Stablecoin AML Compliance in 2026: Why USDT on Tron Carries Most High-Risk Exposure

In 2021, Bitcoin dominated the high-risk funds flowing into centralized exchanges. By 2025, USDT on Tron had taken the lead, accounting for 68% of risky inflows and 80.4% of risky outflows across the 99 exchanges covered by Global Ledger’s High-Risk Benchmark report. That amounted to $12.05 billion in risky USDT deposits during the year, or around $33 million a day.This shift has direct consequences for stablecoin AML compliance.

Sanctions-linked funds can reach exchanges through several intermediary wallets, while regulatory developments in the US and EU are adding new compliance considerations.

Explore what the data reveals about stablecoin risks in 2026, how regulatory requirements affect exchanges, and which AML controls matter most.

What Does Stablecoin AML Compliance Mean?

Issuers control minting, redemption and the ability to freeze tokens, while exchanges and payment platforms perform customer due diligence, wallet and transaction screening, Know Your Transaction (KYT) monitoring, Travel Rule checks, and suspicious activity reporting.

Specific obligations depend on the jurisdiction and the type of business.

In the EU, the Transfer of Funds Regulation requires crypto-asset service providers to collect and share information about senders and recipients for covered stablecoin transfers between providers. In the US, exchanges operating as money transmitters must maintain AML programs and report suspicious activity under the Bank Secrecy Act.

Meeting these requirements also involves deciding which transactions need closer attention, how far to trace exposure and when to investigate. These decisions depend on the actual risks passing through an exchange, including the assets involved. And as Global Ledger’s research shows, the distribution of those risks can change significantly over time.

How USDT on Tron Became the Main Asset for High-Risk Exposure

The shift from Bitcoin to USDT on Tron was already underway in 2022, when USDT first overtook BTC in its share of identified high-risk inflows. The gap continued to widen over the following three years, changing the asset profile of risky funds reaching centralized exchanges.

The change was substantial in dollar terms.

Risky USDT inflows grew from $2.67 billion in 2021 to $12.05 billion in 2025, while risky BTC inflows fell from $24.18 billion to $1.95 billion. Across the full five-year period, USDT on Tron accounted for $44.27 billion in risky inflows and $51.25 billion in risky outflows, exceeding BTC on both measures.

USDT’s Share of Risky Inflows Grew Faster Than Its Share of Deposits

Wider USDT use explains only part of the shift. USDT’s share of all exchange deposits rose from 19% in 2021 to 36% in 2025, while its share of risky inflows rose from 9.2% to 68.0%. BTC still accounted for around 40% of exchange deposits in 2025, yet only 11.0% of risky inflows.

Across the five-year period, high-risk activity made up a larger share of USDT flows than of BTC or ETH flows. These measured rates provide context for compliance reviews, but they are not regulatory or acceptable-risk thresholds.

Why Tron Attracts Both Legitimate and High-Risk Flows

The high-risk figures sit alongside widespread legitimate use of USDT on Tron. Low transaction costs, fast settlement and round-the-clock access to dollar-denominated value make it practical for traders, payment businesses and individual users.

Federal Reserve officials have pointed to similar features when explaining stablecoin use in payments and cross-border transfers, particularly where access to dollars or banking services is limited. Those features can also facilitate transfers between multiple wallets, services and jurisdictions, including transactions linked to high-risk activity.

High-Risk Categories Behind USDT on Tron Exposure

The role of USDT on Tron differs considerably across risk categories.

Sanctions became the largest category over 2021–2025, with $74.09 billion in combined exposure. By 2025, they accounted for 62.2% of risky inflows, up from 11.9% in 2021. Most sanctions-related exposure in the study involved USDT on Tron.

Sanctions-linked USDT was the largest single combination of asset and risk category in the study, with $30.42 billion in risky inflows and $32.54 billion in risky outflows. For exchanges handling substantial USDT on Tron flows, sanctions screening needs to account for connections that extend beyond a direct match with a listed address.

Terrorist financing followed the same concentration pattern on a much smaller scale. It was almost entirely USDT-based, yet represented only 2.6% of risky USDT inflows.

The concentration of sanctions-linked USDT flows makes the division of responsibilities between stablecoin issuers and exchanges particularly important. Issuers may have the technical ability to freeze tokens, while exchanges must assess the risks associated with the transfers they process.

Regulatory requirements in the US and EU address these responsibilities in different ways.

What Regulators Expect From Stablecoin Flows in 2026

In the US, the Genius Act treats permitted payment stablecoin issuers as financial institutions for Bank Secrecy Act purposes.

A joint proposal from FinCEN and OFAC, published in April 2026, would set requirements for AML/CFT programs, sanctions compliance and the technical ability to block, freeze or reject prohibited transactions. The proposal also covers certain secondary-market transfers, although some obligations relate only to issuers’ direct customer relationships.

In the EU, MiCA requires issuers of e-money tokens (EMTs) and asset-referenced tokens (ARTs) to obtain authorization. In its opinion of 8 October 2026, ESMA said MiCA-authorized crypto-asset service providers (CASPs) should stop offering EU clients services involving non-compliant stablecoins. It asked national regulators to ensure that existing exposure is wound down as soon as possible, within three months, allowing only narrowly limited services needed to exit those positions.

