Wolfsberg Stablecoin Issuer Guidance 2025: Bank Controls

The Wolfsberg Group published guidance on 8 September 2025 on how banks can provide services to issuers of fiat-backed stablecoins. Its message is that a bank should treat an issuer like any other customer: understand the business, decide whether the risk is acceptable, then build a monitoring framework to match. This guide explains the structure of the guidance, what it asks of banks, and where it draws the line. For the group's wider approach to payment businesses, see our guide to Wolfsberg guidance on banking payment service providers.

What the guidance covers

The Wolfsberg Group describes the paper as the collective view of its twelve member banks. It deals with how a bank manages financial crime risk when it provides operating accounts, reserve management and client settlement to a stablecoin issuer, particularly one operating in a regulated jurisdiction. It also stresses that most financial crime principles that apply to any bank or non-bank financial institution still apply here. It is guidance, not law, so it does not replace the rules that apply to your firm.

The paper has five parts: an introduction, a common understanding of fiat-backed stablecoins, a section on understanding and monitoring the purpose and intended nature of the business relationship, a section on monitoring the on-chain activity of the issuer's stablecoin, and a conclusion.

Scope: which stablecoins

The guidance covers only corporate-issued stablecoins that are pegged to a fiat currency and fully backed by liquid reserves. It says these should be treated separately from other types of stablecoin. It also notes that the assets backing the stablecoin still carry money laundering and terrorist financing risk, so the reserves are not a reason to relax controls.

Treat the issuer like any other customer

The relationship approach is the heart of the paper. A bank should assess the issuer's risks and controls, decide whether the exposure and the way it is managed are acceptable, and only then build the monitoring framework. For the due diligence itself, banks can use the Wolfsberg financial crime compliance questionnaire and the correspondent banking due diligence questionnaire, with extra questions specific to stablecoins.

What to assess in the issuer's framework

The guidance lists the areas to review in the issuer's controls. They include the regulatory regime the issuer operates under, board oversight, reliance on third parties, cooperation with law enforcement (including freezing, burning and reissuing tokens), blockchain due diligence, sanctions screening, payment transparency, training, and how responsive the issuer is to requests for information. For sanctions risk in particular, see our guide to crypto sanctions evasion.

Operating, reserve and settlement accounts

The paper breaks the relationship into three kinds of account and expects them to stay segregated.

• Operating accounts: the issuer's own business activity.
• Reserve accounts: activity should be limited to settlement flows and reserve management, and the reserve claims should be verified through audit or attestation.
• Settlement accounts: these carry the highest risk and warrant the closest scrutiny of the client mix, the source of funds, compliance with the travel rule and the redemption paths.

Controls the issuer can use

The guidance notes that issuers may use tools such as address allow-listing, deny-list screening and reversible transactions to block or reverse transfers to high-risk wallets. A bank can ask what tools the issuer uses and how well they work as part of its review.

Ongoing review

The bank should review account activity periodically and escalate any deviation from the purpose of the relationship that was agreed at the start. The outcome of that escalation may be corrective action or ending the relationship.

Monitoring on-chain activity

The final substantive section sets out how far a bank should look at the blockchain. The focus is on whether the issuer stays within its own risk appetite, not on counting transaction hops. The depth of monitoring should be proportionate to risk, and banks need qualified staff who can understand blockchain activity. The paper is clear that responsibility for detecting and reporting financial crime still rests primarily with the issuer. The conclusion adds that the bank defines its own risk appetite and decides whether the issuer is a suitable customer and under what conditions, with monitoring based on fiat-side activity and, where needed, on-chain activity.

Why it matters for compliance teams

Banks that serve crypto businesses often face a choice between refusing the whole sector and accepting the risk without a method. This paper offers a method. It does not say banks must serve issuers, and it leaves the decision to the bank's own risk appetite. For the legal framework that governs stablecoins in the European Union, see our guide to stablecoins and e-money tokens under MiCA, and for training that builds this kind of knowledge see our CPD courses.

What we could not confirm

We read the guidance as published on the Wolfsberg Group's website and did not read the linked PDF. We have not compared it with the regulatory rules for stablecoin issuers in any particular country, which differ by jurisdiction, so check your own regulator's requirements.

Frequently asked questions

Does the guidance cover all stablecoins?

No. It covers only corporate-issued stablecoins pegged to a fiat currency and fully backed by liquid reserves.

Does it say banks should serve stablecoin issuers?

No. It sets out a framework for assessing and monitoring the relationship and leaves the decision to the bank's own risk appetite.

Which questionnaires does it suggest?

The Wolfsberg financial crime compliance questionnaire and correspondent banking due diligence questionnaire, with extra stablecoin-specific questions.

Who is responsible for detecting financial crime on the blockchain?

Responsibility rests primarily with the issuer, although the bank monitors in proportion to risk.