Faster rails, same old rules

By Giorgio Giuliani
In Compliance, Financial Infrastructure, Stablecoins
September 19, 2026
8 Min Read
F

Heading to Singapore for Token2049 (6–9 Oct). Promo codes here if you or anyone you know needs a ticket.

The stablecoin sandwich is a reality that is reshaping cross border transactions through the usage of stablecoins as a global settlement layer.

After having presented the model in “The Price of Trust”, I explored over the last few months the key friction points still present in the new model: rails accessibility, local liquidity and – now – AML and compliance requirements.

At the tax collector’s office – Jan Matsys (1539)

This post will be the last one of the series and the goal is to cover what are the mandatory checks and activities that are still necessary in a cross border transaction, and to understand their evolution in a model where stablecoins are the global settlement layer.

The compliance AML checks

Every cross-border transaction, whatever rail it settles on, has to clear the same five checkpoints before and during execution. The first two – customer acceptance policy and KYC/KYB – happen once, at onboarding, and decide who gets to transact in the first place. The other three – the Travel Rule, transaction monitoring and RFIs – run continuously, applied to every transaction and re-triggered by whatever anomaly they turn up. What follows walks through each one, and how much of it actually changes once stablecoins sit underneath as the settlement layer.

Customer Acceptance policies
A customer acceptance policy is Basel’s first KYC pillar, and the plainest one: it’s the internal document that sets out the criteria a financial institution follows when deciding whether to accept a client and do business with them at all, before any transaction-level check ever applies. It functions as the first line of defence against financial crime, in the sense that it keeps a company from doing business with people or entities that don’t match its declared risk appetite in the first place. A CAP typically spells out who the institution accepts, who it rejects outright, what level of due diligence applies to each customer category – including which ones require enhanced due diligence – and who inside the institution has the authority to sign off. To do its job, it has to be risk-sensitive, properly documented, and applied consistently rather than case by case.

In a cross border transaction, it is the policy that determines who is allowed to transact and who is not. It is the gatekeeper at the entry of the system and it is not affected at all by the usage of a stablecoin-based global settlement layer. 

KYC/KYB
“Know Your Customer” and “Know Your Business” are basically checks that require the appropriate identification by the financial institution of the counterparty they are accepting as their clients and they are most likely the two most recognizable checks of the lot. 
Both checks vary by jurisdiction – I’m not gonna detail here the specific fields for each check that should be fairly well-known to the readers of this blog – but they sit on a common foundation: FATF’s 40 Recommendations, which member states are expected to transpose into domestic law.
The FATF (Financial Action Task Force) is the most relevant anti financial crime international organisation, established in 1987 by the G7 countries, it now counts on 39 members and maintains two key fincrime lists: the black list and the grey list. 
The black list includes states or territories whose standards do not comply with FATF regulations and that are not cooperating to improve – currently Iran, North Korea and Myanmar. The grey list contains states whose standards are not adequate to the FATF bar but that are willing to improve.

In the space of KYC and KYB an interesting improvement has gained traction in the last few years: reliance. Basically one regulated entity can use another’s KYC instead of repeating it, even though it stays fully liable if something goes wrong. 

Travel Rule
The Travel Rule is probably the most notorious crypto AML check, even though it was established 30 years ago – in 1996 – by FinCen.
The check requires financial institutions to pass originator and beneficiary information to the next institution – name and account number on both sides, plus one of address, national ID, customer ID or date of birth for the originator – and FATF extended the same logic to virtual assets and VASPs in 2019 under Recommendation 16, at a lower threshold than still applies to traditional wires ($1,000/€1,000 against $3,000), which tells you how much more careful regulators are about crypto rails than about the ones they’ve supervised for thirty years.
This rule is key in cross border transactions as it allows to track the transaction’s parties across the entire lifecycle and its enforcement doesn’t disappear with the stablecoin sandwich – the data still has to move VASP-to-VASP, it just has no native slot on-chain to travel in, so it moves alongside the transaction rather than inside it.

