In the mid-2010s, an actor sanctioned by the United States Treasury had a narrow set of options for moving significant value internationally. Correspondent banking was closed to them. Informal value transfer networks were slow, expensive, and capacity-limited. Physical cash movement was operationally dangerous at any meaningful scale. The effect of financial sanctions was structural: not that target entities could not transact, but that every transaction imposed a friction tax that compounded over time.
A decade later, that friction tax has largely evaporated. The replacement is not Bitcoin, and it is not a new Russian or Chinese institution. It is a USD-denominated stablecoin settling on a public blockchain whose validators are pseudonymous, whose finality is instant, and whose cost per transaction is measured in cents.
This briefing is an attempt to describe that shift structurally rather than anecdotally. The question it addresses is not whether stablecoins are used for sanctions evasion — every published regulatory action of recent years has confirmed that they are — but why the substitution happened so completely, and what compliance programmes need to change about their model of the problem.
Why stablecoins displaced the alternatives
Three properties combine to make USD-pegged stablecoins structurally superior to every predecessor instrument for actors excluded from the formal financial system.
First, settlement rails are permissionless at the protocol level. A sanctioned entity cannot be rejected by a validator set that does not know who they are. Frozen balances at the issuer level exist, but they represent a narrow and after-the-fact intervention — one that requires an issuer to identify the account, an authority to compel freezing, and a reporting cycle that runs in weeks, not seconds. By the time the freeze order lands, the funds have typically moved.
Second, unit-of-account risk is eliminated. Prior to the stablecoin era, sanctions evasion via cryptocurrency required accepting volatility against the dollar, which is the underlying economic reference for most counterparties. A dollar-pegged token removes this friction entirely. A counterparty in Tehran and a counterparty in Dubai can transact in what is, economically, a dollar — without ever touching a dollar-clearing bank.
Third, the infrastructure is competitive. There is no single stablecoin rail to pressure. USDT and USDC together account for the overwhelming majority of volume, but the issuers sit across different jurisdictions, operate under different regulatory regimes, and compete on liquidity. Removing one does not remove the instrument class. This is the opposite of the correspondent banking system, where a small number of USD clearing banks function as gatekeepers for the entire global dollar system.
Stablecoins have not removed sanctions. They have moved the enforcement surface. Enforcement now has to happen at the edges — at on-ramps, off-ramps, and the counterparties of sanctioned actors — rather than at the centre. — GSIG Intelligence, internal methodology note
The rail-level economics
The cost structure of moving a million dollars of value between two willing counterparties who are both excluded from the formal financial system is now, roughly, as follows:
- Transaction fee: under two dollars on a modern high-throughput chain; under ten dollars on Ethereum during most conditions.
- Time to finality: seconds to minutes, depending on the chain.
- Counterparty discovery: effectively free, via a growing constellation of peer-to-peer and over-the-counter desks operating in jurisdictions with weak supervisory coverage.
- Exit risk: real but diffuse, distributed across whatever on-ramp or off-ramp the counterparties eventually use.
Compare this to the operational cost of moving the same value through informal hawala, bulk cash, or trade-based laundering: hours of coordination at minimum, double-digit percentage costs, significant custodial risk at every handoff, and throughput capacity that is measurable in daily totals rather than in lines of code.
The economics of the two systems are not close. For any actor that can accept the counterparty-discovery risk of the stablecoin rail — and for most actors that risk is low, because discovery markets are public — the stablecoin rail has already won.
Where this leaves institutional compliance
The uncomfortable implication for regulated institutions is that the mental model underlying most compliance programmes — we screen our counterparties against a list of sanctioned addresses — was built for a world in which sanctioned actors held identifiable balances in identifiable accounts. That world has been partially replaced.
A sanctioned entity rarely holds the stablecoins it controls. It moves them through pass-through addresses that may exist for minutes before forwarding value onward. Those pass-through addresses may themselves never appear on a sanctions list; they are simply the operational wallets of a service that the sanctioned entity hires to move value. The service itself — a swap desk, a P2P marketplace, a gaming platform, a payment processor — has no direct designation, because it is in a jurisdiction that has not designated it.
The result is a structural invisibility problem. Traditional screening queries — is this address on a sanctions list? — return false. Traditional fingerprint queries — does this address belong to a designated entity? — also return false. The address in question does not belong to a sanctioned entity. It belongs to the infrastructure that serves them.
What the next eighteen months likely look like
Regulatory response to this shift is already visible, if partial. A selection of developments worth watching:
Stablecoin issuer accountability. Both the US GENIUS framework and the EU MiCA regime now impose concrete obligations on issuers to monitor and, where necessary, freeze balances linked to sanctioned or criminal activity. The enforcement history so far is modest in volume but meaningful in direction: a small number of high-profile freezes have demonstrated both that the mechanism works and that the sanctioned actors have adapted around it by rotating through secondary issuers and lesser-monitored chains.
Secondary-market supervision. VASPs facilitating stablecoin transactions are increasingly expected to maintain not just transactional screening but forensic capability — the ability to investigate a suspicious counterparty in real time rather than refer it to an off-platform analytics vendor. This changes the institutional competency required of every mid-sized exchange, PSP, and OTC desk.
Off-ramp concentration. The operational chokepoint of the stablecoin threat-finance rail is no longer the rail itself; it is the point at which value converts back into fiat or into a regulated instrument. This concentrates the enforcement surface at exchanges, fiat ramps, and card programmes. Expect increasing pressure on the institutions that operate these ramps to justify, at a granular level, why their counterparties are not threat-linked.
Intelligence as a compliance deliverable. The quiet shift is a change in what regulators expect to see in a compliance programme. "We screen against this vendor's list" is becoming insufficient. "We investigate, we have an intelligence function, we can produce a forensic report on request" is becoming table-stakes for systemically significant institutions.
Closing
The displacement of correspondent banking by stablecoin rails is among the most significant shifts in global threat finance in thirty years. It is not a speculative future; it is the current steady state. The regulatory and institutional response is underway but is unlikely to reach a settled equilibrium before 2028.
In the interim, the institutions that will perform best are those that treat blockchain intelligence not as a list to be checked but as a forensic function to be built. The distinction is subtle in language but structural in operational outcome.
This briefing is an unclassified summary of a longer GSIG intelligence product available to vetted clients. It does not cite specific entities, addresses, or jurisdictions. Operational intelligence containing transaction-level evidence and entity-level attribution is available to vetted clients under engagement.