Mastercard will score stablecoin payments for fraud and sanctions risk before the money moves

Mastercard has launched Stablecoin Security, a service that gives banks a risk score on a stablecoin payment before the money moves on-chain. The card network presented it on 19 October 2026 at Money20/20 USA in Las Vegas, according to The Block, PYMNTS and Crypto Briefing. It traces where the funds came from, screens them for links to fraud, scams, sanctions breaches or other financial crime, and hands the result to the bank through an API. North America gets it first; worldwide availability is expected in 2027. It is the newest step in Mastercard’s stablecoin push this year, three months after it closed the purchase of BVNK.

We could not read Mastercard’s own release: its website refused our requests on Monday. The product facts below come from the three outlets, which agree with each other. PYMNTS quotes the release at length.

Moving the tokens is one business. With this launch Mastercard also sells banks the checks that sit in front of them, at a time when Chainalysis puts 84% of illicit crypto volume in 2025 in stablecoins and US anti-money-laundering rules for issuers are still at the proposal stage.

What Mastercard Stablecoin Security does before a payment moves

The service is meant to answer one thing before settlement: how risky a given stablecoin transfer is. According to The Block, the service follows the source of funds and screens for exposure to fraud, scams, sanctions violations and other financial crime across the whole payment lifecycle. It also weighs the context of the transaction. The output is a risk score.

PYMNTS gives a little more detail from the release. Stablecoin Security brings payment and blockchain intelligence together, from the moment a payment is initiated to the on-chain transfer. The signals listed are transaction context, source of funds, exposure to restricted parties and scam indicators. It produces intelligence on both the fiat and the stablecoin side of a payment, and the API is described as platform-agnostic.

Banks do not get a new screen to watch. The score is meant to drop into the fraud, compliance and case-management tools they already run, so an analyst sees a stablecoin alert in the same queue as a suspicious wire.

The buyers are financial institutions and the businesses that move stablecoins for clients. Crypto Briefing names exchanges and custodians among the likely users and says the service is not aimed at retail holders checking their own wallets.

Borderless.xyz and Keyrails are the first partners

Mastercard named two initial partners. Borderless.xyz runs a network that connects financial institutions to licensed stablecoin providers; The Block puts its reach at more than 113 countries and 72 currencies. Keyrails works on high-value cross-border trade payments, mostly in emerging markets. Both went through Mastercard’s Start Path programme for blockchain and digital asset start-ups, The Block reports.

Borderless.xyz is not new to Mastercard. In August the two firms began a Crypto Credential pilot with Infinia, Walapay and Koywe to add trust signals to cross-border stablecoin payments. Neither partner has published a statement on Stablecoin Security that we could find.

No bank, card issuer or payment processor has been named as a customer. The partners are infrastructure firms that sit between banks and stablecoin providers, which fits a product sold to institutions rather than to the public.

North America first, global in 2027: what Mastercard has not said

On timing, the three outlets agree on the outline. The service starts in North America. PYMNTS, quoting the release, says Mastercard expects to extend it worldwide in 2027 and to widen its reach next year through BVNK, the stablecoin firm it bought in August. Crypto Briefing also reports global availability planned for 2027. None of them gives an exact launch date in North America.

The gaps are large for a compliance product:

• Mastercard has not said which blockchains the score covers.
• It has not said which stablecoins are screened; Crypto Briefing notes that no issuer or protocol was named.
• There is no price, no pricing model and no list of bank customers.
• Nobody has said whether the score can block a payment or only advises the bank, which then decides.
• There is no word on Europe, or on whether the tool is built for EU data rules on crypto transfers.

Nor do the reports say whose blockchain data sits under the score. Mastercard bought the analytics firm CipherTrace in 2021, and its Crypto Secure tool for card issuers, launched in 2022, was built on it. Crypto Briefing presents Stablecoin Security as an extension of Crypto Secure, which offers AML risk ratings for crypto service providers. That is the outlet’s reading. Mastercard, in what the reports quote, does not name a data source.

Ann Johnson: banks need intelligence and controls

The one executive voice in the release is Ann Johnson, Mastercard’s executive vice president for security solutions. As quoted by PYMNTS, she said: “Stablecoins are creating new possibilities for value exchange, but financial institutions need the right intelligence and controls to participate with confidence.”

Her second sentence makes the business case. Combining payment and blockchain insight, she said, gives institutions “a clearer view of risk to make more informed decisions and build greater trust”.

Johnson did not name a bank that has tested the service, and the release, as reported, gives no figures on how many payments it has scored so far.

