Currency Without Controls: Why Stablecoins Are Outrunning the Travel Rule

The UK was among the first jurisdictions in the world to implement the crypto travel rule. Since September 2023, every virtual asset service provider (VASP) registered with the Financial Conduct Authority (FCA) has been required to collect and transmit originator and beneficiary information for cryptoasset transfers, regardless of value. The policy intention was clear: if digital assets were to operate within the UK's financial system, they would meet the same transparency obligations as traditional payment providers. Two and a half years later, the infrastructure is in place, the supervisory expectations are published, and stablecoins have grown into a $312bn asset class processing $33tn in annual transaction volume globally. Yet the compliance framework designed to govern these transfers remains structurally misaligned with the asset it now most urgently needs to control.

The Financial Action Task Force (FATF) revised Recommendation 16 (R16) at its June 2025 Plenary, expanding the travel rule's objectives beyond money laundering and terrorist financing to include fraud prevention and proliferation financing. It mandated Confirmation of Payee (CoP) verification for cross-border transfers and aligned requirements with ISO 20022 messaging standards. For UK firms, this is not unfamiliar territory. The FCA's expectations already exceed the baseline set by many other jurisdictions. The challenge is not whether the UK has legislated. It is whether legislation alone can close the gap that stablecoins have opened.

The scale of the problem is no longer theoretical

Stablecoins now account for 84% of all illicit cryptocurrency transaction volume, according to the Chainalysis 2026 Crypto Crime Report. In 2024, the figure was 63%. That is not a gradual drift. That is a structural shift.

The characteristics that make stablecoins attractive to legitimate users are precisely those that make them attractive to criminals: low volatility, high liquidity, speed of settlement, and frictionless cross-border movement. What works for remittances works for sanctions evasion. What works for trade settlement works for laundering infrastructure.

TRM Labs reported in February 2026 that illicit entities received approximately $141bn in stablecoins during 2025, the highest level observed in five years. Sanctions-related activity accounted for 86% of all illicit crypto flows. Roughly half of that figure was linked to A7A5, a ruble-pegged stablecoin operating almost entirely within sanctioned networks. The EU sanctioned the network behind A7A5 in October 2025, describing it as a prominent tool for financing activities supporting Russia's war of aggression.

Chainalysis, in a separate analysis, placed total illicit cryptocurrency volumes at $154bn for 2025, a 162% increase over the prior year. Stablecoins dominated the composition of those flows. For UK firms with correspondent banking relationships, exposure to stablecoin-linked counterparties in non-implementing jurisdictions, or customers transacting across high-risk corridors, the concentration of illicit value in stablecoins is not an abstract data point. It is an operational risk that existing controls may not be calibrated to address.

The UK regime is ahead, but the gaps are structural

The UK's travel rule applies a zero-threshold standard to domestic VASP-to-VASP transfers. For cross-border transfers involving a counterparty outside the UK, a broader dataset must accompany any transaction equal to or exceeding the equivalent of EUR1,000 in cryptoassets. The FCA has published clear supervisory expectations, and the Joint Money Laundering Steering Group (JMLSG) has issued sector-specific guidance. On paper, this is among the most rigorous travel rule regimes in operation.

The broader regulatory direction reinforces this. In December 2025, HM Treasury laid the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2025 before Parliament, establishing the UK's first comprehensive regulatory framework for cryptoassets. Stablecoin issuance, custody, dealing, and platform operation will all require FCA authorisation from October 2027. The application window opens in September 2026. The direction is unmistakable.

Yet the FATF's own 2025 targeted update found that only one jurisdiction globally is fully compliant with Recommendation 15 (R.15), the standard governing virtual asset regulation. One. Eighty-five of 117 surveyed jurisdictions have passed travel rule legislation, up from 65 in 2024, but 21% remain entirely non-compliant. The sunrise issue, where UK firms must transact with counterparts in jurisdictions that have not yet implemented the travel rule, remains unresolved. Interoperability between travel rule messaging solutions is limited. Competing protocols persist. There is no universally adopted standard for secure data transmission between VASPs.

For stablecoin transfers, these gaps are compounded by the nature of the asset itself. Consider the scenario: a USDT transfer from a UK-registered exchange to a self-hosted wallet controlled by an unknown party in a non-implementing jurisdiction. The originating VASP has a compliance obligation it cannot fully discharge. The data must be collected. There is no counterparty institution to receive it. The data trail ends.

International frameworks are converging but remain incomplete

The European Union's (EU) Transfer of Funds Regulation (TFR), effective since December 2024, requires crypto asset service providers (CASPs) to collect and transmit originator and beneficiary information with every transfer, regardless of size. The Markets in Crypto-Assets Regulation (MiCA) layers additional requirements on stablecoin issuers through token classification as either e-money tokens (EMTs) or asset-referenced tokens (ARTs). The combination is more comprehensive than most jurisdictions in its treatment of the transfer chain.

The US Guiding and Establishing National Innovation for US Stablecoins Act (GENIUS Act), signed into law in July 2025, classifies permitted stablecoin issuers as financial institutions under the Bank Secrecy Act (BSA), triggering customer identification programmes (CIPs), suspicious activity reporting (SARs), and Office of Foreign Assets Control (OFAC) sanctions screening. Hong Kong's Stablecoin Ordinance, effective August 2025, and the Monetary Authority of Singapore (MAS) framework impose comparable requirements.

