## What Is Stablecoin AML and Why Does It Matter?
Stablecoin AML (Anti-Money Laundering) refers to the regulatory frameworks, technical controls, and monitoring practices applied to stablecoins — blockchain-based tokens pegged to a stable asset such as the US dollar — to detect and prevent financial crime. Unlike volatile cryptocurrencies such as Bitcoin or Ether, stablecoins maintain a predictable value, making them functionally equivalent to digital cash. This stability, combined with the pseudonymous nature of blockchain transactions and 24/7 cross-border settlement, has made stablecoins the instrument of choice for money launderers, sanctions evaders, and terrorist financiers operating in the crypto ecosystem. According to Chainalysis, stablecoins accounted for 62.5% of all illicit cryptocurrency transaction volume in 2023, surpassing Bitcoin for the first time and firmly establishing stablecoin AML as one of the most urgent challenges in financial crime compliance.
## Why Are Stablecoins the Preferred Vehicle for Crypto Money Laundering?
The criminal appeal of stablecoins is rooted in a specific combination of properties that no other financial instrument fully replicates. First, stablecoins eliminate the price volatility risk that complicates money laundering using Bitcoin or Ether — a launderer moving $1 million in USDT does not face the risk of receiving $700,000 worth of value upon conversion, a scenario that is commonplace with volatile assets. Second, stablecoins settle instantly and globally without requiring a correspondent bank, a SWIFT code, or a compliance officer at a financial institution to authorize the transfer. Third, the most widely used stablecoins — particularly USDT (Tether) on the Tron network — operate on blockchains with transaction fees measured in fractions of a cent, making high-frequency, high-volume layering schemes economically viable at a scale that traditional finance cannot match.
The Tron blockchain has become particularly significant in this context. Tron hosts the largest share of circulating USDT by network, and its low fees have made it the dominant rail for illicit stablecoin flows. The United Nations Office on Drugs and Crime (UNODC) identified Tron-based USDT as the primary vehicle for money laundering across Southeast Asian cyber-fraud operations in its 2024 report on transnational organized crime, estimating that billions of dollars in fraud proceeds are laundered annually through this pathway. The combination of USDT’s dollar peg, Tron’s negligible fees, and the availability of over-the-counter (OTC) brokers willing to convert USDT into fiat currency with minimal KYC makes this an effectively industrialized laundering pipeline.
## How Do USDT, USDC, and DAI Differ in Their AML and Compliance Profiles?
The three largest stablecoins by market capitalization — USDT (Tether), USDC (Circle), and DAI (Sky, formerly MakerDAO) — have fundamentally different compliance architectures, issuer behaviors, and risk profiles for AML purposes. Understanding these distinctions is essential for any compliance team conducting due diligence or risk assessment on stablecoin exposure.
| Feature | USDT (Tether) | USDC (Circle) | DAI (Sky/MakerDAO) |
|---|---|---|---|
| Issuer | Tether Ltd. (BVI) | Circle Internet Financial (US) | Sky Protocol (decentralized) |
| Regulatory Jurisdiction | British Virgin Islands | United States (FinCEN MSB) | Decentralized (no single issuer) |
| Address Freezing | Yes — proactive and reactive | Yes — proactive and reactive | Limited (smart contract-level only) |
| Blacklist Transparency | Partial (on-chain visible, not always disclosed) | High (public compliance reports) | Minimal |
| Reserve Audits | Quarterly attestations (BDO) | Monthly attestations (Deloitte) | Over-collateralized on-chain (fully transparent) |
| Law Enforcement Cooperation | Case-by-case basis | Formal US law enforcement cooperation | Protocol governance only |
| Illicit Use Prevalence | High (dominant in illicit flows) | Moderate | Low (limited liquidity in illicit circuits) |
| MiCA Compliance Status | Under review (non-EU issuer) | Pursuing EU e-money license | Complex (decentralized issuer) |
This table illustrates a compliance hierarchy that risk officers must internalize: USDC operates under the most rigorous regulatory oversight due to Circle’s US registration as a Money Services Business, its proactive cooperation with law enforcement, and its formal reserve attestation program. USDT, while also capable of freezing addresses, operates under lighter-touch BVI jurisdiction and has historically been slower to respond to compliance demands. DAI presents a different category of risk — as a decentralized, over-collateralized stablecoin with no central issuer capable of unilaterally freezing addresses, it offers the least compliance tooling for investigators but also sees lower absolute volumes in illicit use due to its smaller market footprint and higher collateral requirements for issuance.
