US Senate Findings Put GCC Stablecoin Transactions Under Spotlight

US Senate Inquiry Heightens Sanctions Compliance Burden

Findings by the U.S. Senate Permanent Subcommittee on Investigations (PSI) identifying stablecoins, particularly tether (USDT), as a key liquidity engine powering Iran’s shadow banking apparatus signal that Western authorities may no longer view reactive compliance as sufficient.

For licensed virtual asset service providers (VASPs) operating across the Gulf Cooperation Council (GCC), the findings could significantly reshape counterparty risk assessments. Given the region’s geographic proximity to Iran and its fluid cross-border trade networks, distinguishing legitimate GCC transactions from sanctioned proxy activity requires increasingly precise wallet attribution.

One potential consequence is that regional cryptocurrency exchanges, and, to a lesser extent, merchants may need to reassess their relationships with liquidity providers, over-the-counter desks and cross-border payment processors.

Sanctions Liability Across Payment Rails

Despite this shifting landscape, many merchants still operate under the assumption that receiving local currency in a domestic bank account insulates them from crypto-related sanctions risks. Legal experts warn, however, that liability does not necessarily begin or end with bank settlement.

According to Soham Jethani, partner at law firm Septten, there is no single universal point in the payment chain at which liability attaches.

“The relevant prohibition may concern dealing with a designated person, making funds or economic resources available, or handling property in which a designated person has an interest,” Jethani said, noting that such risks can materialize long before final bank settlement.

Jethani emphasized that receiving fiat currency does not eliminate underlying compliance obligations. Merchants must understand their customers, the structure of their payment arrangements and the controls deployed by their payment providers. While a wallet risk flag warrants investigation rather than serving as automatic proof of a violation, the operational burden generally falls on licensed VASPs rather than individual merchants.

Token Title vs. Contractual Claims

That operational reality raises deeper legal questions when transactions involving local currency-backed stablecoins touch flagged wallets or high-risk exchanges. Specifically, uncertainty remains over whether merchants ever legally take title to those tokens or merely hold a contractual claim for fiat against their payment processor.

Jethani noted that a stablecoin or token’s denomination does not determine legal ownership. Instead, title depends on the underlying contracts and actual payment flows. A merchant may receive tokens directly, have tokens held on its behalf or possess only a contractual entitlement to dirhams from its provider.

“That distinction affects custody, insolvency exposure, and which assets or claims the merchant holds,” Jethani explained. “It does not answer every sanctions question. A prohibited transaction can involve services or making resources available without the merchant owning the tokens.”

He added that an indirect or historical wallet connection does not automatically establish a violation under Office of Foreign Assets Control (OFAC) or UAE sanctions regulations. Enforcement depends on the applicable sanctions regime, the parties involved and the specific facts surrounding a transaction.

Global Stablecoins and Secondary Sanctions Exposure

Similarly, accepting globally traded stablecoins can expose businesses to secondary sanctions risks from foreign regulatory regimes, even when transactions appear purely domestic. Secondary sanctions can allow jurisdictions, most notably the United States, to penalize non-U.S. entities or individuals for certain dealings with sanctioned parties even without a direct territorial nexus.

For example, a non-U.S. bank that knowingly facilitates a significant transaction for a sanctioned Iranian financial institution could face severe restrictions, including potential exclusion from the U.S. financial system.

Jethani cautioned that these risks can be difficult to detect in local stablecoin transfers, even when globally traded tokens are used.

“The transaction may appear domestic, while the stablecoin, its issuer, one of the parties’ wallets or wallet providers, the on-ramp/off-ramp exchange, or potential custodian or other intermediary may be connected to a sanctioned party or restricted activity,” Jethani warned.

Consequently, local-currency settlement through a bank does not eliminate underlying legal risks. Instead, it can obscure upstream exposure, where an illicit counterparty or intermediary in the transaction chain could create compliance risks for other participants.

Real-Time Checkout and Pre-Screened Ecosystems

In instant retail checkout scenarios, where transaction screening must occur within seconds, traditional blockchain analytics can also face limitations. Jethani noted that real-time checks depend heavily on the quality and timeliness of underlying data, which can be affected by attribution delays involving newly created wallets, obfuscation through exchange hot wallets and complex cross-chain bridges.

However, Jethani said real-time retail risks in regulated markets such as the UAE are mitigated because transactions are “risk-fenced” well before customers reach the checkout.

Under this model, consumers use wallets associated with licensed UAE exchanges, where assets are subject to continuous monitoring and pre-screening. Suspicious funds can be frozen before a point-of-sale transaction is initiated, while recipient merchants undergo prior know-your-customer (KYC) onboarding before they can accept settlements.

While no system is entirely foolproof, Jethani emphasized that pre-screening both sides of a transaction creates a significant barrier against illicit activity across most retail transactions.

VASPs Bear the Operational Burden

Fundamentally, legal liability and operational risk remain concentrated on the licensed VASP processing the transaction.

In practice, the regulated intermediary facilitating the on-ramp and off-ramp bears responsibility for conducting comprehensive counterparty and sanctions-risk assessments, applying appropriate controls and authenticating transactions. Across GCC jurisdictions with established cryptocurrency regulatory frameworks, this can include compliance with applicable Travel Rule requirements and comprehensive counterparty screening.

“The duty is always on the regulated player in-between the transaction to take responsibility for the counterparties,” Jethani said. “If things go wrong, they will be the ones held up as in violation and subject to fines and penalties.”

Jethani said regulatory clarity ultimately benefits compliant market participants because licensed entities have strong incentives to protect their regulatory status.

“People are working hard to be able to be licensed to provide this service, and they will not jeopardize their hard-won licenses for a single transaction,” Jethani said. “It is not worth the risks, monetarily or reputationally, no matter who is on the other side.”

This regulatory oversight has helped strengthen the UAE’s position as a hub for digital asset firms. Jethani pointed to the rigorous testing and compliance requirements firms face during the licensing process, arguing that these safeguards have supported the country’s standing with the Financial Action Task Force (FATF) even as its digital asset sector has expanded rapidly.