Stablecoin issuers are being brought into the BSA perimeter. On April 8, 2026, the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) announced a joint Notice of Proposed Rulemaking (docket FINCEN-2026-0100; 91 FR 18582) that spells out how anti-money laundering and sanctions compliance obligations apply to permitted payment stablecoin issuers (PPSIs) under the GENIUS Act.

The 303-page proposed rule classifies PPSIs as financial institutions under the Bank Secrecy Act (BSA), requires them to maintain five-element OFAC sanctions compliance programs, requires technical capabilities, policies, and procedures to block, freeze, or reject specific impermissible transactions, and proposes SAR filing, CDD, recordkeeping, information-sharing, and Travel Rule obligations. The FINCEN-2026-0100 comment period closed on June 9, 2026.

A second rulemaking now fills in the customer identification piece. On June 22, 2026, FinCEN and the banking agencies published the PPSI Customer Identification Program NPRM (docket FINCEN-2026-0101; 91 FR 37234). Comments on that CIP proposal are due August 21, 2026.

As of August 17, 2026, FINCEN-2026-0100 is closed and remains a proposed rule; FINCEN-2026-0101 remains open for comments until August 21, 2026.

This is the implementing regulation the industry has been waiting for since the GENIUS Act became law on July 18, 2025. Below is a section-by-section breakdown of what the rule requires, who it covers, and what you need to build.

Penalty exposure

Unlicensed stablecoin issuance: $100,000/day civil penalty per violation ($200,000/day for willful noncompliance). Knowing participation: up to $1,000,000 per violation, up to 5 years imprisonment, or both. OFAC sanctions violations carry separate penalties up to $368,136 per violation or twice the transaction value. Criminal liability extends personally to officers, directors, employees, agents, and control persons.

Who is covered by the proposed rule?

The rule would apply to permitted payment stablecoin issuers (PPSIs) as defined by the GENIUS Act. A PPSI is any entity authorized to issue payment stablecoins under one of three regulatory pathways:

Issuer type Primary regulator Threshold
Subsidiary of insured depository institution Federal banking regulator (OCC, FDIC, Fed) No cap
Nonbank, uninsured national bank, federal branch of foreign bank OCC No cap
Nonbank with <$10B outstanding stablecoins State regulator (if framework is "substantially similar") <$10B

The proposed AML/CFT program requirements and OFAC sanctions compliance elements are identical across all three categories. The difference lies in who examines you -- not what you would need to build.

DeFi exemption

The GENIUS Act explicitly excludes distributed ledger protocols, development activities, immutable and self-custodial wallet interfaces, and liquidity pool participation from the definition of "digital asset service provider." If you are building non-custodial DeFi infrastructure, you are not a PPSI and these requirements do not apply to you.

Non-US issuers

Foreign issuers of USD-denominated payment stablecoins must register with the OCC, hold reserves in a US financial institution, and operate under a home jurisdiction the Treasury Secretary deems "comparable" to US standards. They cannot be domiciled in a comprehensively sanctioned country or a jurisdiction of primary money laundering concern (GENIUS Act Section 18).

What are the five OFAC sanctions compliance elements?

The proposed OFAC rule requires every PPSI to maintain a sanctions compliance program built around five mandatory elements. These mirror OFAC's existing Framework for OFAC Compliance Commitments, but the proposed rule makes them legally binding for stablecoin issuers -- not just best practice:

  1. Senior management commitment

    Your board or senior leadership must formally approve the sanctions compliance program, allocate adequate resources, and designate a compliance officer with sufficient authority and autonomy. OFAC examines whether management actively supports compliance or merely signs off on a document. The proposed rule requires this commitment to be documented and reviewable.

  2. Risk assessment

    Conduct a sanctions-specific risk assessment covering your products, services, customer base, geographic exposure, and counterparty types. For stablecoin issuers, this means assessing the risk profile of every blockchain your token operates on, bridging mechanisms, OTC desks, and any jurisdictions where your stablecoin circulates. The assessment must be updated when your risk profile changes -- not just annually.

  3. Internal controls -- the bullseye requirement

    Build systems and procedures to identify, interdict, escalate, and report sanctioned activity. Section 502.201(b)(3) would require PPSIs to establish and maintain risk-based internal controls -- including technical capabilities and written policies and procedures -- to identify, block, and/or reject transactions that may violate or would violate US sanctions. For on-chain issuers, this is a core product-control requirement, but the proposal does not prescribe a single token-contract design.

  4. Testing and auditing

    Maintain an independent testing or audit function for your sanctions compliance program -- both the technology (does your screening tool catch what it should?) and the procedures (do your staff follow the escalation process?). The function needs sufficient resources, expertise, and authority to identify sanctions compliance weaknesses and feed them back into the program.

