Stablecoin Compliance Checklist: 12 Steps for Finance Teams
A practical 12-step checklist for finance teams managing USDC or USDT, covering regulatory scope, KYB, wallet screening, approvals, Travel Rule duties, accounting and audit evidence.
A stablecoin compliance checklist should cover regulatory classification, counterparty verification, sanctions and blockchain screening, transaction approvals, wallet security, Travel Rule obligations, reconciliations, accounting, incident response and audit evidence. The exact requirements depend on whether the company issues stablecoins, provides regulated transfer or custody services, or simply uses USDC or USDT for treasury and payments. Finance, legal and compliance teams should document that scope before moving funds.
A stablecoin compliance program should control the full transaction lifecycle: who may hold or move USDC or USDT, which counterparties and wallet addresses are permitted, how transfers are approved, what evidence is retained and how on-chain balances reconcile to the books. The first task is determining which rules apply because a corporate stablecoin user does not have the same obligations as an issuer, exchange, custodian or money transmitter.
Why regulatory classification comes first
The U.S. GENIUS Act created a federal framework for permitted payment stablecoin issuers, including requirements relating to reserves, redemption, disclosures, risk management and Bank Secrecy Act compliance. Those issuer-specific duties should not automatically be applied to every company paying vendors or holding treasury assets in third-party stablecoins.
A finance team using USDC or USDT still faces sanctions, fraud, accounting, tax, contractual and operational risks. Additional AML, licensing, reporting or Travel Rule duties may apply if the business accepts and transmits funds for others, exchanges assets, provides custody, issues a token or otherwise operates as a regulated financial intermediary. International activity can also bring frameworks such as the EU Markets in Crypto-Assets Regulation and local virtual-asset rules into scope.
| Operating model | Typical compliance focus | Question for counsel |
|---|---|---|
| Corporate treasury user | Sanctions, counterparty controls, wallet security, accounting and records | Does any activity amount to regulated transmission, exchange or custody? |
| Stablecoin issuer | Authorization, reserves, redemption, disclosures, AML and supervisory reporting | Which federal, state and overseas issuer regimes apply? |
| Payments or transfer provider | Licensing, customer due diligence, transaction monitoring and Travel Rule processes | Is the company acting as a money transmitter or virtual-asset service provider? |
| Custodian or exchange | Asset safeguarding, customer identification, market controls and regulatory reporting | Which custody, securities, commodities or financial-services rules govern the product? |
12-step stablecoin compliance checklist
1. Map every jurisdiction and regulated activity
Document where the company is incorporated, where customers and counterparties are located, where staff initiate transfers and which entities control the wallets. Then describe each activity in operational terms: buying stablecoins, holding them, exchanging them, paying third parties, receiving customer funds, redeeming tokens or transferring assets on another person’s behalf.
Have qualified counsel classify those activities. Maintain a regulatory inventory listing the rule, responsible owner, applicable entity, filing or control requirement and review date. Revisit the analysis before entering a new country, adding a chain or launching a customer-facing payment flow.
2. Assign governance and personal accountability
Approve a written stablecoin policy through the appropriate board or management committee. Name owners across finance, treasury, compliance, legal, security and accounting, and define who can propose, approve, sign, reconcile and investigate a transaction.
Issuer certifications and regulated AML responsibilities can create direct accountability for executives and compliance officers. Even where those duties do not apply, management should receive regular reporting on balances, exceptions, screening alerts, failed transfers, access changes and unresolved reconciliation items.
3. Build risk-based KYC and KYB procedures
Identify customers and counterparties to the level required by the company’s role and risk. For a business, verify legal name, registration, operating address, ownership, authorized representatives and the purpose of the relationship. Higher-risk relationships may require beneficial-owner checks, source-of-funds evidence and enhanced due diligence.
Do not treat a wallet address as an identity. Record how the address was obtained, who controls it, which network it uses and whether control was independently confirmed. Refresh records when ownership, authorized personnel or payment instructions change.
4. Screen people, entities and wallet addresses
Screen relevant parties against applicable sanctions and restricted-party lists. Separately assess blockchain exposure using an address-risk tool that can identify links to sanctioned addresses, stolen funds, scams, illicit marketplaces or obfuscation services.
Screen before approval rather than only after settlement. Define what produces an automatic block, what requires escalation and who can resolve a false positive. Rescreen saved addresses because sanctions designations and attribution data change over time. Stablerail supports sanctions and address screening before a send, so the result can form part of the approval record.
5. Determine Travel Rule obligations
The Travel Rule is not a universal rule that every corporate wallet transfer above a single global threshold must follow. In the United States, recordkeeping and information-transmission requirements can apply to covered financial institutions and certain transmittals of funds, while other jurisdictions use different thresholds and virtual-asset terminology.
Determine whether the company is a covered institution, whether the transfer is in scope and what originator and beneficiary information must accompany it. Establish procedures for self-hosted wallets, missing counterparty data, mismatches and transfers involving providers that cannot exchange required information.
6. Approve supported stablecoins, networks and contracts
Create an allowlist of stablecoin issuers, token contract addresses and blockchain networks. Check contract addresses against official issuer sources; a ticker symbol alone is not enough because fraudulent tokens can use the same name.
For each asset, assess reserve and redemption disclosures, legal terms, freeze or blacklist functionality, chain dependencies, liquidity venues and concentration risk. Define who may add an asset or network and what review is required after a material issuer, contract or regulatory change.
7. Design wallet custody and access controls
Choose custody arrangements according to value, transaction frequency and recovery needs. Controls may include institutional custody, hardware-backed keys, multisignature wallets or multiparty computation. The important outcome is that no routine payment depends on one person, device or unrecoverable secret.
