FATF Stablecoins and Unhosted Wallets: Freeze and Screening
Quick answer. It encourages issuers to be able to block, freeze and withdraw tokens at any time, and strongly encourages monitoring secondary market use. Jurisdictions should consider requiring that capability, redemption due diligence, and allow-lists and deny-lists. It is non-binding.
Video transcript
The FATF calls peer-to-peer transfers between unhosted wallets a key vulnerability for stablecoins. Its non-binding March 2026 report encourages issuers to be able to block, freeze and withdraw tokens.
Citing Chainalysis, the report says stablecoins were 84 percent of 154 billion dollars in illicit virtual asset volume in 2025.
FATF standards generally bind intermediaries, not individuals. Funds can hop through wallets beyond Travel Rule reach, and bridges may weaken an issuer's ability to freeze or blacklist.
Issuers are encouraged to freeze and withdraw tokens, and strongly encouraged to manage secondary market risk. Jurisdictions should consider requiring due diligence at redemption, plus allow-lists and deny-lists.
When an issuer froze over 29 million dollars tied to a conglomerate, the group launched a stablecoin marketed as immune to freezing. The July update says jurisdictions need to ensure issuers can comply with lawful freeze orders.
For VASPs, FATF indicators flag wallets several hops from Travel Rule coverage, dormant wallets that wake for cross-chain bursts, and progressive bridging before an off-ramp. Pair analytics with human review.
Our checklist, not the FATF's: map every privileged role on every chain, prove frozen addresses cannot move value, confirm freezes reach bridged supply, and time the path from request to freeze.
Guardian maps every role that can freeze or upgrade, then attacks those flows. Read the full article, or talk to Guardian at guardian.security.
On 3 March 2026 the Financial Action Task Force (FATF) published its Targeted Report on Stablecoins and Unhosted Wallets, subtitled Peer-to-Peer Transactions.
Citing Chainalysis, it says stablecoins made up 84% of the USD 154 billion in illicit virtual asset transaction volume in 2025 (paragraph 29).
It names peer-to-peer (P2P) transfers through unhosted wallets as "a key vulnerability," and looks to issuers and virtual asset service providers (VASPs) to narrow it.
This article explains the technical and security side of the FATF's Targeted Report on Stablecoins and Unhosted Wallets and its July 2026 Targeted Update. It is not legal advice; confirm how it applies to you with counsel.
What the Report Is
"As with all FATF guidance products, the Guidance is non-binding" (paragraph 10). Jurisdictions decide what to adopt.
It covers developments to the end of 2025, drawing on 29 case studies and a survey of issuers and analytics firms.
The FATF's July 2026 Targeted Update on virtual assets picks it up in paragraphs 35 to 38. A companion July report on DeFi lists 12 indicators of control.
The Gap: P2P Transfers
The FATF defines P2P transactions as transfers without a VASP or other obliged entity, such as between two unhosted wallets.
Its Standards generally place obligations on intermediaries, not individuals. So P2P transfers via unhosted wallets are "not explicitly subject to AML/CFT controls" (paragraph 25).
The Travel Rule reaches only part of the path. VASPs should collect originator and beneficiary data even for transfers between a customer and an unhosted wallet (paragraph 50).
But funds can then move through layered wallets "transactionally distant" from Travel Rule-covered wallets. No obliged entity files a suspicious transaction report on those hops (paragraphs 51 and 53).
Bridges make it worse. Where tokens circulate as wrapped versions on other chains, interoperability "may weaken" the issuer's ability "to freeze or blacklist assets" (paragraph 56).
Jurisdictions see the risk but lack data. In the July update, 88% (58 of 66) rated P2P transactions high risk, while only 23% (31 of 133) collect P2P market metrics (paragraph 38).
What Issuers Are Expected to Do
The recommended actions use different verbs, and the verb shows how firm each control is.
| Control | Wording | Addressed to |
|---|---|---|
| Block, freeze and withdraw at any time | "Encouraged" | Issuers |
| Mitigate secondary market risk, including monitoring use | "Strongly encouraged" | Issuers |
| Public law enforcement contact, monitored 24/7 | "Should consider" | Issuers |
| Burn, freeze and withdraw on the secondary market | "Should consider" requiring | Jurisdictions |
| Due diligence at redemption | "Should consider" requiring | Jurisdictions |
| Limits on issuance on high-risk chains | "Should consider" requiring | Jurisdictions |
| Allow-lists and deny-lists | "Should also consider" requiring | Jurisdictions |
| Pre-launch compliance reviews | "Should institutionalise" | Jurisdictions |
Block, freeze or withdraw
The report separates the three (footnote 31). Blocking stops a specific transaction without freezing the whole wallet. Freezing immobilizes an address.
Withdrawal removes tokens, for example by burning and re-issuing them. It lets an issuer comply with an authority's order, such as a confiscation (paragraph 67).
A freeze works even with no identity behind the address. Where an address is linked to crime, "executing freezing functions remain feasible" (paragraph 63).
Allow-list or deny-list
A deny-list rejects transfers involving listed addresses. An allow-list rejects any transfer involving an address that is not on it.
Deny-lists are more common but reactive, usually triggered by law enforcement or a sanctions listing. Allow-lists are proactive but may push out users who do not want to be identified (paragraph 66).
In one Swiss franc stablecoin plan, unhosted wallets join the allow-list once a Swiss bank, a VASP or a comparably regulated foreign bank verifies the holder (Box 7).
