Crypto businesses paid over $1 billion in AML and sanctions fines in 2025. OKX alone paid $504 million for skipping know-your-customer checks for seven years, in a case the DOJ says involved over $1 trillion in transactions processed without a license. In April 2026, U.S. regulators proposed a rule that holds a business liable for a stablecoin sanctions violation it didn’t even know about.
This piece looks at how businesses should move stablecoins in 2026, against the backdrop of the US’s GENIUS Act, the EU’s MiCA, and, closer to home, Nigeria’s emerging rules: SEC’s ARIP licensing track, the ISA 2025, and CBN’s guidelines on bank-VASP relationships. The focus here is Nigeria.
What’s Actually at Stake If You Get This Wrong?
Stablecoin regulation includes a set of current risks for any business that pays or gets paid in stablecoins, whether or not that business issues them.
A business using the wrong stablecoin rail can lose that rail overnight, with no grace period, and it already happened at scale. When MiCA took full effect, Coinbase announced it would delist USDT for EEA users in December 2024, with removal effective 31 March 2025, and by that same date Kraken, Crypto.com, and Binance had all independently cut their EEA USDT pairs to zero. Businesses with payment flows on those rails woke up to rejected transactions with no clear timeline for resolution.
US sanctions law already holds businesses strictly liable for violations, regardless of intent. The joint FinCEN/OFAC proposed rule extends that expectation to stablecoin issuers. Published in the Federal Register on 10 April 2026, the rule requires stablecoin issuers to run active sanctions compliance programs instead of screening after the fact.
OKX is a clear example. As covered earlier, the exchange paid over $504 million for operating as an unlicensed money transmitter and knowingly skipping AML and KYC controls.
A stablecoin held on a balance sheet is only as strong as its reserves. For a business holding stablecoins for treasury, payroll, or settlement, the gap between a fully-reserved token and a weaker one is the gap between a bad quarter and a real loss if a de-peg (when stablecoin value deviates from the asset it is pegged to, i.e. USDT deviates from USD) happens.
The due-diligence burden has shifted onto the business, not just its provider. Regulators are increasingly looking at the full payment chain; a business that can’t show it vetted its provider’s compliance is exposed even if the provider itself is licensed.
Why Regulators Are Moving At All
The policy logic driving new rules is a named risk: Dollarization. The IMF’s 2026 Article IV Consultation on Nigeria stated: “The increasing use of U.S. dollar-denominated stablecoins raises risks to monetary sovereignty, capital flow management, financial stability, and financial integrity by facilitating potential “digital dollarization” and cross-border transactions outside the formal financial system.”
Five Questions to Ask Your Stablecoin Payments Provider
Before trusting any provider with stablecoin payments, here are five questions you need answers to:
- Are you licensed in every jurisdiction where my business operates? Ask for the license names and registration numbers, not a general claim. How do you handle Travel Rule documentation (the rule requiring crypto platforms to share sender and recipient information on qualifying transfers) for qualifying transfers?
- Do you screen transactions against sanctions lists in real time, or only on a periodic basis?
- What’s the defined process when a transaction triggers a compliance alert?
- Does your coverage reach the market I operate in, or does “global” stop at seven jurisdictions?
The GENIUS Act and MiCA: The Two Global Frameworks
The US and EU wrote the templates most other regimes are now copying. A business operating internationally needs to understand both, not just the one closest to home.
The GENIUS Act, United States: Signed into law on 18 July 2025, it restricts stablecoin issuance to insured depository institutions and OCC (Office of the Comptroller of the Currency)-approved non-bank issuers. It removes compliant “payment stablecoins” from SEC and CFTC (Commodity Futures Trading Commission) jurisdiction. Issuers must publish monthly reserve disclosures, maintain full 1:1 backing in cash or short-term Treasuries, and comply with the Bank Secrecy Act.
Regulators can freeze or seize stablecoins when legally required. The proposed OFAC strict-liability rule sits inside this framework. The act has an 18-month implementation window running to early 2027, so the picture in the US is still being finalized.
MiCA, European Union: MiCA’s stablecoin-specific provisions, covering e-money tokens and asset-referenced tokens, applied from 30 June 2024. The broader crypto-asset service provider regime became applicable from 30 December 2024. It’s the most comprehensive single rulebook in force anywhere, and it’s what BVNK’s global regulatory rundown covers in the greatest depth, across seven jurisdictions, though notably without ever mentioning Nigeria, Ghana, or any African market.
E-money tokens track a single fiat currency; asset-referenced tokens track a basket of assets. Only EU-authorised credit or e-money institutions can issue either type. Reserves must sit with EU custodians in the token’s own currency, and redemption is guaranteed at par value at any time. This is the rule that forced the USDT delisting event described above.
Other Notable Regulations
Five more financial centers have live or near-live stablecoin regimes. Each is a variation on the principles already covered, worth knowing at a glance rather than in depth.
- United Kingdom. FCA (Financial Conduct Authority) authorization is required under the Financial Services and Markets Act 2023 framework, with secondary legislation expected through 2026. Rather than drafting a single comprehensive crypto law from scratch, the UK’s approach is phased, integrating stablecoins into its existing electronic money and payment frameworks.
- Singapore. The Monetary Authority of Singapore (MAS) finalized its framework in August 2023. Compliant issuers can label their tokens “MAS-regulated stablecoins,” a trust signal none of the other regimes offer by name. Redemption is guaranteed within five business days.
- Hong Kong. The strictest capital requirement in this group: a HK$25 million minimum paid-up capital under the Stablecoin Ordinance, effective 1 August 2025. Redemption is guaranteed within one business day.
- Japan. The most conservative regime by design. Under the amended Payment Services Act in place since June 2023, only licensed banks, trust companies, and registered money-transfer agents may issue stablecoins, enforcing a systemic-stability-first approach.
- UAE. The CBUAE’s (Central Bank of the UAE) Payment Token Services Regulation has been live since August 2024. It produced the first licensed dirham-pegged stablecoin, AE Coin, and runs alongside the UAE’s own CBDC rollout rather than competing with it.
How Does Breet Stay Compliant?
Real-time screening and compliance alerts
Breet takes the regulatory burden entirely off the user’s shoulders. KYC and AML screenings run automatically on every transaction in accordance with the Nigeria Data Protection Act (NDPA) and NDPC guidelines.
Business verification (KYB) is streamlined to complete in under 24 hours, and the company safeguards user data with PCI DSS (PCI Data Security Standard) and ISO/IEC 27001:2022 certifications.
Compliant African Coverage
Rather than treating local currency as a conversion step bolted onto a dollar-first product, Breet settles natively to NGN and GHS through a resident legal entity. This localized structure ensures that the platform inherently aligns with regional financial regulations, providing a seamless and fully compliant fiat gateway without requiring businesses to navigate complex cross-border compliance on their own.
Breet serves 100+ verified businesses across Africa, has settled 3M+ transactions, and runs on a 99.9% uptime SLA (service level agreement). See how Breet’s compliance is built into the transaction.
