Mastercard Wants to Score Stablecoin Payments Before They Settle. The 60% Number Explains Why

Can you actually vet a stablecoin payment before the money moves?

That's the question every bank with a treasury desk has been asking since USDC and USDT stopped being a crypto curiosity and started showing up on real settlement instructions. Mastercard's answer, unveiled at Money20/20 in Las Vegas, is a product called Stablecoin Security. It's an API. It returns a risk score on a transfer before and during the moment that transfer travels across chains, providers and the traditional banking rail waiting at the other end.

Two partners are live at launch: Borderless.xyz and Keyrails. North America first. Wider commercial availability in 2027.

Look, the pitch is simple. Stablecoin transfers settle in seconds. Investigations don't. Being fast and being sure are two different things, and for most of this market's short history, everyone picked fast.

The Numbers Behind the Launch

Mastercard didn't ship this on vibes. The company cites research covering 593 million stablecoin transfer events and 141 million Ethereum transactions in 2025. Almost 60% of those transfers took a complex, multi-step route instead of a clean wallet-to-wallet hop.

That 60% is the whole story.

A multi-step route means hops. A hop means an intermediary, a swap, a bridge, a payment processor, or a wallet that's one or two degrees removed from whoever actually sent the funds. Every hop is a place where provenance gets thinner. Chainalysis, TRM Labs and Elliptic have been selling that provenance for years, mostly to exchanges and law enforcement. Mastercard is selling it to the bank on the other side of the trade, and that's a much bigger and much more skittish customer base.

Here's the thing. Settling a payment and clearing the counterparty aren't the same operation. A transfer can be technically perfect and still be a problem. Was the sending wallet compromised last week? Is the recipient on a sanctions list under a name nobody typed into the memo field? Did the funds come out of a mixer three hops back? Those questions have answers. The answers live in data the sending bank doesn't own.

What Mastercard Is Really Selling

Read the product description closely and you notice something. Mastercard isn't promising to catch fraud. It's promising to score it.

That distinction matters more than the marketing does. Compliance officers don't get fired for approving a payment that came with a documented risk score. They get fired for approving a payment with no documentation at all. What Mastercard is selling, underneath the API wrapper, is a defensible paper trail for stablecoin settlement. The risk number is the artifact. The decision to say yes is the product.

This is a playbook Mastercard has run before. The company piloted USDC settlement with banks back in 2021, then built out a multi-token network for tokenized deposits and card rails. Each step moved the card network from watching crypto at a distance to sitting inside the settlement flow. Stablecoin Security is the compliance layer that had to exist before any bank treasurer would let real volume through it.

This could have been prevented is a sentence I write too often. This time the industry is doing the prevention before the headline, which is a welcome change of pace.

Where the Score Breaks Down

Now the hard part.

A risk score is only as good as the labeling graph underneath it. Address attribution is the least glamorous and most contested layer in crypto security. Labels go stale. Clusters split. A wallet flagged as a sanctioned service gets drained and replaced, and the new address takes weeks to catch up with the old label. So who's checking the labels?

Ask anyone who has run transaction monitoring at a mid-size exchange. False positives are what kill these tools at scale. A score of 72 out of 100 tells an analyst nothing actionable unless the model says which factor drove the number. Mastercard says the assessment weighs payment context, fund origin and exposure to restricted parties. That's the right list. The open question is how much granularity comes back through the API and whether the bank's own risk engine can actually consume it without a human in the middle.

There's a second-order risk nobody's talking about. If every bank routes stablecoin payments through the same three scoring providers, those providers become a systemic dependency. A bad label update doesn't hit one institution. It hits everyone reading the same feed on the same morning. The vulnerability was hiding in plain sight: concentration, not code.

What to Watch

Timing first. North America now, commercial availability in 2027. That's a long runway, and it tells you the product is still in the phase where bank partners shape the risk model more than the roadmap does. Watch for the first named bank integration. That announcement will be worth more than any press release.

Second, watch the issuers. Circle and Tether both have freezing powers and both already run their own analytics. If risk scoring gets built into the mint and redeem path, Mastercard's API becomes a go-between instead of a gate. Nobody in payments wants to be middleware.

Third, watch regulation. US stablecoin legislation has shifted the conversation from whether banks should touch this to how banks document it. Any rule requiring pre-transaction screening pushes this product from nice-to-have to budget line item. Any rule that only asks for post-hoc reporting does the opposite.

The attack vector here was straightforward before this launch. Send funds through three hops nobody could see and let the receiving bank's compliance team shrug. Mastercard is closing that gap one API call at a time. It won't stop a determined launderer. It does raise the cost of the lazy version, and raising the cost of the lazy version is most of what security work actually is.

Funds aren't safu. They never were. But at least now there's a number attached to the risk before the money leaves the account.