What VASPs Are Expected to Do
Paragraph 78 lists approaches that jurisdictions and firms already use:
- Limiting how much customers can send to unhosted wallets.
- Enhanced due diligence on unhosted wallet transactions, including the wallet's beneficial owner.
- Blockchain analytics to rate customers' unhosted counterparties.
- Due diligence on unhosted wallets at issuance and redemption.
- Prohibiting, or denying licenses to, platforms that allow transfers to unhosted wallets.
Singapore expects VASPs to limit unhosted transfers to first-party wallets and to verify the customer owns them (Box 13).
The July update adds recommendations. VASPs should apply enhanced due diligence to higher-risk unhosted wallet activity and use analytics to detect rapid transfers.
Their wallet screening, blacklisting, whitelisting where appropriate, and freezing and blocking capabilities should mitigate identified risks and be quick to update.
Annex A gives screening rules a starting point. Three indicators fit unhosted wallet flows:
- Transfers involving unhosted wallets "multiple hops away" from Travel Rule-covered wallets.
- A dormant unhosted wallet that wakes, makes many cross-chain transfers, then goes quiet.
- Progressive bridging and wrapping across chains before an off-ramp.
Analytics have limits. Providers' methods differ and can miss sophisticated obfuscation, so pair them with trained human review (paragraph 69).
The July Update and Freeze-Resistant Coins
The July update adds a case that tests the model (paragraph 35).
A third-party issuer froze over USD 29 million in a wallet linked to a Cambodia-based conglomerate. The conglomerate then launched a USD-pegged stablecoin "marketed as immune to asset freezing."
The FATF's conclusion: VASPs "may be unable to rely on issuer-level asset freeze/burn mechanisms as a compliance safeguard."
It says the case underscores the need for jurisdictions to ensure issuance arrangements include "the technical capacity to comply with lawful blocking, freeze and seizure orders."
The March report saw the same pressure. Freezes of USDT at IRGC-linked addresses in mid-2025 "may encourage" moves to stablecoins such as DAI that lack a freeze function (paragraph 36).
For VASPs, it is a reason to check a token's freeze capability at listing. For issuers, see our comparison of MAS, HKMA and GENIUS Act freeze rules.
Testing Freeze and Screening Paths
Our checklist, not the FATF's:
- List every freeze, blacklist, burn, mint, pause and upgrade role on every chain, with its holder.
- Prove a frozen address cannot move value through transfers, allowances, permits, bridges or redemption.
- Check that a freeze reaches bridged and wrapped supply, or that the bridge enforces it.
- Rehearse burn and re-issue end to end, including where the new tokens land.
- Time the path from a law enforcement request to a confirmed freeze, outside office hours.
- Log who adds deny-list entries, from which data source, and how fast.
- For allow-lists, re-verify holders on a schedule and remove lapsed ones.
- On the VASP side, test screening against wallets several hops from your own.
Our multichain deployment checklist covers role and peer checks on each new chain.
How Guardian Helps
Guardian's smart contract audits start with a design review of roles and upgrade paths, then attack privileged flows directly.
Our regulatory assessments map every role that can move value, upgrade, pause, freeze or change parameters, with its holder, threshold and timelock.
On Polygon, Guardian flagged a queued USDT0 migration that would have left more USDT0 circulating than USDT available to redeem it. It was fixed before the transactions ran (USDT0 client story).
Frequently Asked Questions
Is the FATF report on stablecoins and unhosted wallets binding?
No. The report says that, as with all FATF guidance products, it is non-binding. It recommends actions to jurisdictions and the private sector, and obligations follow only where a jurisdiction adopts them.
Does the FATF require stablecoin issuers to be able to freeze tokens?
Not directly. It encourages issuers to build block, freeze and withdraw capability, and says jurisdictions should consider requiring it. The July 2026 update stresses that jurisdictions need to ensure issuers can comply with lawful freeze orders.
What does the FATF expect VASPs to do about unhosted wallets?
Collect originator and beneficiary data on transfers with unhosted wallets, apply enhanced due diligence to higher-risk wallet activity, and use analytics to detect rapid transfers. Approaches in use include capping transfers to unhosted wallets and allowing only verified first-party wallets.
What is the difference between an allow-list and a deny-list?
A deny-list blocks listed addresses from moving the token. An allow-list blocks every address not pre-approved, and approval can include due diligence. The FATF says deny-lists are more common but reactive; allow-lists are proactive but may push out privacy-minded users.
Sources
- FATF: Targeted Report on Stablecoins and Unhosted Wallets, Peer-to-Peer Transactions (March 2026), official page
- FIAU Malta: hosted copy of the FATF March 2026 report PDF, the copy read for this article because fatf-gafi.org blocks automated access
- FATF: Targeted Update on Implementation of the FATF Standards on Virtual Assets and VASPs (July 2026), official page
- FIAU Malta: hosted copy of the FATF July 2026 Targeted Update PDF
- A&O Shearman FinReg: FATF targeted report on stablecoins and unhosted wallets (3 March 2026)
- OJK (Indonesia): FATF Targeted Report on Stablecoins and Unhosted Wallets, March 2026 (summary in Indonesian)
- Guardian: USDT0 client story
- Guardian: Regulatory and Compliance Assessment
Test your freeze paths before a regulator does
Guardian reviews your token's freeze, blocklist, mint and bridge paths and maps who holds each role, read from the deployed contracts.