Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions Compliance Program Requirements

Federal RegisterApr 10, 2026

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF THE TREASURY

Office of Foreign Assets Control

31 CFR Part 502

Financial Crimes Enforcement Network

31 CFR Parts 1010 and 1033

[Docket No. FINCEN-2026-0100]

RIN 1506-AB73

Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions Compliance Program Requirements

AGENCY:

Financial Crimes Enforcement Network, Office of Foreign Assets Control, Treasury.

ACTION:

Joint proposed rule.

SUMMARY:

The Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) and Office of Foreign Assets Control (OFAC) are jointly issuing this proposed rule to implement provisions of the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act). Specifically, it implements the GENIUS Act's directive to treat permitted payment stablecoin issuers (PPSIs) as financial institutions for purposes of the Bank Secrecy Act, proposes anti-money laundering obligations for PPSIs, and proposes certain specific obligations required by the GENIUS Act for PPSIs. It also implements the GENIUS Act's directive to require PPSIs to maintain effective sanctions compliance programs.

DATES:

Comments must be received by June 9, 2026.

ADDRESSES:

Comments must be submitted in one of the following two ways (please choose only one of the ways listed):

• Electronically at

https://www.regulations.gov.

Follow the “Submit a comment” instructions under Docket FINCEN-2026-0100. If you are reading this document on

federalregister.gov

, you may use the green “SUBMIT A PUBLIC COMMENT” button beneath this rulemaking's title to submit a comment to the

regulations.gov

docket.

• You may mail written comments to the following address: Regulatory and Strategic Affairs Division, Financial Crimes Enforcement Network, P.O. Box 39, Vienna, VA 22183. Mailed comments must be received by the close of the comment period.

Do not include any personally identifiable information (such as name, address, or other contact information) or confidential business information that you do not want publicly disclosed. All comments are public records; they are publicly displayed exactly as received, and will not be deleted, modified, or redacted. Comments may be submitted anonymously. Follow the search instructions on

https://www.regulations.gov

to view public comments.

In accordance with 5 U.S.C. 553(b)(4), a summary of this rule may be found at

https://www.regulations.gov

under Docket FINCEN-2026-0100.

FOR FURTHER INFORMATION CONTACT:

FinCEN:

The FinCEN Regulatory Support Section by submitting an inquiry at

www.fincen.gov/contact.

OFAC:

Assistant Director for Regulatory Affairs, 202-622-4855 or

https://ofac.treasury.gov/contact-ofac.

SUPPLEMENTARY INFORMATION:

I. Executive Summary

Payment stablecoins could revolutionize payment systems, but the U.S. financial system's strength, size, and reliability make its payment systems a notable target for misuse by illicit actors, which jeopardizes U.S. national security. To combat illicit finance risk, this notice of proposed rulemaking (NPRM) implements the GENIUS Act's directive to subject PPSIs to anti-money laundering (AML) requirements, including Bank Secrecy Act (BSA) requirements, and to require PPSIs to maintain an effective economic sanctions compliance program.

Although issued jointly by FinCEN and OFAC, the NPRM outlines independent changes to two different chapters of Title 31 of the Code of Federal Regulations. First, FinCEN is proposing changes to its existing regulations and creation of a new part of chapter X to effectuate the GENIUS Act's directive to apply BSA and AML obligations to PPSIs. Second, OFAC is proposing a new part to chapter V to effectuate the GENIUS Act's directive that PPSIs maintain an effective economic sanctions compliance program.

II. Statutory Authority

A. The Guiding and Establishing National Innovation for U.S. Stablecoins Act

The GENIUS Act provides a comprehensive framework for the regulation of payment stablecoins.

The GENIUS Act outlines the reserve, capital, liquidity, and risk management requirements for PPSIs and tasks implementing those requirements to the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), and, as applicable, any State payment stablecoin regulators.

The OCC, Board, FDIC, and NCUA are responsible for establishing a process and framework for the licensing, regulation, examination, and supervision of PPSIs under their respective purviews.

The GENIUS Act requires that a PPSI “be treated as a financial institution for purposes of the Bank Secrecy Act, and as such, shall be subject to all Federal laws applicable to a financial institution located in the United States relating to economic sanctions, prevention of money laundering, customer identification, and due diligence.”

The GENIUS Act directs the Secretary of the Treasury to issue regulations, tailored to the size and complexity of the PPSI, implementing this provision of the GENIUS Act.

GENIUS Act, Public Law 119-27, 139 Stat. 419 (2025) (codified at 12 U.S.C. 5901-5916).

See

12 U.S.C. 5901(25), (30);

see also

12 U.S.C. 5903(a)(4)(A), 5906(d).

12 U.S.C. 5901(25) (defining “primary Federal payment stablecoin regulator” and outlining jurisdiction regarding specific types of PPSIs), 5904 (directing the primary Federal payment stablecoin regulators to “establish a process and framework for the licensing, regulation, examination, and supervision” for PPSIs under their respective jurisdictions).

12 U.S.C. 5903(a)(5)(A).

12 U.S.C. 5903(a)(5)(B). In addition to rulemaking authority codified in the “Treatment Under the Bank Secrecy Act and Sanctions Law” section, the GENIUS Act also generally calls for the Secretary of the Treasury to promulgate regulations “to carry out [the GENIUS Act] through appropriate notice and comment rulemaking.” 12 U.S.C. 5913(a). In accordance with Treasury Order 101-05 and 31 U.S.C. 321(b)(2), the authority vested in the Secretary under the GENIUS Act to issue regulations related to prevention of money laundering and countering the financing of terrorism and related to economic sanctions has been delegated to the Director of FinCEN and to the Director of OFAC, respectively.

Regarding the BSA and AML, in addition to its clear, general directive that PPSIs be treated as financial institutions for purposes of the BSA and be subject to “all Federal laws” related to preventing money laundering, the GENIUS Act specifies that a PPSI's obligations include: (i) maintenance of an effective AML program, which includes appropriate risk assessments and designation of an officer to supervise the program; (ii) retention of appropriate records; (iii) monitoring and reporting any suspicious transaction relevant to a possible violation of law or regulation; (iv) maintenance of technical capabilities, policies, and procedures to

block, freeze, and reject specific or impermissible transactions that violate Federal or State law, rules, or regulations; and (v) maintenance of an effective customer identification program,

including identifying and verifying the PPSI's account holders, high-value transactions, and appropriate enhanced due diligence.

The GENIUS Act contains other provisions that control illicit risk in the payment stablecoin ecosystem. One of these provisions is the requirement that PPSIs only issue payment stablecoins if the issuer has the technological capability to comply and will comply with the terms of any “lawful order,” which the GENIUS Act defines, in part, as an order issued or promulgated by a Federal agency or court to seize, freeze, burn, or prevent the transfer of payment stablecoins.

The GENIUS Act's customer identification program requirement is expected to be the subject of a separate rulemaking.

12 U.S.C. 5903(a)(5)(A)(i)-(v).

12 U.S.C. 5903(a)(6)(B), 5901(16) (defining “lawful order”).

Regarding sanctions, the GENIUS Act expressly subjects PPSIs to “all Federal laws applicable to a financial institution located in the United States relating to economic sanctions”

and requires PPSIs to maintain “an effective economic sanctions compliance program, including verification of sanctions lists, consistent with Federal law.”

12 U.S.C. 5903(a)(5)(A).

12 U.S.C. 5903(a)(5)(A)(vi).

This NPRM represents one piece of the comprehensive regulatory framework for PPSIs set out in the GENIUS Act.

On September 19, 2025, the Department of the Treasury issued an advance notice of proposed rulemaking concerning the GENIUS Act.

See

Treasury,

GENIUS Act Implementation,

90 FR 45159 (Sept. 19, 2025);

see also

FDIC,

Approval Requirements for Issuance of Payment Stablecoins by Subsidiaries of FDIC-Supervised Insured Depository Institutions,

90 FR 59409 (Dec. 19, 2025); NCUA,

Investments in and Licensing of Permitted Payment Stablecoins Issuers,

91 FR 6531 (Feb. 12, 2026); OCC,

Implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the Office of the Comptroller of the Currency,

91 FR 10202 (Mar. 2, 2026); Treasury,

GENIUS Act Broad-Based Principles for Determining Whether a State-Level Regulatory Regime Is Substantially Similar to the Federal Regulatory Framework,

91 FR 16844 (Apr. 3, 2026).

B. The Bank Secrecy Act

The Bank Secrecy Act, or “BSA,” is the common name for a collection of statutory authorities designed to safeguard the national security of the United States by combating money laundering, the financing of terrorism, and other illicit finance activity.

Under the BSA, Congress authorized the Secretary to impose various obligations on financial institutions, including requiring risk-based programs to prevent money laundering and the financing of terrorism. The BSA also enables the Secretary to require financial institutions to file reports and keep records that “are highly useful” including “in criminal, tax, or regulatory investigations, risk assessments, or proceedings,” or in the conduct of “intelligence or counterintelligence activities, including analysis, to protect against terrorism.”

In order to enable both the public and private sectors to identify and stop illicit actors, the BSA also directed the establishment of appropriate frameworks for information sharing among various actors, including financial institutions and law enforcement authorities.

The Secretary has delegated the authority to implement, administer, and enforce the BSA and its associated regulations to the Director of FinCEN.

See

31 U.S.C. 5311. Certain parts of the Currency and Foreign Transactions Reporting Act, its amendments, and the other statutes relating to the subject matter of that Act, have come to be referred to as the BSA. These statutes are codified at 12 U.S.C. 1829b, 12 U.S.C. 1951-1960, and 31 U.S.C. 5311-5314 and 5316-5336 and notes thereto, with implementing regulations at 31 CFR chapter X. Consistent with that understood meaning, as codified, the GENIUS Act defines the “Bank Secrecy Act” to mean “(A) section 1829b of [title 12]; (B) chapter 2 of title I of Public Law 91-508 (12 U.S.C. 1951

et seq.

); and (C) subchapter II of chapter 53 of title 31.” 12 U.S.C. 5901(2).

See

31 U.S.C. 5311(1);

see also

5313, 5318(g).

See

31 U.S.C. 5311(5), 5311 note (“Cooperation Among Financial Institutions, Regulatory Authorities, and Law Enforcement Authorities”);

see also

31 U.S.C. 310.

See

Treasury Order 180-01 (Jan. 14, 2020), para. 3, available at

https://home.treasury.gov/about/general-information/orders-and-directives/treasury-order-180-01; see also

31 U.S.C. 310(b)(2)(I) (providing that the Director of FinCEN shall “[a]dminister the requirements of subchapter II of chapter 53 of this title, chapter 2 of title I of Public Law 91-508, and section 21 of the Federal Deposit Insurance Act, to the extent delegated such authority by the Secretary”).

Many of the obligations included in the BSA are explicitly included in the GENIUS Act as obligations imposed on PPSIs. For example, in both the BSA and the GENIUS Act, Congress authorized Treasury to impose obligations to maintain effective AML programs;

retain records;

monitor and report suspicious activity;

maintain customer identification programs;

and conduct enhanced due diligence.

See

31 U.S.C. 5318(h); 12 U.S.C. 5903(a)(5)(A)(i).

See, e.g.,

31 U.S.C. 5318(a)(2); 12 U.S.C. 1826b; 12 U.S.C. 1953; 12 U.S.C. 5903(a)(5)(A)(ii).

See

31 U.S.C. 5318(g); 12 U.S.C. 5903(a)(5)(A)(iii).

See

31 U.S.C. 5318(

); 12 U.S.C. 5903(a)(5)(A)(v).