Why tracing stablecoin money is harder than it looks

A stablecoin transfer is public. Anyone can see the sending address, the receiving address and the amount. What a public ledger does not show is who controls those addresses, or what happened to the coins three hops earlier. Risk scoring fills that gap by looking at an address’s history and its links to known clusters: mixers, sanctioned entities, scam wallets, exchanges. Our beginner’s guide to stablecoins explains how the tokens themselves work.

The Block points to research cited by Mastercard to show why this is hard. A Bank for International Settlements working paper published on 11 June 2026, “The anatomy of stablecoin transactions”, studied 593 million transfer events inside 141 million Ethereum transactions from 2025, for USDT, USDC and PYUSD. Nearly 60% of those transfer events took place inside complex transactions that bundle trading, lending or other steps, not in simple one-to-one payments. Some operations ran to more than 1,000 steps.

For a bank, that means a single incoming USDC transfer may be the last leg of a chain of swaps and contract calls. Screening only the last address can miss where the money started.

Crypto Briefing adds a figure from Mastercard’s internal research: fraud rates on crypto transactions run about four times higher than on non-crypto ones. Mastercard has not published that study, so the number stands as the outlet reports it.

Why now: stablecoins carry most illicit crypto flows

The launch comes after two of the large blockchain analytics firms put stablecoins at the centre of crypto crime for 2025. The figures differ by method, and both firms present them as estimates.

The A7A5 case shows what sanctions screening is up against. The rouble-linked token launched in February 2025; the US Treasury’s OFAC sanctioned the network behind it on 14 August 2025 and the EU sanctioned the token on 23 October 2025, according to The Block. TRM Labs counts more than $72 billion of A7A5 volume in its 2025 report.

Legitimate use is growing too. Allium counts more than one billion stablecoin payments in the first nine months of 2026, up 71%, and $3.9 billion of stablecoin card spending, CoinDesk reported on Sunday. More payments means more transfers that a bank’s compliance team has to clear.

The GENIUS Act puts duties on issuers, not on card networks

In the United States, the GENIUS Act stablecoin law is due to take effect on 18 January 2027 (see our GENIUS Act effective date page). On 8 April 2026, FinCEN and OFAC proposed the anti-money-laundering and sanctions rules for permitted payment stablecoin issuers, according to a summary by the law firm Orrick. Issuers would need a risk-based AML programme, a sanctions programme covering secondary market activity, and the technical ability to block, freeze or reject transactions. Comments closed on 9 June 2026. We found no final rule.

The obligations fall on issuers. Mastercard is not one. It sells the screening to the banks and payment firms around the issuers, which face their own AML duties when stablecoins pass through their accounts.

Mastercard bought BVNK; now it sells the checks

Stablecoin Security is the latest step in a year of stablecoin moves by Mastercard:

• In March 2026 it agreed to buy BVNK, a stablecoin payments infrastructure firm, for up to $1.8 billion, The Block reports.
• On 3 June it widened settlement on its network to six regulated stablecoins, among them USDC, PYUSD and RLUSD, on chains including Ethereum, Solana and the XRP Ledger, The Block reported.
• The BVNK deal closed in August, and the Crypto Credential pilot with Borderless.xyz started the same month.
• Last week it launched the Global Money Platform with BVNK, combining fiat and stablecoin accounts, conversion, card spending and bank payouts, with Nuvei and Marqeta among the first customers (CoinDesk). Marqeta had already picked Coinbase to run the stablecoin side of its cards.

Executives have been explicit about the direction. Chief executive Michael Miebach told Bloomberg TV on 9 October that cross-border payments are the strongest use case for stablecoins, PYMNTS reports. In September, finance chief Ling Hai said Mastercard was building stablecoin orchestration and white-label wallet tools into its payments stack after the BVNK purchase.

Visa is moving on a parallel track: last week its money-movement service took USDC prefunding live with Inyo Global. Visa’s step moves money. Mastercard’s new tool scores that money, and the bank still makes the call on whether to accept it.

What it means for European readers

Nothing has been announced for Europe. Mastercard speaks only of global availability in 2027, without naming countries. EU banks and crypto firms already work under MiCA and the Transfer of Funds Regulation, which since 30 December 2024 requires sender and recipient data on crypto transfers between providers, and from 10 July 2027 the EU anti-money-laundering regulation bans anonymous crypto accounts. Scoring the origin of on-chain funds is one way banks meet those duties. Whether Mastercard’s version will be offered in the EU, and for euro stablecoins as well as dollar ones, is not known.

What to watch next

Money20/20 USA runs until 21 October, and more stablecoin announcements are likely there. Stablecoin Security will be easier to judge once a bank says it uses it and Mastercard publishes the chains and tokens it covers. A firm North American launch date is still missing too. After that come the BVNK integration and the wider rollout Mastercard has set for 2027, and on 18 January 2027 the GENIUS Act date, with or without final AML rules.