Stablecoins increasingly favoured for money laundering, financing of terrorism and proliferation: FATF report

The Financial Action Task Force (FATF), in its latest report, has said that stablecoins are increasingly being favoured for illegal activities, including money laundering and terror financing, with indications that state-linked actors in Iran and North Korea are also using them for operations such as proliferation financing and weapons procurement.

Stablecoins are a type of cryptocurrency designed to keep their prices stable, usually by linking them to another asset such as a fiat currency or gold.

“Notwithstanding the FATF’s framework, stablecoins are exposed to heightened ML (Money Laundering)/TF (Terrorist Financing)/PF (Proliferation Financing) risks when transferred on a P2P (peer-to-peer) basis via unhosted wallets. These vulnerabilities are exacerbated by their characteristics such as the price stability and ample liquidity…,” noted the “Targeted Report on Stablecoins and Unhosted Wallets”.

“State-linked cybercriminal groups have rapidly adopted stablecoins as a preferred method for laundering proceeds from ransomware, phishing, and other cyber-enabled crimes. Most notably, (North Korea) DPRK’s Lazarus Group, Andariel, and Onyx Sleet specialise in virtual asset theft, espionage, and disruptive attacks, like ransomware,” it said, adding that groups like Lazarus have used malware and social engineering to infiltrate virtual asset firms to steal funds, including a nearly $1.46 billion theft in February 2025.

According to the Multilateral Sanctions Monitoring Team, since at least 2023, “the DPRK’s 221 General Bureau” has sought to expand the use of stablecoins beyond cyber-enabled financial crime to include their use as a means of exchange and payment for goods and services prohibited under the United Nations Security Council resolutions.

“In particular, DPRK entities have been assessed to use Tether (USDT) in transactions involving the sale and transfer of military equipment and raw materials…this activity indicates an apparent effort by DPRK entities to operationalise the use of stablecoins in WMD-related procurement activities,” said the report.

It added that Iranian actors are “leveraging stablecoins to finance proliferation”. “Notably, the Islamic Revolutionary Guard Corps (IRGC) has turned to virtual assets to finance its evasion activities…UN sanctioned Iranian actors use virtual assets to obtain drone components and other high-tech equipment, and Iran has begun accepting virtual assets for weapons payments. Iranian actors have also been assessed to use virtual assets to transfer funds to UN sanctioned actors in the region, such as the Houthis, for weapons procurement,” the FATF said.

The report said terrorist organisations using virtual assets increasingly favour stablecoins over Bitcoin for reasons similar to those identified for money launderers. It also flagged their use for laundering of drug money, in online gambling platforms, and other illegal operations.

The report cited an operational analysis carried out by Financial Intelligence Unit (FIU) India in the case of a group of people receiving Virtual Digital Asset (VDA) deposits from a Southeast Asia-based payment service provider.

“An Indian Virtual Digital Asset Service Provider (VDA SP) identified a pattern among a set of customers whose IP addresses were traced back to Southeast Asia. These individuals exhibited a consistent behaviour of funding their accounts with USDT (United States Dollar Tether), immediately liquidating it, and withdrawing the corresponding amount in INR (Indian Rupee) to their bank accounts and with no other types of transactions apart from this,” it said.

After repeated attempts, VDA SP was able to connect with 21 customers and found that the customers were in various locations in Southeast Asia and were employed as construction labour, restaurant workers, etc. Several of them had logged in from the same device.

As it turned out, the Indian nationals working in scam centres, mainly in Cambodia and Myanmar, were using the Southeast Asia-based payment service provider for transfer of salary to their family, friends, and relatives in India. Under the Prevention of Money Laundering Act, in October 2025, FIU India issued a notice against the service provider and its illegal operations in India were blocked.

The FATF report has suggested several good practices, including tailored regulatory frameworks for stablecoin issuers, use of advanced blockchain analytics, programmable controls embedded in smart contracts, and strengthened domestic and international co-operation mechanisms, as steps to counter their possible misuse. As of mid-2025, over 250 stablecoins — with total market capitalisation exceeding $300 billion — were in circulation.

Published – March 10, 2026 11:06 pm IST