See

31 U.S.C. 5318(i); 12 U.S.C. 5903(a)(5)(A)(v).

C. Office of Foreign Assets Control Statutory Authority

OFAC acts under Presidential national emergency powers, as well as various statutory authorities, and has been delegated responsibility by the Treasury Secretary for developing, administering, and enforcing U.S. economic sanctions. The International Emergency Economic Powers Act (IEEPA), enacted in 1977, is a key authority for imposing economic sanctions.

IEEPA authorizes the President to declare a national emergency in response to an unusual or extraordinary threat to the United States that has its source in whole or substantial part outside the United States.

Upon declaration of a national emergency, IEEPA authorizes the President to, among other actions, investigate, block, regulate, or prohibit transactions and dealings in property subject to U.S. jurisdiction when a foreign national or country has an interest.

IEEPA also provides the President with the authority to issue regulations as may be necessary to exercise the authorities granted in IEEPA.

The President typically delegates the authority to administer economic sanctions pursuant to IEEPA to the Secretary, who redelegates the implementation authority to OFAC.

See

50 U.S.C. 1701

et seq.

See

50 U.S.C. 1701.

See

50 U.S.C. 1702.

See

50 U.S.C. 1704.

See, e.g.,

31 CFR 525.106, 548.802, 591.802.

Through the exercise of its delegated IEEPA authority and other authorities, OFAC administers and enforces economic sanctions to prohibit certain transactions and to block assets under U.S. jurisdiction, including by issuing civil money penalties. OFAC sanctions include sanctions that block the property or interests in property of, or prohibit certain transactions or dealings with, sanctioned individuals and entities, including foreign governments and officials, terrorists, international narcotics traffickers, and those engaged or who have engaged in activities such as serious human rights abuse, corruption, the proliferation of weapons of mass destruction, transnational organized crime, sanctions evasion, or the provision of material support to sanctioned individuals and entities. OFAC also administers comprehensive sanctions that broadly prohibit

transactions and dealings involving an entire country or geographic region or a particular sector of a country's economy.

III. Advance Notice of Proposed Rulemaking

Treasury issued an advance notice of proposed rulemaking (ANPRM) in September 2025 seeking public comment on potential Treasury regulations implementing the GENIUS Act.

Pertinent to this proposal, the ANPRM asked questions related to definitions used in the GENIUS Act; the GENIUS Act's BSA, AML, and sanctions program provisions; and the potential costs and benefits associated with BSA and sanctions obligations.

GENIUS Act Implementation,

90 FR 45159. The ANPRM solicited comment on a range of potential Treasury efforts related to the GENIUS Act and payment stablecoins that are outside the purview of this rulemaking. For example, the ANPRM included questions related to the GENIUS Act prohibition on digital asset service providers offering and selling a payment stablecoin to any person in the United States unless the payment stablecoin is issued by a PPSI or a foreign payment stablecoin issuer that meets certain requirements.

Id.

at 45160-61. It also included questions related to Treasury's role in determining whether a state-level regulatory regime is substantially similar to the Federal framework and whether a foreign country's regulatory and supervisory regime is comparable to the U.S. framework.

Id.

at 45162-63.

Id.

at 45161-63.

In response to this ANPRM, Treasury received approximately 450 timely comments from a variety of stakeholders, including banks and credit unions, stablecoin issuers, digital asset exchanges, analytics companies, law firms, trade associations, non-governmental organizations, technology firms, academics, and members of the public. Treasury reviewed and considered the pertinent comments in crafting this proposal.

In general, commenters supported applying BSA and sanctions program obligations to PPSIs. For BSA obligations, some commenters advocated these requirements mirror existing obligations and risk-based frameworks. Some commenters generally asserted that different obligations should apply with regards to transactions on the primary market versus transactions on the secondary market.

On costs and benefits, some commenters acknowledged meaningful upfront costs associated with complying with the BSA, sanctions program obligations, and the GENIUS Act, particularly for new or unregulated entrants, but also stated that clearer rules would lower long-term compliance friction, reduce illicit finance risks, improve supervisory efficiency, and ultimately strengthen market confidence and U.S. competitiveness.

See infra

section IV.C discussing the meaning of primary and secondary market for purposes of this rulemaking.

IV. Stablecoin Ecosystem

The GENIUS Act only governs a subcategory of stablecoins, namely “payment stablecoins” as defined by the GENIUS Act, and a subcategory of actors in the payment stablecoin ecosystem, most critically for this rulemaking, PPSIs.

Thus, under the GENIUS Act, not all stablecoins are payment stablecoins and not all stablecoin issuers will be eligible to be PPSIs. Because the GENIUS Act framework is not yet in place, it is not yet determined which specific stablecoins will be payment stablecoins and which specific issuers will be PPSIs. An understanding of the stablecoin ecosystem, uses of stablecoins, and risks associated with stablecoins generally informs the parameters of the proposed rule, including the rationale behind certain proposed obligations.

See, e.g.,

12 U.S.C. 5902, 5903.

A. Overview of Stablecoins and Stablecoin Issuers

Stablecoins are a blockchain-based

digital asset

designed to maintain a stable value relative to an underlying asset, most often, but not always, a fiat currency.

Many stablecoin issuers represent that their stablecoin can be redeemed at par upon request, although redemption terms and rights vary by stablecoin. The asserted redemption value of a stablecoin is generally tied to the value of the pool of reserve assets that “backs” the stablecoin.

A blockchain is “any technology where data is: (i) shared across a network to create a public ledger of verified transactions or information among network participants; (ii) linked using cryptography to maintain the integrity of the public ledger and to execute other functions; (iii) distributed among network participants in an automated fashion to concurrently update network participants on the state of the public ledger and any other functions; and (iv) composed of source code that is publicly available.”

See

Executive Order (E.O.) 14178,

Strengthening American Leadership in Digital Financial Technology,

90 FR 8647, sec. 2(b) (Jan. 31, 2025).

For this proposed rule, a “digital asset” is “any digital representation of value that is recorded on a cryptographically secured distributed ledger.”

See

12 U.S.C. 5901(6).

White House,

Strengthening American Leadership in Digital Financial Technology,

p. 88 (July 2025) [hereinafter

E.O. 14178 Report

], available at

https://www.whitehouse.gov/wp-content/uploads/2025/07/Digital-Assets-Report-EO14178.pdf.

This report was issued by the President's Working Group on Digital Asset Markets, of which the Secretary is a member, pursuant to E.O. 14178.

See id.

at p. 90. As discussed in the

E.O. 14178 Report,

as of July 2025, more than 99 percent of the outstanding value of stablecoins in circulation is pegged to the U.S. dollar.

Id.

Other types of assets that may back different forms of stablecoins include digital assets, precious metals, or corporate bonds with lower credit ratings.

See id.

Most stablecoins backed by financial assets, including fiat currency, have centralized control, meaning that one company, or a group of companies, are responsible for governance functions, including defining and ensuring compliance with standards related to the issuance, purchase, redemption, custody, and transfer of the stablecoin. Generally, a stablecoin issuer will issue a stablecoin when a user provides the issuer funds denominated in the fiat currency of the stablecoin's peg. Similarly, a stablecoin is redeemed when a user exchanges stablecoins with the stablecoin issuer for funds valued at the corresponding amount of fiat currency.

Currently, many stablecoin issuers generally interact directly with a small number of larger companies, which are often institutional participants in the trading of digital assets (

i.e.,

digital asset exchanges).

Those companies, in turn, interact with a larger and more diverse group of users. Many stablecoin issuers predominantly offer issue and redemption services to financial institutions, including digital asset exchanges that may be regulated under the BSA as money services businesses (MSBs).

Generally, once an issuer issues stablecoins to such financial institutions, those institutions put the stablecoins into broader circulation to other users, such as individual, retail users. Similarly, individual users generally do not redeem stablecoins through a stablecoin issuer but rather interact with a digital asset exchange or platform.

However, in the future, issuers could more commonly interact directly with retail users, including issuing and redeeming payment stablecoins.

See

Watsky, Cy,

et al., Primary and Secondary Markets for Stablecoins,

FEDS Notes, Washington: Board of Governors of the Federal Reserve System (Feb. 23, 2024), available at

https://doi.org/10.17016/2380-7172.3447.

See id.; see also E.O. 14178 Report,

supra

note 32, pp. 104-05.

See, e.g., E.O. 14178 Report,

supra

note 32, p. 18.

Most stablecoin issuers use smart contracts

to issue stablecoins, enable

or prohibit subsequent transactions in the stablecoin, and redeem stablecoins. The smart contracts underlying most stablecoins maintain a ledger of the number of stablecoins “owned by a set of accounts where each account is owned by a blockchain address” or wallet.

Smart contracts generally allow for programmability that can enable a stablecoin issuer to maintain control over and alter the use of its stablecoin.

A smart contract is a “collection of code and data . . . that is deployed using cryptographically signed transactions” on a blockchain network, which is executed by nodes on a blockchain to perform any given set of pre-determined functions or conditions that are recorded on a blockchain.

See

National Institute of Standards and Technology (NIST), NISTIR 8202,

Blockchain Technology Overview,

p. 32 (Oct. 2018), available at

https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf

(“A smart contract can perform calculations, store information, expose properties to reflect a publicly exposed state and, if appropriate, automatically send funds to other accounts.”).

NIST, NISTIR 8408,

Understanding Stablecoin Technology and Security Considerations,

p. 6 (Sept. 2023), available at

https://nvlpubs.nist.gov/nistpubs/ir/2023/NIST.IR.8408.pdf.

The lynchpin of a blockchain is asymmetric (public key) cryptography, which is used to secure and send transactions on a blockchain.

See Blockchain Technology Overview, supra

note 37, p. 11. First, a user generates a private key (a string of characters that function like a password) and uses that private key to generate a public key (an account number on a blockchain known as an address). Without the private key associated with an address or public key, a user cannot access the digital assets contained within. Developers have created software or hardware wallets to enable users to manage their public and private keys.

See E.O. 14178 Report, supra

note 32, pp. 9-10.

In the current environment, control capabilities vary depending on how the stablecoin issuer designed the stablecoin, including the associated smart contract and the blockchain on which the smart contracts are deployed. For example, a stablecoin issuer may be able to prohibit specific wallet addresses from interacting with the stablecoin and its smart contract. Applying such controls to a particular wallet address would effectively prevent the holder of a stablecoin from transferring, redeeming, or otherwise moving the stablecoin. Additionally, some stablecoin issuers can send stablecoins in circulation to an unrecoverable wallet address, commonly referred to as “burning,” effectively removing the stablecoins from a given wallet and from circulation in general.

In some cases, including when required by a lawful order, stablecoin issuers reissue stablecoins equivalent to burned or frozen funds to different wallets as part of efforts to recover and return funds to victims of criminal activity.

Understanding Stablecoin Technology and Security Considerations, supra

note 38, p. 8.

B. Stablecoin Use Cases

Currently, most stablecoin users primarily rely on stablecoins to store value, facilitate trades in other digital assets, or to interact with smart contracts. Payment stablecoins could, however, become a more widely adopted form of payment.

U.S. consumers and businesses process trillions of dollars of payments daily.

Although innovations like real-time payment networks

decrease settlement times, particularly for domestic transfers, cross-border payments through traditional payment mechanisms remain more costly and slower.

Innovation in cross-border payments could support economic growth, including by facilitating international trade. Payment stablecoins may be able to mitigate some of the challenges individuals and small businesses face in navigating cross-border payments by increasing speed, decreasing cost, and enabling transactions with fewer intermediaries.

See E.O. 14178 Report, supra

note 32, p. 91.

Id.

at p. 88.

See id.

at p. 89;

see, e.g.,

Fed. Reserve, About the FedNow Service (n.d.), available at

https://www.frbservices.org/financial-services/fednow/about.html.

See E.O. 14178 Report, supra

note 32, p. 88.

See id.

at pp. 90-91.

