Stablecoins in Europe: The Race for Digital Money

Stablecoins are no longer a crypto story. With a global market capitalisation exceeding $305 billion and annual transfer volumes that surpassed Visa and Mastercard combined in 2024, they have crossed into mainstream financial infrastructure.[1] If your financial institutions hasn’t formed a clear view on what this means operationally, strategically, and from a compliance perspective, the time to do so is now.

This article covers what financial institutions need to understand: how stablecoins work and why they lead the field among digital money formats, why dollar dominance is a geopolitical issue rather than just a market fact, what banks entering this space are discovering, and how the regulatory frameworks on both sides of the Atlantic are taking shape. With USDT and USDC alone accounting for 93% of the global stablecoin market and euro-denominated alternatives representing less than 0.3%, dollar dominance in this space is hard to overstate.[2] The central question for Europe is whether a consortium of 37 banks united under the Qivalis initiative can still mount a credible answer, or whether the window has already closed.

The basics are worth getting right

Stablecoins are blockchain-based digital tokens that maintain a stable value relative to a reference asset, typically a fiat currency like the US dollar or euro. They combine the programmability and settlement speed of crypto infrastructure with the predictability of sovereign currency

To understand where stablecoins fit, it helps to look at the broader landscape of digital money. Three main formats are commonly discussed: cryptocurrencies, Central Bank Digital Currencies (CBDCs), and stablecoins. Of these, stablecoins are the most developed, in both adoption and regulatory clarity. Cryptocurrencies remain highly volatile and speculative. CBDCs are a different matter: as of mid-2025, 137 countries representing 98% of global GDP are exploring them, with 49 in active pilot, but despite that global momentum stablecoins have moved faster and are already deployed at scale in commercial applications that CBDCs are still testing.[3]

Privately issued, not sovereign money

One distinction that often gets overlooked is that stablecoins are privately issued instruments, not sovereign money. A stablecoin is only as stable as the entity behind it. Its value depends entirely on the issuer’s reserve management, governance practices, and regulatory compliance. There is no central bank backstop. If the issuer mismanages its reserves, faces a redemption run, or loses regulatory standing, the coin can suddenly lose its fixed value. The TerraUSD collapse in May 2022 illustrated this, when design flaws and a loss of confidence wiped out tens of billions of dollars in market value within days. [4] Before incorporating stablecoins into their products or processes, this is the first thing any institution should understand. CBDCs carry no such risk: they are sovereign money issued directly by central banks, and governments retain full control over their issuance. Governments can also programme features such as spending restrictions or targeted distribution directly into the currency.

The cross-border payment advantage

Cross-border payments are where the efficiency advantage becomes impossible to ignore. A traditional payment through Society for Worldwide Interbank Financial Telecommunication (SWIFT) does not travel directly from sender to receiver. It passes through a chain of correspondent banks, each adding time, cost, and friction. A single payment may cross three to five entities before reaching its destination, incurring fees up to $50 and taking one to three business days to settle.[5] A stablecoin payment eliminates that chain entirely. The token moves directly from sender to receiver on a blockchain, with no intermediaries and settlement in under five seconds at a cost below one cent.

Three ways businesses are using stablecoins

One of the three ways in which standout businesses are using stablecoins is for cross-border payments. They are cheaper and faster than traditional methods, so the benefits are clear. The second way is to protect company cash. In countries with high inflation, where the local currency quickly loses value, companies can hold stablecoins instead, since their value remains stable. The third use is for automated payments. Because stablecoins run on code, they can automate payments, eliminating manual checking and approval of each transaction and saving time while reducing errors.[6]

Dollar dominance is a geopolitical issue, not just a market fact

The dollar dominance is striking. As the gap between USDT, USDC, and euro-denominated alternatives already shows, this imbalance is not just a market preference. It reflects a structural problem with geopolitical consequences. The dollar stablecoin ecosystem is self-reinforcing: the larger it grows, the harder it becomes for alternatives to gain traction. Network effects in payments are powerful and slow to reverse.

