GAFI - Targeted Report on Stablecoins and

Targeted Report on Stablecoins and Unhosted Wallets Peer-to-Peer Transactions FATF Report March 2026The Financial Action Task Force (FATF) is an independent inter -governmental body that develops and promotes policies to protect the global financial system against money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti -money laundering (AML) and counter-terrorist financing (CFT) standard. For more information about the FATF, please visit www.fatf-gafi.org This document and/or any map included herein are without prejudice to the status of or sovereignty over any territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area.

Citing reference: FATF (2026), Targeted Report on Stablecoins and Unhosted Wallets – Peer-to-Peer Transactions, FATF, France,

www.fatf-gafi.org/content/fatf-gafi/en/publications/virtualassets/targeted-report-stablecoins-unhosted-wallets

© 2026 FATF/OECD. All rights reserved. No reproduction or translation of this publication may be made without prior written permission. Applications for such permission, for all or part of this publication, should be made to the FATF Secretariat, 2 rue André Pascal 75775 Paris Cedex 16, France (e-mail: contact@fatf-gafi.org).

Photocredits cover: . © Shutterstock| 1

TARGETED REPORT ON STABLECOINS AND UNHOSTED WALLETS – PEER-TO-PEER TRANSACTIONS

Table of Contents

Abbreviations and Acronyms ............................................................................................................................ 2 Executive Summary ............................................................................................................................................. 3 Introduction ......................................................................................................................................................... 4 Objectives and Structure...................................................................................................................................... 4 Previous FATF Work on Stablecoins .................................................................................................................. 4 Scope ................................................................................................................................................................... 5 Methodology ....................................................................................................................................................... 5

Executive Summary ............................................................................................................................................. 3 Introduction ......................................................................................................................................................... 4 Objectives and Structure...................................................................................................................................... 4 Previous FATF Work on Stablecoins .................................................................................................................. 4 Scope ................................................................................................................................................................... 5 Methodology ....................................................................................................................................................... 5 Background .......................................................................................................................................................... 6 Background on Stablecoin Ecosystem and Definitions ....................................................................................... 6 FATF Requirements for VASPs and Applicability to Stablecoins ...................................................................... 8

Part One: Analysis on Current situation, Threats and Vulnerabilities .................................................... 11

Current Situation ............................................................................................................................................... 11 Threat Actors Use of Stablecoins ...................................................................................................................... 12 Vulnerabilities ................................................................................................................................................... 18

Part Two: Good Practices to Mitigate Misuse of Stablecoins, Including for P2P Transactions .......... 22

Effective Implementation of FATF Standards .................................................................................................. 22 Stablecoin Issuers Applying Controls ............................................................................................................... 24 Using Advanced Tools for Detecting and Monitoring Suspicious Transactions ............................................... 27 Effective Supervision of Stablecoin issuers and other entities involved in stablecoin arrangements ................ 29 Robust Public-Private Sector Collaboration ...................................................................................................... 31 Following Investigative Leads .......................................................................................................................... 32 ML/TF/PF Risks Mitigation measures for Unhosted Wallets and P2P Transactions ........................................ 32 Conclusion ........................................................................................................................................................... 34 Recommended Actions ..................................................................................................................................... 35

Annex A: List of Risk Indicators ...................................................................................................................... 372 |

TARGETED REPORT ON STABLECOINS AND UNHOSTED WALLETS – PEER-TO-PEER TRANSACTIONS

Abbreviations and Acronyms AECs Anonymity Enhanced Cryptocurrencies AML/CFT/CPF Anti-Money Laundering/Countering the Financing of Terrorism/Counter Proliferation Financing CBDCs Central Bank Digital Currencies CDD Customer Due Diligence DeFi Decentralised Finance DEX Decentralised Exchange DLT Distributed Ledger Technology DPRK Democratic People's Republic of Korea DTOs Drug trafficking organisations