C. Payment Stablecoin Activity

Due to the use of smart contracts underlying stablecoin transactions and how users interact with stablecoin issuers, the ecosystem can, broadly speaking, be divided into two components, the primary market and the secondary market. For the purposes of this rulemaking, FinCEN and OFAC use these terms to help describe categories of payment stablecoin activity and articulate the parameters of particular obligations.

FinCEN and OFAC will use the term “primary market” to generally describe a PPSI interacting directly with a user or holder of a payment stablecoin, such as when a PPSI engages in issuing, converting, redeeming, repurchasing, burning, and reissuing payment stablecoins, as well as providing associated services, such as providing custodial services.

Generally speaking, primary market activity will involve activity where a PPSI and a user have a relationship or direct interaction beyond the involvement of a PPSI's smart contract (

e.g.,

the PPSI's maintenance of an account through which the transactions of such user or customer may be effectuated).

If consistent with the law and authorized by a primary Federal payment stablecoin regulator or the State payment stablecoin regulator, as applicable, PPSIs can also engage in activities as a “digital asset service provider,” as defined by the GENIUS Act, and activities incidental thereto. Such activities include exchanging and transferring digital assets.

See

12 U.S.C. 5903(a)(7)(B), 5901(7). Such activity would also constitute primary market activity.

FinCEN and OFAC will use the term “secondary market” to describe payment stablecoin activity that does not directly involve the PPSI as a party to the transaction other than via a smart contract. For example, secondary market activity could include an individual purchasing payment stablecoins from an intermediary, an individual sending payment stablecoins from a self-hosted wallet to a vendor to purchase goods, an individual exchanging payment stablecoins for another digital asset via a digital asset exchange, or person-to-person transactions in payment stablecoins.

D. Illicit Finance Risks Associated With Stablecoins

The liquidity and stability of stablecoins relative to other digital assets and rapid settlement of stablecoins make them appealing to illicit actors as well as legitimate users.

As a result, in general, illicit actors have increasingly used stablecoins to facilitate transactions and store proceeds.

The illicit finance risks discussed below related to stablecoins are likely to generally also apply to payment stablecoins, particularly because the most prolific stablecoins carry indicators they could be payment stablecoins.

See

Treasury,

2026 National Money Laundering Risk Assessment,

p. 50 (Mar. 2026) [hereinafter

2026 NMLRA

], available at

https://home.treasury.gov/system/files/246/2026-NMLRA.pdf; E.O. 14178 Report,

supra

note 32, p. 94.

See 2026 NMLRA, supra

note 46, p. 50.

The U.S. government has linked stablecoins to a range of illicit activities and bad actors, including scammers and fraudsters;

Democratic People's Republic of Korea (DPRK) information technology (IT) workers, cybercriminal groups and related money laundering networks;

drug traffickers;

terrorist

groups;

and sanctions evasion and money laundering networks;

among others. Between January 1, 2015, and November 21, 2025, FinCEN received approximately 55,000 suspicious activity reports (SARs) that referenced one or more specific stablecoins in the narrative, as well as an additional approximately 8,400 reports that included a general reference to the term “stablecoin.” Also, between January 1, 2015, and November 21, 2025, OFAC received approximately 5,800 reports on blocked property and 3,000 reports on rejected transactions that referenced one or more specific stablecoins in the narrative, as well as approximately six reports that included a general reference to the term “stablecoin”. Furthermore, the Financial Action Task Force noted in 2025 that “[e]stimates suggest that a majority of all on-chain illicit activity is now transacted in stablecoins,” aligning with the trend of overall growth in stablecoin adoption.

See, e.g.,

Compl.,

United States

Approximately 225,364,961 USDT,

No. 25-cv-1907 (D.D.C. June 18, 2025) (civil forfeiture action against more than $225.3 million in stablecoins allegedly involved in concealing proceeds of digital assets investment fraud);

United States

Su,

No. 25-cr-362 (C.D. Cal. Jan. 27, 2026) (defendant sentenced to 46 months in prison for role in digital investment scam involving $36.9 million where victim funds were converted to stablecoins).

See, e.g.,

Indictment,

United States

Sop,

No. 23-cr-128 (D.D.C. Mar. 18, 2023) (indictment alleging defendant laundered proceeds of DPRK IT workers in violation of sanctions, including through use of stablecoins); DOJ, Press Release,

Department Files Civil Forfeiture Complaint Against Over $7.74M Laundered on Behalf of the North Korean Government

(June 5, 2025), available at

https://www.justice.gov/opa/pr/department-files-civil-forfeiture-complaint-against-over-774m-laundered-behalf-north-korean; United States of America

Approximately 1,159,834.52 USDT,

No. 25-cv-3771 (D.D.C. Oct. 24, 2025) (civil forfeiture complaint of stablecoins related to virtual currency heists perpetrated by DPRK hacking groups).

See, e.g., United States

Zhang et al.,

No. 22-cr-10279 (Aug. 15, 2025) (defendants sentenced to prison in connection with drug trafficking scheme

involving conversion of proceeds to stablecoins);

see also

DOJ, Press Release,

Cyber Scam Organization Disrupted Through Seizure of Nearly $9M in Crypto

(Nov. 21, 2023), available at

https://www.justice.gov/usao-ndca/pr/cyber-scam-organization-disrupted-through-seizure-nearly-9m-crypto.

See, e.g.,

Judgment,

United States

Li,

2:23-cr-596 (C.D. Cal. Feb. 10, 2026) (defendant sentenced to 240 months);

see also

DOJ, Press Release,

Man Sentenced to 20 Years in Prison for role in $73 Million Global Cryptocurrency Investment Scam

(Feb. 9, 2026), available at

https://www.justice.gov/archives/opa/pr/foreign-national-pleads-guilty-laundering-millions-proceeds-cryptocurrency-investment-scams. See

Plea,

United States

He,

2:25-cr-175 (C.D. Cal. Apr 7, 2025);

see also

DOJ, Press Release,

California Man Sentenced for Role in Global Digital Asset Investment Scam Conspiracy Resulting in Theft of More than $36.9M from Victims

(Sept. 8, 2025), available at

https://www.justice.gov/opa/pr/california-man-sentenced-role-global-digital-asset-investment-scam-conspiracy-resulting.

ii. Terrorist Financing and Weapons Proliferation

Certain terrorist groups, such as the Islamic State of Iraq and Syria-Khorasan (ISIS-K) and Hamas, use various types of digital assets, including stablecoins.

In some instances, terrorist organizations generate revenue in digital assets, including stablecoins, through online donation drives.

One long-running online ISIS-K fundraiser, for example, collected $2 million in stablecoins in 2022.

Terrorist groups

soliciting donations of digital assets turn to stablecoins to avoid the volatility and price fluctuations that impact other digital assets and to facilitate more seamless conversion to fiat currency.

Treasury,

2026 National Terrorist Financing Risk Assessment,

p. 19 (Mar. 2026) [hereinafter

2026 NTFRA

], available at

https://home.treasury.gov/system/files/246/2026-NTFRA.pdf.

See, e.g., Justice Department Disrupts Hamas Terrorist Financing Scheme Through Seizure of Cryptocurrency, supra

note 51.

United Nations Security Council Counter Terrorism Committee Executive Directorate,

Evolving Trends in the Financing of Foreign Terrorist Fighters' Activity, 2014-2024,

p. 11 (Nov. 2024), available at

https://www.un.org/securitycouncil/ctc/sites/www.un.org.securitycouncil.ctc/files/cted_trends_tracker_evolving_trends_in_the_financing_of_foreign_terrorist_fighters_activity_2014_-_2024.

2026 NTFRA, supra

note 65, p. 26.

Terrorist organizations have also utilized stablecoins as a means of transferring funds. For example, DOJ unsealed a civil forfeiture action in July 2025 against approximately $2 million worth of digital assets connected with a Gaza-based money transfer business that was involved in financially supporting Hamas. The complaint describes a detailed scheme whereby users utilized the money transfer business to fund accounts at a digital asset exchange and to fund wallet addresses containing stablecoins to obfuscate their financial support of international terrorist organizations, including Hamas.

See Justice Department Disrupts Hamas Terrorist Financing Scheme Through Seizure of Cryptocurrency, supra

note 51.

Iran has increasingly turned to digital assets to conduct illicit financial activity, obtain drone components and other high-tech equipment, accept payments for weapons, and transfer funds to sanctioned actors in the region. Iranian illicit actors often prefer stablecoins over other digital assets for these transactions due to stablecoins' superior ability to finance international trade.

FATF,

Targeted Report on Stablecoins and Unhosted Wallets: Peer-to-Peer Transactions,

¶ 36 (Mar. 2025), available at

https://www.fatf-gafi.org/content/dam/fatf-gafi/publications/targeted-report-on-stablecoins-and-unhosted-wallets.pdf.coredownload.inline.pdf.

iii. Narcotics Production and Trafficking

Transnational criminal organizations (TCOs) also use stablecoins to procure components for the manufacturing of illegal drugs and to launder the proceeds of illegal drug sales. For example, Mexico-based drug cartels are increasingly purchasing fentanyl precursor chemicals and manufacturing equipment from People's Republic of China-based suppliers using digital assets, including stablecoins.

Additionally, prosecutors have charged that, in some cases, TCOs use money brokers to pick up bulk cash derived from drug sales in the United States; exchange the cash for digital assets, including stablecoins; and send the digital assets to wallets controlled by brokers or co-conspirators.

According to DOJ, in some instances, the digital assets are then converted into cash and delivered to cartel leaders in Mexico and Colombia.

In November 2024 for instance, DOJ filed a civil forfeiture complaint against more than $5.5 million in stablecoins allegedly involved in a money laundering operation related to drug trafficking.

FinCEN,

Supplemental Advisory on the Procurement of Precursor Chemicals and Manufacturing Equipment Used for the Synthesis of Illicit Fentanyl and Other Synthetic Opioids,

p. 9 (June 20, 2024), available at

https://www.fincen.gov/system/files/advisory/2024-06-20/FinCEN-Supplemental-Advisory-on-Fentanyl-508C.pdf.

See, e.g.,

Superseding Indictment,

United States

Duarte et al.,

No. 24-cr-20367 (S.D. Fla. Nov. 19, 2024).

Id.

Compl.

United States

Approximately 114,366.044785 Tether (USDT) Cryptocurrency from Binance Account User ID Ending in 7382,

No. 24-cv-01503, (E.D. Wisc. Nov. 20, 2024);

see also

Decision and Order,

United States

Approximately 114,366.044785 Tether (USDT) Cryptocurrency from Binance Account User ID Ending in 7382,

No. 24-cv-01503, (E.D. Wisc. Feb. 6, 2026) (default judgment ordering assets to be forfeited).

3. Sanctions Evasion

Sanctions evasion and money laundering networks have leveraged stablecoins to move funds on behalf of numerous sanctioned actors, including Russian elites, sanctioned digital asset exchanges, the DPRK government, Iranian actors, foreign terrorist organizations, and global terrorists. For example, in December 2024, OFAC designated as Specially Designated Nationals (SDNs) five individuals and four entities that are associated with or leverage the TGR Group, a sprawling international network of businesses and employees that works to obfuscate the illicit activities of its clients, which include sanctioned Russian elites, including by facilitating exchanges of bulk cash for stablecoins.

Treasury, Press Release,

Treasury Exposes Money Laundering Network Using Digital Assets to Evade Sanctions

(Dec. 4, 2024), available at

https://home.treasury.gov/news/press-releases/jy2735.

Additionally, in August 2025, OFAC redesignated as an SDN Garantex Europe OU (Garantex), a virtual currency exchange that directly facilitated notorious ransomware actors and other cybercriminals by processing over $100 million in transactions linked to illicit activities since 2019.

Garantex was originally designated as an SDN in April 2022.

