GENIUS Act Compliance for Small Stablecoin Issuers

If you issue payment stablecoins, you are now a BSA financial institution. The GENIUS Act (S.1582), enacted as Public Law 119-27 on July 18, 2025, designates all permitted payment stablecoin issuers (PPSIs) as financial institutions under the Bank Secrecy Act (Section 4(a)(5)). That means AML/CFT program requirements, sanctions compliance obligations, and criminal exposure for violations -- all applied to an industry that, until last year, had no federal stablecoin-specific regulatory framework.

On April 8, 2026, FinCEN and OFAC jointly issued a Notice of Proposed Rulemaking (docket FINCEN-2026-0100) spelling out how these AML/CFT and sanctions obligations apply to PPSIs. The Federal Register comment deadline closed on June 9, 2026. The statutory July 18, 2026 rulemaking target has passed; as of this August 17 update, the Treasury Unified Agenda still lists the PPSI AML/sanctions and CIP items at proposed-rule stage. Enforcement begins no later than January 18, 2027.

Separate from that closed AML/sanctions docket, FinCEN and the federal banking agencies published a PPSI Customer Identification Program proposal on June 22, 2026 (docket FINCEN-2026-0101). Comments on the CIP proposal are due August 21, 2026.

This guide covers what the law requires, what the proposed rules add, and what you need to build -- specifically if you are a sub-$10B stablecoin issuer operating under state regulation.

---

Who does the GENIUS Act apply to?

The Act creates three regulatory pathways for becoming a PPSI. Your path determines your primary regulator:

Most smaller issuers will fall into the third category -- state-regulated PPSIs with less than $10 billion in outstanding payment stablecoins (Section 2(31), Section 4(c)(1)). If you cross the $10B threshold, you must transition to federal regulation within 360 days or cease new issuance, unless you obtain a waiver from your primary federal regulator.

Non-US issuers

Foreign payment stablecoin issuers of USD-denominated stablecoins must (Section 18): (1) register with the OCC, (2) hold reserves in a US financial institution sufficient for US customer liquidity demands, (3) operate under a home jurisdiction the Treasury Secretary deems "comparable" to US standards, and (4) not be domiciled in a comprehensively sanctioned country or a jurisdiction of primary money laundering concern.

---

What are the five OFAC sanctions compliance elements?

The proposed OFAC rule requires every PPSI to maintain a sanctions compliance program built around five mandatory elements. These mirror OFAC's existing Framework for OFAC Compliance Commitments, but are now legally binding for stablecoin issuers:

1. Senior management commitment

   Your board or senior leadership must formally approve the sanctions compliance program, allocate adequate resources, and designate a compliance officer with sufficient authority. This is not a checkbox -- OFAC examines whether management actively supports compliance or merely signs off on a document.

2. Risk assessment

   Conduct a sanctions-specific risk assessment covering your products, services, customer base, geographic exposure, and counterparty types. For stablecoin issuers, this means assessing the risk profile of your blockchain ecosystems, bridging mechanisms, OTC desks, and any jurisdictions where your stablecoin circulates.

3. Internal controls

   Build systems and procedures to identify, interdict, escalate, and report sanctioned activity. The proposed rule explicitly requires PPSIs to maintain technical capabilities, policies, and procedures to block, freeze, and reject specific or impermissible transactions that violate federal or state law. For on-chain issuers, the implementation may involve contract controls, issuer-side controls, policies, procedures, or a combination that can be tested and documented.

4. Testing and auditing

   Regular independent testing of your sanctions compliance program -- both the technology (does your screening tool catch what it should?) and the procedures (do your staff follow the escalation process?). OFAC expects at minimum annual testing, with more frequent testing for higher-risk profiles.

5. Training

   All relevant personnel must receive sanctions compliance training at onboarding and annually thereafter. Training must cover OFAC regulations, your internal procedures, red flags specific to stablecoin transactions, and consequences of violations. Document everything -- training records are a standard OFAC audit request.

---

What technical capabilities must you build?

Beyond the five-element program, the proposed rules impose specific technical requirements that directly affect your engineering team:

Block, freeze, reject

Proposed 31 CFR 1033.240 requires PPSIs to maintain technical capabilities, policies, and procedures to block, freeze, and reject specific or impermissible transactions that violate federal or state law. For issuers with smart contract-based tokens, a contract-level blocklist may be one implementation pattern, but the proposal is framed as a capability requirement. The key question is whether your architecture can comply with lawful orders and prevent prohibited activity, including where third-party activity interacts with the issuer's smart contract.