CBDCs Central Bank Digital Currencies CDD Customer Due Diligence DeFi Decentralised Finance DEX Decentralised Exchange DLT Distributed Ledger Technology DPRK Democratic People's Republic of Korea DTOs Drug trafficking organisations EDD Enhanced Due Diligence FIs Financial Institutions KYC Know Your Customer ML/TF/PF Money Laundering/Terrorist Financing/Proliferation Financing OTC Over the Counter P2P Peer to Peer PPPs Public–Private Partnerships SAR/STR Suspicious Activity/Transaction Report TFS Targeted Financial Sanctions TRW Travel Rule-covered Wallet VAs/VASPs Virtual Assets/Virtual Asset Service Providers| 3

TARGETED REPORT ON STABLECOINS AND UNHOSTED WALLETS – PEER-TO-PEER TRANSACTIONS

Executive Summary

1. Stablecoins have grown rapidly in scale, adoption, and functional integration within both the virtual asset ecosystem and, increasingly, the traditional financial system. As of mid-2025, over 250 stablecoins were in circulation, with total market capitalisation exceeding USD 300 billion and daily trading volumes surpassing those of Bitcoin. Fiat -backed, centrally governed stablecoins—predominantly USD -referenced—dominate the market and are widely used across multiple blockchains. While stablecoins are incre asingly used for legitimate purposes, their distinctive features —price stability, high liquidity, interoperability —also make them attractive tools for threat actors.

2. Stablecoins, including through unhosted wallets, have become a common component of ML, TF and PF schemes that use virtual assets. While there are some simple and/or direct uses of stablecoins observed, many schemes use stablecoins as one feature in a more complex series of transactions designed to obfuscate the origin of funds, and distance it from the intended use.

Reporting indicates that stablecoins are the most popular virtual asset used in illicit transactions.

3. Stablecoins, generally, have the same vulnerabilities a s other virtual assets. These

of transactions designed to obfuscate the origin of funds, and distance it from the intended use. Reporting indicates that stablecoins are the most popular virtual asset used in illicit transactions.

3. Stablecoins, generally, have the same vulnerabilities a s other virtual assets. These vulnerabilities are exacerbated by their characteristics such as the price stability and ample liquidity, which can make stablecoins more likely to be used in P2P transactions. P2P transactions via unhosted wallets represent a key vulnerability in the stablecoin ecosystem.

Conducted without the involvement of AML/CFT -obliged intermediaries, these transactions can be of higher risk , especially when layered through unhosted w allets. In addition, stablecoins could exhibit more asset-specific vulnerabilities, notably those arising from their interconnections with traditional finance. Cases indicate that threat actors have used stablecoins to purchase prohibited goods without cashing out through intermediaries, however, data remains limited regarding the broader use of stablecoins for the purchase of goods and services or for P2P transactions. Therefore, it is important for jurisdictions and relevant stakeholders to continue to closely monitor whether stablecoins are increasingly used for purchases without reliance on traditional on - and off -ramps, and the extent to which accurate data on the scale and proportion of P2P transactions can be obtained.

4. In response to these risks and vulnerabilities , the report identifies a range of good practices that can be implemented by wider jurisdictions and private sector. Some are common with all virtual assets , while others unique to stablecoins. These include establishing comprehensive legal frameworks in compliance with the FATF Standards; imposing clear AML/CFT obligations on stablecoin issuers, intermediaries, and custodians; assessing risk and implementing risk mitigation measures for transactions involving unhosted wallets; and leveraging advanced technology-based tools. The report also emphasises the need for further coordination among competent authorities and across borders, as well as the importance of providing technical assistance to jurisdictions that have not yet adequately implemented regulatory and supervisory frameworks for stablecoins. This report also demonstrates several

leveraging advanced technology-based tools. The report also emphasises the need for further coordination among competent authorities and across borders, as well as the importance of providing technical assistance to jurisdictions that have not yet adequately implemented regulatory and supervisory frameworks for stablecoins. This report also demonstrates several jurisdictions that have also adopted innovative approaches, such as requiring issuers to embed programmable controls in stablecoin smart contracts, to support freezing, deny -listing, or other risk mitigation actions in secondary markets.