These are substantial developments. They are also incomplete. The GENIUS Act does not address self-hosted wallets. It does not cover peer-to-peer transfers for payment purposes. It does not impose travel rule obligations on the transfer layer itself. The issuer can freeze tokens once an illicit address is identified, but identification typically occurs after the value has already moved. Tether has frozen addresses linked to scams, terrorist financing, and sanctions evasion. This is a reactive capability, not a preventive control.

For UK firms, the relevance is direct. International convergence determines the quality of travel rule data that UK VASPs receive from foreign counterparts. Where the counterparty jurisdiction has weak or partial implementation, the UK firm bears the residual risk. The FCA expects firms to make a risk-based assessment of whether to proceed. The practical difficulty is that the assessment must be made at speed, often in real time, and the data available to inform it is frequently insufficient.

Self-hosted wallets and the compliance frontier

The FATF has consistently maintained that peer-to-peer transfers between two private wallets are generally outside the scope of the travel rule, because no intermediary VASP is involved. This position is technically coherent. It is operationally dangerous.

The FATF's own 2025 targeted update acknowledged the risk explicitly. Mass adoption of stablecoins stored in unhosted wallets could decrease the use of anti-money laundering (AML) obliged entities entirely. Stablecoins could be used directly for the purchase of goods and services without passing through any regulated chokepoint. No screening. No data transmission. No trail.

This is not a distant scenario. In Latin America, 71% of stablecoin activity is tied to cross-border payments, according to TRM Labs, much of it conducted through informal channels. In Africa, regulators are paying closer attention to stablecoin usage in trade corridors linking the continent with the Middle East and Asia. Supervisory capacity remains limited. The practical effect is that stablecoins are functioning as a parallel payment system: fast, cheap, dollar-denominated, and substantially outside the compliance framework the FATF has spent five years building.

UK firms are not insulated from this dynamic. Where a UK-registered VASP processes an outbound transfer to an unhosted wallet, HM Treasury's guidance is clear: the originating provider must still collect information on the intended beneficiary, even though there is no receiving institution to which data can be transmitted. The obligation exists. The mechanism to make it effective does not. The travel rule is an intermediary-based framework. When the intermediary is removed, the framework does not degrade. It collapses.

What UK firms should be doing now

The revised R16 will not take full effect until 2030. That timeline is misleading. The FCA's supervisory expectations are already live. The FSMA Cryptoassets Regulations are expected to come into force in October 2027, with the authorisation window opening in September 2026. Firms that treat these dates as distant milestones are misjudging the regulatory trajectory. The FCA has made clear, through its consultation papers CP25/14 on stablecoin issuance and custody and CP25/40 through CP25/42 on the broader cryptoasset regime, that it expects firms to be preparing now.

Three areas demand immediate attention. First, stablecoin transfer monitoring must be integrated into existing AML frameworks, not bolted on as a parallel process. Stablecoin transactions settle in seconds. Pre-transaction screening is essential. Post-transaction detection, the model built for correspondent banking where settlement takes hours, is inadequate for an asset that moves faster than controls can react.

Second, counterparty risk assessment must account for the jurisdictional patchwork of travel rule implementation. The same stablecoin can carry fundamentally different regulatory treatment depending on the jurisdiction and the counterparty type. UK firms transacting with counterparts in non-implementing jurisdictions must apply corridor-level risk policies, assessing risk by transfer route rather than by asset alone. The FCA's expectation that firms take 'all reasonable steps and exercise all due diligence' leaves little room for firms that have not built these capabilities.

Third, firms must invest in interoperable travel rule solutions capable of exchanging originator and beneficiary data securely and in real time. The fragmentation of messaging protocols, with the Travel Rule Information Sharing Architecture (TRISA), OpenVASP, and proprietary systems competing for adoption, remains a significant barrier. Waiting for a single standard to emerge is not a strategy. Build for multiple protocols now.

The compliance gap that regulation alone cannot close

Stablecoins have achieved what no other digital asset has: genuine utility as a medium of exchange at global scale. Remittances. Trade settlement. Treasury management. Cross-border payments. Their transaction volume in 2025 exceeded $33tn, approaching the throughput of major card networks. Their market capitalisation has surpassed $312bn. US Treasury Secretary Scott Bessent has predicted the market could reach $2tn by 2028. None of this momentum is likely to slow.

The UK has built one of the world's most rigorous travel rule regimes for cryptoassets. The forthcoming FSMA Cryptoassets Regulations will extend the regulatory perimeter further, bringing stablecoin issuance, custody, and platform operation under full FCA authorisation. These are significant achievements. They are also, on their own, insufficient.

The travel rule was designed for a financial system in which value moved through identifiable, regulated institutions. Stablecoins have created a parallel system in which value moves between any two parties with an internet connection and a wallet address. Regulation is converging. Controls are not. Until that gap is addressed, not through legislation alone but through operational infrastructure that embeds compliance into the transfer layer itself, stablecoins will remain what they are today: a currency without controls. That is not a sustainable position for an industry that aspires to replace the payment rails it was built to improve.

Do you have confidence that your stablecoin compliance framework can keep pace with the assets it is designed to govern?

At OpusDatum, we help UK firms navigate the intersection of stablecoin adoption and travel rule compliance. Our advisory services support institutions in building transfer monitoring frameworks, counterparty risk policies, and travel rule implementation strategies that reflect both the FCA's supervisory expectations and the operational reality of digital asset payments.

To discuss how we can support your firm, contact us.