According to an indictment against two Garantex operators, Garantex, beginning in and around early 2023, maintained at least some of its operational accounts in stablecoins.

The operators allegedly moved the exchange's operational wallets storing stablecoins to a new digital asset wallet on a daily basis to evade detection by blockchain analytics services.

Treasury, Press Release,

Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion and Cyber Criminals

(Aug. 14, 2025), available at

https://home.treasury.gov/news/press-releases/sb0225.

Treasury, Press Release,

Treasury Sanctions Russia-Based Hydra, World's Largest Darknet Market, and Ransomware-Enabling Virtual Currency Exchange Garantex

(Apr. 05, 2022), available at

https://home.treasury.gov/news/press-releases/jy0701.

Indictment ¶ 29,

United States

Besciokov and Mira Serda,

No. 25-cr-39, (E.D. Va. Feb. 27, 2025),

https://www.justice.gov/opa/media/1392316/dl.

Id.

The U.S. government has pursued cases involving DPRK IT workers and co-conspirators involved in money laundering alleged to have leveraged stablecoins as part of schemes to evade sanctions and generate revenue for the DPRK regime, in part because they found stablecoins susceptible to laundering. For example, in June 2025, a forfeiture complaint alleged that the DPRK government generated digital assets, in part, through remote work done by DPRK IT workers deployed around the globe.

The complaint also alleges that DPRK IT workers requested to be paid in stablecoins because they (and their alleged money laundering co-conspirators) retain a consistent value and can more easily trade stablecoins for fiat currency.

Compl. ¶¶ 48-49,

United States

Virtual Currency Associated with North Korean IT Worker Money Laundering and Sanctions Evasion Conspiracies,

No. 25-cv-1769, (D.D.C. June 5, 2025).

Id.

at ¶¶ 50, 59.

The U.S. government has identified the use of stablecoin connected to Iranian actors' provision of material support to the Iranian Revolutionary Guard Corps (IRGC). For example, in September 2025, DOJ filed a civil forfeiture action to recover approximately $584,741 in stablecoins alleged to be the property of Mohammad Abedininajafabadi or of his company,

who was charged with conspiring to export sophisticated electronic components from the United States to Iran in violation of U.S. export control and sanctions laws.

Additionally, in sanctions actions targeting Iran's IRGC-Quds Force-backed Ansarallah (Houthi) operatives, OFAC has identified digital asset wallet addresses that have been used by the Houthis to transfer funds

associated with their activities. Many of the identified wallet addresses have been used to transact stablecoins.

Furthermore, on January 30, 2026, OFAC designated as SDNs two UK-based exchanges with connections to notorious Iranian financier Babak Zanjani.

These exchanges processed approximately $1 billion in funds linked to the IRGC. One of the designated exchanges, Zedxion Exchange, Ltd., issued a stablecoin.

DOJ, Press Release,

United States Seeks Civil Forfeiture of Cryptocurrency Associated with Iranian National Mohammad Abedini

(Sept. 11, 2025), available at

https://www.justice.gov/usao-ma/pr/united-states-seeks-civil-forfeiture-cryptocurrency-associated-iranian-national-mohammad.

Compl.,

United States

Sadeghi and Abedininajafabadi,

No. 24-cr-10391 (D. Mass. Dec. 13, 2024).

See, e.g.,

Treasury, Press Release,

Treasury Sanctions Houthi Network Procuring Weapons and Commodities from Russia

(Apr. 2, 2025), available at

https://home.treasury.gov/news/press-releases/sb0068;

Treasury,

Counter Terrorism Designations and Designation Update; Russia-related Designation Removal; Reports for Licensing Activities Undertaken Pursuant to the Trade Sanctions Reform and Export Enhancement Act (TSRA)

(Apr. 2, 2024), available at

https://ofac.treasury.gov/recent-actions/20250402.

Treasury, Press Release,

Treasury Sanctions Iranian Regime Officials for Violent Repression and Corruption

(Jan. 30, 2026), available at

https://home.treasury.gov/news/press-releases/sb0375.

See

TRM Labs,

How Two UK-registered Companies Moved Over a Billion in Stablecoins for the IRGC

(Jan. 9, 2026), available at

https://www.trmlabs.com/resources/blog/how-two-uk-registered-companies-moved-over-a-billion-in-stablecoins-for-the-irgc.

V. Existing Regulatory Framework for Stablecoin Issuers

A. Existing Bank Secrecy Act Obligations

Currently, stablecoin issuers generally are subject to BSA obligations as financial institutions, specifically money transmitters, which are a type of MSB. The BSA statutory definition of “financial institution” includes a “person who engages as a business in the transmission of currency, funds, or value that substitutes for currency.”

FinCEN's regulations define “money services business,” one category of which is a “money transmitter” that “provides money transmission services.”

“Money transmission services” is in turn defined as “the acceptance of currency, funds, or other value that substitutes for currency from one person

and

the transmission of currency, funds or other value that substitutes for currency to another location or person by any means.”

“Value that substitutes for currency” includes “virtual” currencies (also called convertible virtual currencies or “CVCs”), such as stablecoins, that either have an equivalent value in real currency or act as a substitute for real currency.

FinCEN has further clarified that, unless a limitation or exception applies, persons engaged in issuing and redeeming a virtual currency (

i.e.,

“administrators”) are money transmitters and thus subject to BSA obligations as MSBs.

Stablecoin issuers are, thus, money transmitters because they, for example, issue and redeem virtual currencies and accept and transmit value that substitutes for currency when issuing and converting, redeeming, or repurchasing stablecoins.

31 U.S.C. 5312(a)(2)(J), 5312(a)(2)(R) (defining, in part, a “financial institution” a “business engaged in the exchange of currency, funds, or value that substitutes for currency or funds,” or “a licensed sender of money or any other person who engages as a business in the transmission of currency, funds, or value that substitutes for currency”). As part of the AML Act, Congress amended 31 U.S.C. 5312 to add this “value that substitutes for currency” language.

See

Public Law 116-283, sec. 6102(d), 134 Stat. 4547 (2021). In the AML Act, Congress also reaffirmed FinCEN's existing regulatory framework applying MSB obligations to persons engaged in certain activities related to “value that substitutes for currency,” including the issuing and redeeming of virtual currencies.

See

FinCEN,

Bank Secrecy Act Regulations; Definitions and Other Regulations Relating to Money Services Businesses,

76 FR 43585, 43586 (July 21, 2011);

see also

FinCEN Guidance, FIN-2013-G001,

Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies

(Mar. 18, 2013) [hereinafter 2013 CVC Guidance], available at

https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-persons-administering;

FinCEN, FIN-2019-G001,

Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies

(May 9, 2019) [hereinafter 2019 CVC Guidance], available at

https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-certain-business-models.

31 CFR 1010.100(ff)(5).

31 CFR 1010.100(ff)(5)(i)(A) (emphasis in original).

2013 CVC Guidance,

supra

note 87, p 3.

See id.

at p. 2 (concluding administrators are generally MSBs and stating that “An administrator is a person engaged as a business in issuing (putting into circulation) a virtual currency, and who has the authority to redeem (to withdraw from circulation) such virtual currency”);

see also

2019 CVC Guidance,

supra

note 87, p. 13.

As MSBs, stablecoin issuers are currently subject to a range of BSA obligations. MSBs are required to, for instance: (i) establish written AML programs;

(ii) file currency transaction reports (CTRs)

and SARs;

and (iii) maintain certain records, including those relating to certain transmittals of funds.

MSBs are subject to examination for BSA compliance by the Internal Revenue Service (IRS) under a delegation of authority by FinCEN.

See

31 CFR 1022.210.

See

31 CFR 1022.310.

See

31 CFR 1022.320.

See

31 CFR 1022.400, 1010.410(e)-(f).

See

31 CFR 1010.810(b)(8).

As required by the GENIUS Act, FinCEN is proposing certain obligations that differ in some material respects from current obligations that stablecoin issuers are subject to as MSBs, as well as some PPSI-specific obligations required by the GENIUS Act. However, in many respects, FinCEN expects that the proposed requirements for PPSIs would be comparable to stablecoin issuers' existing requirements as MSBs.

B. Existing Sanctions Obligations

The GENIUS Act provides that PPSIs are persons

formed in the United States

and that PPSIs shall be subject to “all Federal laws applicable to a financial institution located in the United States relating to economic sanctions.”

Because the GENIUS Act requires PPSIs to be formed in the United States, PPSIs will be “U.S. persons” under existing OFAC regulations

100

once the Act takes effect.

101

Therefore, stablecoin issuers qualifying as PPSIs will be subject to the same U.S. sanctions obligations that currently apply to all other U.S. persons, including those that are stablecoin issuers.

12 U.S.C. 5901(24) (defining a “person” as “an individual, partnership, company, corporation, association, trust, estate, cooperative organization, or other business entity, incorporated or unincorporated”).

12 U.S.C. 5901(23) (defining a “permitted payment stablecoin issuer” as “a person formed in the United States that is—(A) a subsidiary of an insured depository institution that has been approved to issue payment stablecoins under 12 U.S.C. 5904; (B) a Federal qualified payment stablecoin issuer; or (C) a State qualified payment stablecoin issuer”).

See

12 U.S.C. 5903(a)(5)(A).

100

See, e.g.,

31 CFR 510.326, 555.313, 583.314.

101

See

12 U.S.C. 5901(23).

As discussed in section II.C, U.S. sanctions require U.S. persons, including U.S. person stablecoin issuers, to block the property and interests in property of blocked persons that are in their possession or control and report them to OFAC. This blocking prohibition requires U.S. persons, including those that are stablecoin issuers, to ensure that property and interests in property of such blocked persons, including stablecoins, that are in their possession or control are not transferred, withdrawn, or otherwise dealt in, unless authorized by OFAC or exempt. More broadly, U.S. persons, including those that are stablecoin issuers, are also generally prohibited from engaging in most transactions with blocked persons, including making any contribution or provision of funds, goods, or services to or for the benefit of blocked persons or receiving any contribution or funds, goods, or services from blocked persons, unless authorized by OFAC or exempt. Blocked persons subject to these restrictions include individuals and entities listed on OFAC's Specially Designated Nationals and Blocked Persons List (“SDN

List”).

102

In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked and subject to the above restrictions, even if they are not specifically named on OFAC's SDN List.

103

102

See

OFAC,

Specially Designated Nationals List,

available at

https://sanctionslist.ofac.treas.gov/Home/SdnList.

103

See

OFAC,

Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked

(Aug. 13, 2014), available at

https://ofac.treasury.gov/media/6186/download?inline.

There are a variety of scenarios where these prohibitions apply to U.S. person stablecoin issuers. For example, U.S. person stablecoin issuers are generally prohibited from engaging in primary market activities with blocked persons, such as issuing stablecoins to blocked persons or redeeming stablecoins belonging to blocked persons; such transactions, if consummated, would constitute a prohibited dealing in blocked property, unless authorized or exempt. In such instances, a stablecoin issuer is required to block these stablecoins because the blocked person has a property interest in the stablecoin and such stablecoins are in the possession or control of the stablecoin issuer, a U.S. person, at the time of the transaction. To effectively block such stablecoins, the stablecoin issuer must ensure that it has denied all parties access to the stablecoins, ensure that it complies with OFAC regulations related to the holding and reporting of blocked assets (discussed further below), and implement controls that align with a risk-based approach.

104

See

OFAC,

Frequently Asked Question 646,

available at

https://ofac.treasury.gov/faqs/646.

U.S. person stablecoin issuers are also prohibited from engaging in secondary market activities with blocked persons. For example, a U.S. person stablecoin issuer would engage in a prohibited provision of services to a blocked person if it allowed the blocked person to engage with the stablecoin issuer's smart contract to facilitate trades of stablecoins on the secondary market. In this instance, the stablecoin issuer would also be required to block such stablecoins because the blocked person has an interest in the stablecoins, which the issuer controls via its smart contract.

