The stablecoin conversation has crossed an important threshold. For several years, financial institutions debated whether tokenised money would progress beyond crypto trading, treasury experiments and limited payment pilots. That question is rapidly becoming outdated. Stablecoins are moving into mainstream payment distribution — and the competitive question is now whether institutions can operate them safely at scale.
Visa's launch of the Visa Stablecoin Platform on 16 July is the latest evidence. The platform gives banks, fintechs and other payment providers a managed environment for stablecoin minting, storage, movement and redemption, initially supporting Open USD. The announcement matters less because of any single token than because Visa is placing stablecoin functionality inside familiar institutional workflows.
Distribution is arriving. The harder work is making compliance travel at the same speed as the money.
The Regulatory Perimeter Is Becoming Operational
Recent developments show regulators moving from broad principles toward specific operating requirements.
Australia's expanded AML/CTF regime reached a major milestone on 1 July. Existing and newly regulated virtual-asset service providers must now implement the Travel Rule for virtual-asset transfers, requiring information about originators and beneficiaries to accompany transactions. AUSTRAC's transitional guidance makes clear that this is not simply a disclosure exercise; firms must adapt systems, policies and customer-information processes.
In the United States, the Office of the Comptroller of the Currency is consulting on AML/CFT and sanctions standards for permitted payment stablecoin issuers. The OCC proposal, whose comment period closes on 24 July, would place supervised issuers within a formal Bank Secrecy Act, FinCEN and sanctions-control framework. A related customer-identification proposal remains open through August.
These developments point in the same direction: a stablecoin payment is not exempt from financial-crime controls because it settles on-chain. The technology may change how value moves, but it does not remove the obligation to understand who is transacting, why the payment is occurring and where the funds have been.
KYC Is the Beginning, Not the Complete Control
Traditional KYC concentrates on the customer at onboarding. Stablecoin risk is more dynamic.
A customer who appears low-risk today may later interact with a sanctioned address, mixer, fraudulent investment scheme, compromised protocol or high-risk VASP. Funds can also move through several intermediate wallets before reaching a regulated institution. Effective controls must therefore combine identity verification with continuous wallet, transaction and counterparty assessment.
This is where risk evaluation needs to become more precise. A binary "clean or illicit" label is rarely sufficient. Institutions need policies covering direct and indirect exposure, transaction size, time elapsed, number of wallet hops, asset and blockchain characteristics, customer behaviour and the reliability of attribution data.
Recent Chainalysis benchmarking suggests that monitoring standards have tightened substantially. However, it also finds wide differences between direct- and indirect-exposure thresholds. That inconsistency is consequential: sophisticated actors deliberately use intermediary wallets and cross-chain routes to increase distance from an identified illicit source.
Leadership teams should consequently ask a more useful question than "Do we screen wallets?" They should ask: "What risk does our screening detect, at what distance, under which thresholds, and what action follows an alert?"
The Travel Rule Must Connect to Transaction Risk
Travel Rule compliance and blockchain monitoring are often implemented as separate projects. That creates an avoidable blind spot.
Travel Rule data supplies identity and institutional context. Blockchain analytics supplies behavioural and transactional context. Together, they allow a VASP to compare the declared originator, beneficiary and purpose with the actual movement of funds.
A robust process should verify the counterparty VASP, assess its jurisdiction and regulatory status, validate the completeness of required information, screen relevant wallets, and determine whether the transaction is consistent with the customer's expected activity. Missing data, conflicting information or elevated on-chain exposure should trigger a documented risk-based response — not merely another unresolved alert.
The challenge becomes more pronounced with unhosted wallets. FATF's targeted stablecoin report highlights the growing misuse of stablecoins through peer-to-peer transactions and cross-chain activity. It recommends stronger secondary-market monitoring, customer due diligence at redemption and, where proportionate, technical capabilities such as freezing or denying transactions involving high-risk addresses.
That represents a significant shift: compliance responsibility increasingly extends beyond issuance and redemption to the broader life of the asset.
Risk Management Must Include the Stablecoin Itself
Financial-crime compliance is only one dimension. Institutions must also evaluate reserve quality, redemption rights, liquidity, governance, custody dependencies, smart-contract controls, operational resilience and cross-chain exposure.
The Financial Stability Board's implementation review found substantial inconsistencies between jurisdictions, creating opportunities for regulatory arbitrage. The Bank for International Settlements has likewise warned that supervision and enforcement lag behind rulemaking in many markets.
A licence therefore cannot substitute for due diligence. Institutions need a repeatable method for assessing both the issuer and every critical participant around it.
The Observation That Matters
The winning stablecoin businesses will not be those that bolt controls onto the fastest rail. They will be those that make trust, traceability and risk evaluation part of the rail itself.
For institutions moving into stablecoin payments, the operational challenge is to join identity, regulatory status, transaction behaviour and asset-level risk into evidence that payment and compliance teams can act on — in real time, at the speed the payment infrastructure demands.
That is what compliance infrastructure means in the stablecoin era. Not a checklist bolted on after launch. A system designed in from the beginning.
UWAY provides compliance infrastructure for FinTech, Web3, and digital asset businesses across Hong Kong, Singapore, and the EU.