Why Are Stablecoins No Longer a “Gray Zone”?
Regulators in the world’s largest markets have moved stablecoins into the category of payment instruments, and the requirements around their circulation are now close to those for banks: customer verification, checks on the origin of funds, and the ability to freeze them.
👆 In the U.S., these rules were introduced by the GENIUS Act, signed on July 18, 2025. It requires stablecoin issuers to maintain AML programs — anti-money-laundering measures — and to be able to freeze tokens on lawful request. The law takes full effect no later than January 18, 2027, but the market is already adjusting ahead of time. In the EU, stablecoin rules have been in force since 2024 under MiCA, the crypto-asset regulation, and as of July 1, 2026, serving EU clients without a MiCA license is no longer allowed.
These laws don’t directly apply to Kyrgyzstan, but the largest stablecoin issuers and international exchanges are adjusting to them anyway, and the requirements end up reaching everyone who works with their tokens.
FATF — the international anti-money-laundering group — explains why stablecoins specifically are under pressure. In its report, it cites a Chainalysis estimate: in 2025, stablecoins accounted for roughly 84% of the volume of illicit virtual-asset transactions. The very same price stability that makes stablecoins convenient for payments also makes them convenient for money laundering.
What’s Changed in Exchange Rules in Kyrgyzstan?
The tightening happened in stages. In early 2025, the Financial Market Supervision Service (Finnadzor) banned operations through unlicensed operators and the use of enhanced-privacy wallets. By that fall, the requirements had become systematic.
🔎 Cabinet of Ministers Resolution No. 625, dated September 30, 2025, obligated VASPs — virtual asset service providers, including exchangers — to conduct KYC, meaning client identification and verification, including remote verification. In addition, VASPs are required to check every transaction through accredited blockchain-analytics providers. This check is called KYT (Know Your Transaction): it evaluates not the person, but the history of the funds on the blockchain. That’s why an exchanger asks not just for a passport, but also about the wallet’s purpose and the origin of the money.
The same resolution banned operations involving anonymous wallets, NFTs, online casinos, foreign prepaid cards, and high-risk assets. Exchangers are required to keep AML/CFT (anti-money-laundering / counter-terrorist-financing) records for at least 5 years.
😢 In April 2026, in its 20th sanctions package, the EU applied an anti-circumvention tool to a third country for the first time — Kyrgyzstan — and the Kyrgyz exchange Meer had its assets frozen over its use of the ruble-pegged stablecoin A7A5.
Why Do They Check the Wallet, Not Just the Passport?
The risk for an exchanger sits in the history of the address: USDT from a “tainted” wallet can be frozen even after the exchange has already happened. USDT’s smart contract has an administrative function that blocks specific addresses. Once blocked, tokens from that address can’t be transferred, exchanged, or redeemed. If an exchanger accepts such USDT, it risks ending up with frozen funds and questions from regulators.
💰 Freezes have already become routine. On September 28, 2026, Tether reported that it works with more than 340 law enforcement agencies in 67 countries, and that the total value of assets frozen with its involvement had exceeded $4.9 billion.
For a customer, this means the check can touch them too. If KYT shows that funds are linked to risky addresses — mixers, online casinos, or sanctioned services, for example — the exchanger can pause the transaction and request documents on the origin of the funds, and in some cases refuse the exchange. This isn’t an accusation — it’s a mandatory procedure, and most people pass it simply by providing the requested documents.
FATF is also shifting its focus toward person-to-person transfers and non-custodial wallets — wallets whose keys are held by the owner themselves. Providers are recommended to assess the risk of such addresses through blockchain analytics. In the EU, this logic is codified in Regulation 2023/1113 (TFR). It doesn’t apply directly to Kyrgyzstan, but international exchanges operate under it, so a client from the KR can still run into it. 📍 On a withdrawal above €1,000 to a personal wallet, an exchange is required to confirm that the address belongs to the client, and it usually asks the client to sign a message with the wallet or send a small test transaction.
What Data Is Actually Needed, and Why Is It Requested Again?
1️⃣ For an exchange, two levels of data are legitimately requested: a basic set at registration, and confirmation of the source of funds in specific cases. The basic level is almost identical everywhere: full name, address, date of birth, and a photo ID. This is usually paired with a selfie or a liveness check — a video verification confirming there’s a real person in front of the camera.
This kind of check didn’t appear out of paranoia. Sumsub reports that fraudsters use generative AI to create realistic fake passports and driver’s licenses and pass KYC on exchanges with them.
2️⃣ The second level is confirmation of the source of funds: a bank statement, an income certificate, a sales contract. This is requested for large or unusual amounts, and when KYT flags a risky address history. What counts as a “large” amount is left to each platform’s own internal rules.
❗️ Re-verification is normal in several cases: a document has expired, the client is raising their limits, the rules have changed (as they did after Resolution No. 625), or a risk signal was triggered on a transaction. An exchanger is required to keep client data up to date, so it may ask even a long-standing client to update their information.
What Should Raise a Red Flag in a Verification Request?
ъ
What should raise a red flag is any request for a seed phrase, payment, or verification outside the official website. A seed phrase is the set of words used to restore access to a wallet. It and the private key are never part of KYC, under any circumstances. A legitimate platform verifies identity or wallet ownership through its own site, after you’ve logged into your account — it never asks for a seed phrase via a link in an email. If someone asks for it, it’s fraud.
Payment “for verification” is a sign of a fake exchange. The scheme is typical: a deposit, fabricated profit, and then — at withdrawal — a demand to pay extra for “verification,” “unlocking,” or “taxes.”
The channel of the request matters more than its wording. Verification is only ever initiated from your personal account on the official website — never through Telegram, WhatsApp, or a call from “support.” Scammers now use AI-generated voices and cloned platforms, so visual cues alone are increasingly unreliable.
The absence of KYC is also a red flag. In the KR, client verification is mandatory for licensed providers, so a platform operating “without verification” is operating outside the rules. A license can be checked in the Finnadzor registry at fsa.gov.kg.
How Does Verification Work at Amana Exchange?
At Amana Exchange, verification happens in two steps. First, the client registers with an email and password. Then they go through identity verification via Sumsub: logging in with a Google account, uploading a passport, and taking a selfie.
Sumsub is an international verification service used by many crypto platforms. It’s a separate service, so it should only be accessed through the link in your personal account on the official Amana Exchange website — never through links from messengers or emails. Verification takes a few minutes and is only needed once; data is requested again only in the cases described above.