OFAC sanctions prohibitions may also take other forms that do not require blocking but prohibit U.S. persons, including stablecoin issuers, from engaging in trade or financial transactions or other dealings with certain persons or geographic regions or countries, such as North Korea, Cuba, Iran, and Crimea, unless authorized by OFAC or exempt.

105

In cases where an underlying transaction is prohibited but there is no blockable interest, all U.S. persons, including those that are stablecoin issuers, are required to reject such transactions and report them to OFAC. For example, U.S. sanctions against Iran generally prohibit U.S. persons from directly or indirectly providing services to persons in Iran, unless otherwise authorized or exempt.

106

Accordingly, U.S. person stablecoin issuers are generally prohibited from engaging in primary or secondary market activities with persons in Iran, including issuing stablecoins to persons in Iran, redeeming stablecoins of persons in Iran, or allowing persons in Iran to engage with the issuer's smart contracts to facilitate trades of stablecoins, as any of these activities would constitute a provision of financial services to Iran. However, unlike when a blocked person is directly or indirectly involved in a transaction, a stablecoin issuer would only be required to reject such transactions and report them to OFAC.

105

See

31 CFR part 510, part 515, part 560, part 589.

106

See

31 CFR 560.204, 560.410, 560.427.

OFAC's regulations also require U.S. persons, including stablecoin issuers, to comply with certain reporting and recordkeeping requirements, pursuant to OFAC's Reporting, Procedures and Penalties Regulations (RPPR).

107

Among other requirements, the RPPR require U.S. persons, including stablecoin issuers, to submit reports of blocked property and rejected transactions to OFAC within 10 business days and annual reports of blocked property by September 30 each year.

108

Persons engaging in transactions subject to the provisions of OFAC's regulations are also required to preserve such records for at least 10 years.

109

107

See

31 CFR part 501.

108

See

31 CFR 501.603, 501.604.

109

See

31 CFR 501.601.

OFAC's basic regulatory requirement for all U.S. persons, including those that are stablecoin issuers, is that they do not violate the sanctions that OFAC administers. The ramifications of non-compliance, inadvertent or otherwise, can jeopardize critical foreign policy and national security goals. Violations of OFAC sanctions may result in the imposition of civil or criminal penalties. OFAC may impose civil penalties for sanctions violations on a strict liability basis, meaning that U.S. persons, including those that are stablecoin issuers, may be held civilly liable for sanctions violations even if such person did not know or have reason to know that it was engaging in a prohibited transaction.

As a general matter, however, OFAC also takes into consideration the totality of facts and circumstances surrounding an apparent violation to determine the appropriate enforcement response. OFAC's Economic Sanctions Enforcement Guidelines, 31 CFR part 501, Appendix A (“Enforcement Guidelines”), lay out a set of 11 factors that OFAC will generally consider in determining the appropriate administrative action in response to an apparent violation of U.S. sanctions, including the amount of the penalty, to the extent that a civil monetary penalty is appropriate.

110

Any of the 11 factors may be considered aggravating or mitigating and may therefore result in adjustments to the proposed penalty. One of those factors includes the existence, nature, and adequacy of a subject person's risk-based sanctions compliance program at the time of the apparent violation. Accordingly, when applying the Enforcement Guidelines to a given factual situation, OFAC considers favorably the presence of an effective sanctions compliance program at the time of an apparent violation.

110

31 CFR part 501, Appendix A.

VI. Proposed AML/CFT Regulation

This proposed rule implements the GENIUS Act's requirement that PPSIs be treated as financial institutions under the BSA. In doing so, it applies the BSA obligations currently applicable to existing financial institutions that are specifically enumerated in the GENIUS Act,

111

other quintessential BSA obligations, and GENIUS Act obligations specific to PPSIs. It also proposes regulatory infrastructure, including definitions, to effectuate the obligations.

111

Although specifically enumerated in the GENIUS Act, this proposed rule does not impose a customer identification program obligation, which is the subject of a separate rulemaking.

In crafting this proposed rule, FinCEN is mindful that some entities may transition from the current MSB framework to the new PPSI framework. FinCEN is also cognizant that some PPSIs will be closely affiliated with or part of institutions with existing BSA obligations. To promote regulatory clarity and efficiency, FinCEN used its well-established regulatory obligations for banks, MSBs, and other financial institutions as points of reference for its proposed PPSI obligations.

A. Permitted Payment Stablecoin Issuers

Before turning to the specifics of the proposed regulation, FinCEN first outlines several broader considerations

that impact how FinCEN proposes to regulate PPSIs and how it expects PPSIs will operationalize the proposed obligations. FinCEN first explains its assessment of how PPSI activities compare to those of other types of financial institutions defined in the BSA and proposes using its authority under 31 U.S.C. 5312(a)(2)(Y). It then describes how entities that are PPSIs may relate to other categories of BSA-defined financial institutions. Finally, FinCEN briefly discusses how it is proposing to apply obligations with regards to different types of market activity.

1. Defining PPSI as a Type of Financial Institution

The GENIUS Act directs that a “permitted payment stablecoin issuer shall be treated as a financial institution for purposes of the Bank Secrecy Act” and “shall be subject to all Federal laws applicable to a financial institution located in the United States relating to . . . prevention of money laundering.”

112

However, the GENIUS Act does not specify how PPSIs should be mechanically codified into the existing BSA framework.

112

12 U.S.C. 5903(a)(5)(A).

The BSA defines “financial institution” as a range of entities, all of which could be subject to statutory obligations and FinCEN's regulations.

113

These institutions include insured banks; commercial banks and trust companies; businesses engaged in the exchange of currency, funds, or value that substitutes for currency or funds; and any person who engages as a business in the transmission of currency, funds, or value that substitutes for currency.

114

Notably, designation as a “financial institution” under 31 U.S.C. 5312(a)(2) affects treatment not only under the BSA but also under other statutes that address money laundering or predicate crimes that can underpin money laundering. These laws include those relating to federal third-party subpoenas

115

to access to financial records by U.S. law enforcement,

116

criminal money laundering

117

and terrorist financing offenses,

118

as well as other provisions of federal and state law.

119

113

See

31 U.S.C. 5312(a)(2);

see also

12 U.S.C. 5901(23) (defining “permitted payment stablecoin issuer”).

None of these proposed changes to the GENIUS Act's language are intended to substantively alter the GENIUS Act's requirements as implemented through this propose rule. FinCEN seeks comment on the clarity of these definitions, including whether any deviation that FinCEN is proposing from the GENIUS Act's language could be read as changing the intended effect of

the Act, and whether any additional terms should be defined.

FinCEN is reserving two subparagraphs, (nnn) and (ooo), expecting they will contain definitions proposed in a previously issued FinCEN rulemaking related to AML/CFT programs for the 11 types of existing financial institutions.

i. Proposed Amendment to 31 CFR 1010.100(t)—Financial Institution

The GENIUS Act directs that a “permitted payment stablecoin issuer shall be treated as a financial institution for purposes of the” BSA.

139

To implement this directive and ensure that PPSIs are subject to the appropriate BSA obligations in a clear and consistent manner—and because, as discussed above in section VI.A.1, FinCEN proposes exercising its 31 U.S.C. 5312(a)(2)(Y) authority to define PPSIs as financial institutions under the BSA—FinCEN is proposing to amend the definition of “financial institution” at 31 CFR 1010.100(t) to expressly include “permitted payment stablecoin issuer.” Consistent with other financial institutions, “permitted payment stablecoin issuer” will be defined separately in a new paragraph.

139

See

12 U.S.C. 5903(a)(5)(A).

ii. Proposed Amendment to 31 CFR 1010.100(ff)—Money Services Business

FinCEN is proposing to amend the definition of “money services business,” 31 CFR 1010.100(ff), to add PPSIs to the list of financial institutions that the term “money services business” shall not include. The amendment makes clear that PPSIs are subject to obligations as a PPSI and not as a money services business.

iii. Proposed Amendment to 31 CFR 1010.100(bbb)—Transaction

FinCEN is proposing to amend the definition of “transaction,” 31 CFR 1010.100(bbb), to add the issuance or redemption of a payment stablecoin as a type of transaction. This amendment clarifies that these activities qualify as transactions. It should not be construed, including by negative inference, that issuance and redemption of other kinds of value that substitute for currency are not a transaction.

140

Moreover, it should not be construed, including by negative inference, that issuing and redeeming payment stablecoins are the only kinds of transactions in which a PPSI will engage.

140

See

2019 CVC Guidance,

supra

note 87, p. 13 (discussing that an “administrator” engages in issuing and redeeming a virtual currency and is generally a money transmitter).

iv. Proposed Amendment to 31 CFR 1010.100(eee)—Transmittal Order

FinCEN is proposing to amend the definition of “transmittal order,” 31 CFR 1010.100(eee), to add a payment stablecoin as a subject of an order. As discussed in greater detail below, this amendment is intended to clarify that a transmittal order to pay payment stablecoins is a transmittal order like an order to pay traditional money. It should not be construed, including by negative inference, that orders to pay other kinds of value that substitute for currency are not transmittal orders.

141

See infra

section VI.C.9.ii.a;

see also

2019 CVC Guidance,

supra

note 87, p. 11.

v. Proposed 31 CFR 1010.100(ppp)—Digital Asset

FinCEN is proposing to define the term “digital asset” as provided in the GENIUS Act, 12 U.S.C. 5901(6). Under the proposed rule, the term “digital asset” would mean any digital representation of value that is recorded on a cryptographically secured distributed ledger. FinCEN considers it useful to define this term explicitly in its regulations in order to enhance the clarity and conciseness of its regulations. Many of the regulatory obligations that FinCEN is proposing to impose on PPSIs take into account, in one way or another, the concept of digital assets. Most notably, the term “digital assets” is used in “payment stablecoin.”

FinCEN's use of the term “digital asset” is limited currently to proposed obligations to be imposed on PPSIs. FinCEN is aware that the addition of “digital asset” adds a term related to other terms used in the BSA, its own regulations and its guidance—most notably “value that substitutes for currency” and “convertible virtual currency.” FinCEN's defining and use of the term “digital asset” in proposed obligations to be imposed on PPSIs should not be construed, including by negative inference, to alter or displace anything about FinCEN's regulatory infrastructure related to value that substitutes for currency or CVC. Digital assets may be value that substitutes for currency, and vice versa, but the two are not synonymous, and the regulatory requirements that may be associated with one must be evaluated independently of the requirements that may be associated with the other.

vi. Proposed 31 CFR 1010.100(qqq)—Distributed Ledger

FinCEN is proposing to define the term “distributed ledger” as provided in the GENIUS Act, 12 U.S.C. 5901(8). Under the proposed rule, the term “distributed ledger” would mean a technology in which data is shared across a network that creates a public digital ledger of verified transactions or information among network participants and cryptography is used to link the data to maintain the integrity of the public ledger and execute other functions. The term distributed ledger is used both in the term digital asset and payment stablecoin.

vii. Proposed 31 CFR 1010.100(rrr)—Lawful Order

FinCEN is proposing to define the term “lawful order” as provided in the GENIUS Act, 12 U.S.C. 5901(16), with certain modifications in light of a preexisting FinCEN regulatory definition. Under the proposed rule the term “lawful order” would mean any final and valid writ, process, order, rule, decree, command, or other requirement issued or promulgated under Federal law, issued by a court of competent jurisdiction or by an authorized Federal agency pursuant to its statutory authority, that (1) requires an individual, partnership, company, corporation, association, trust, estate, cooperative organization, or other business entity, incorporated or unincorporated, to seize, freeze, burn, or prevent the transfer of payment stablecoins that the individual or entity issued; (2) specifies the payment stablecoins or accounts subject to blocking with reasonable particularity; and (3) is subject to judicial or administrative review or appeal as provided by law.