The European Central Bank (ECB) has been direct about what this means for Europe. A July 2025 blog post warned that dollar dominance in stablecoins would give the United States strategic and economic advantages, allowing it to finance its debt more cheaply while exerting global influence, and would leave Europe with higher financing costs, reduced monetary policy autonomy, and geopolitical dependency.[7] A March 2026 ECB working paper went further, warning that widespread adoption of dollar-denominated stablecoins in the euro area could trigger retail deposit outflows, constrain European banks’ lending capacity, and in extreme cases amount to a form of partial currency substitution. [8]

For European corporates, the dependency is already real. Companies that have moved to stablecoin rails for cross-border payments are almost all doing so on dollar infrastructure. In practice, this means they are relying on US financial systems, even for payments that have nothing to do with the United States.

Case in point: Meta’s return to stablecoins

In 2019, Meta (then known as Facebook) announced Libra, a stablecoin backed by a basket of national currencies that was designed to function as a global digital currency.[9] Governments and central banks on both sides of the Atlantic pushed back hard, citing concerns about monetary sovereignty, privacy, and systemic risk. The project was progressively scaled back, rebranded as Diem, and ultimately shut down in early 2022 when its assets were sold off. At the time, the regulatory climate simply didn’t support it.

The climate has changed. Meta is planning a stablecoin comeback in the second half of 2026, this time taking a fundamentally different approach.[10] Rather than issuing its own coin, Meta is positioning itself as a distribution channel, integrating third-party stablecoin rails across Facebook, Instagram, and WhatsApp. Stripe, the payments company widely used by businesses to process online transactions, is reported to be the likely infrastructure partner.[11] Its CEO Patrick Collison joined Meta’s board in April 2025. For Europe, the implications are significant. Meta has more than 3 billion users globally. If stablecoin payments become embedded in its platforms, the adoption curve for dollar-pegged digital payments accelerates at a scale no European initiative has yet matched, and the window for euro-denominated alternatives to compete on distribution narrows further. That dynamic is exactly what European banks are now racing to get ahead of.

A new playing Field for Financial Firms

The opportunity

Major banks view stablecoins as both a risk and an opportunity. Those that do not act risk losing ground to tech companies and crypto companies, which could take over payment services, along with money and client data that come with them. However, banks that do act can update their business model, find new revenue streams and offer clients services that are not currently available.

The clearest opportunity lies in cross-border payments. Stablecoins eliminate the correspondent banking chain, reducing costs and settlement times for corporate clients. For banks, this means retaining clients who might otherwise turn to fintech alternatives, while also generating income from the reserves backing stablecoin issuance. The revenue model is straightforward and the competitive advantage is clear.[12]

JPMorgan has already taken action, expanding its JPM Coin platform to support euro-denominated payments with Siemens being its first corporate client. Additionally, in early 2025, Bank of America’s CEO indicated that the bank would launch its own stablecoin. Citigroup, PayPal, and others have signalled varying degrees of interest. The question is no longer whether banks will participate in this market. Rather, it is whether their compliance and operational infrastructure can keep up with the speed at which deployment is happening.[13]

The risk

These opportunities come with significant operational and reputational complexities.

Compliance

The biggest issue is compliance. Stablecoin payments happen all day and night, every day of the week, raising the bar on monitoring that many banks already do in real time for other payment rails. They need to continuously monitor for suspicious activity, signs that an issuer might encounter difficulties. They also need to monitor unusual account behaviour and cash-out requests on a scale that batch-based checks were never designed to handle.

The risk of regulatory scrutiny and criminal misuse is real, not just a theoretical concern. According to Chainalysis, 63% of illicit crypto transaction volume in 2024 was attributed to stablecoins, linked to money laundering, sanctions evasion, and financial crime.[14] While this reflects usage patterns more than inherent risk, it signals the intensity of scrutiny that any bank entering this space should expect. Know Your Customer (KYC) processes need to be rethought from the ground up. Both the Guiding and Establishing National Innovation for US Stablecoins (GENIUS) Act and the EU’s Markets in Crypto-Assets Regulation (MiCAR) require KYC obligations to extend to blockchain wallet addresses, something most existing programmes were not designed to handle. Leading compliance teams are responding with a triple-layer approach, monitoring simultaneously at the blockchain, transaction, and broader ecosystem levels.

