Read FATF stablecoin and unhosted-wallet risks without stigma

Separate the wallet model from the behavior being assessed

An unhosted wallet means the user controls the keys rather than a service provider. That fact alone does not show illicit activity. FATF's report is useful for understanding system risks and controls, but an individual decision still needs transaction-specific evidence, local law and proportionate privacy safeguards.

FATF's March 2026 targeted report discusses criminal misuse of stablecoins, especially in peer-to-peer transfers involving unhosted wallets, and presents risk-mitigation recommendations informed by more than 50 submissions. Policy-level risk indicators describe patterns and controls; they do not establish wrongdoing by a named customer or provider. Keep wallet controller beside key custody; compare service provider with account relationship by date, and leave proof open until issuer is verified.

Define custody accurately

Hosted and unhosted describe who controls transaction authority and keys. Record custody model and the service roles around the transfer. The wallet controller, key custody, service provider, account relationship and proof belong on the policy-to-transaction evidence grid. Keep the report's scope beside the local rule, provider status and transaction facts so readers can see what each layer proves. Name the owner of chain, the source for contract, the unit attached to wallet controller and the condition that would change service provider.

Do not equate self-custody with anonymity or criminal intent. End with a verification question instead of converting a generic warning into a personal accusation. A reviewer should reproduce account relationship from proof, trace issuer to chain and understand why key custody was not substituted for contract. Apply the instruction again in its narrow form: Record custody model and the service roles around the transfer. Preserve the evidence for define custody accurately without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Identify the stablecoin

Stablecoins differ by issuer, chain, contract, reserve claim and redemption route. Match issuer and contract before considering risk indicators. The issuer, chain, contract, reserve reference and redemption path belong on the policy-to-transaction evidence grid. End with a verification question instead of converting a generic warning into a personal accusation. A reviewer should reproduce account relationship from proof, trace issuer to chain and understand why key custody was not substituted for contract.

A common ticker does not establish one asset or one control framework. Policy-level risk indicators describe patterns and controls; they do not establish wrongdoing by a named customer or provider. If service provider conflicts with issuer, retain both captures, recheck wallet controller and postpone any step that depends on proof. Apply the instruction again in its narrow form: Match issuer and contract before considering risk indicators. Preserve the evidence for identify the stablecoin without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Distinguish pattern from proof

Policy reports aggregate typologies, case studies and observed vulnerabilities. Use a typology to form a verification question for the real transaction. The report claim, scope, observed behavior, corroboration and uncertainty belong on the policy-to-transaction evidence grid. Policy-level risk indicators describe patterns and controls; they do not establish wrongdoing by a named customer or provider. If service provider conflicts with issuer, retain both captures, recheck wallet controller and postpone any step that depends on proof.

A policy-level percentage cannot prove the nature of a named wallet transfer. Keep the report's scope beside the local rule, provider status and transaction facts so readers can see what each layer proves. The final decision must connect contract to account relationship, preserve the boundary around key custody and state when chain needs another observation. Apply the instruction again in its narrow form: Use a typology to form a verification question for the real transaction. Preserve the evidence for distinguish pattern from proof without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Apply proportionate checks

Controls can include customer due diligence, transaction monitoring and cross-border cooperation. Ask which rule applies, who performs the check and what data is necessary. The legal basis, controller, requested data, retention and appeal route belong on the policy-to-transaction evidence grid. Keep the report's scope beside the local rule, provider status and transaction facts so readers can see what each layer proves. The final decision must connect contract to account relationship, preserve the boundary around key custody and state when chain needs another observation.

Collecting every available personal detail is not automatically proportionate or effective. End with a verification question instead of converting a generic warning into a personal accusation. Keep wallet controller beside key custody; compare service provider with account relationship by date, and leave proof open until issuer is verified. Apply the instruction again in its narrow form: Ask which rule applies, who performs the check and what data is necessary. Preserve the evidence for apply proportionate checks without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Protect legitimate-user evidence

Public hashes can support tracing while private keys and seed words remain secret. Share the minimum transaction identifiers through a verified channel. The hash, address role, amount, time, source of funds and redactions belong on the policy-to-transaction evidence grid. End with a verification question instead of converting a generic warning into a personal accusation. Keep wallet controller beside key custody; compare service provider with account relationship by date, and leave proof open until issuer is verified.

No risk review requires surrendering wallet recovery material. Policy-level risk indicators describe patterns and controls; they do not establish wrongdoing by a named customer or provider. Name the owner of chain, the source for contract, the unit attached to wallet controller and the condition that would change service provider. Apply the instruction again in its narrow form: Share the minimum transaction identifiers through a verified channel. Preserve the evidence for protect legitimate-user evidence without copying passwords, authentication codes, private keys, recovery phrases or unnecessary identity images.

Use the FATF report at its intended policy level

The report supports discussion of stablecoin misuse patterns, P2P exposure and possible mitigation approaches. Cite FATF stablecoins and unhosted wallets report with its HTTPS address and access date; use source-checked explainers only for supporting definitions. If service provider conflicts with issuer, retain both captures, recheck wallet controller and postpone any step that depends on proof. Keep the report's scope beside the local rule, provider status and transaction facts so readers can see what each layer proves.

It does not determine guilt, local legality, wallet ownership or the outcome of a particular provider review. The final decision must connect contract to account relationship, preserve the boundary around key custody and state when chain needs another observation. End with a verification question instead of converting a generic warning into a personal accusation.

Keep risk analysis specific, dated and reviewable

State which facts support the decision and which are merely contextual, then revisit the assessment when law or provider status changes. Name the owner of chain, the source for contract, the unit attached to wallet controller and the condition that would change service provider. Policy-level risk indicators describe patterns and controls; they do not establish wrongdoing by a named customer or provider.

Risk controls should not shame ordinary users, and no stablecoin transfer should be used to chase gambling losses or escape debt. Adults 18+ who meet local law should protect essential money, set cash and time limits before any play, never borrow or chase losses, and use the responsible-play centre for stronger separation or confidential support. A reviewer should reproduce account relationship from proof, trace issuer to chain and understand why key custody was not substituted for contract.