5. Finally, this report makes available to members of the FATF Global Network indicators of the misuse of stablecoins, particularly through unhosted wallets. It also makes internal recommendations for the FATF Global Network to consider to potentially mitigat e risk in the stablecoin environment.4 |

TARGETED REPORT ON STABLECOINS AND UNHOSTED WALLETS – PEER-TO-PEER TRANSACTIONS

Introduction Objectives and Structure

6. Previous FATF work has focused on stablecoins more broadly 1 . The objective of this project is to enhance the understanding of emerging ML/TF/PF risks , threat actors and vulnerabilities related to stablecoins and unhosted wallets, particularly during P2P transactions. In addition, the project identif ies and share s good practices to mitigate those risks.2

These objectives are achieved through three sections: • Background: Sets out the various participants in the stablecoin ecosystem, provides relevant definitions, and outlines the applicability of the FATF Standards to stablecoins arrangements, as well as the current implementation status of FATF Standards. • Part One : Analyses the current situation regarding stablecoin ecosystem development and how stablecoins differ from other virtual assets, and identifies threat actors as well as national and sectoral vulnerabilities exploited by them. • Part Two: Explores good practices on mitigation measures from the public and private sectors, as well as on investigative and national/international co-operation. Previous FATF Work on Stablecoins

7. The FATF has conducted work on stablecoins since 2019 , first through the public study

• Part Two: Explores good practices on mitigation measures from the public and private sectors, as well as on investigative and national/international co-operation.

Previous FATF Work on Stablecoins

7. The FATF has conducted work on stablecoins since 2019 , first through the public study ‘Money laundering risks from “stablecoins” and other emerging assets’ and also the ‘FATF Report to the G20 on So -called Stablecoins’.3 The FATF continued to clarify the application of the FATF Standards to help jurisdiction s mitigate those risks. 4 In the Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers (2025), the FATF observed that the use of stablecoins by a range of illicit actors, including DPRK actors, terrorist financiers, and drug trafficking networks, has continued to increase over time.5

8. The FATF has highlighted the need to closely monitor developments in the stablecoin ecosystem to ensure that the FATF Standards remain effective despite ongoing virtual asset evolution. In particular, the FATF underscored the importance of continued monitoring of: (1)

1 2025-Targeted-Upate-VA-VASPs.pdf.coredownload.pdf; Updated Guidance for a Risk -Based Approach for Virtual Assets and Virtual Asset Service Providers; VIRTUAL ASSETS – DRAFT FATF REPORT TO G20 ON SO-CALLED STABLECOINS 2 The FATF defines peer-to-peer (P2P) transactions as VA transfers conducted without the use or involvement of a VASP or other obliged entity (e.g., VA transfers between two unhosted wallets whose users are acting on their own behalf). See: Updated Guidance for a Risk-based Approach for Virtual Assets and Virtual Assets Service Providers 3 FATF Money laundering risks from “stablecoins” and other emerging assets (2019); FATF (2020), FATF Report to the G20, FATF, France. 4 FATF 12-Month Review of the Revised FATF Standards on Virtual Assets and Virtual Assets Service Providers (2021) ; FATF Updated Guidance for a RiskBased Approach for Virtual

(2020), FATF Report to the G20, FATF, France. 4 FATF 12-Month Review of the Revised FATF Standards on Virtual Assets and Virtual Assets Service Providers (2021) ; FATF Updated Guidance for a RiskBased Approach for Virtual Assets and Virtual Asset Service Providers (2021); FATF Second 12 -Month Review of the Revised FATF Standards on Virtual Assets and Virtual Assets Service Providers (2021). 5 FATF Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers (2025).| 5