The proposed definition modifies the GENIUS Act definition of lawful order by replacing the statutory term “person” with language used in the GENIUS Act definition of “person,” as provided in 12 U.S.C. 5901(24).

142

The term “person” is already defined in FinCEN regulations at 31 CFR 1010.100(mm)

143

and differs from the GENIUS Act definition of “person.” In particular, FinCEN's regulatory definition of “person” includes Indian Tribes as defined in the Indian Gaming Regulatory Act, which the GENIUS Act definition of person does not include.

Further, FinCEN's regulatory definition also does not characterize the entities that comprise the category as “business” entities, as the GENIUS Act definition does. To ensure the definition of “lawful order” for PPSIs accurately applies to the “persons” that Congress intended, as evidenced by the GENIUS Act definition of the term, FinCEN accordingly proposes to, instead of using the term person, incorporate the language the GENIUS Act uses to define person into the regulatory definition of “lawful order.” FinCEN solicits comments on whether the incorporation of the specific GENIUS Act language is necessary, or whether, if FinCEN reverts to the use of the term “person” as currently defined in its regulations, this will change the intended meaning or effect of the GENIUS Act.

142

See

12 U.S.C. 5901(24) (defining “person” as “an individual, partnership, company, corporation, association, trust, estate, cooperative organization, or other business entity, incorporated or unincorporated”).

143

See

31 CFR 1010.100(mm) (defining “Person” as “An individual, a corporation, a partnership, a trust or estate, a joint stock company, an association, a syndicate, joint venture, or other unincorporated organization or group, an Indian Tribe (as that term is defined in the Indian Gaming Regulatory Act), and all entities cognizable as legal personalities.”).

Additionally, the GENIUS Act uses the term “account” in the definition of lawful order and FinCEN proposes to do the same.

144

A number of other terms currently codified in FinCEN's general definition section, 31 CFR 1010.100 also use the term “account” without defining the term.

145

As discussed in greater detail below, and consistent with that approach, FinCEN proposes not further elaborating on the meaning of account within the definition of lawful order and requests comment on this approach.

146

144

See

12 U.S.C. 5901(16) (defining, in part, “lawful order” as one that “specifies the payment stablecoins or

accounts

subject to blocking with reasonable particularity” (emphasis added)).

145

See, e.g.,

31 CFR 1010.100(p) (defining “established customer”); 1010.100(bbb) (defining “transaction”). For financial institutions with customer identification program (CIP) obligations, those institution's subparts often include a definition of “account.” However, those definitions are limited to CIP obligations unless expressly noted elsewhere.

See

31 CFR 1020.100(a) (defining “account” for CIP purposes in bank subpart); 1023.100(a) (defining “account” for CIP purposes in brokers or dealers in securities subpart);

see also

1010.230 (defining “account” in obligation related to legal entity customers by explicit reference to CIP definitions of “account”).

146

See infra

section VI.C.6.ii discussing proposed obligations related to lawful order compliance and technical capabilities.

viii. Proposed 31 CFR 1010.100(sss)—Payment Stablecoin

FinCEN is proposing to define the term “payment stablecoin” as provided in the GENIUS Act, 12 U.S.C. 5901(22), with certain modifications in light of preexisting FinCEN regulatory definitions and technical changes. Additionally, FinCEN proposes embedding within the definition of payment stablecoin two other terms defined in the GENIUS Act.

Under the proposed rule, the term “payment stablecoin” would mean a digital asset (i) that is, or is designed to be, used as a means of payment or settlement and (ii) the issuer of which: (A) is obligated to convert, redeem, or repurchase for a fixed amount of monetary value, but not for a digital asset denominated in a fixed amount of a monetary value; and (B) represents that such issuer will maintain, or create the reasonable expectation that it will maintain, the digital asset at a stable value relative to the value of a fixed amount of monetary value. The proposed definition also provides that a “payment stablecoin” does not include a digital asset that is: (i) a national currency; (ii) a deposit (as defined in section 3 of the Federal Deposit Insurance Act (12 U.S.C. 1813)) including a deposit recorded using distributed ledger technology; or (iii) a security, as defined in section 2 of the Securities Act of 1933 (15 U.S.C. 77b), section 3 of the Securities Exchange Act of 1934 (15 U.S.C. 78c), or section 2 of the Investment Company Act of 1940 (15 U.S.C. 80a-2). For purposes of the definition of “payment stablecoin,” FinCEN intends for the definition of “security” provided in paragraph (iii) of the proposed definition to apply and not the preexisting regulatory definition of “security” at 31 CFR 1010.100(ss).

The GENIUS Act's definition of “payment stablecoin” contains language clarifying that “no bond, note, evidence of indebtedness, or investment contract that was issued by a permitted payment stablecoin issuer shall qualify as a security solely [because the issuer satisfies] the conditions in [paragraph (1) of the proposed “payment stablecoin” definition], consistent with section 17 of the Act.” FinCEN has determined that this “for avoidance of doubt” language is unnecessary for its regulatory definition of payment stablecoin. The GENIUS Act includes amendments to the cited statutes covered in proposed paragraph (iii) that clarify that payment stablecoins are not securities.

147

Accordingly, while this clarification may have been necessary to understand the intent of the GENIUS Act at the time it was passed, the Act's amendments of security-related statutory provisions obviate the need to include this language in FinCEN's regulations.

147

See

section 17 of the GENIUS Act, Public Law 119-27.

The proposed definition of “payment stablecoin” also includes definitions of the terms “national currency” and “monetary value” within the definition of “payment stablecoin” consistent with the definition of the terms in the GENIUS Act, 12 U.S.C. 5901(19) and (17), with certain modifications. Although the GENIUS Act defines both terms independently from payment stablecoin, neither term is used outside of payment stablecoin as pertinent to this rulemaking. Moreover, adding the GENIUS Act definitions of “national currency” or “monetary value” as separately defined terms in 31 CFR 1010.100 could have an unintended impact on other FinCEN regulations that already use similar terms to mean different things, and could therefore have unintended impact on the regulatory obligations of other types of financial institutions or create unnecessary confusion about those regulatory obligations. Relatedly, within the definition of “national currency,” FinCEN proposes replacing the statutory term “money” with the GENIUS Act's definition of “money.” This should avoid confusion as “money” appears elsewhere in FinCEN's regulations.

FinCEN proposes that for purposes of the definition of “payment stablecoin” the term—(i)

National currency

means each of the following—(A) A Federal Reserve note (as the term is used in the first undesignated paragraph of section 16 of the Federal Reserve Act (12 U.S.C. 411)); or (B) A medium of exchange currently authorized or adopted by a domestic or foreign government including a monetary unit of account established by an intergovernmental organization or by agreement between two or more countries that is: (1) standing to the credit of an account with a Federal Reserve Bank; (2) issued by a foreign central bank; or (3) issued by an intergovernmental organization pursuant to an agreement by two or more governments; and (ii)

Monetary value

means national currency or deposit (as defined in section 3 of the Federal Deposit Insurance Act (12 U.S.C. 1813)) denominated in a national currency. The proposed definition of “national currency” reformats and modifies the definition in the GENIUS Act, 12 U.S.C. 5901(19), by including the GENIUS Act definition of “money,” 12 U.S.C. 5901(18) within the definition, in paragraph (B), and making statutory paragraphs (B), (C), and (D) into proposed paragraphs (

), (

), and (

) for grammatical consistency. The proposed definition of “monetary value” within the definition of “payment stablecoin” is consistent with the definition of the term in the GENIUS Act, 12 U.S.C. 5901(17).

ix. Proposed 31 CFR 1010.100(ttt)—Permitted Payment Stablecoin Issuer

FinCEN is proposing to define the term “permitted payment stablecoin issuer” as provided in the GENIUS Act, 12 U.S.C. 5901(23), with certain

modifications in light of preexisting FinCEN regulatory definitions. Under the proposed rule, the term permitted payment stablecoin issuer would mean an individual, partnership, company, corporation, association, trust, estate, cooperative organization, or other business entity, incorporated or unincorporated formed in the United States that is: (1)(A) a subsidiary of an insured depository institution that has been approved to issue payment stablecoins by a primary Federal payment stablecoin regulator; or (B) a subsidiary of an insured credit union that has been approved to issue payment stablecoins by a primary Federal payment stablecoin regulator; (2) a Federal qualified payment stablecoin issuer; or (3) a State qualified payment stablecoin issuer. The proposed definition modifies the definition of permitted payment stablecoin issuer provided in the GENIUS Act by replacing the statutory term “person” with the language the GENIUS Act uses to define “person” as provided in 12 U.S.C. 5901(24).

148

As described above, the term “person” is already defined in FinCEN regulations at 31 CFR 1010.100(mm)

149

and differs from the GENIUS Act definition of person. To ensure the definition of “permitted payment stablecoin issuer” accurately applies only to “persons” as defined in the GENIUS Act, FinCEN proposes adding the GENIUS Act definition of “person” within the “permitted payment stablecoin issuer” definition.

148

See

12 U.S.C. 5901(24) (defining the term “person” to mean “an individual, partnership, company, corporation, association, trust, estate, cooperative organization, or other business entity, incorporated or unincorporated”).

149

See

31 CFR 1010.100(mm) (stating “Person. An individual, a corporation, a partnership, a trust or estate, a joint stock company, an association, a syndicate, joint venture, or other unincorporated organization or group, an Indian Tribe (as that term is defined in the Indian Gaming Regulatory Act), and all entities cognizable as legal personalities.”).

Additionally, the proposed definition modifies statutory paragraph (A) by replacing the term “insured depository institution” with the GENIUS Act definition of “insured depository institution,” in 12 U.S.C. 5901(15), which includes two subparagraphs one applying to insured depository institutions as defined in section 3 of the Federal Deposit Insurance Act and a second for insured credit unions. FinCEN is also omitting from the GENIUS Act's definition “insured depository institution” the phrase “as defined in section 3 of the Federal Deposit Insurance Act (12 U.S.C. 1813).” While this language may be essential for regulators responsible for approving issuers, FinCEN does not believe it is necessary to understand the scope of the obligations it proposes to impose or the population on which those obligations are imposed. Finally, the definition also replaces the statutory reference “has been approved to issue payment stablecoins under section 5” with “has been approved to issued payment stablecoins by a primary Federal payment stablecoin regulator” in both proposed paragraph (1)(A) and (1)(B).

x. Proposed 31 CFR 1010.100(uuu)—Primary Federal Payment Stablecoin Regulator

FinCEN is proposing to define the term “primary Federal payment stablecoin regulator” as provided in the GENIUS Act, 12 U.S.C. 5901(25), with certain modifications. Under the proposed rule, the term “primary Federal payment stablecoin regulator” would mean (1) for a subsidiary of an insured depository institution, as described in paragraph (ttt)(1)(A) of this section, the appropriate Federal banking agency of such insured depository institution; (2) for a subsidiary of an insured credit union, as described in paragraph (ttt)(1)(B), the NCUA; (3) for a State chartered depository institution not covered in subparagraph (1), the FDIC, the OCC, or the Board; or (4) for a Federal qualified payment stablecoin issuer, the OCC.

The proposed definition modifies the statutory definition by including cross references to the proposed definition of “permitted payment stablecoin issuer” to describe a subsidiary of an insured depository institution and a subsidiary of an insured credit union. The definition also uses the full agency names for each Federal banking agency named in the definition for stylistic consistency with other FinCEN regulations.

xi. Proposed 31 CFR 1010.100(vvv)—Federal Qualified Payment Stablecoin Issuer

FinCEN is proposing to define the term “Federal qualified payment stablecoin issuer” as provided in the GENIUS Act, 12 U.S.C. 5901(11), with certain technical modifications for conciseness and in deference to another agency's authority. Under the proposed rule, the term “Federal qualified payment stablecoin issuer” would mean an entity that is approved by the OCC under 12 U.S.C. 5903 to issue payment stablecoins and is either—(1) a nonbank entity; (2) an uninsured national bank; or (3) a Federal branch.