Beyond compliance, three further risks run through any stablecoin strategy: security, who is backing the coin, and whether it can hold its value.

Security, backing, and value risk

Security became a serious concern after the 2025 Bybit hack, in which hackers stole $1.4 billion. [15] It showed clearly what can go wrong when companies don’t properly protect digital assets. Counterparty and issuer risk is structural: private entities, not central banks, issue stablecoins, so companies need to check each issuer’s reserves and reputation on their own. The last risk is whether the coin can keep its value. The TerraUSD collapse in 2022 showed that even a popular stablecoin can suddenly lose its value, causing panic as everyone tries to cash out at once.

Client trust and education

There is also a risk that sits one step further out but is not less consequential. Most retail and corporate clients currently have little understanding of how stablecoins work, what backs them, or how they differ from familiar payment methods. That knowledge gap directly creates a trust gap, and trust has to be there before adoption can happen. Financial institutions that move fast on deployment without investing equally in client education are likely to find their clients do not follow. Building that understanding is not a marketing problem. It is a core part of what it means to introduce a genuinely new financial instrument responsibly.

The European response: Qivalis

The dependency on dollar-denominated stablecoins, and the pressure that creates for European banks to act, has produced a concrete response. The response comes from Qivalis, a joint venture launched by a consortium of 37 European banks building a fully regulated, 1:1-backed euro stablecoin, scheduled for launch in the second half of 2026.[16] The membership includes major companies such as BBVA, BNP Paribas, ING, UniCredit, Rabobank, and CaixaBank, spanning nearly every major European market. A full list of participating banks is available on the Qivalis website.

The intent is clear. European companies currently lack access to a regulated, European-issued digital settlement asset that does not route through US financial infrastructure. Qivalis is designed to provide one.[17] Jan-Oliver Sell, CEO of Qivalis, has described the problem directly: with only dollar stablecoins available at scale, European companies depend on US-controlled digital rails for cross-border commerce.

The regulatory approach is MiCAR-compliant from the outset. That matters, because MiCAR is the dedicated framework the EU has built specifically for crypto-asset issuers and service providers. Qivalis is not seeking exemptions or operating in a regulatory grey zone. It is not working around the rules; it is built to operate within them.

The Competitive Landscape

The challenge ahead is real. Network effects in payments are strong and slow to shift. The clearest example is EURC: Circle, an American company, currently issues the largest euro-denominated stablecoin in circulation.[18] That is the exact problem Qivalis is meant to solve: a non-European issuer controls even the leading euro stablecoin today, leaving European companies dependent on a US company for euro-denominated digital money.

MiCAR, meanwhile, has pushed Tether’s USDT out of the EU entirely. With MiCAR’s final compliance deadline on 1 July 2026, licensed European exchanges have been delisting USDT because Tether never sought the required authorisation.[19] Reaching enough liquidity to actually be useful will not be easy for Qivalis either, but it enters a market where regulation has already excluded the largest dollar-based competitor, and the largest euro alternative remains foreign-owned.

The Trust Gap

There is also a trust dimension that should not be underestimated. Qivalis is a new instrument from companies that most retail and corporate clients will not immediately associate with digital money. Even with 37 banks behind it, client familiarity with euro stablecoins is low. The consortium will need to invest in building that understanding, not just in building the product.

The conditions for Qivalis to succeed are improving. Geopolitical fragmentation is raising European appetite for alternatives to dollar infrastructure. Regulatory clarity under MiCAR gives it a foundation that earlier euro-stablecoin efforts lacked. Whether that is enough depends on execution, and execution depends on the regulatory rules Qivalis and every other stablecoin issuer now has to operate within.

What this means in practice

The stablecoin transition is not a future scenario. It is happening now, and it is moving faster than most formal planning cycles were built to accommodate.

For banks

For banks, the question is no longer whether to engage with stablecoin infrastructure but how quickly and through which route. That means assessing whether they can issue, store, and convert stablecoins into traditional currency and back, against existing regulatory frameworks. It also means identifying partnership opportunities with issuers or infrastructure providers, and adapting compliance architecture for real-time, 24/7 monitoring before deployment decisions are made, not after.

