Treasury Proposes Rule to Implement the GENIUS Act’s Requirements to Counter Illicit Finance

If your institution issues, plans to issue, or operates a subsidiary that issues U.S. dollar-denominated stablecoins, your compliance obligations are about to be codified in federal law for most stablecoin issuers for the first time. (PPSIs that are subsidiaries of insured depository institutions already have BSA obligations through their parent institutions; for them, this rule adds significant new on-chain enforcement and standalone sanctions compliance requirements with substantial penalties.) On April 8, 2026, FinCEN and OFAC jointly issued a Notice of Proposed Rulemaking (NPRM) that would require permitted payment stablecoin issuers (PPSIs) to comply with federal AML and sanctions laws. This is a proposed rule. The comment period closes June 9, 2026. Final regulations are required by July 18, 2026, with full enforcement beginning no later than January 18, 2027. (Federal Register Vol. 91, No. 69, April 10, 2026; Docket FINCEN-2026-0100.)

NETBankAudit experts have over 25 years of experience in digital asset compliance and regulatory audits. If you have questions about the GENIUS Act or the proposed rule, please contact our team.

What Is the GENIUS Act? Essential Background

Enacted July 18, 2025, the GENIUS Act governs payment stablecoins, digital tokens pegged to the U.S. dollar that allow holders to transfer value on blockchain networks and redeem tokens for dollars on demand, creating the first comprehensive federal regulatory framework for this market. 

Its most consequential provision classifies all permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act (BSA), triggering the full suite of BSA compliance obligations. Prior to the GENIUS Act, stablecoin issuers operated in a regulatory gray area where BSA obligations were not explicitly applied to token issuance; this rule eliminates that ambiguity entirely.

The stablecoin market is now processing trillions of dollars in annual volume and is increasingly integrated into cross-border payment corridors, raising the regulatory stakes. The Treasury Congressional Report on the GENIUS Act and illicit finance highlighted the threat landscape that motivated this rule: stablecoins have been exploited for fentanyl trafficking, Hamas terrorist financing, Iranian sanctions evasion, and large-scale investment fraud. These risks, combined with the rapid growth of the market, drove the urgency for BSA classification and robust compliance requirements.

Treasury Secretary Scott Bessent has framed the proposal as a way to secure American leadership in digital assets, expand dollar access globally, and drive demand for U.S. Treasuries (which back stablecoins). The OCC and FDIC have already issued proposed prudential standards covering reserve asset requirements; the FinCEN/OFAC rule is the AML/sanctions layer on top of those prudential rules. This dual-rule structure creates overlapping enforcement mechanisms for both state-regulated and federally-regulated issuers.

Who Is Covered: Defining “Permitted Payment Stablecoin Issuers”

A PPSI is defined as an entity that issues U.S. dollar-denominated stablecoins for payments and allows on-demand redemptions. There are three subcategories of PPSIs under the GENIUS Act:

• Subsidiaries of insured depository institutions
• Federally-regulated issuers
• State-regulated issuers meeting federal standards (available to PPSIs with less than $10 billion in outstanding stablecoins)

For PPSIs that are subsidiaries of insured depository institutions, FinCEN expects parent and subsidiary AML/CFT program obligations would be similar enough that compliance resources and practices can be coordinated and shared. The rule also applies to non-U.S. issuers seeking to serve U.S. markets, they would be required to comply with the same AML/sanctions obligations, with specific enforcement mechanisms for non-U.S. issuers to be addressed in the final rule. Major existing stablecoin issuers and new market entrants will need to assess how the proposed requirements affect their compliance structures.