  5. Training

    Maintain risk-based sanctions compliance training for all relevant personnel and stakeholders, performed at least annually and at a frequency appropriate to the PPSI's risk profile. Training should cover OFAC regulations, your internal procedures, red flags specific to stablecoin transactions (chain-hopping, mixing services, sanctioned jurisdiction exposure), and consequences of violations. Document everything -- training records are a standard OFAC audit request.

What technical capabilities must issuers build?

Beyond the five-element program, the proposed rule imposes specific technical requirements that directly affect your engineering team:

Block, freeze, reject

The April NPRM and the GENIUS Act require PPSIs to maintain technical capabilities, policies, and procedures to block, freeze, or reject specific or impermissible transactions that violate Federal or State law, rules, or regulations, and to comply with lawful orders. For issuers with smart contract-based tokens, this may require transfer-control, freeze, burn, redemption, or account-level controls that can be applied when legally required. The official language is capability-based and risk-based; it is not a mandate to use one particular contract pattern.

Real-time screening

Sanctions controls need to be fast enough to identify prohibited activity and support required blocking, freezing, rejection, reporting, and lawful-order responses. For high-throughput stablecoins, batch-only review after risk has already materialized is a weak control. Screening should cover OFAC-administered sanctions lists, including the SDN list and other applicable programs, and should be calibrated to the issuer's products, counterparties, geographies, chains, and secondary-market exposure.

Audit trail

Screening and interdiction events should produce timestamped records: what was screened, against which list version, what the result was, and what action was taken. If OFAC or FinCEN requests records for a specific address, customer, transaction, or time period, you need to produce them. "We screened it but did not log the result" is not a defensible position.

Vendor vs. in-house

The proposed rule allows sanctions compliance tools to be developed internally or sourced from a vendor. The Chainalysis sanctions oracle -- the most widely used free on-chain screening tool -- checks addresses against OFAC, EU, and UN sanctions designations. However, the free oracle provides address-level lookups only, without the audit trail, compliance certificates, or match-handling workflow a PPSI will need to evidence its program. Free screening tells you if an address is sanctioned; it does not produce the documentation trail that proves your compliance program works.

What AML program requirements apply?

Under the proposed BSA framework, PPSIs would maintain a full AML/CFT program. The proposed rule specifies these core obligations:

Suspicious Activity Reports (SARs)

PPSIs would register with FinCEN's BSA E-Filing system and file SARs for suspicious transactions. The crypto industry already files approximately 55,000 crypto-related SARs annually (Treasury press release). Filing deadlines: 30 calendar days from detection (60 days if no suspect identified).

Customer due diligence (CDD) and CIP

The April AML/CFT NPRM proposes risk-based CDD obligations, including understanding customer relationships, monitoring for suspicious transactions, and maintaining and updating customer information, including beneficial ownership information for legal entity customers. The June 22 CIP NPRM then proposes the account-opening mechanics: a written CIP appropriate for the PPSI's size and business, risk-based procedures to verify each customer's identity, collection of name, date of birth or formation, address, and identifying number before account opening, verification within a reasonable time, recordkeeping, government-list comparison, customer notice, and limited reliance on another federally regulated financial institution. Comments on these CIP mechanics are due August 21, 2026 under FINCEN-2026-0101.

Travel Rule

Stablecoin transfers above the applicable threshold would require transmittal of originator and beneficiary information -- a capability many issuers lack today.

How does this affect small issuers vs. large issuers?

The proposed rule does not differentiate compliance obligations by issuer size. A PPSI with $50 million in outstanding stablecoins has the same five-element OFAC program requirement as one with $50 billion. However, the practical impact differs significantly:

Factor Large issuers ($10B+) Small issuers (<$10B)
Existing compliance team Established (Tether, Circle already have full programs) Often minimal or absent
Screening infrastructure Enterprise vendors already deployed May rely on free tools without audit trails
Block/freeze capability Often already supported through issuer-controlled transfer restrictions May require contract upgrade or migration
SAR filing experience Already filing SARs as MSBs New obligation -- must register with FinCEN
Cost of compliance Incremental -- adding PPSI-specific procedures to existing programs Step-function increase -- building a new PPSI compliance program
Primary regulator Federal (OCC, FDIC, Fed) State regulator (if "substantially similar" framework exists)

The proposed rule creates a compliance floor. Issuers that cannot meet it may need to exit the market or consolidate.

Comment status and open CIP docket

The April AML/sanctions NPRM comment window has closed. FINCEN-2026-0100 comments were due on June 9, 2026, so do not treat that docket as an open submission opportunity as of this July 10 update.

