9 minute read | April.30.2026
Payment stablecoin issuers would face comprehensive new AML/CFT and sanctions compliance obligations under a joint proposed rule issued April 8, 2026, by the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) and Office of Foreign Assets Control (OFAC). The rule, issued under the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act, would require permitted payment stablecoin issuers (PPSIs) to build out compliance programs comparable to those of traditional financial institutions — covering the full lifecycle of a stablecoin from issuance through secondary market activity.
The proposed rule has significant operational implications for current and prospective stablecoin issuers, insured depository institutions with PPSI subsidiaries, and digital asset market participants evaluating their regulatory status. As we noted previously, the GENIUS Act provides for a framework for the regulation of PPSIs, amends the Bank Secrecy Act (BSA) to provide that PPSIs are “covered financial institutions,” mandates that PPSIs maintain effective sanctions compliance programs, and tasks FinCEN, OFAC and several other agencies with related rulemaking.
The proposed rule would apply to all PPSIs, including subsidiaries of insured depository institutions and insured credit unions approved to issue payment stablecoins; federal-qualified payment stablecoin issuers (FQPSIs); nonbank entities, uninsured national banks and federal branches approved by the Office of the Comptroller of the Currency (OCC); and state-qualified payment stablecoin issuers (SQPSIs).
Under the GENIUS Act, an SQPSI with consolidated outstanding issuance exceeding $10 billion must transition to federal supervision unless it obtains a waiver. FinCEN noted that it expects PPSIs that are subsidiaries of insured depository institutions covered by their own BSA compliance program requirements to be able to leverage the parent institution’s program for BSA compliance.
The proposed rule draws a distinction between the primary and secondary market and imposes obligations on PPSIs regarding both.
While some PPSIs’ obligations would extend only to primary market activities, including customer due diligence and suspicious activity reporting requirements, other obligations would extend to secondary market activities. Specifically, a PPSI would be required to have the technical capabilities to block, freeze and reject specific or impermissible transactions that violate federal or state law. PPSIs would also be required to have the technological capability to comply with the terms of any “lawful order,” including orders to seize, freeze, burn or prevent the transfer of payment stablecoins. Such orders would include, for example, a seizure warrant.
The GENIUS Act requires that PPSIs be formed in the United States, subjecting them to the same OFAC sanctions obligations as all other U.S. persons. However, the proposed rule would codify the first explicit federal requirement that a specific category of U.S. persons, PPSIs, maintain an effective sanctions compliance program covering “all payment stablecoin-related activity,” defined to include the full lifecycle of a payment stablecoin from issuance through removal from circulation, whether on the primary or secondary market. The proposal draws heavily from OFAC’s Framework for OFAC Compliance Commitments and its 2021 Virtual Currency Industry Guidance, requiring:
The GENIUS Act authorizes civil monetary penalties of up to $100,000 per day for material violations of the sanctions program requirement, with an additional $100,000 per day for knowing violations, in addition to penalties otherwise available under U.S. sanctions laws.
OFAC also clarified that a PPSI would engage in prohibited dealings with a blocked person if it allowed the blocked person to engage the PPSI’s smart contract that facilitates stablecoin transactions on the secondary market, and that a PPSI is deemed to control stablecoins it issues that are transferred via its smart contract. This is why, as noted above, the PPSI would have to be able to block, freeze or reject such secondary market transactions to comply with OFAC sanctions. The proposed rule suggests that OFAC expects PPSIs to take action to identify and address instances in which sanctions targets hold or trade the PPSIs’ stablecoins on the secondary market.
The proposed rule would require PPSIs to implement and maintain a written AML/CFT program that is approved by the PPSI’s board of directors or a similar body. It would also impose on PPSIs an AML/CFT program requirement consistent with those set out in the BSA Program Proposed Rule for other types of financial institutions, with the intent of providing PPSIs flexibility to allocate resources to high-risk areas and away from areas of lower risk.
The AML/CFT program for PPSIs would generally mirror the AML/CFT program for banks and other “covered” financial institutions that are subject to customer identification program (CIP) and customer due diligence (CDD) requirements, including requirements to identify and verify beneficial owners of “legal entity customers.” The proposal addresses CDD and beneficial ownership; FinCEN has indicated that CIP requirements for PPSIs will be addressed in a separate forthcoming rulemaking.
CDD and beneficial ownership requirements would generally be limited to primary market activities, although FinCEN noted that consideration of secondary market transactions may be appropriate when considering a PPSI customer’s risk profile for purposes of CDD requirements.
BSA reporting and recordkeeping requirements for PPSIs would also generally align with those applicable to covered financial institutions. They would include a requirement to report suspicious primary market transactions that involve or aggregate at least $5,000 in funds or other assets. FinCEN clarified that a secondary market transfer is not subject to suspicious activity reporting requirements if the PPSI’s role is limited to interacting with a smart contract.
The proposed rule would also require PPSIs to comply with funds transfer-related recordkeeping and travel rules. Under these rules, PPSIs would be required to retain certain records and information for funds transfers and transmittals of $3,000 and to transmit certain of this information to other financial institutions participating in the transfer. PPSIs would also be subject to USA PATRIOT Act special measures under Section 311, the Section 313/319 correspondent and private banking due diligence rules, and Section 314(a) and (b) information sharing.
Similar to the BSA Program Proposed Rule, FinCEN proposed a policy for supervision and enforcement in which it would generally limit enforcement actions to instances in which a PPSI failed to establish a compliant AML/CFT program or, once established, there is a significant or systemic failure to maintain the program. FinCEN would delegate its authority to examine federally qualified PPSIs to the OCC, Federal Reserve Board of Governors, Federal Deposit Insurance Corporation or National Credit Union Administration, as applicable. FinCEN would delegate its authority to examine state-qualified PPSIs not supervised by these agencies to the Internal Revenue Service. The proposed rule would require each of these agencies to notify and consult with FinCEN before taking any significant AML/CFT supervisory action against a PPSI.
Comments are due June 9, 2026. FinCEN and OFAC have posed nearly 60 questions across a wide range of topics, including the relationship of PPSIs’ obligations to those of parent banks and MSBs; the appropriate scope of secondary market obligations; whether the suspicious activity reporting threshold and secondary market carve-out are appropriate; whether the sanctions compliance program elements are sufficiently clear and flexible; and whether AML/CFT obligations should be extended to foreign payment stablecoin issuers (FPSIs), which the current proposal does not cover.
We will continue to track developments under the GENIUS Act. If you are evaluating your compliance readiness or considering submitting a comment, please contact a member of our team.