For European companies

For European companies operating in stablecoins, the dual-licence requirement (MiCAR plus EMI) is now the compliance baseline, not a stretch goal. The EBA’s June 2025 No Action Letter and February 2026 clarifications were not ambiguous: companies supporting EMT payment flows that have not obtained a payment firm or EMI licence are operating outside the framework. The zerohash precedent, secured in May 2026 from De Nederlandsche Bank, sets the benchmark. Any European-based company looking to participate in stablecoin infrastructure, whether as an issuer, custodian, or payment processor, should treat obtaining both licences as an immediate priority, not a future-quarter agenda item.

For compliance teams

For compliance teams specifically, wallet-level screening is no longer optional. Stablecoins appear disproportionately in illicit flows relative to their market share, and that pattern will attract regulatory scrutiny across European jurisdictions. Blockchain analytics tools are baseline infrastructure, not specialist add-ons. The governance frameworks for when to freeze assets, escalate internally, and file reports need to exist before an issue arises, not during one.

The architecture of digital money is being built right now. Companies that treat stablecoins as a compliance problem to manage rather than infrastructure to understand are already operating with an incomplete picture. The decisions being made in the next 12 to 18 months will set positions that will be difficult to change.

Conclusion

Stablecoins are no longer an experiment on the edge of finance. They are becoming core infrastructure for cross-border payments, corporate treasury, and increasingly, for the platforms billions of people already use every day. The dollar’s dominance in this space did not happen by accident, and it will not reverse by accident either.

For Europe, the stakes go beyond market share. A digital financial system built almost entirely on dollar rails carries real consequences for monetary autonomy, financial stability, and strategic independence. Qivalis represents a credible, regulated attempt to close that gap, but it enters a market shaped by entrenched network effects, an American company holding the largest euro stablecoin position, and a regulatory environment that, while more developed than its US counterpart, is still finding its footing in practice.

Execution, not ambition, will decide what happens next. Three things will determine that: how quickly European banks can build trust and liquidity, how consistently EU member states apply the rules they have agreed to, and how seriously financial companies across the continent respond to a shift that is already underway. The window to act is not unlimited. The companies that move early, and move deliberately, will be the ones that shape what European digital money looks like, rather than simply adapting to a market someone else has already built.

Want to know more?

Is your organization ready for the regulations surrounding stablecoins and digital money in Europe?

Contact use at: info@compliancechamps.com

Are crypto mixers becoming harder to ignore because of the AMLR?

Why crypto mixers matter for AML compliance

Crypto mixers, also known as tumblers, are tools that enhance the anonymity of users of cryptocurrencies. They do so by shuffling cryptocurrencies from multiple users to hide the original source and destination of funds. The purpose is to reduce traceability on a blockchain: by mixing the transaction with those of others, it is significantly more complicated to trace the original source or destination of the crypto-asset. But mixers have two sides of the same coin: they provide increased privacy for genuine users, while at the same time allowing bad actors to hide their finances. This is particularly relevant during the layering phase of money laundering. The main goal in this second phase of money laundering is to distance funds from their criminal source by creating multiple transaction layers that complicate audit trails. A mixer can be used as an effective tool for this specific purpose: in a single step, the transaction trails that would otherwise be visible on the blockchain are harder to trace from their original source. In practice, this means that for crypto-asset service providers (CASPs), screening customers only at onboarding is not sufficient. When a customer deposits funds that have been routed through a mixer or when a transaction is directed to an address associated with one, the customer’s identity alone is insufficient to assess the origin or destination of the funds. CASPs must therefore also assess the transaction history of both incoming and outgoing funds.

How the AMLR affects mixer-related risks

The Anti-Money Laundering Regulation (AMLR), which will apply from 10 July 2027, introduces obligations aimed at reducing the risks associated with crypto mixers. More broadly, the AMLR will require CASPs to conduct ongoing monitoring of business relationships, including scrutiny of transactions throughout the relationship to ensure that they are consistent with the CASP’s knowledge of the customer and their risk profile.[1] This is particularly relevant to mixer exposure, which may only become apparent after onboarding.

