A stablecoin is issued by one company, but it circulates through thousands of venues, wallets, bots, OTC desks, bridges, Telegram deals, and payment processors. That distribution is the product. It is also the compliance weakness.
Regulators are catching up to issuer obligations. The harder operational question is what happens before an issuer can act. The answer, in most real cases, is secondary-market AML: the messy layer where funds move wallet to wallet and business teams must decide whether to accept, pause, reject, or escalate.
Why direct issuer controls are not enough
Issuer controls work best when the issuer has a clean event: mint, redeem, account relationship, subpoena, law-enforcement request, confirmed sanctions match. Secondary-market movement gives less structure. The wallet may be new. The counterparty may be anonymous. The payment may be part of a P2P chain.
That does not make the risk unknowable. It means the evidence is probabilistic and operational. You screen the address, weigh exposure, keep a record, and make a decision before releasing value.
The next compliance fault line
The fault line is going to sit between "issuer can freeze" and "operator should have checked." If funds pass through a desk, exchange, or payment flow and later trace to a sanctioned network, the first question will not be whether the issuer eventually acted. It will be whether the operator had a defensible process at the moment of acceptance.
That is why wallet checks, watchlists, receipt records, and review notes matter. They are not decoration. They are the operating proof that a team did not take contaminated flow blind.
Sources
Federal Register, permitted payment stablecoin issuer AML/CFT program proposal: https://www.federalregister.gov/documents/2026/04/10/2026-06963/permitted-payment-stablecoin-issuer-anti-money-launderingcountering-the-financing-of-terrorism