The open rulemaking is now the June 22 PPSI Customer Identification Program proposal. If the proposed account-opening, verification, recordkeeping, government-list comparison, or reliance mechanics create technical or operational issues for your issuer model, submit those comments under FINCEN-2026-0101 before August 21, 2026.

Submission details

What remains worth commenting on

For the open CIP docket, the highest-signal comments will be specific and operational:

Industry comments still carry weight, but the target has changed: FINCEN-2026-0100 is closed; FINCEN-2026-0101 is open.

What is the timeline?

Date Event Action required
July 18, 2025 GENIUS Act signed into law Statutory clock starts
April 8, 2026 FinCEN + OFAC announce AML/sanctions NPRM (FINCEN-2026-0100) Review proposed rules, begin building compliance program
April 10, 2026 AML/sanctions NPRM published in the Federal Register (91 FR 18582) 60-day comment clock begins
June 9, 2026 FINCEN-2026-0100 comment period closed Closed docket; monitor final rule
June 22, 2026 PPSI Customer Identification Program NPRM published (FINCEN-2026-0101; 91 FR 37234) Review CIP, verification, recordkeeping, government-list comparison, and reliance mechanics
July 18, 2026 Statutory implementing-rule target passed Track final rules; AML/sanctions remains proposed-rule stage in the Aug. 14, 2026 Unified Agenda
August 21, 2026 FINCEN-2026-0101 CIP comments due Submit CIP comments via regulations.gov
January 18, 2027 Outside statutory effective date (18 months from GENIUS Act enactment) Act can take effect earlier if final regulations trigger the 120-day date

The outside statutory effective date is January 18, 2027. The GENIUS Act takes effect earlier if final implementing regulations issue and 120 days pass before that date, so issuers should not treat January 18 as guaranteed extra time.

Frequently asked questions

What is the FinCEN stablecoin rule published in April 2026?

A joint FinCEN/OFAC proposed rule (docket FINCEN-2026-0100; 91 FR 18582) implementing the GENIUS Act's AML/CFT and sanctions requirements for permitted payment stablecoin issuers. The 303-page rule classifies PPSIs as BSA financial institutions and proposes AML/CFT programs, five-element OFAC programs, SAR filing, CDD, recordkeeping, information-sharing, and Travel Rule obligations. Comments closed June 9, 2026.

What are the five OFAC sanctions compliance elements?

(1) Senior management commitment, (2) risk assessment, (3) risk-based internal controls including technical capabilities and written policies and procedures, (4) independent testing and auditing, and (5) risk-based training performed at least annually and at a frequency appropriate to the PPSI's risk profile.

What does block, freeze, reject mean for on-chain transactions?

PPSIs must maintain technical capabilities, policies, and procedures to block, freeze, or reject specific or impermissible transactions when required by Federal or State law, sanctions rules, regulations, or lawful orders. The proposal does not prescribe one token-contract design; it frames the obligation as risk-based internal controls supported by records, testing, and escalation.

Are comments still open?

For FINCEN-2026-0100, no: comments closed on June 9, 2026. For the separate PPSI Customer Identification Program NPRM, comments are due August 21, 2026 under FINCEN-2026-0101.

What are the penalties for non-compliance?

Civil: up to $100,000/day per violation ($200,000/day willful). Criminal: up to $1,000,000 and 5 years per violation. OFAC penalties apply separately -- up to $368,136 per violation or twice the transaction value. Liability extends to officers, directors, and control persons.

Bottom line

The FinCEN/OFAC proposed rule transforms stablecoin issuance from a patchwork of state-level requirements into a federally supervised financial activity with BSA-grade obligations. The five-element OFAC sanctions compliance program is the core framework. The block/freeze/reject and lawful-order capability requirements are the hardest technical requirements, but they should be described in the rule's own terms: risk-based controls, technical capabilities, policies, and procedures. The SAR filing, CDD, CIP, and Travel Rule obligations bring stablecoin issuers in line with the rest of the regulated financial system.

The AML/sanctions comment deadline has passed. The CIP comment window remains open until August 21, 2026, and the outside statutory effective date is January 18, 2027 unless final regulations make the 120-day effective-date trigger earlier.

ChainScreen will track the final AML/sanctions rule and the open CIP docket as the GENIUS Act implementation clock runs.

Analysis by ChainScreen. Published April 10, 2026. Updated August 17, 2026.

Sanctions screening evidence for stablecoin issuers

Section 502.201(b)(3) makes documentation as important as the screening result: keep timestamped records, list-version evidence, and freeze/escalation decisions.

Read regulatory guides →

Sources

Related articles

Regulations GENIUS Act Compliance for Small Stablecoin Issuers in 2026 Read → Regulations Which Sanctions Lists Does MiCA Require? OFAC vs EU Consolidated Read → Operations Sanctions Screening Implementation Guide: From Excel to API in 30 Days Read →