The GENIUS Act definition of Federal qualified payment stablecoin issuer contains for the three subtypes of institutions—nonbank entities, uninsured national banks, and foreign bank branches—references to OCC approval and in one case OCC's statutory authority. FinCEN proposes to consolidate references to OCC approval and remove reference to the OCC's statutory authority. FinCEN considers this approach appropriate in light of the fact that the OCC, not FinCEN, has the authority to determine how, using what terms and establishing what categories, to discharge the OCC's regulatory obligations in connection with Federal qualified payment stablecoin issuers as required by the GENIUS Act. FinCEN conceives of its responsibility in this connection as establishing a smooth interface between its own regulations on the subject and those of the OCC, and it regards the proposed language as the best way to do so. In addition, the proposed language has the benefit of conciseness.

xii. Proposed 31 CFR 1010.100(www)—State Payment Stablecoin Regulator

FinCEN is proposing to define the term “State payment stablecoin regulator” as provided in the GENIUS Act, 12 U.S.C. 5901(30), with certain modifications in light of preexisting FinCEN regulatory definitions. Under the proposed rule, the term “State payment stablecoin regulator” would mean a state agency that has the primary regulatory and supervisory authority in such state over entities that issue payment stablecoins. Under the GENIUS Act, the term “State” includes “each of the several States of the United States, the District of Columbia, and each territory of the United States.”

150

FinCEN proposes modifying the GENIUS Act's definition of “State payment stablecoin regulator” to account for FinCEN's existing definition of “State,”

151

which does not include any U.S. territories. FinCEN is thus adding its existing regulatory phrase “Territory and Insular Possession” to make clear that for purposes of this definition “State” includes territories.

152

150

See

12 U.S.C. 5901(28).

151

See

31 CFR 1010.100(vv) (defining “State” as “The States of the United States and, wherever necessary to carry out the provisions of this chapter, the District of Columbia.”).

152

See

31 CFR 1010.100(zz) (defining “Territories and Insular Possessions” as “The Commonwealth of Puerto Rico, the United States Virgin Islands, Guam, the Commonwealth of the Northern Mariana Islands, and all other territories and possessions of the United States other than the Indian lands and the District of Columbia.”).

xiii. Proposed 31 CFR 1010.100(xxx)—State Qualified Payment Stablecoin Issuer

FinCEN is proposing to define the term “State qualified payment stablecoin issuer” as provided in the GENIUS Act, 12 U.S.C. 5901(31), with certain modifications in light of preexisting FinCEN regulatory definitions. Under the proposed rule, the term “State qualified payment stablecoin issuer” would mean an entity that is: (1) legally established under the laws of a State or Territory and Insular Possession and approved to issue payment stablecoins by a State payment stablecoin regulator; and (2) not an uninsured national bank chartered by the OCC pursuant to title LXII of the Revised Statutes; a Federal branch or an insured depository institution, or a subsidiary, of such national bank, Federal branch, or insured depository institution. For meaning of “insured depository institution” this definition would reference the proposed definition of “permitted payment stablecoin issuer” at proposed 1010.100(ttt), clarifying that, consistent with the GENIUS Act, “insured depository institution,” includes insured depository institutions and insured credit unions.

153

12 U.S.C. 5901(15).

As with the definition of “State qualified payment stablecoin issuer,” FinCEN is adding “Territorial and Insular Possessions” to clarify that, consistent with the GENIUS Act, issuers legally established under the laws of a Territory and Insular Possession can qualify as a State qualified payment stablecoin issuer.

2. Proposed Amendment to 31 CFR 1010.810—Delegation of Examination Authority

As administrator of the BSA, FinCEN has overall authority for enforcement and compliance with the BSA and its implementing regulations.

154

FinCEN, however, may delegate examination authority to appropriate agencies while retaining authority for the coordination and direction of procedures and activities of these agencies.

155

FinCEN has delegated examination authority for various financial institutions, as reflected at § 1010.810(b), and is proposing the same approach with regards to examination authority for PPSIs.

154

See

Treasury Order 180-01,

supra

note 15, para. 3;

see also

31 CFR 1010.810(a).

155

31 U.S.C. 5318(a)(1); 31 CFR 1010.810(a); Treasury Order 180-1,

supra

note 15, paras. 3(b), 4(b).

Broadly speaking, the GENIUS Act divides PPSIs into two categories: PPSIs that are regulated for safety and soundness by a primary Federal payment stablecoin regulator (which includes the OCC, Board, FDIC, and NCUA) and PPSIs that are regulated for safety and soundness by a State payment stablecoin regulator.

156

FinCEN proposes delegating examination authority over PPSIs to federal agencies responsible for examining the same entities for safety and soundness and, where no such federal agency exists, to the IRS.

157

156

See, e.g.,

12 U.S.C. 5905 (outlining supervision by primary Federal payment stablecoin regulators); 12 U.S.C. 5906 (outlining supervision by State payment stablecoin regulators).

157

Compare

31 CFR 1010.810(b)(1)-(6)

with

31 CFR 1010.810(b)(8).

i. State Qualified Payment Stablecoin Issuers

Under the GENIUS Act, generally, a State qualified payment stablecoin issuer with a consolidated total outstanding issuance of not more than $10 billion payment stablecoins may opt for regulation under a State-level regulatory regime, provided that the State-level regulatory regime is substantially similar to the Federal regulatory framework under the GENIUS Act.

158

State qualified payment stablecoin issuers that exceed the $10 billion in outstanding issuance of payment stablecoins must either transition to the regulatory framework of the primary Federal payment stablecoin regulator, which is then jointly administered by the State payment stablecoin regulator and the primary Federal payment stablecoin regulator, or obtain a waiver permitting the State qualified payment stablecoin issuer to remain solely supervised by a State payment stablecoin regulator.

159

158

See

12 U.S.C. 5903(c), 5906.

159

12 U.S.C. 5903(d).

Where a financial institution is not examined for compliance with the BSA and FinCEN's regulations by the OCC, Board, FDIC, or NCUA, and is not otherwise supervised by a Federal functional regulator, FinCEN has delegated its examination authority to the IRS in § 1010.810(b)(8). Likewise, here FinCEN proposes delegating its examination authority to the IRS for PPSIs not examined by the OCC, Board, FDIC, and NCUA—

i.e.,

a primary Federal payment stablecoin regulator—for safety and soundness. This population will include State qualified payment stablecoin issuers not supervised by a primary Federal payment stablecoin regulator, either because the State qualified payment stablecoin issuer's outstanding issuance is not more than $10 billion or because the primary Federal payment stablecoin regulator has granted the PPSI a waiver to allow the PPSI to remain supervised by a State payment stablecoin regulator. FinCEN believes the IRS is well positioned to conduct BSA examinations for PPSIs not examined by a primary Federal payment stablecoin regulator. As the BSA examiner for a range of institutions not otherwise examined by another agency, the IRS has staff trained in BSA examinations and a strong relationship with FinCEN and various state regulators. Relatedly, the IRS currently examines money transmitters, including stablecoin issuers, for BSA compliance and is, thus, well positioned to assess PPSI compliance with the BSA and ensure consistent application of BSA provisions across PPSIs based in various states.

To effectuate this delegation of BSA examination, FinCEN believes that no changes are necessary to § 1010.810(b)(8), which already states that such authority is delegated with respect to “financial institutions . . . not currently examined by Federal bank supervisory agencies for soundness and safety.” FinCEN believes the proposed text ensures that each PPSI not examined by a primary Federal payment stablecoin regulator for safety and soundness is examined by the IRS. This delegation will not grant authority to the IRS where a State qualified payment stablecoin issuer is subject to a primary Federal payment stablecoin regulator's framework that is jointly administered by the federal and state regulator and results in a primary Federal payment stablecoin regulator examining for safety and soundness.

ii. Proposed 31 CFR 1010.810(b)(8)—Federal Qualified Payment Stablecoin Issuers

Under the GENIUS Act, the OCC, Board, FDIC, and NCUA are the primary Federal payment stablecoin regulators and responsible for, among other things, assessing a PPSI's safety and soundness.

160

Additionally, the GENIUS Act requires the primary Federal payment stablecoin regulators to issue regulations relating to, among other things, risk management principles-based requirements and standards, including relating to the BSA.

161

160

12 U.S.C. 5905(a)(3); 12 U.S.C. 5901(25).

161

12 U.S.C. 5903(a)(4)(A)(iv).

With regards to banks, FinCEN has delegated its authority to examine financial institutions for chapter X compliance to the agency that examines

the institution for safety and soundness.

162

Consistent with that approach, FinCEN's proposal adds a new paragraph to § 1010.810(b) to delegate examination authority to the primary Federal payment stablecoin regulators responsible for assessing a PPSI's safety and soundness. FinCEN believes the primary Federal payment stablecoin regulator responsible for promulgating standards related to BSA and examining particular PPSIs for safety and soundness is best positioned to carry out effective and efficient BSA exams. As the definition of primary Federal payment stablecoin regulator outlines the agency responsible for oversight of various categories of PPSIs, FinCEN is not proposing to detail in § 1010.810(b)(11) which agency is responsible for which subcategory of PPSIs.

163

162

See

31 CFR 1010.810(b)(1)-(3), (5).

163

See infra

section VI.C.1.x.

3. Proposed 31 CFR 1033.210—AML/CFT Program Requirements for PPSIs

The GENIUS Act directs that PPSIs be subject to “maintenance of an effective anti-money laundering program, which shall include appropriate risk assessments and designation of an officer to supervise the program.”

164

Effective AML/CFT programs safeguard national security and generate significant public benefits by preventing the flow of illicit funds in the financial system and by assisting law enforcement and national security agencies with the identification and prosecution of persons attempting to launder money and undertake other illicit activity through the financial system.

165

164

See

12 U.S.C. 5903(a)(5)(A)(i);

see also

31 U.S.C. 5318(h).

165

31 U.S.C. 5318(h)(2)(B)(iii).

FinCEN has separately issued a notice of proposed rulemaking that would amend FinCEN's regulations that prescribe AML/CFT program requirements for current financial institutions program rules under the BSA. Updating the AML/CFT program requirements across financial institution types is part of FinCEN's efforts to reform and modernize the BSA, as well as implement the Anti-Money Laundering Act of 2020 (AML Act).

166

That proposed rule is designed to help ensure that financial institutions' AML/CFT programs are appropriately risk-based, such that compliance with their program obligations is focused on the goals of the BSA, including combatting and preventing money laundering, the financing of terrorism, and other illicit finance activity risks (collectively, ML/TF risks), rather than mere technical compliance. Furthermore, that proposed rule for banks would help ensure that supervisory and enforcement actions related to AML/CFT programs are focused on significant or systemic failures to implement an effective AML/CFT program (

i.e.,

deficiencies or issues that arise from failing to implement, in all material respects, a properly established AML/CFT program).

166

Anti-Money Laundering Act of 2020, Public Law 116-283, Div. F, sections 6001-6511, 134 Stat. 3388, 4547-4633 (Jan. 1, 2021).

In this proposed rule FinCEN proposes to impose on PPSIs an AML/CFT program obligation consistent with the program being proposed for the 11 types of financial institutions currently covered by BSA program requirements, with some modifications due to the GENIUS Act's specific provisions. FinCEN assesses that such consistency across the types of financial institutions promotes clarity, creates efficiencies, and best protects the U.S. financial system from illicit actors. As described below, under FinCEN's proposal, an AML/CFT program is inherently tailored to the risk and operations of a PPSI, meeting the GENIUS Act's directive that rules are tailored to an issuer's size and complexity.

