The GENIUS Act takes effect on 18 January 2027, and it treats every permitted payment stablecoin issuer as a financial institution under the Bank Secrecy Act, the US anti-money laundering law. The detailed rules are still proposals. FinCEN and OFAC proposed the anti-money laundering (AML) and sanctions programme rule on 10 April 2026, and both agencies propose that it applies 12 months after the final rule is issued. Issuers planning to apply in 2027 should build their programme to the proposal now, because the regulator reviewing the application will ask how the issuer meets these duties.
This guide sets out where each rulemaking stands, what the proposed programme contains, how the sanctions and blocking duties work, and a build plan. It is written for compliance heads, general counsel and founders at issuers, and at banks and fintechs planning a stablecoin subsidiary. For the licence itself, see our guide to the GENIUS Act stablecoin issuer application.
Where the rules stand in November 2026
Four rulemakings shape an issuer's financial crime duties. Only one is final, and it is the one that does not cover AML.
| Date | Agency | What it does | Status |
|---|---|---|---|
| 10 April 2026 | FinCEN and OFAC | AML and sanctions programme rule for permitted payment stablecoin issuers (91 FR 18582) | Proposed. Comments closed 9 June 2026 |
| 22 June 2026 | FinCEN with the OCC, Federal Reserve, FDIC and NCUA | Customer identification programme for issuers (91 FR 37234) | Proposed. Comments closed 21 August 2026 |
| 22 June 2026 | OCC | Applies the FinCEN and OFAC rules to issuers the OCC supervises and sets its supervision framework (OCC Bulletin 2026-28) | Proposed |
| 21 October 2026 | OCC | Final GENIUS Act rule on licensing, reserves, redemption and reporting, excluding AML and sanctions | Final. Takes effect 18 January 2027 |
The OCC said its final rule covers everything required of it "other than those related to the Bank Secrecy Act, anti-money laundering, and Office of Foreign Asset Control sanctions", which will follow in a separate rulemaking. The OCC has also said it will announce separately when it starts accepting applications. No date had been given on 12 November 2026.
The timing matters. FinCEN proposes an effective date 12 months after the final rule, and OFAC proposes the same. The customer identification rule would also apply 12 months after it is final. So the detailed rules will very likely start after 18 January 2027. That does not leave an issuer free to wait. The Act itself makes issuers financial institutions under the Bank Secrecy Act, and the approving regulator assesses whether an applicant can meet the Act's requirements.
Who the AML rule covers
The proposal covers permitted payment stablecoin issuers, often shortened to PPSIs: firms approved under the GENIUS Act to issue a payment stablecoin, meaning a digital token designed to be redeemed for a fixed amount of money. There are three routes to that status: a subsidiary of an insured bank or credit union, a federal qualified issuer approved by the OCC, and a state qualified issuer approved by a state regulator.
FinCEN proposes to define issuers as a new type of financial institution under 31 CFR 1010.100, with their own rules in a new 31 CFR part 1033. Issuers would be taken out of the money services business (MSB) definition for their issuing activity, so they would no longer register with FinCEN as MSBs for it. Other activity, such as running a separate exchange, may still need MSB registration and state money transmitter licences.
Issuers must be formed in the United States, so OFAC treats them as US persons, which means US sanctions apply to them directly.
Foreign issuers are outside this rule. FinCEN said it is "only proposing application of AML/CFT requirements to PPSIs" and asked for views on whether any requirements should apply to foreign payment stablecoin issuers. A foreign issuer seeking access to US markets should read our note on foreign stablecoin issuer registration under the GENIUS Act.
The AML programme FinCEN proposes
The proposed programme in 31 CFR 1033.210 is modelled closely on FinCEN's programme rules for banks. Each part has to be written down, approved and evidenced.
| Element | What the proposal requires | What to have ready |
|---|---|---|
| Written programme | A written, risk-based AML programme approved by the board, an equivalent governing body or appropriate senior management | Board minute approving the programme, with a review cycle |
| Risk assessment | Identify, assess and document money laundering and terrorist financing risks, generally each year, and take account of FinCEN's published AML priorities | A dated risk assessment covering customers, products, distribution channels and each blockchain the token runs on |
| Internal controls | Policies, procedures and controls that reduce the risks identified | Procedures mapped to each risk, with owners |
| Customer due diligence | Ongoing due diligence, including beneficial ownership for legal entity customers | Onboarding and periodic review standards by risk level |
| AML officer | A named individual located in the United States, accessible to regulators, without certain disqualifying convictions | Appointment letter, job description and reporting line to the board |
| Independent testing | Testing by people independent of the programme; the AML officer would generally not count as independent | Test scope, tester and first test date |
| Training | Ongoing training for relevant staff | Training plan by role, with records |
A bank subsidiary may extend its parent bank's programme to the issuer, provided the single programme meets the requirements of each entity. This is the simplest route for banks, but the risk assessment still has to cover the token's own risks.
Issuers must also be able to give FinCEN, on request, the certifications they submit to their primary regulator that the AML programme has been implemented. A certification is a signed statement, so the evidence behind it has to exist before it is signed.
Customer identification
The customer identification programme proposed on 22 June 2026 is the familiar bank model. Before opening an account the issuer collects the customer's name, date of birth or date of formation, address (not a post office box) and an identification number. It then verifies identity within a reasonable time using documents, other methods or both, and has procedures for when it cannot verify: refuse, limit or close the account, or file a suspicious activity report.