Real-time screening

Every transaction must be screened against OFAC-administered sanctions lists before settlement. For a stablecoin with high transaction throughput, this means your screening solution must operate at the speed of your blockchain -- not batch-processing hours later. Screening must cover the SDN list, the Sectoral Sanctions Identifications list, and other applicable OFAC programs.

Audit trail

Every screening event must produce a timestamped record: what was screened, against which lists, what the result was, and what action was taken. If OFAC or FinCEN requests your screening records for a specific address or time period, you need to produce them. "We screened it but didn't log the result" is not a defensible position.

---

What is the full compliance checklist for sub-$10B issuers?

This checklist covers both the GENIUS Act's statutory requirements and the proposed FinCEN/OFAC implementing rules. Items are ordered by implementation priority -- authorization blockers first, then program requirements, then ongoing operations.

1. Obtain PPSI authorization via your state regulator

   Apply to your state's payment stablecoin regulator. Your state must have a framework the federal regulators deem "substantially similar" to the GENIUS Act's requirements. If your state does not have an approved framework, you must apply to the OCC as a nonbank PPSI. Check the CSBS implementation tracker for state-level progress.

2. Establish 1:1 reserve backing

   Maintain reserves backing outstanding stablecoins on at least a 1:1 basis using permissible assets (US Treasury bills, insured deposits, other approved instruments). Reserve composition must be disclosed and audited.

3. Designate a BSA/AML compliance officer

   As a BSA financial institution, you must appoint a compliance officer responsible for your AML/CFT program. This person needs board-level access and sufficient authority to halt transactions. For small issuers, this role can overlap with your general counsel or chief compliance officer, but the designation must be formal and documented.

4. Build the five-element OFAC sanctions compliance program

   Senior management commitment, risk assessment, internal controls, testing, and training -- all documented, all auditable. See the detailed breakdown above. This is not optional; it is a condition of operating as a PPSI.

5. Implement block/freeze/reject controls

   Choose and document the control architecture for blocking, freezing, or rejecting prohibited or impermissible activity. A contract-level blocklist may be appropriate for some token designs, but the proposed rule speaks in capability, policy, and procedure terms. Validate that your architecture can comply with lawful orders and produce evidence of the action taken.

6. Deploy real-time sanctions screening with audit trail

   Screen all transactions against OFAC lists before settlement. Log every screening event with timestamp, list version, result, and action taken. Your screening vendor must provide verifiable records, not just pass/fail responses.

7. Write AML/CFT policies and procedures

   Customer due diligence (CDD), enhanced due diligence (EDD) for high-risk counterparties, suspicious activity reporting (SAR) procedures, and a firm-wide risk assessment methodology. These must be board-approved and reviewed at least annually.

8. Implement customer identification and verification

   BSA requirements include a Customer Identification Program (CIP). A separate June 22, 2026 PPSI CIP NPRM (FINCEN-2026-0101) proposes how that requirement would apply to stablecoin issuers, with comments due August 21, 2026. For now, design minting and redemption onboarding around identity collection, verification, recordkeeping, and list screening, then adjust when the final CIP rule is issued.

9. Establish SAR filing procedures with FinCEN

   Register with FinCEN's BSA E-Filing system. Train staff on when and how to file Suspicious Activity Reports. SAR filing timelines are strict: 30 calendar days from detection (60 days if no suspect identified).

10. Conduct independent compliance testing

    Engage an independent party (internal audit or external firm) to test your sanctions screening effectiveness and AML procedures. Document findings and remediation. OFAC expects this at minimum annually.

11. Train all relevant personnel

    Sanctions compliance training at onboarding and annually. AML/CFT training covering red flags, escalation procedures, and regulatory obligations. Keep dated records of who was trained, on what, and when.

12. Track closed and open rulemakings

    The AML/sanctions comment period for FINCEN-2026-0100 closed on June 9, 2026. The separate CIP proposal, FINCEN-2026-0101, remains open through August 21, 2026. Track both dockets and reconcile your program against final rules as they are issued.

---

What is the timeline?

