Stablecoins Arrive from an Unknown Wallet: Which Signals Should Trigger Enhanced Review?
Your company receives a stablecoin payment. The amount appears to relate to an invoice, but the sending address is absent from the customer file. Should finance approve settlement, request evidence or pause a planned action?
An unknown address first represents missing information. It may belong to the customer, a service provider or a third-party payer. Enhanced review becomes useful when inconsistencies or risk signals leave the payment inadequately explained. The aim is a proportionate, documented decision made by an authorised person.
1. Establish the facts without interacting with an unknown asset
Record the network, exact token identifier, transaction hash, time, quantity, addresses and confirmation status. Verify the asset’s contract or identifier against an independent official source. A wallet display name or payer screenshot is insufficient.
Compare the transfer with the invoice and payment instructions: approved asset, permitted network, expected quantity and conversion rule. A lookalike token or unexpected network requires technical review without establishing illicit origin.
For unsolicited assets, do not follow embedded links, connect the wallet to a suggested website or sign an approval to “unlock” or “return” funds. Use approved tools and preserve evidence before intervention.
2. Connect the sending address to the economic payer
Contact the customer through a previously verified channel. Establish who paid, which invoice the payment settles and which account or provider was used.
A provider may send from a pooled address that does not directly identify the customer. A third party may also legitimately settle an invoice. Document the connection, payment references and commercial explanation in either case.
A cryptographic signature may demonstrate control of an address at a particular time. On its own, it does not establish the controller’s legal identity or the economic source of funds. Evidence must connect technical observations with off-chain records.
3. Which signals justify enhanced review?
FATF’s September 2020 red-flag indicators include unusual behaviour, commercially unexplained amounts and inconsistencies about the source of funds. They support assessment rather than automatic accusations. FATF’s March and July 2026 publications update the context for stablecoins and unhosted wallets.
UNEXPLAINED PAYER — The customer cannot identify a third-party payer or changes the explanation.
COMMERCIAL MISMATCH — Amounts, reference currency or frequency do not fit the invoice and relationship.
SPLIT PAYMENTS — Several transfers unexpectedly replace one payment without a clear commercial reason.
UNUSUAL REFUND — An overpayment is followed by an urgent request to send the excess to another address or beneficiary.
WEAK TRACEABILITY — Provider information, references or supporting records conflict or cannot be verified.
ON-CHAIN ALERT — An approved tool reports meaningful exposure to a flagged address or activity; the nature and reliability of the connection need assessment.
LEGAL CONTEXT — A potential match to applicable sanctions, or uncertainty about a provider’s status, needs qualified verification.
An unhosted wallet, bridge or country is not proof of wrongdoing in isolation. Several converging signals may justify review; one sufficiently substantiated serious signal may also trigger escalation. Materiality is not determined by value alone.
4. Treat KYT output as an input to judgement
Know-your-transaction analysis assesses activity and exposures using on-chain data and classifications. Keep the tool, date, network, address, report version and available methodology. An unexplained score is difficult to challenge or reproduce.
Separate direct links from indirect exposure, traced funds from a mere interaction, and confirmed labels from uncertain attribution. Tracing depth and coverage influence the result. Pooled provider addresses need an appropriately contextualised interpretation.
Request additional evidence where the analysis remains ambiguous. No alert does not establish no risk. An alert does not establish payer identity, commercial purpose or an offence. Technical findings inform a human decision.
5. Choose a proportionate operational response
The on-chain receipt may already be complete. A company can govern its own use, conversion and refund decisions; it does not necessarily possess technical or legal power to freeze the token.
CLARIFY — Obtain missing information, check consistency and record the explanation before internal approval.
ENHANCED REVIEW — Temporarily restrict the relevant internal actions under the procedure, retain evidence and refer the exception to the designated owner.
ESCALATE — For serious signals, involve legal or compliance functions and the appropriate provider to establish applicable measures and duties.
An internal pause pending review is not a finding of illegality. Give it a reason, owner, deadline and reassessment rule. Exceptions should not remain indefinitely unresolved in a spreadsheet.
Do not improvise a refund. The sending address may belong to a provider, while a subsequently supplied address may belong to someone else. Verify the beneficiary, channel and conditions with authorised parties before an approved return.
6. Distinguish the receiving business from a regulated provider
In the European Union, Regulation 2023/1113 governs information accompanying certain crypto-asset transfers involving a relevant provider. It does not turn a company receiving payment for its own sales into a crypto-asset service provider.
Due-diligence, reporting and freezing obligations depend on the entity’s status, activities, parties and applicable regimes. Separate the company’s internal control policy from legal obligations. Serious uncertainty requires a qualified assessment before deciding what to communicate and to whom.
Apply the same discipline to African corridors and US relationships: verify local regimes and relevant sanctions for the particular transaction. An EU rule, a US list or a geographical category does not apply indiscriminately to every company.
7. Example: a 20,000-unit invoice and an unexpected refund request
Entirely fictional scenario: an invoice calls for 20,000 units of an approved stablecoin. The company receives 22,000 units from a new address. A message immediately requests the return of the additional 2,000 units to a different address.
The combined signals are an unlinked payer, an overpayment and a new refund destination. Finance preserves the transaction record, contacts the customer through the known channel and asks for an explanation. It pauses the proposed refund in its internal process pending an authorised decision.
If evidence confirms a legitimate error and a verified return beneficiary, the exception can be resolved under the procedure. Conflicting explanations warrant escalation. The scenario supports neither automatic repayment nor automatic accusation.
Conclusion — Turn a signal into a reviewable decision
The BECTRA sequence is TRANSACTION → CUSTOMER/INVOICE → PAYER → SIGNALS → EVIDENCE → REVIEW → DECISION.
Retain the facts, questions, responses, analytical limits and signed decision. This discipline enables measured handling of an unknown address and makes the controls explainable to finance teams, providers and authorised stakeholders.
How BECTRA can help
BECTRA supports review criteria, evidence organisation and the governance of stablecoin exceptions. This advisory and research work helps businesses structure decisions and discussions with legal, financial and compliance professionals.
Further reading
Sources
Primary sources consulted on 9 October 2026. Historical indicators are dated; the example and operational process are BECTRA educational constructions.
Comments