TARGETED REPORT ON STABLECOINS AND UNHOSTED WALLETS – PEER-TO-PEER TRANSACTIONS

whether stablecoins achieve global mass adoption in a manner that allows the purchase of goods and services with little or no reliance on traditional onand off-ramps; and (2) the extent to which jurisdictions and the private sector are able to obtain accurate data on the scale and proportion of P2P transactions. Scope

9. This report reflects developments in the stablecoin ecosystem until the end of 2025. It explains the applicability of the FATF Standards to the various participants involved in stablecoin arrangements, identifies the market development of stablecoins, shows the increasing ML/TF/PF risks of stablecoins, particularly associated with unhosted wallets during P2P transactions.

10. The report explores the vulnerabilities of stablecoins, some of which are common to most virtual assets, while others are unique to stablecoins. The report focuses on providing practical risk mitigation measures for stablecoins, with a focus on P2P transactions with a variety of case studies provided by jurisdictions, concluded by recommended actions for relevant stakeholders. As with all FATF guidance products, the Guidance is non-binding.

Methodology

11. The methodology involved collecting and analysing inputs from the FATF project team and the Virtual Asset Contact Group (VACG) members, engaging with relevant stakeholders, and reviewing and refining existing materials on stablecoin arrangements, including:

Methodology

11. The methodology involved collecting and analysing inputs from the FATF project team and the Virtual Asset Contact Group (VACG) members, engaging with relevant stakeholders, and reviewing and refining existing materials on stablecoin arrangements, including: • Two rounds of requests for information were made to the FATF project team and VACG members to provide inputs. These requests yielded (a) 29 case studies on threats, typologies, and jurisdictional measures were received, and (b) 25 inputs were submitted on AML/CFT/CPF obligations of participants in the stablecoin ecosystem, regulatory challenges, and good practices for mitigation measures. • Private sector entities , such as stablecoin issuers and blockchain analytics companies, were invited to respond to a targeted outreach survey focusing on challenges and good practices in mitigating illicit finance risks associated with stablecoins. • A virtual roundtable meeting with key stakeholders was held based on the survey results to gain more detailed insights on mitigation measures.6 |

TARGETED REPORT ON STABLECOINS AND UNHOSTED WALLETS – PEER-TO-PEER TRANSACTIONS

Background Background on Stablecoin Ecosystem and Definitions Basic Definitions

12. A stablecoin is one form of virtual assets, which is a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes.

While the FATF has recogni sed that stablecoins are not a legal or technical category and clarified that the use of this term by the FATF is not intended to endorse any stability claims, the term generally refers to a type of virtual asset that has a stabilisation mechanism and can be used as a means of payment and/or store of va lue.6 Often, stablecoin seeks or purports to maintain price stability by linking its value to one or more reference assets, such as fiat currencies or virtual assets, and may be backed by such assets. Regardless of how stablecoins are considered at national level, providers of services to stablecoins who fit the FATF definition of VASP or FI should be subject to the corresponding obligations in accordance with the FATF

currencies or virtual assets, and may be backed by such assets. Regardless of how stablecoins are considered at national level, providers of services to stablecoins who fit the FATF definition of VASP or FI should be subject to the corresponding obligations in accordance with the FATF Standards.7 Asset-Backed Stablecoins

13. Asset-backed stablecoins are backed by financial assets such as fiat currencies or government bonds. Issuers of asset-backed stablecoins often purport and commit to have the ability to redeem stablecoins for the backing asset on a 1:1 basis for users at all times, which could contribute to price stability. Asset -backed stablecoins in general have centrali sed governance structures, often managed by the issuer.

VA-Backed Stablecoins

14. VA-backed stablecoins are issued using virtual assets (VAs) and tokeni sed financial instruments as collateral. Due to concerns over the price volatility of the collateral assets, such arrangements typically require and maintain an over collateralised position . Issuance, redemption, collateral management and liquidation are often conducted through autonomous smart contracts, and in some cases, users may be able to issue stablecoins directly without relying on centralised governing entities.