The Regulatory Stack: Where This Rule Fits

• This FinCEN/OFAC rule is the AML/sanctions layer in a multi-agency regulatory stack that also includes:
  
  • OCC: proposed prudential standards (February/March 2026) covering reserve asset requirements
  • FDIC: prudential framework proposal (April 7, 2026), largely mirroring the OCC approach; includes 1:1 reserve requirements, prohibition on payment of yield/interest, 12-month operational backstop, two-day redemption requirement
  • FDIC clarified that stablecoin holders are not covered by deposit insurance, though reserves backing those tokens are protected; deposit insurance at the $250,000 cap per depository bank applies to the issuer, not passed through to stablecoin holders, meaning large issuers may not be able to fully cover reserves through deposit insurance, and customer disclosures should be clear that stablecoin holders have no pass-through deposit insurance protection.
  • FDIC’s April 2026 proposal clarified that “tokenized deposits” will be treated as deposits for regulatory purposes if they functionally mirror deposit definitions, regardless of labeling.
• The White House Council of Economic Advisors released a report on April 8, 2026, finding that eliminating stablecoin yield would increase bank lending by only $2.1 billion (0.02% increase), a finding that put the White House mildly on the side of allowing yield, a fiercely contested issue. The FDIC’s prohibition on yield in its prudential proposal directly contradicts this, and the issue remains unresolved and actively contested.
• Notably, both this NPRM and FinCEN’s concurrent proposed overhaul of BSA program requirements for traditional financial institutions were published in the same Federal Register edition, reflecting a unified enforcement philosophy that applies equally to digital and traditional institutions and a shift from check-the-box to effectiveness-based compliance.

The Core AML/CFT Program Requirements

As proposed, PPSIs would be required to establish a written, board-approved AML/CFT program that includes:

• A documented risk assessment process
• Internal controls
• Independent testing of the AML/CFT program (with a written copy available to FinCEN upon request)
• Ongoing employee training program
• A designated AML/CFT compliance officer who would be required to reside in the United States (individuals with felony convictions related to financial crimes, including insider trading, cybercrime, and fraud, would be barred from this role)

The rule would require a risk-based approach: issuers would need to focus compliance resources on higher-risk users and transactions, and risk assessments would need to consider both on-chain and off-chain information, reflecting the reality that stablecoin markets span public blockchains and secondary exchanges.

Customer Due Diligence and KYC

• PPSIs would be required to identify and verify customers and conduct enhanced due diligence on high-risk clients, putting stablecoin issuers on the same KYC standard as traditional financial institutions.
• Enhanced due diligence would be required for correspondent accounts for foreign financial institutions and private banking accounts.
• While the rule would not require direct monitoring of all secondary market transactions between third parties, PPSIs would be required to maintain a reasonable understanding of their customers’ secondary market activity. This creates a significant compliance obligation that would need to be documented carefully. Firms should document their approach to understanding customer secondary market activity, determine the scope of enhanced due diligence triggered by secondary market risk, and ensure that approach is defensible and clearly distinguished from direct secondary market monitoring, which is not required.
• SAR (Suspicious Activity Report) filings would be required for transactions that may indicate violations of law, subject to a proposed $5,000 reporting threshold. SAR obligations would not extend to secondary market transactions between third parties that merely interact with a smart contract (an important carve-out).

Travel Rule and Recordkeeping

• PPSIs would be required to comply with the Recordkeeping Rule for fund transfers of $3,000 or more.
• PPSIs would be required to transmit required information under the Travel Rule to other financial institutions, this is a standard BSA requirement now being applied to stablecoin issuers.

The Sanctions Compliance Program: Unique Provisions

• For the first time in proposed regulation, PPSIs would be explicitly required to maintain a standalone OFAC sanctions compliance program, separate from and in addition to their AML/CFT program. Previously, stablecoin issuers had no explicit OFAC program requirement, operating instead under general U.S. person sanctions obligations.
• PPSIs would be required to maintain technical capabilities to block, freeze, and reject transactions that violate U.S. sanctions, including the ability to “burn” tokens (permanently destroy them) or re-issue tokens when required by law or lawful regulatory/law enforcement orders.
• Non-compliance with sanctions obligations would carry penalties of $100,000 per day.
• OFAC’s five-pillar framework would apply: management commitment, risk assessment, internal controls, testing and auditing, and training. OFAC would not expect “check-the-box compliance” but would grant flexibility in implementation; institutions would need to document all five pillars.
• OFAC’s own view: internal audits can lack the independence, expertise, and resources needed for objective evaluation of sanctions compliance. The rule responds to this by requiring a truly independent audit of both the AML and sanctions programs.
• The sanctions provisions would apply to U.S. persons, including stablecoin issuers, with respect to OFAC-sanctioned persons, entities, and jurisdictions.