RFI – Request for information
The Request for Information (RFI) is a formal or informal inquiry within correspondent banking transactions used by bank compliance teams, financial crime units, or regulators to gather missing facts about a transaction.
It is a private framework instituted by the Wolfsberg group, a group of 13 global banks founded in 2000 at the Wolfsberg Castle in Switzerland. 

An RFI is a request that the correspondent bank sends to the local bank to gather more information on the sender of the transaction. It is usually triggered by unusual transactions, KYC/CDD gaps, source of funds or high risk alerts.
It is a safeguard introduced specifically for correspondent banking transactions and it’s not bypassed by the stablecoin sandwich – whenever a transaction hits traditional financial rails, it is potentially subject to an RFI.

Transaction Monitoring
Transaction monitoring is the ongoing, increasingly real-time review of customer financial activity to catch patterns that don’t fit the profile of the customer.  
The obligation traces back to FATF’s Recommendation 10, and it’s been transposed everywhere in slightly different clothing: the US Bank Secrecy Act frames it as financial institutions assisting government agencies in detecting and preventing money laundering, the UK runs it through the Proceeds of Crime Act 2002 and the 2017 Money Laundering Regulations, and the EU has just moved from directive to regulation with 2024/1624, paired with a new directive, 2024/1640.
Transactions monitoring usually looks for some common flags: suspicious patterns, behavioural anomalies, geographic inconsistencies, sources of funds that don’t add up. For crypto transactions, some specific crypto-native flags have been added: anonymity-enhancing technologies like privacy coins and mixers, chain hopping across assets and networks to break the trail, rapid off-ramping back to fiat before a monitoring system has caught up.

When a flag is raised, the institution is legally required to report a Suspicious Activity Report or Suspicious Transaction Report to the financial intelligence units, without notifying the interested subjects. 

Conclusions

Exploring the most important AML and Compliance requirements in cross border transactions has been very useful to understand what changes and what doesn’t when a well-oiled operating model changes. The finding that emerges is clear: compliance is not plumbing, so it does not change when the plumbing changes.

None of the five checks in this post disappear, shrink, or even really change shape once stablecoins sit underneath the transaction instead of a correspondent chain: a customer acceptance policy still decides who gets to transact before anything else happens; KYC/KYB and reliance still determine who’s actually behind the wallet; the Travel Rule still has to travel – it just does so alongside the transaction rather than inside it, because the blockchain never built it a slot; an RFI still fires whenever a payment touches a traditional rail, because that’s exactly what an RFI is for; transaction monitoring still watches for the same patterns and files the same reports to the same financial intelligence units, with crypto-specific flags added on top rather than swapped in.

Stablecoins are an architectural innovation, they change the cornerstone of cross border transactions. Rails and liquidity are architectural problems, and for this reason are improved by the new model. Compliance is not, it is a set of obligations imposed on whoever sits at the edge of the system, and for this reason it doesn’t really change.

Overall, I believe the stablecoin sandwich is a truly innovative model which improves the level of service for many customers and with ample margins of improvement – in particular through the adoption of local stablecoins. But it will always have to deal with legal, compliance and AML technicalities that will maintain a certain level of friction. The way these problems are tackled by teams will eventually determine who are the new winners in this space.

Resources

Travel Rule

Customer Acceptance policies

KYC/KYB

Travel Rule

RFI – Request for information

Transaction Monitoring

SHARE THIS:
FacebookTwitterReddit

About the author

Giorgio Giuliani
View all posts

Read more

June 26, 2026

The Price of Trust: Pre-funded accounts in Global Settlement

By Giorgio Giuliani
9 Min Read
26June

This post traces how money actually moves across borders, why trillions of dollars sit locked in pre-funded accounts to make that movement possible, and whether the emerging stablecoin infrastructure is genuinely replacing that model or merely relocating its constraints to a different layer.

By Giorgio Giuliani September 19, 2026