Anonymous accounts

First, mixers can be used to obscure the origin or destination of crypto-assets and frustrate attempts to trace transaction flows, for example until the assets can be transferred, exchanged or cashed out. An anonymous crypto-asset account at a CASP could further facilitate this process by providing access to the regulated financial system without a clearly identifiable account holder. The AMLR will address this risk by prohibiting CASPs from maintaining anonymous accounts or accounts that otherwise enable the anonymisation of the account holder or the masking of transactions.[2]

Self-hosted addresses

Second, transfers to or from self-hosted addresses may expose CASPs to mixer-related risks. Standard KYC alone does not provide sufficient insight into the transaction history of the crypto-assets involved. The AMLR will therefore require CASPs to identify and assess the money laundering and terrorist financing risks associated with such transfers and to have appropriate internal policies, procedures and controls in place.[3] Where blockchain monitoring or other risk indicators point to mixer exposure, CASPs may need to apply proportionate mitigating measures, such as obtaining additional information on the origin and destination of the crypto-assets or conducting enhanced ongoing monitoring.

Customer due diligence

Third, mixer exposure not only affects how funds move but also raises questions about their origin and purpose. As part of customer due diligence, CASPs will have to assess and, where appropriate, obtain information on and understand the purpose and intended nature of the business relationship or occasional transaction. Where funds appear to have passed through a mixer, this may require the CASP to obtain further explanation and documentation regarding the origin or the destination of those funds before proceeding. [4]

Enhanced due diligence

Finally, where mixer exposure or other suspicious indicators point to a higher-risk transaction, CASPs may be required to apply enhanced due diligence. This includes examining the origin and destination of the funds and the purpose of transactions that are complex, unusually large, conducted in an unusual pattern or lack an apparent economic or lawful purpose.[5]

In practical terms, funds that have passed through a mixer can represent a higher-risk indicator that may oblige CASPs to conduct enhanced due diligence and may, depending on the circumstances, give rise to a suspicious transaction report. Risk-based monitoring must cover incoming as well as outgoing activity, an aspect that can be overlooked in practice. CASPs must assess not only where crypto-assets are being sent but also the origin of incoming deposits where relevant. Incoming deposits should therefore be included in the CASP’s transaction-monitoring framework.

Practical consequences for CASPs

In practice, this will have a significant operational impact on CASPs. Key implications include:

Blockchain analytics: Blockchain analytics tools can support the mapping of transaction chains and the identification of mixer exposure and other risk factors.

Risk-scoring: Risk-based rules and scoring mechanisms can help CASPs prioritise alerts and determine the appropriate follow-up action.

Customer profiling and ongoing monitoring: CASPs should establish the customer’s expected transaction profile, including relevant use of self-hosted wallets, and monitor subsequent activity for inconsistencies or mixer exposure.

Escalation procedures for suspicious activity: Clear internal procedures must be in place for reporting and following up on suspicious activity.

Staff training: Compliance and operational staff must be equipped to recognise mixers and related transaction patterns as part of internal controls.

Better documentation: Risk assessment and monitoring decisions must be demonstrably recorded.

Higher compliance costs: The required technology, staffing and process changes are likely to increase compliance costs for CASPs.

Conclusion

Crypto mixers illustrate why the AMLR will require CASPs to look beyond customer onboarding. The Regulation does not impose a general prohibition on mixers, nor does exposure to a mixer automatically make a transaction suspicious. It will, however, require CASPs to assess the risks associated with crypto-asset flows throughout the business relationship and to take proportionate action where relevant risk indicators arise.

The key question is therefore not whether CASPs can eliminate mixer exposure, but whether they can identify, assess, document and escalate it effectively. This requires more than blockchain analytics alone. Customer risk profiles, transaction-monitoring controls, internal procedures, reporting lines and staff knowledge must operate as one coherent framework.

Compliance Champs supports CASPs in translating regulatory requirements into practical and proportionate controls. Through risk assessments, reviews of policies and procedures, compliance monitoring and reporting, training and implementation support, we help organisations identify gaps and strengthen their AML framework. Contact Compliance Champs to assess whether your current framework is ready for the AMLR.

Do you seek support and assistance in enhancing your Crypto Compliance Framework?

Please reach out to us on: info@compliancechamps.com

EU Pay Transparency Directive

The EU Pay Transparency Directive is coming, and for many organisations, the work required is bigger than it looks.