As of July 10, 2026, the January 18, 2027 outer enforcement deadline is 192 days away. If you have not started building your compliance infrastructure, the timeline is tight but workable. If you are waiting for the final rules to start -- you will likely not make it.

---

How big is the market impact?

The stablecoin market exceeded $317 billion in market capitalization as of April 2026, with transaction volumes exceeding $28 trillion in Q1 2026 alone. The top five stablecoins account for roughly 87% of the market, but the long tail of smaller issuers is where the compliance gap is widest.

Large issuers like Tether and Circle already maintain substantial compliance teams -- Tether has confirmed using Chainalysis for sanctions screening, and Circle operates in-house compliance infrastructure. For sub-$10B issuers, the GENIUS Act represents a step-function increase in compliance obligations. Many are running with minimal or no formal sanctions programs today.

The proposed rule effectively creates a compliance floor: below it, you cannot operate. The question for small issuers is not whether to comply, but whether the cost of compliance is sustainable for their business model.

---

Frequently asked questions

When does the GENIUS Act take effect for stablecoin issuers?

The GENIUS Act was enacted as Public Law 119-27 on July 18, 2025. Full enforcement begins on the earlier of (a) 120 days after primary federal regulators issue final implementing regulations, or (b) January 18, 2027 -- 18 months from enactment. FinCEN and OFAC issued proposed AML/CFT and sanctions rules on April 8, 2026 (docket FINCEN-2026-0100), and the Federal Register comment deadline closed on June 9, 2026. The statutory July 18, 2026 rulemaking target has passed; as of August 17, 2026, the Treasury Unified Agenda still lists the PPSI AML/sanctions and CIP items at proposed-rule stage.

Is the June 2026 CIP proposal the same rulemaking?

No. The June 22, 2026 PPSI Customer Identification Program NPRM is a separate proposal under docket FINCEN-2026-0101. Comments on that CIP proposal are due August 21, 2026.

Does the GENIUS Act apply to DeFi protocols and self-custodial wallets?

No. The Act explicitly excludes distributed ledger protocols, development activities, immutable and self-custodial wallet interfaces, and liquidity pool participation from the definition of "digital asset service provider." These exemptions mean DeFi protocols and non-custodial software are not subject to the Act's PPSI licensing, sanctions compliance, or BSA obligations.

What sanctions lists must stablecoin issuers screen against?

The proposed OFAC rule requires PPSIs to screen against all OFAC-administered sanctions lists, including the SDN (Specially Designated Nationals) list, the Sectoral Sanctions Identifications list, and other OFAC programs. PPSIs must also maintain technical capabilities, policies, and procedures to block, freeze, or reject prohibited or impermissible transactions. Issuers operating internationally should also consider screening against jurisdictional lists (EU Consolidated, UN) relevant to their operations.

What are the penalties for non-compliance with the GENIUS Act?

Unlicensed stablecoin issuance carries civil penalties up to $100,000 per day per violation, or $200,000 per day for willful noncompliance. Knowing participation in violations can result in fines up to $1,000,000 per violation, imprisonment for up to five years, or both. Criminal liability extends to officers, directors, employees, agents, and control persons of the issuing entity.

Do non-US stablecoin issuers need to comply?

Yes, if they issue USD-denominated payment stablecoins. Foreign issuers must register with the OCC, hold reserves in a US financial institution, and operate under a home jurisdiction whose regulatory framework the Treasury Secretary determines is "comparable" to US standards. They cannot be domiciled in a comprehensively sanctioned country or a jurisdiction designated as a primary money laundering concern.

---

Bottom line

The GENIUS Act and its proposed implementing rules transform stablecoin issuance from a lightly regulated activity into a BSA-supervised financial service. For sub-$10B issuers, the core requirements are clear: get authorized, build a five-element OFAC sanctions compliance program, implement block/freeze/reject capability, deploy real-time screening with audit trails, and establish AML/CFT procedures that meet BSA standards.

As of August 17, 2026, the January 18, 2027 outer enforcement deadline is 154 days away. The AML/sanctions comment period for FINCEN-2026-0100 closed on June 9, 2026; the separate CIP docket, FINCEN-2026-0101, remains open until August 21, 2026. If you have CIP-specific concerns, that is the active docket. If you have AML/sanctions gaps, now is the time to close them.

$100,000 per day is an effective motivator.