The Financial Action Task Force (FATF) has issued a stark warning about the growing utilize of stablecoins in illicit financial activity, particularly through peer-to-peer (P2P) transactions conducted via unhosted wallets. The international watchdog’s recently published “Targeted Report on Stablecoins and Unhosted Wallets” details how the very features that have driven the adoption of stablecoins – price stability, liquidity and interoperability – are simultaneously exploited by criminals.
The report highlights a dramatic increase in the stablecoin market, growing from $30 billion in 2020 to a market capitalization exceeding $390 billion by the finish of 2025, with over 250 stablecoins in circulation by mid-2025. This rapid expansion has attracted the attention of those involved in money laundering, terrorist financing, and cybercrime, including state-linked groups, according to the FATF.
Specifically, the report points to the increasing use of stablecoins by North Korean hacking groups, citing the February 2025 Bybit hack, which resulted in the theft of over $1.4 billion worth of Ethereum. The FATF also flagged concerns about Iranian actors leveraging stablecoins to finance proliferation activities and the broader use of these digital assets to launder proceeds from ransomware and phishing attacks.
Chainalysis, a blockchain analytics firm, found that stablecoins accounted for 84% of illicit virtual asset transaction volume in 2025, often involving unhosted wallets and sophisticated laundering techniques designed to obscure the origin of funds. The core vulnerability lies in P2P transactions via unhosted wallets, which occur directly between individuals without the oversight of regulated intermediaries like Virtual Asset Service Providers (VASPs).
The FATF report also notes that stablecoin issuers may struggle to control activities across different blockchains, potentially allowing illicit transactions to fall outside of existing counter-illicit finance controls. The agency lamented that only a limited number of jurisdictions have implemented regulatory frameworks specifically tailored to the unique characteristics of stablecoins.
To address these risks, the FATF is urging its 38 member nations, along with 20 additional jurisdictions with significant VASP activity, to fully implement Recommendations 15 and 16 of its standards. These recommendations establish anti-money laundering and counter-terrorism financing (AML/CFT) rules for virtual assets and VASPs, including customer due diligence and “travel rule” obligations. The “travel rule” requires VASPs to collect and transmit originator and beneficiary information for fund transfers.
While 99 jurisdictions have now passed or are in the process of passing legislation implementing the Travel Rule as of June 2025, the FATF notes that progress has been uneven. A 2023 report revealed that 75% of assessed jurisdictions demonstrated only partial compliance or were non-compliant with the standards.
Beyond Recommendations 15 and 16, the FATF suggests several best practices for jurisdictions and the private sector. These include requiring stablecoin issuers to implement risk-based technical and governance controls, such as the ability to freeze stablecoins and conduct customer due diligence at redemption. The agency also recommends developing technical expertise within supervisory and law enforcement authorities, including knowledge of smart contract functionalities and monitoring P2P transactions via unhosted wallets, and fostering public-private partnerships to share information on emerging threats.
The FATF’s report underscores the need for a coordinated global approach to regulating stablecoins, but as of March 9, 2026, a comprehensive international framework remains elusive. The agency has not announced a timeline for further action, leaving the future of stablecoin regulation uncertain.