Directive (EU) 2023/970 introduces binding obligations that go well beyond publishing salary ranges. Think gender-neutral job evaluations, written pay criteria, employee rights to comparative pay information, and mandatory gender pay gap reporting.

That is exactly why we built our new compliance service offering at Compliance Champs.

We guide organisations through every step: from an initial training and compliance gap assessment, through job evaluation and policies and procedures, to reporting setup and ongoing support. Whether you are starting from scratch or closing specific gaps, we will help you build a programme that is practical, documented, and audit-ready.

We have put together a one-pager that outlines exactly what the Directive requires and how our services map to it.

Download here

Compliance audits: from incident to system

This is the final article in the series ‘The landscape of compliance investigations’. The earlier articles in this series focused on individual files and relationships. Integrity investigations, due diligence, IDD and AML/KYC each centred on specific parties, transactions or client relationships. The core question was tangible: what happened here, with this client, this deal or this signal?

With compliance audits, the perspective shifts fundamentally. The focus is no longer on the individual case, but on the machinery surrounding it: policies, processes, controls, culture and reporting lines. The question is no longer “is this specific file in order?”, but “does our compliance framework as a whole function as intended, and where are the blind spots?”

While this series focuses on the broad landscape of investigations within a single organisation, the parallel series AML/CFT internal audits – The invisible battle zooms in specifically on the dynamics of AML/CFT audits. There, we discuss why so many audits devolve into a paper reality, and what it takes to achieve truly risk-driven testing.

1. What do we mean by a compliance audit?

The term ‘compliance audit’ is elastic. In practice, scope ranges from a focused spot check on a single topic (such as sanctions screening or conflicts of interest) to a comprehensive review of the entire compliance management system.

A thorough audit analyses the organisation at three levels:

Design: Are the policies, procedures, roles and systems theoretically structured in a way that makes compliance possible at all?
Existence: Have those elements actually been implemented, or do they exist on paper only?
Operation: Do the controls function in practice as intended, and are deviations identified and corrected in a timely manner?

Where a forensic investigation primarily looks backwards (“what went wrong?”), a compliance audit looks forward: “if we continue on this path, where will the next incidents occur?” The AML/CFT audit series returns to this sharply as the difference between tick-box exercises and audits that genuinely uncover hidden risks.

2. The audit as a mirror of the system

Integrity and compliance issues rarely stand alone. An incident, a red flag in IDD, a client with elevated sanctions risk or a difficult KYC file is almost always a symptom of a deeper systemic problem. Think of:

An unclear or poorly embedded risk appetite.
Policies designed behind a desk that bear no relation to operational reality.
Poor data quality or failing tooling.
Vague boundaries between business, legal, compliance and audit.
A culture in which critical questions are seen as obstructive or time-consuming.

Compliance audits expose these patterns without mercy. They reveal why the same types of errors or omissions recur across different files, teams or countries. In this way, the audit forms the logical conclusion of this series: it shifts the focus definitively from the incident to the system.

3. Three flavours in practice

Although the boundaries are fluid in practice, we can conceptually distinguish three types of compliance audits.

3.1 Theme-based audits

These audits focus sharply on a single specific topic. Common examples include:

Sanctions and export controls
Conflicts of interest and secondary roles
Whistleblower arrangements and speak-up culture
Gifts and hospitality
Third-party due diligence
Data privacy and information security

The aim is to test whether the processes and file management around that theme hold up against internal and external standards, and whether day-to-day pressures have quietly overtaken best practice.

For more serious topics such as sanctions and transaction monitoring, such a theme audit closely borders on regular monitoring. The AML/CFT internal audits series examines the specific pitfalls of this: the temptation of checklist thinking, blind spots in data, and the subtle pressure to soften sharp findings.

3.2 Process and chain audits

Here the focus is not on the standard, but on the flow. We examine the end-to-end chain, such as:

The full client onboarding and KYC process.
The procurement and supplier chain.
M&A and integration trajectories.
Trade and export processes.

The central question is: where in the chain do risks accumulate, where do we rely too heavily on a single vulnerable control point, and where is there no clear owner? Often the errors seen in individual files reappear here at scale: structural backlogs, poor file management or critical controls simply skipped under time pressure.