The definition of customer is the point most issuers need to understand. A customer is a person who opens an account, meaning a formal relationship with the issuer. Holders who buy, sell or redeem tokens only through the secondary market, and never deal with the issuer directly, are not customers. Owning the token alone does not create an account. The agencies asked whether this should be widened, so the final rule may differ.
Records are kept for five years after an account closes for identifying information, and five years after they are made for verification records. An issuer may rely on another federally regulated financial institution's identification procedures in some cases, but stays responsible for the result.
Suspicious activity reports, records and the travel rule
| Duty | Proposed rule for issuers |
|---|---|
| Suspicious activity reports | Report suspicious activity involving or aggregating at least $5,000, the bank threshold, against $2,000 for MSBs |
| Filing deadline | Within 30 days of first detecting facts that may require a report; up to a further 30 days if no suspect is identified |
| Secondary market | No duty to file reports on secondary market activity; voluntary reports keep the legal protection for filers |
| Retention | Reports and supporting documents kept for five years from filing |
| Currency transaction reports | Not required for transactions in payment stablecoins; could apply if an issuer handles physical cash |
| Recordkeeping and travel rule | The definition of transmittal order would expressly include payment stablecoins, so the $3,000 funds transfer record and travel rules apply to issuer transmittals |
The travel rule means passing the sender's and recipient's details along with a transfer, so the next institution can screen it. For a token issuer this has to work for redemptions and issuances to and from other financial institutions, which usually needs both a data standard and contractual terms with counterparties.
The sanctions compliance programme
OFAC proposes a new 31 CFR part 502 for issuers. It requires an effective sanctions compliance programme with five elements, the same ones OFAC has long used to judge firms in enforcement cases:
- senior management commitment, shown by resources, authority and reporting to the board
- a sanctions risk assessment covering customers, counterparties, geographies and the token's use on each blockchain
- internal controls, including screening of customers and of wallet addresses against OFAC's lists
- testing and audit of those controls
- training for staff
OFAC civil penalties can apply on a strict liability basis, meaning a breach can be penalised without proof that the firm knew. OFAC's enforcement guidelines take account of whether an effective programme existed, so the programme reduces both the chance of a breach and the penalty if one happens. Wilful breaches of the new part 502 may carry criminal penalties.
Block, freeze and reject: the technical duty
This is the requirement with no close parallel in bank rules. The GENIUS Act requires every issuer to have the technical capability, policies and procedures to block, freeze and reject specific or impermissible transactions, and to comply with lawful orders. A lawful order is an order from a federal agency or court to seize, freeze, burn or prevent the transfer of payment stablecoins.
The duty reaches the secondary market. In the proposal's examples, an issuer must block a transaction where a blocked person has an interest in the token, and must not let a blocked person use its smart contract to trade on the secondary market. FinCEN has not prescribed how to do this, so the issuer chooses the method. In practice that means freeze and burn functions in the token's smart contract, control over who can use them, a tested process to act on an order quickly, and records of every use.
The AML programme does not require issuers to monitor secondary market transactions. It does require them to understand the risk from their customers and their distribution channels, including each blockchain where the token is deployed. An issuer that adds a new chain should update its risk assessment first.
Who examines the programme
An issuer's AML programme will be examined by its primary regulator: the OCC, the Federal Reserve, the FDIC or the NCUA. State qualified issuers are supervised by their state, and FinCEN proposes to delegate its examination authority to the IRS for issuers not examined by a federal banking agency.
The OCC's June 2026 proposal would make issuers it supervises comply with the Bank Secrecy Act, the relevant sections of the GENIUS Act and the FinCEN and OFAC rules, and would require the OCC to consult FinCEN before significant AML enforcement action. Issuers can expect AML to sit in the same examination cycle as reserves, redemption and governance.
A build plan before 18 January 2027
| When | Task |
|---|---|
| November and December 2026 | Read the April and June proposals against the current operating model. Decide the legal entity, and for bank subsidiaries whether to extend the parent's programme |
| By December 2026 | Appoint a US-based AML officer. Draft the risk assessment, including every blockchain and distribution channel |
| December 2026 to January 2027 | Write the AML, customer identification and sanctions procedures. Specify and test freeze, burn and reject functions in the smart contract |
| January 2027 | Board approval of the programme. Agree travel rule data exchange with banks, exchanges and custodians that will distribute the token |
| Before applying | Arrange independent testing of the programme and a training record. Prepare the application narrative on financial crime controls |
| When final rules are issued | Compare the final text with the build and close gaps within the 12 months, if that effective date is adopted |
Building to the proposal is not wasted work if the final rule changes. The core elements follow long-standing bank rules and OFAC's own framework, and the points most likely to change, such as the scope of customer identification and the treatment of the secondary market, are narrow.
What this means for exchanges, custodians and wallets
Exchanges and custodians that hold or trade payment stablecoins are not issuers, and this rule does not apply to them. They have their own deadline under the GENIUS Act, set out in our guide to the GENIUS Act for exchanges and custodians, and most remain MSBs with their own AML duties. They will feel this rule indirectly: issuers will ask distribution partners for due diligence information, travel rule data and the ability to act on freeze orders.
Regulatory Counsel supports issuers and the banks and fintechs planning to issue with AML programme design, sanctions controls and ongoing compliance support, alongside the payment stablecoin issuer licence. Our cryptoassets practice covers the state and federal licences that sit around an issuance.