On-Chain Enforcement Challenge

• PPSIs would be required to have technical systems to block, freeze, burn, or re-issue tokens in compliance with lawful orders, this is straightforward for clearly sanctioned, listed wallets.
• Determining when blocking or rejecting secondary market transactions is necessary would be technically and legally complex, especially for gray-area transactions, and may carry litigation risk, as PPSIs may face legal challenge when blocking transactions involving wallets not on official sanctions lists but associated with suspicious activity.
• The rule recognizes the cryptographic nature of stablecoin markets and the fact that transactions occur on public blockchains where PPSIs may not have direct control over all secondary activity.
• If a stablecoin’s transactions suddenly spike on a foreign exchange known for poor AML controls, the PPSI would be required to incorporate this into its risk assessment and compliance program.

Enforcement Philosophy: Important Nuance

• FinCEN stated in the NPRM preamble it “generally would not take an enforcement action” against issuers whose programs meet the rule’s standards, this signals regulatory forbearance for good-faith compliant firms.
• Enforcement actions and major supervisory actions would be limited to cases where the issuer has a significant or systemic failure to maintain its program, not isolated or technical violations.
• Under the proposal, FinCEN would need to be notified at least 30 days before any other regulator takes a significant AML-related supervisory action against a PPSI, a mechanism that did not previously exist and centralizes enforcement coordination through FinCEN.
• FinCEN encourages financial institutions to use innovative technologies (AI, machine learning, blockchain analytics) as part of their AML programs; firms that responsibly experiment with innovation would not incur additional enforcement risk.

What Compliance Professionals Should Do: A Three-Horizon Action Plan

1. Before June 9, 2026 (Comment Period)

• Review the proposed rule in detail and assess how the requirements would affect your institution’s current compliance program, technical capabilities, and staffing.
• Identify areas where the proposed requirements would create operational or technical challenges, especially regarding secondary market monitoring, on-chain enforcement, and sanctions compliance.
• Submit comments to FinCEN/OFAC highlighting any ambiguities, implementation challenges, or areas where further regulatory clarity is needed.

2. Before July 18, 2026 (Preparation for Final Rule)

• Begin gap analysis of your current AML/CFT and sanctions compliance programs against the proposed requirements, including the five-pillar OFAC framework.
• Engage with technology and legal teams to assess your institution’s ability to block, freeze, burn, or re-issue tokens in response to lawful orders and sanctions requirements.
• Develop a documented approach to understanding customer secondary market activity, including how you will distinguish between required due diligence and direct monitoring.

3. Before January 18, 2027 (Full Compliance Readiness)

• Finalize and board-approve your written AML/CFT and sanctions compliance programs, ensuring all required elements are documented and independently tested.
• Build or enhance internal audit capability for digital assets and smart contract risk, ensuring independence and technical expertise.
• Train compliance staff on the new requirements, focusing on the nuances of secondary market monitoring, on-chain enforcement, and the documentation of risk-based decisions.

Key Takeaways for Compliance Professionals

• Review your institution’s BSA/AML program and identify where new on-chain and sanctions-specific requirements would require changes or additions to existing controls.
• Before June 9, 2026, prioritize submitting comments on any ambiguous or operationally challenging aspects of the proposed rule, especially around secondary market monitoring and technical enforcement.
• Assess your institution’s current technical capabilities for on-chain enforcement (blocking, freezing, burning, re-issuing tokens) and begin planning for any required upgrades or new controls.
• Prepare for the OFAC five-pillar sanctions compliance requirement, including the need for a truly independent audit function that can evaluate both AML and sanctions programs for digital assets.
• Use January 18, 2027 as your planning anchor for full compliance readiness, build your implementation timeline backward from this date to ensure all program elements are in place and tested before enforcement begins.

Building a compliant PPSI program requires specialized expertise across AML program design, OFAC sanctions compliance, digital asset audit capability, and on-chain technical controls, areas where NETBankAudit’s team is equipped to provide targeted support. For more information on how these requirements may affect your institution, or for support in preparing your compliance program, contact NETBankAudit.