## What Is Tether’s Address Freezing Capability and How Much Has Been Frozen?
Tether’s address freezing mechanism is one of the most significant — and underappreciated — tools in the stablecoin AML ecosystem. Tether has embedded a blacklist function directly into the USDT smart contract on Ethereum, Tron, and other supported networks. When an address is added to this blacklist, all USDT held in that address becomes permanently frozen and non-transferable, effectively rendering it worthless to its holder without any intervention from a court or law enforcement agency at the blockchain level.
The scale of Tether’s freezing activity has grown substantially. As of early 2025, Tether has frozen addresses holding a cumulative total exceeding $1.7 billion in USDT, according to data compiled from on-chain analytics by Dune Analytics and corroborated by Tether’s own published compliance reports. The freeze actions have been executed in cooperation with law enforcement agencies including the US Department of Justice, the FBI, the Secret Service, and international partners. In October 2023, Tether froze 32 addresses linked to terrorist financing and sanctions evasion, including addresses connected to entities sanctioned by the Office of Foreign Assets Control (OFAC). Tether also froze approximately $225 million in USDT in November 2023 at the request of US law enforcement in connection with a pig butchering fraud investigation in Southeast Asia — at the time, the largest single freeze action in stablecoin history.
However, critics within the compliance community note that Tether’s freezing activity remains reactive rather than proactive in the vast majority of cases. Unlike Circle, Tether does not publish a detailed transparency report on its compliance activities, and the criteria and timelines for responding to law enforcement requests are not publicly documented. For AML compliance officers assessing counterparty risk, this opacity is a meaningful factor in risk-rating stablecoin exposure.
## How Does Circle’s Compliance Approach Differ for USDC?
Circle Internet Financial has pursued a deliberately differentiated compliance strategy, positioning USDC as the institutionally safe stablecoin for regulated financial services. Circle is registered as a Money Services Business with FinCEN, holds state money transmitter licenses across the United States, and has publicly committed to pursuing regulatory licensing under the European Union’s Markets in Crypto-Assets (MiCA) framework. Circle publishes monthly reserve attestation reports audited by Deloitte, providing a higher standard of reserve transparency than Tether’s quarterly BDO attestations.
On the enforcement cooperation front, Circle maintains a formal legal process for law enforcement requests and publishes semi-annual transparency reports detailing the number of USDC freeze requests received and actioned. In 2023, Circle reported responding to over 200 formal law enforcement requests, a figure that reflects the volume of USDC-linked financial crime investigations globally. Circle also maintains a proactive sanctions screening program, monitoring USDC activity against OFAC’s Specially Designated Nationals (SDN) list and freezing addresses in real time upon sanctions designation — a capability it demonstrated when it rapidly froze USDC addresses associated with Tornado Cash within hours of OFAC’s August 2022 designation of the mixing service.
For compliance teams, this creates a meaningful risk differentiation: USDC exposure at a regulated financial institution carries materially lower residual AML risk than equivalent USDT exposure, not because illicit actors do not use USDC, but because Circle’s regulatory posture and enforcement cooperation mean that illicit flows are more likely to be identified, frozen, and reported in a timely manner.
## How Are Stablecoins Used in Sanctions Evasion, Terrorist Financing, and Fraud?
Stablecoins have emerged as the instrument of choice across three distinct categories of financial crime: sanctions evasion, terrorist financing, and large-scale fraud.