Separate transaction creation from approval and signing. Use role-based access, strong authentication, signing quorums, withdrawal allowlists and tested recovery procedures. Remove access promptly when staff change roles and review privileged users on a defined schedule.
8. Establish transaction approval rules
Define approval requirements by entity, amount, destination, purpose and risk rating. Require supporting evidence such as an invoice, contract, payroll file or intercompany instruction. First-time addresses and changes to saved payment details should receive independent verification through a trusted channel.
| Transaction condition | Minimum control | Evidence to retain |
|---|---|---|
| New beneficiary address | Independent address verification and screening | Verification record, network and screening result |
| Routine approved beneficiary | Role-based approval and fresh pre-send screening | Invoice, approvers, transaction hash and result |
| Large or unusual transfer | Enhanced review and additional signing authority | Business rationale, source of funds and approvals |
| Screening alert or data mismatch | Hold pending compliance disposition | Alert details, investigation and final decision |
9. Monitor transactions and investigate alerts
Monitoring should cover both pre-transaction risk and activity after settlement. Relevant indicators may include rapid movement through newly created wallets, unusual transaction velocity, unexpected chain changes, repeated near-threshold transfers or exposure inconsistent with the counterparty’s stated business.
Document alert thresholds, case ownership and escalation deadlines. A regulated institution should connect investigations to its suspicious-activity reporting process where required. A corporate treasury user still needs a defensible process for freezing activity, consulting counsel and preserving evidence.
10. Reconcile on-chain activity to the ledger
Reconcile wallet balances and transactions to internal subledgers, custodial statements and the general ledger. Capture token quantity, transaction hash, network, sending and receiving addresses, block time, fees, exchange rate source, fiat value and accounting period.
Investigate timing differences, unsupported deposits, duplicate entries, failed transactions and assets sent on the wrong network. Define the accounting treatment for transaction fees, gains or losses, impairments or fair-value changes based on the applicable accounting framework and facts.
11. Test liquidity, redemption and incident response
Issuer reserve requirements are different from a corporate holder’s liquidity controls. Treasury teams should nevertheless understand where and how stablecoins can be redeemed or sold, which accounts are eligible, what limits or onboarding conditions apply and what happens if a venue or blockchain is unavailable.
Run tabletop exercises for a compromised wallet, sanctions alert after receipt, stablecoin depeg, token freeze, lost signer, chain outage and mistaken transfer. Record decision rights, communication channels, insurer or law-enforcement contacts where relevant, and the steps for preserving logs.
12. Retain audit evidence and review the program
Keep a complete evidence package for each transfer: payment purpose, counterparty record, address verification, screening result, approvals, signing record, transaction hash, accounting entry and exception disposition. Retention periods should follow applicable AML, tax, corporate and financial-record rules rather than an arbitrary universal schedule.
Test the program periodically and after material changes. Review samples of transfers, user access, sanctions alerts, reconciliations, wallet recovery and policy exceptions. A stablecoin treasury account such as Stablerail can centralize USDC and USDT approvals, signing quorum, global payouts, fiat off-ramp and exportable audit evidence, but the company remains responsible for configuring controls and determining its legal obligations.
Finance team implementation checklist
- Classify the company’s stablecoin activities with legal and compliance teams.
- Inventory every wallet, custodian, stablecoin, contract address and supported network.
- Assign transaction creators, approvers, signers, reconcilers and escalation owners.
- Require counterparty verification and address screening before funds are sent.
- Test one transaction from request through ledger reconciliation and evidence export.
- Schedule access reviews, control testing and incident exercises.
The strongest stablecoin compliance program is not the one with the most alerts or policy pages. It is the one that consistently prevents unauthorized transfers, identifies prohibited exposure before settlement, produces reliable books and gives reviewers a complete record of why each transaction was allowed.
Frequently asked questions
What should be included in a stablecoin compliance checklist?
The checklist should cover regulatory classification, KYC or KYB, sanctions and blockchain screening, approved assets and networks, wallet access, transaction approvals, monitoring, accounting, reconciliation, incident response and record retention. Each control should have a named owner and evidence showing that it operated.
Does the GENIUS Act apply to companies that only use USDC or USDT?
The GENIUS Act primarily establishes requirements for permitted payment stablecoin issuers. A company that only holds or pays with third-party stablecoins may not have issuer obligations, but sanctions, accounting, tax and other financial-services rules can still apply depending on its activities and jurisdictions.
Does the Travel Rule apply to every stablecoin transaction over $3,000?
No. Applicability depends on the jurisdiction, the parties’ regulatory status and the nature of the transfer. In the United States, covered financial institutions may have recordkeeping and information-transmission duties for qualifying transmittals, but an ordinary corporate wallet payment is not automatically subject to the rule solely because of its value.
How should a finance team verify a stablecoin wallet address?
Confirm the address and network through a trusted channel independent of the original payment request, especially for a new beneficiary or changed instructions. Record who controls the address, screen it before sending and use a small test transfer when operationally appropriate.
What stablecoin records should be retained for an audit?
Retain the payment purpose, counterparty verification, wallet address and network, screening results, approvals, signing record, transaction hash, fees, valuation source and accounting entry. Also preserve investigations, policy exceptions and reconciliation evidence according to applicable legal and financial-record retention periods.
Former CEO of Simple, a self-custodial wallet with $2B+ in transaction volume across 75+ countries.
More about the Stablerail team- Stablecoin treasury managementApprovals, limits, yield and reporting on one balance.
- Stablecoin payoutsBatch contractor and vendor payments with screening.
- USDT vs USDCWhich stablecoin your company should settle in.
- Stablecoin finance glossaryMPC, off-ramp, travel rule and the rest, in plain English.
- Product updatesEverything we ship, month by month.