Algorithmic Stablecoins

15. Algorithmic stablecoins are typically designed to maintain price stability by adjusting supply through smart contracts or algorithms such as synthetically collaterali sed dollar-type stablecoins8 without any backed assets. Algorithms managing the economics of the stablecoin increase supply when prices rise and decrease supply when prices fall to maintain stability.

Issuance and management are often conducted through autonomous smart contracts, and governance can be more decentrali sed than with asset -backed stablecoins. Generally, these stablecoins do not offer redemption into fiat currency, and instead aim to stabili se prices through mechanisms such as stablecoin swaps or burns.

6 Financial Stability Board, High -level Recommendations for the Regulation, Supervision and Oversight of Global Stablecoin Arrangements: Final report. 7 FATF (2021) Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers

through mechanisms such as stablecoin swaps or burns.

6 Financial Stability Board, High -level Recommendations for the Regulation, Supervision and Oversight of Global Stablecoin Arrangements: Final report. 7 FATF (2021) Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers 8 These stablecoins incorporate mechanisms that offset price volatility by combining virtual assets with derivatives.| 7

TARGETED REPORT ON STABLECOINS AND UNHOSTED WALLETS – PEER-TO-PEER TRANSACTIONS

Participants in the Stablecoin Ecosystem

16. There are various participants in the stablecoin ecosystem. Relevant participants and their roles can differ depending on the organi sation and nature of stablecoins and their arrangements. • Stablecoin Issuers: Stablecoin issuers are responsible for issuing and redeeming stablecoins and ensuring their purported stability in the interim. They often mint stablecoins in exchange for fiat currencies or other assets while collecting fees for issuance and redemption. In many cases, the issuer also deploys and maintains the smart contracts necessary for all on -chain transactions in their stablecoin.

Moreover, the issuer can assign part of its functions, such as redemption, to intermediary VASPs. • Reserve Custodians: Reserve custodians store and manage the reserve assets backing the stablecoins on behalf of the issuer. • Intermediaries: VASPs including VA exchanges and f inancial institutions that provide buying, selling, safekeeping, trading or conversion services for stablecoins. Some exchanges may buy stablecoins from the issuer and distribute them into the retail market. Decentralised finance (DeFi) may also provide services to users, such as remittance, payment, exchange, and lending involving stablecoins. • Payment Service Providers/Card Networks : Payment service providers and card networks can enable the use of stablecoins for payments for goods and services by offering stablecoin payment infrastructure to merchants. They can also facilitate remittances to individuals. • Unhosted Wallets: Virtual asset wallets that are not hosted or managed by a thirdcard networks can enable the use of stablecoins for payments for goods and services by offering stablecoin payment infrastructure to merchants. They can also facilitate remittances to individuals. • Unhosted Wallets: Virtual asset wallets that are not hosted or managed by a thirdparty service provider and where the user maintains exclusive control over the access keys. Certain unhosted wallet service providers also offer stablecoin swap functions. • Blockchain Analytics Tool Providers : Blockchain analytics tool providers generate analysis based on information obtained from examination of blockchains and entities with customer interfaces, such as wallet service providers, and this data may be utilised by stablecoin issuers and intermediaries to support measures to mitigate illicit finance risk including restrictive measures requirements. They use different taxonomies , which make the outcomes of their analysis difficult to compare. Stablecoin Lifecyle and Features

17. A stablecoin issuer typically issues stablecoins and they are circulated amongst users and VASPs and then redeemed for fiat currency. While the mechanisms for issuance and redemption vary depending on the type of stablecoin, this section provides the general processes in this lifecycle for centrally issued asset-backed stablecoins.