In sanctions evasion, state and non-state actors have used USDT to circumvent restrictions imposed by OFAC and equivalent bodies in the EU and UK. The most documented cases involve entities in Russia, Iran, and North Korea. Elliptic’s 2024 Crypto Crime Report documented USDT flows through Tron-based exchanges to entities in sanctioned jurisdictions, with a significant volume transiting through peer-to-peer OTC desks that conduct minimal KYC. North Korea’s Lazarus Group, responsible for an estimated $3 billion in cryptocurrency theft between 2017 and 2023 according to the UN Panel of Experts, has increasingly converted stolen volatile assets into stablecoins as an intermediate layering step before moving funds to fiat.
In terrorist financing, the US Department of Justice and OFAC have designated multiple stablecoin-linked addresses connected to Hamas, Palestinian Islamic Jihad, and Hezbollah. In October 2023, the DOJ announced the seizure of cryptocurrency accounts containing USDT linked to Hamas fundraising networks, with funds raised through social media solicitation campaigns directing donors to on-chain addresses. The Tether freeze of October 2023 referenced above was directly related to this enforcement action.
In fraud — particularly the pig butchering (sha zhu pan) schemes predominantly operated from Southeast Asian cyber-fraud compounds — stablecoins are the settlement layer for an industry estimated by the Global Anti-Scam Organisation (GASO) to generate over $64 billion annually. Victims are manipulated into transferring funds to wallets controlled by fraud operators, who immediately convert receipts to USDT or USDC for rapid cross-border transfer through a layering network of wallets, exchanges, and OTC brokers before extraction to fiat.
## What Do Stablecoin Transaction Volumes Reveal About Illicit Flow Dominance?
The quantitative evidence for stablecoin dominance in illicit crypto flows is now well-established across multiple independent research sources. Chainalysis’s 2024 Crypto Crime Report found that stablecoins represented 62.5% of all illicit transaction volume in 2023, compared to 19% for Bitcoin and 13% for Ether. This represents a dramatic structural shift from 2019, when Bitcoin accounted for over 90% of illicit crypto volume. The shift reflects both the growth of stablecoin market capitalization (total stablecoin supply exceeded $160 billion in early 2025, per DefiLlama) and the deliberate preference of sophisticated financial criminals for stable-value instruments.
| Year | Stablecoin Share of Illicit Volume | Bitcoin Share | Total Illicit Volume |
|---|---|---|---|
| 2019 | ~3% | ~90% | ~$6.6B |
| 2021 | ~18% | ~52% | ~$14.0B |
| 2022 | ~35% | ~28% | ~$20.6B |
| 2023 | ~62.5% | ~19% | ~$24.2B |
Sources: Chainalysis Crypto Crime Report 2024; Elliptic 2024 Financial Crime Report.
This trajectory indicates that stablecoin illicit volume is not a temporary phenomenon but a structural feature of the crypto crime landscape. For compliance teams conducting transaction monitoring, the implication is that risk models calibrated primarily against Bitcoin or Ether exposure are increasingly misaligned with the actual threat environment.
## What Does MiCA Mean for Stablecoin AML Compliance in the EU?
The European Union’s Markets in Crypto-Assets Regulation (MiCA), which entered into force on June 30, 2023 and became fully applicable from December 30, 2024, represents the most comprehensive stablecoin regulatory framework enacted by any major jurisdiction to date. MiCA establishes two distinct regulatory categories for stablecoins: Asset-Referenced Tokens (ARTs), which are pegged to a basket of assets, and Electronic Money Tokens (EMTs), which are pegged to a single fiat currency such as the euro or US dollar. USDT and USDC fall within the EMT category under MiCA’s taxonomy.
For EMT issuers, MiCA requires: authorization as an electronic money institution (EMI) under EU law; maintenance of reserves in segregated accounts at EU credit institutions; limits on daily transaction volume for non-euro-denominated EMTs (issuers must take corrective action if daily transactions exceed 1 million transactions or €200 million in value); and full compliance with the EU’s existing AML framework, including the Transfer of Funds Regulation (TFR) and the forthcoming Anti-Money Laundering Regulation (AMLR).