The EU Transfer of Funds Regulation also applies the Travel Rule to covered stablecoin transfers involving CASPs. Global Ledger’s MiCA guide explains the authorization regime.

In July 2026, Tether froze more than $131 million in USDT on Tron across four addresses after OFAC sanctioned wallets linked to Iran’s central bank and the Islamic Revolutionary Guard Corps. For exchanges that had already processed transfers involving those addresses, the freeze could trigger a review of earlier activity, including whether previous screening decisions were justified by the information available at the time.

Stablecoin AML Controls for Exchanges and Payment Platforms

For exchanges, the findings point to several areas where existing AML controls may need to be reviewed. USDT concentration affects how transactions are prioritized, indirect sanctions exposure requires monitoring beyond direct counterparties, and issuer freezes can prompt investigations into earlier transfers. The following seven controls address these risks and the associated compliance requirements.

1. Asset-aware risk scoring: alert thresholds and review priorities should reflect differences in risk between assets. Global Ledger’s 1.24% USDT deposit exposure rate provides a reference point, but an exchange still needs to calibrate its rules against its own customer activity, transaction volumes and alert results.

2. Sanctions screening and rescreening of Tron addresses: deposit and withdrawal addresses need to be checked as sanctions lists and wallet attribution change, as described in the crypto sanctions screening guide. When an address is designated after a transfer has taken place, the exchange may also need to review the earlier customer activity connected to it.

3. Indirect exposure monitoring: KYT needs to capture links that run through intermediary wallets, rather than stopping at the direct counterparty. Analysts should be able to see the transaction path, the amount involved, how many hops separate the wallet from the high-risk entity and what supports the attribution.

4. Issuer-freeze handling: when an issuer freezes or blacklists an address, exchanges need to assess related transactions, apply any required restrictions and review earlier activity. That may include funds the exchange still holds, earlier transfers and counterparties that interacted with the address before the freeze.

5. Swap and conversion monitoring: stablecoin funds may pass through other tokens, chains and swap services before reaching an exchange. FinCEN has described how A7A5, a ruble-backed token used by the A7 network, can be converted into USDT. Without visibility into the conversion, screening the USDT transfer alone may miss its earlier connection to sanctions risk.

6. Travel Rule for stablecoin transfers: collect and check originator and beneficiary information for covered transfers, with the relevant controls for self-hosted wallets under Travel Rule requirements. In the EU, transfers involving self-hosted addresses have additional requirements, including assessment of ownership or control for transfers above €1,000.

7. Point-in-time records: keep the attribution, risk score and supporting evidence available at the time of each decision. If a wallet is linked to a sanctioned entity months later, the case file should still show what the exchange knew when it processed the original transfer.

Why Indirect Exposure Matters for USDT

Sanctions exposure sat further from exchanges than the other major categories.

Global Ledger found that its value-weighted depth rose from 2.08 blockchain hops in 2021 to 3.06 in 2025, while terrorist financing averaged 2.85 hops over the five-year period. Since USDT accounted for 81% of sanctions-related risky inflows, these longer transaction paths are particularly relevant to stablecoin screening.

USDT AML controls that check only the immediate counterparty cannot identify a sanctions connection several transfers away. The crypto AML transaction monitoring guide covers how to set hop and amount thresholds.

What an Exchange’s Exposure Rate Can Actually Tell It

The depth of transaction tracing affects how much high-risk activity an exchange can identify. But even when that exposure is measured, its significance is difficult to assess without knowing how it compares with the wider market.

For our High-Risk Benchmark, we analyzed $36.28 trillion in BTC, ETH and USDT on Tron flows across 99 centralized exchanges between 2021 and 2025. We traced connections to identified high-risk entities within five blockchain hops and measured exposure against each exchange’s liquidity, allowing consistent comparisons between platforms of different sizes.

The results revealed substantial differences. Across the sample, risky funds averaged 0.68% of inflows and 0.42% of outflows. Yet 48 exchanges exceeded the benchmark in at least one direction, and eight were extreme outliers. For USDT on Tron specifically, high-risk activity accounted for 1.24% of deposits over five years. These figures measure identifiable exposure within the study’s scope rather than proven illicit activity or regulatory thresholds.

For exchanges, such comparisons help establish whether their stablecoin exposure stands out, which risks warrant closer investigation and where existing AML controls may need attention. Global Ledger can provide an individual, confidential comparison against the industry benchmark using blockchain transaction data, without requiring internal company information.

See how your exchange compares with the industry benchmark.

Conclusion: Stablecoin AML Beyond Asset-Agnostic Controls

USDT on Tron now carries most identified high-risk flows across the exchanges in Global Ledger’s study, and sanctions account for a large share of that exposure. The funds may arrive through intermediary wallets or carry connections that become visible only after attribution changes. For exchanges, reliable stablecoin AML therefore depends on understanding the full transaction context and retaining the evidence behind each decision.

Global Ledger supports stablecoin compliance with real-time wallet and transaction risk scoring for USDT on Tron, sanctions screening, direct and indirect exposure detection and Source and Use of Funds analysis. Explore Global Ledger KYT or see Global Ledger’s crypto AML solutions for centralized exchanges.

FAQ