoin such as USDT or USDC, yes. Both Tether and Circle can add an address to a deny-list inside the token contract, which blocks transfers and can lead to funds being frozen or burned. Circle says it acts only on court orders or law-enforcement requests, while Tether often freezes within 24 hours of credible intelligence.

What is a freeze-resistant stablecoin?

It is a token engineered so that no issuer can freeze or seize it, even under a lawful order. Examples flagged by regulators include Huione’s USDH and Russia’s ruble-pegged A7A5. FATF has warned that compliance teams may no longer be able to rely on issuer-level freezes as a safeguard.

Does FATF make laws that apply to me?

No. FATF sets standards, and individual governments write the actual laws. In the United States, stablecoin anti-money-laundering rules come from FinCEN and OFAC under the Bank Secrecy Act and the GENIUS Act, not the SEC. In the EU they come from the AMLR, the Transfer of Funds Regulation, and the new authority AMLA. FATF’s leverage is its grey list, which raises costs for entire economies that fall behind.

What did FATF’s 2026 stablecoin guidance actually recommend?

Its March 2026 report told governments to impose clear anti-money-laundering obligations on stablecoin issuers, intermediaries, and custodians; to build technical expertise in blockchain analytics; and, most notably, to encourage issuers to embed programmable controls such as freezing and deny-listing directly into stablecoin smart contracts so authorities can act in secondary markets.

Anneke de Vries covers regulation and policy for HOGE Wire.