The practical consequences for the market are significant. Tether announced in 2024 that it would not pursue MiCA authorization for USDT in the EU’s initial implementation period, effectively making USDT non-compliant for EU-regulated entities under the full MiCA regime. Circle, conversely, obtained an EMI license in France and has positioned USDC and its euro-denominated stablecoin EURC as MiCA-compliant products, creating a competitive compliance advantage in the EU market. For compliance officers at EU-regulated crypto asset service providers (CASPs), this regulatory divergence materially affects their permissible product offerings and counterparty risk frameworks.
## How Does Defy Monitor Stablecoin Flows for AML Compliance?
Defy’s AML compliance platform provides purpose-built stablecoin monitoring capabilities that address the specific risk patterns described in this analysis. Unlike generic blockchain analytics tools, Defy’s approach is calibrated to the behavioral signatures of stablecoin-based financial crime, including the multi-hop layering patterns common in pig butchering proceeds laundering, the OTC broker intermediation patterns used in sanctions evasion, and the address clustering techniques that allow compliance teams to attribute activity across pseudonymous wallet networks.
Defy’s real-time scanning engine monitors stablecoin transactions across all major networks — including Ethereum, Tron, Polygon, Arbitrum, and BNB Chain — and scores each transaction against a continuously updated risk model that incorporates OFAC SDN designations, Tether’s on-chain blacklist, Circle’s frozen address registry, and Defy’s proprietary threat intelligence feeds. When a transaction involves an address with exposure to a sanctioned entity, a known fraud network, or a mixer or privacy protocol, compliance officers receive an immediate alert with a full transaction trace and risk justification, enabling the rapid suspicious activity reporting (SAR) and transaction freezing that regulatory frameworks require.
For the issuer cooperation dimension of stablecoin AML, Defy’s platform generates the structured evidence packages — chain-of-custody transaction traces, address attribution reports, and fund flow diagrams — that legal teams submit when requesting address freezes from Tether or Circle, or when supporting law enforcement seizure requests. The quality and completeness of these packages directly affects both the speed and success rate of freeze and recovery actions, making investigative tooling a critical operational component of stablecoin AML programs.
## What Is the Role of Issuer Cooperation in Stablecoin Enforcement?
The capacity of stablecoin issuers to freeze addresses unilaterally represents a compliance capability with no direct analog in either traditional finance or the broader cryptocurrency ecosystem. A commercial bank can freeze an account, but this requires legal process and is limited to assets held at that institution. By contrast, Tether and Circle can render stablecoin balances permanently non-transferable by modifying a smart contract state variable — an action that can be executed in minutes and is irreversible at the blockchain level without issuer action.
This capability makes issuer cooperation a critical variable in stablecoin AML effectiveness. The enforcement community has identified a consistent pattern: the faster an issuer responds to a freeze request following the identification of illicit funds, the lower the probability that the funds are successfully moved to a liquidation point before the freeze is executed. In the pig butchering context, fraud proceeds may transit through dozens of intermediate wallets within hours of the initial victim transfer, meaning that a 48-hour issuer response time may be insufficient to prevent fund extraction, while a 2-hour response may successfully freeze a substantial portion of the proceeds.
The implication for the regulatory agenda is clear: mandatory timelines for issuer response to law enforcement freeze requests, and standardized technical interfaces for submitting those requests, are the next critical infrastructure requirement for stablecoin AML. MiCA’s AML provisions move in this direction for EU-licensed issuers, and the forthcoming US stablecoin legislation — currently under debate in both chambers of Congress — is expected to include issuer cooperation mandates as a condition of federal authorization. Compliance teams at regulated institutions should monitor this legislative development closely, as issuer cooperation standards will directly affect the residual AML risk of stablecoin product offerings.
---
*Defy (getdefy.co) provides real-time AML compliance infrastructure for crypto businesses, including stablecoin transaction monitoring, sanctions screening, and investigation tooling. Sources referenced in this article include the Chainalysis 2024 Crypto Crime Report, Elliptic 2024 Financial Crime Report, UNODC 2024 Report on Transnational Organized Crime in Southeast Asia, UN Panel of Experts Report on North Korea (2024), OFAC enforcement actions (2022–2024), and DefiLlama stablecoin market data.*