18. Stablecoin issuers typically issue stablecoins by receiving fiat currencies or VAs from contracting parties and minting stablecoins corresponding to the value received. Issuing a stablecoin creates two types of markets:8 |

TARGETED REPORT ON STABLECOINS AND UNHOSTED WALLETS – PEER-TO-PEER TRANSACTIONS

• Primary: Primary customers purchase or redeem stablecoins directly from the issuer and then could put the stablecoin into broader circulation in the secondary market. These customers, typically VASPs or institutional clients, undergo customer due diligence and onboarding procedures. They can also be retail customers. • Secondary: Secondary customer stablecoin holders may use a hosted wallet involving a VASP or financial institution subject to AML/CFT obligations, or use unhosted wallets to hold and transfer the stablecoins peer-to-peer, without the involvement of an AML/CFT obliged entity. Accordingly, secondary customers

• Secondary: Secondary customer stablecoin holders may use a hosted wallet involving a VASP or financial institution subject to AML/CFT obligations, or use unhosted wallets to hold and transfer the stablecoins peer-to-peer, without the involvement of an AML/CFT obliged entity. Accordingly, secondary customers using unhosted wallets may not be subject to AML/CFT obligations.

19. Stablecoin issuers often maintain a degree of control over their stablecoins in both primary and secondary market transactions using smart contracts. Issuers can program smart contracts to prevent certain wallet addresses from transacting in their stablecoin (e.g., blacklisting) or to remove stablecoins from circulation in the secondary markets ( i.e., freezing or burning). Issuers can also view all on-chain transactions in their stablecoin given the nature of public blockchains.

20. Typically, redemption from the issuer is available only to primary customers, subject to the issuer’s rules . In some cases, redemption may be facilitated through issuer -designated intermediaries in accordance with applicable legal frameworks. Primary and secondary stablecoin holders may exchange stablecoins for fiat currency or other virtual assets through centralised intermediaries ( VASPs), decentralised exchanges (DEXs) , or via peer -to-peer transactions.

Governance Structure

21. Generally, stablecoin arrangements have a governing structure that is responsible for the operation of the stablecoin services. A central ised governance body such as issuers and intermediaries may perform the core functions of the stablecoin arrangement (such as AML/CFT/CPF and managing stabilisation mechanisms). In many existing arrangements, the issuer takes on the key role of governing the stablecoin arrangement, although some functions could be managed by intermediaries or technology providers. Stableco in arrangements can also be structured in a decentralised manner as discussed in previous sections, which can make responsibility ambiguous.

FATF Requirements for VASPs and Applicability to Stablecoins

22. FATF Recommendation 15 of the FATF Standards requires all jurisdictions to:9 a. identify, assess and understand the ML/TF/PF risks emerging from VAs and

responsibility ambiguous. FATF Requirements for VASPs and Applicability to Stablecoins

22. FATF Recommendation 15 of the FATF Standards requires all jurisdictions to:9 a. identify, assess and understand the ML/TF/PF risks emerging from VAs and VASPs. b. ensure that VASPs are required to be licensed or registered in the jurisdiction where they are created. c. apply sanctions to natural or legal persons that carry out VASP activities without the requisite license or registration.

9 See the Interpretative Note of Recommendation 15, FATF Recommendations www.fatfgafi.org/content/dam/fatfgafi/recommendations/FATF%20Recommendations%202012.pdf| 9

TARGETED REPORT ON STABLECOINS AND UNHOSTED WALLETS – PEER-TO-PEER TRANSACTIONS

d. ensure that VASPs are subject to supervision. e. apply proportionate and dissuasive sanctions to VASPs that fail to comply with AML/CFT/CPF requirements. f. ensure that targeted financial sanctions obligations apply to VASPs.

23. VAs are defined by the FATF as a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes. Virtual assets do not include digital representations of fiat currencies, securities and other financial assets that are already covered elsewhere in the FATF Recommendations. Given their characteristics, the FATF considers stablecoins as virtual assets.

24. Persons and entities involved in stablecoin arrangements would be classified as VASPs or FIs in the circumstances detailed below10: • Stablecoin Issuers: Under the FATF Standards, the sole act of issuing a VA on its own is not a covered service under the de