3.3 Framework or system audits

This is the helicopter view. These audits examine the complete compliance framework:

The governance surrounding integrity and compliance.
The actual structure and effectiveness of the three lines of defence.
The methodology behind risk identification and monitoring.
Training, awareness and overall compliance culture.
Escalation and reporting to the board, audit committee and regulator.

This type of audit aligns with external standards (such as international guidance on effective compliance programmes or corporate governance codes). It determines whether the organisation’s foundations are solid enough that the other investigations in this series can do their work at all.

4. From finding to improvement plan

Stating the obvious, perhaps, but practice is stubborn: a compliance audit only has value if its findings lead to real change. Too often, an audit results in a thick document that goes straight into a drawer: a long list of observations, but no sharp action plan.

An effective audit report follows a clear three-part structure:

Finding: What has been factually and objectively observed?
Risk: What could concretely go wrong if this is left as is?
Recommendation: What is needed to close the gap structurally?

The report must also provide a realistic assessment of impact and feasibility. The goal is for executives and line managers to immediately understand what is on their plate. It must not become a technical compliance exercise. In the AML/CFT series, we address this under “from report to action”: how do you get management to genuinely move? Being right on paper is one thing. Delivering real change within the organisation is what counts.

5. Roles and responsibilities: the playing field between compliance and audit

As with the other investigations in this series, a compliance audit involves multiple key players. This requires clear coordination.

Compliance is the owner of the framework and the substantive standard-setting. In that role, compliance often conducts its own reviews or thematic assessments, or prepares the areas into which internal audit will later dig deeper.
Internal Audit maintains the independent perspective on the design and operation of controls, often with compliance as a substantive sparring partner.
External specialists join when specific in-depth expertise is required (such as complex sanctions legislation, FCPA/UKBA or IT security), or when maximum independence is required vis-à-vis the regulator or the supervisory board.

Nothing is more damaging to effectiveness, or to internal relationships, than audit and compliance inadvertently fishing in the same pond or duplicating each other’s work. Clear demarcation upfront is not a luxury, but a hard necessity. In the AML/CFT articles, we challenge this further in the context of the “myth of independence”: how internal politics and pressure from above can colour audit outcomes, and how auditors can push back against this.

6. Learning from practice: the root cause approach

Incidents, integrity reports, due diligence findings and KYC issues are all windows onto underlying risks. A mature compliance audit uses that data systematically through:

Case analysis: Which types of incidents recur, and what does that reveal about gaps in our policies?
Trend analysis: What patterns emerge when we look at data across different countries, business lines or product groups?
Root cause investigation: If the same error is made in three different departments, what is the common underlying cause?

The organisation thereby learns to stop mopping the floor and actually turn off the tap. The AML/CFT audit series builds on this by looking specifically at the blind spots in data and culture that mean red flags are in practice still missed or ignored.

7. Compliance audits and the limits of the reasonable

In compliance audits, the inevitable question arises sooner or later: “when is enough, enough?” An auditor can always find more: one additional control, a tightened policy, an extra reporting layer. Without a clearly defined risk appetite, you risk building a top-heavy compliance apparatus that completely paralyses the organisation.

A mature audit approach is willing to make choices:

It benchmarks findings directly against the established risk appetite.
It not only identifies where practice deviates from the manual, but also acknowledges where the risks are negligible.
It facilitates the healthy conversation between board, business and compliance about the balance between safety, workability and cost.

This discussion is directly mirrored in AML/CFT audits: stricter monitoring and generating more alerts may always look better on paper, until the system becomes clogged and the real risks are drowned out by noise.

8. Final note: the circle is complete

With the compliance audit, the circle of this series is closed. Where we began in the capillaries of the organisation, at the concrete incident, the difficult KYC file or the integrity report, we end at the nervous system.

The dynamic is clear: incidents expose the acute wounds, due diligence and KYC keep the back door closed, but the compliance audit checks whether the foundations of the entire house can withstand the storm. It shifts the focus definitively from firefighting to structural fire safety. The ultimate question for the board is not whether the rules happened to be followed today, but whether the organisation is structured in such a way that it can still do so tomorrow and a year from now.

Invitation to Consult

If this article has raised questions or topics you would like to discuss further, we welcome you to reach out. If you have a specific case you would like to explore, we are happy to arrange an informal introductory conversation. Our contact details can be found here.

Get in touch

Dennis van der Meer | +31618948848 | dennis.van.der.meer@compliancechamps.com

Boy Custers | +31649935735 | boy.custers@compliancechamps.com

FIU-NL gets a pause button, but crypto keeps moving

From 1 July 2026, Financial Intelligence Unit Nederland (FIU-NL) will receive a new power: the power to postpone transactions. Under the new Article 17a Wwft, FIU-NL may require reporting institutions to temporarily postpone one or more transactions if there are signs of money laundering, related criminal activity or terrorist financing.

The word temporarily is important.

This is not a general freezing power. A postponement may last for up to five working days. If the request is made on behalf of a foreign FIU, it may last for up to ten working days. The aim is to create a short period in which suspicious value can be stopped before it disappears.

The Anti Money Laundering Centre, the knowledge and expertise centre of the FIOD, has described the new power in similar terms. It is a temporary tool with clear limits. It is not an open-ended freeze.

Why crypto makes this more complex

For crypto, this distinction matters.

FIU-NL’s new power does not extend to stopping a blockchain network in its entirety. Unlike a bank transfer that may sometimes be recalled, or a payment instruction that may still be intercepted, on-chain transactions are settled by the network itself. Once crypto assets have been broadcast to and confirmed on a blockchain network, the transaction is generally final in practice. It cannot usually be reversed by a regulated platform or by a government authority.

There is one practical point to keep in mind. A crypto withdrawal request is not always the same as a completed blockchain transaction. Before confirmation, a transaction may still be pending. It may still be inside the platform’s own systems, or it may be waiting for confirmation by the network. At that stage, it may still be possible to stop it.

Once the transaction has been confirmed on chain, the original transfer is effectively out of reach.

Where the pause button can still work

This makes exchanges, brokers and custody providers important control points. They may still be able to stop a pending withdrawal, restrict crypto assets held in custody, or block a customer’s balance before value leaves the platform.

FIU-NL’s new power can therefore help in two practical situations: where crypto assets are still held in a custodial account at a regulated platform, and where fiat proceeds or other customer balances remain available.

However, the new power does not solve the crypto’s speed and finality problem. If the relevant transaction has already been confirmed on chain, the pause button comes too late for that transaction.

Why this matters for regulated platforms and their customers

For regulated platforms, such as exchanges and custody providers, FIU-NL’s new power has direct operational consequences. When a platform receives a postponement request from FIU-NL, it must act immediately. It must also be able to document its response afterwards.

This means the issue is not only legal. Platforms need clear internal procedures. These procedures should explain how FIU-NL requests are received, escalated, and handled. They should also make clear who is authorized to act on such requests, how the relevant assets or balances are identified, and how each step is recorded.

The effectiveness of the new power will also depend heavily on the quality and speed of the platform’s transaction monitoring. Suspicious activity that is only identified after a withdrawal has been confirmed on chain cannot be postponed or reversed. Platforms should therefore assess whether their monitoring, alert handling and withdrawal controls are fast enough.

This also matters for customers. A delayed withdrawal or temporarily restricted balance should be handled quickly, consistently and in line with the legal requirements. If the platform is allowed or required to communicate with the customer, it should be able to explain the situation clearly without harming the legal process.

There is also a risk that bad actors will adapt. They may try to move assets away from regulated platforms more quickly, because those platforms are the main point where transactions can still be stopped. This makes fast monitoring, clear escalation and effective withdrawal controls even more important.

Part of a broader AML trend

The Dutch change should not be seen on its own. Similar intervention tools already exist in other European AML frameworks. FIU-NL has also noted that many foreign FIUs already have comparable powers, and that the Dutch addition should support international cooperation.

The direction is clear. AML is moving beyond reporting suspicion after the event. Increasingly, the focus is on stopping suspicious value flows before they disappear.

Crypto tests the limits of this approach.

The legal power to pause a transaction only matters where there is still practical control. Platforms can freeze, delay, or block. Blockchains do not rewind.