167

See

12 U.S.C. 5903(a)(5)(B).

i. AML/CFT Program Overview

A central objective of Treasury and FinCEN's BSA modernization efforts is to create an AML/CFT supervisory and regulatory regime that is more effective in achieving the purposes of the BSA and promoting better outcomes for law enforcement and national security agencies.

168

This proposed rule would further that objective by explicitly defining the requirements for a PPSI to establish and maintain an effective AML/CFT program. Consistent with the changes that the AML Act made for other types of financial institutions, it would also adopt into regulation the AML Act's expectation that AML/CFT programs should be risk-based, including ensuring that PPSIs direct more attention and resources toward higher-risk customers and activities, consistent with the risk profile of the PPSI, rather than toward lower-risk customers and activities.

169

168

31 U.S.C. 5311.

169

31 U.S.C. 5318(h)(2)(B)(iv)(II).

Under proposed § 1033.210 PPSIs would have an effective AML/CFT program and comply with the requirements of 31 U.S.C. 5318(h)(1) and § 1033.210 if the PPSI: (1) establishes an AML/CFT program in accordance with paragraph (b) of § 1033.210; and (2) maintains an AML/CFT program by implementing the AML/CFT program in accordance with paragraph (c) of § 1033.210. As part of the program, and consistent with the mandate in the GENIUS Act, PPSIs would be required to conduct ongoing customer due diligence.

a. Factors That FinCEN Considered

The AML Act requires FinCEN to take into account certain factors when prescribing minimum AML/CFT program standards. FinCEN has considered all these factors in developing this proposed rule.

170

See

31 U.S.C. 5318(h)(2)(B). Per the BSA, the factors FinCEN considered include, “(i) Financial institutions are spending private compliance funds for a public and private benefit, including protecting the United States financial system from illicit finance risks. (ii) The extension of financial services to the underbanked and the facilitation of financial transactions, including remittances, coming from the United States and abroad in ways that simultaneously prevent criminal persons from abusing formal or informal financial services networks are key policy goals of the United States. (iii) Effective anti-money laundering and countering the financing of terrorism programs safeguard national security and generate significant public benefits by preventing the flow of illicit funds in the financial system and by assisting law enforcement and national security agencies with the identification and prosecution of persons attempting to launder money and undertake other illicit activity through the financial system. (iv) Anti-money laundering and countering the financing of terrorism programs [. . .] should be—(I) reasonably designed to assure and monitor compliance with the requirements of this subchapter and regulations promulgated under this subchapter; and (II) risk-based, including ensuring that more attention and resources of financial institutions should be directed toward higher-risk customers and activities, consistent with the risk profile of a financial institution, rather than toward lower-risk customers and activities.”

As stated in 31 U.S.C. 5318(h)(2)(B)(iii), effective AML/CFT programs safeguard national security and generate significant public benefits by preventing the flow of illicit funds in the financial system and by assisting law enforcement and national security agencies with the identification and prosecution of persons attempting to launder money or undertake other illicit activity through the financial system. The proposed rule would advance the BSA modernization and reform goals of the AML Act by providing PPSIs and their regulators with clarity about the requirements to have effective AML/CFT programs.

Likewise, 31 U.S.C. 5318(h)(2)(B)(iv)(I) provides that AML/CFT programs should be “reasonably designed to assure and monitor compliance” with the BSA and its implementing regulations and be risk-based. The proposed rule advances these objectives by explicitly requiring PPSIs to have effective AML/CFT programs and by describing the

minimum components for an AML/CFT program to be effective. Specifically, as part of an effective AML/CFT program, the proposed rule requires that a PPSI establish and maintain a risk-based set of internal policies, procedures, and controls that are reasonably designed to ensure compliance with the BSA and FinCEN's regulations.

The internal policies, procedures, and controls requirement in the proposed rule also demonstrates FinCEN's consideration of 31 U.S.C. 5318(h)(2)(B)(iv)(II), which states that AML/CFT programs should be risk-based, including ensuring that more attention and resources of a PPSI should be directed toward higher-risk customers and activities, consistent with a PPSI's risk profile, rather than toward lower-risk customers and activities. The proposed rule incorporates this directive by explicitly requiring, as part of a PPSI's risk-based internal policies, procedures, and controls, that a PPSI identify, assess, and document its ML/TF risks through risk assessment processes. These risk assessment processes require a PPSI to evaluate ML/TF risks and review and incorporate the AML/CFT Priorities, as appropriate, with updates to risk assessment processes promptly upon any change that the PPSI knows or has reason to know significantly changes the PPSI's ML/TF risks. These risk assessment processes are designed to help PPSIs mitigate ML/TF risks and ensure that they are allocating resources commensurate with their documented ML/TF risks, directing more attention and resources toward higher-risk customers rather than toward lower-risk customers and activities.

Finally, 31 U.S.C. 5318(h)(2)(B)(ii) requires FinCEN to consider the extension of financial services to the underbanked and the facilitation of financial transactions, including remittances, while preventing criminal persons from abusing formal or informal financial services networks. Through its emphasis on risk-based AML/CFT programs, the proposed rule seeks to provide PPSIs with the flexibility to serve a broad range of customers and avoid one-size-fits-all approaches to customer risk that can lead to PPSIs declining to provide financial services to entire categories of customers. The proposed rule would help ensure that decisions taken by PPSIs with respect to closing customer accounts are based on legitimate ML/TF risks and informed by relevant facts and circumstances. The proposed rule is intended to mitigate the risks of PPSIs potentially being inappropriately pressured into closing customer accounts by emphasizing the risk-based nature of AML/CFT programs. In doing so, the proposed rule also furthers the objectives of E.O. 14331,

Guaranteeing Fair Banking for All Americans,

which seeks to combat “politicized or unlawful debanking.”

171

E.O. 14331,

Guaranteeing Fair Banking for All Americans,

90 FR 38925 (Aug. 12, 2025).

b. Program Overview

The proposed rule would require a PPSI to

establish

an AML/CFT program and then

maintain

the AML/CFT program by implementing, in all material respects, the established AML/CFT program. In prescribing the minimum standards for an AML/CFT program and in supervising and examining compliance with those standards, the AML Act requires the Secretary and the appropriate Federal functional regulator to take into account that effective AML/CFT programs safeguard national security and help law enforcement prevent the flow of illicit funds in the financial system.

172

An AML/CFT program can be effective without preventing every minor instance of a financial institution falling prey to illicit finance misuse. Accordingly, the proposed rule would set out that an AML/CFT program is “effective” and complies with the requirements of 31 U.S.C. 5318(h)(1) so long as it is established and maintained in accordance with applicable requirements.

172

See

31 U.S.C. 5318(h)(2)(B)(iii).

A PPSI would be required to establish a risk-based set of internal policies, procedures, and controls that are reasonably designed to ensure compliance with the BSA and 31 CFR chapter X. The risk-based internal policies, procedures, and controls must also be reasonably designed to: (1) identify, assess, and document the PPSI's ML/TF risks through risk assessment processes that evaluate the risks of the PPSI's business activities, review and, as appropriate, incorporate the AML/CFT Priorities, and are updated promptly upon any change that the PPSI knows or has reason to know significant changes in the PPSI's ML/TF risks; (2) mitigate the PPSI's ML/TF risks, consistent with the PPSI's risk assessment processes; and, (3) conduct ongoing customer due diligence.

The proposed rule would also require a PPSI to establish an ongoing employee training program and independent AML/CFT program testing as part of its AML/CFT program.

Finally, the proposed rule would require a PPSI to designate an individual responsible for establishing and implementing the AML/CFT program and coordinating and monitoring day-to-day compliance; that individual would be required to be located in the United States and accessible to, and subject to oversight and supervision by, FinCEN and its designee, including the appropriate primary Federal payment stablecoin regulator. That individual also could not have been convicted of a felony offense involving certain kinds of activity, as required by the GENIUS Act.

173

See

12 U.S.C. 5903(f).

Under the proposed rule, having an effective AML/CFT program would be more than a one-time adoption of a risk-based set of internal policies, procedures, and controls. Rather, a PPSI would be required to keep its risk-based set of internal policies, procedures, and controls—and the risk assessment processes that inform them—current as the PPSI's risk profile changes. Similarly, an AML/CFT program would involve more than a one-time creation of an employee training program or initiation of an independent testing mechanism: the PPSI would also be required to keep such aspects of the AML/CFT program current as the PPSI's risk profile changes. Thus, even where a PPSI has previously established an AML/CFT program in accordance with the proposed rule, a failure to update the program to reflect significant changes to the PPSI's risk profile may result in the program no longer meeting the program establishment requirements, and the PPSI may accordingly be subject to supervisory or enforcement action for failure to establish an effective AML/CFT program.

Once a PPSI has properly “established” an AML/CFT program, the PPSI must “maintain” the program by implementing it, in all material respects. Minor deficiencies of an AML/CFT program would not necessarily mean that a PPSI has failed to implement the program.

ii. Proposed 31 CFR 1033.210(b)—Program Establishment

The AML/CFT program requirements for PPSI's must have certain minimum elements comprised of: (1) internal policies, procedures, and controls; (2) an independent audit function to test programs; (3) a designated compliance officer; and (4) an ongoing employee training program.

a. Proposed 31 CFR 1033.210(b)(1)—Internal Policies, Procedures, and Controls

The BSA requires financial institutions to develop “internal

policies, procedures, and controls” as part of their AML/CFT programs.

174

Proposed § 1033.210(b)(1) provides that a PPSI's risk-based set of internal policies, procedures, and controls must be reasonably designed to: (1) identify, assess, and document ML/TF risks through risk assessment processes; (2) mitigate ML/TF risks consistent with the risk assessment processes, including by allocating more attention and resources toward higher-risk customers and activities rather than toward lower-risk customers and activities; and (3) conduct ongoing CDD.

174

31 U.S.C. 5318(h)(1)(A).

Under this proposal, a PPSI's risk-based set of internal policies, procedures, and controls should be based upon, informed by, and consistent with a PPSI's risk assessment processes. The level of sophistication of the internal policies, procedures, and controls should be commensurate with the size, structure, risk profile, and complexity of the PPSI.

The requirement that a PPSI's risk-based set of internal policies, procedures, and controls be “reasonably designed” gives PPSIs flexibility in how they achieve compliance with the BSA and the proposed rule's other requirements. As part of having risk-based set of internal policies, procedures, and controls reasonably designed to ensure compliance with the BSA and FinCEN's regulations, PPSIs may choose to responsibly adopt new technologies or innovative approaches to comply with BSA requirements.

1. Proposed 31 CFR 1033.210(b)(1)(i)—Risk Assessment Processes

FinCEN is proposing in § 1033.210(b)(1)(i) that, as part of a PPSI's risk-based set of internal policies, procedures, and controls, the PPSI establish and maintain risk assessment processes to: (1) evaluate the ML/TF risks of the PPSI's business activities, including products, services, distribution channels, customers, and geographic locations; (2) review and, as appropriate, incorporate the AML/CFT Priorities; and (3) be updated promptly upon any change that the PPSI knows or has reason to know significantly changes the PPSI's ML/TF risks. This provision implements the GENIUS Act's directive that PPSI AML/CFT programs include appropriate risk assessments.

175

See

12 U.S.C. 5903(a)(5)(A)(i).

The proposed rule requires, as part of a PPSI's risk-based internal policies, procedures and controls, that it identify, assess, and document its ML/TF risks using risk assessment processes. This risk assessment process, generally conducted on an annual basis, results in a documented ML/TF risk assessment.

FinCEN believes PPSIs are best positioned to identify and evaluate their ML/TF risk and is therefore not prescribing any particular risk assessment processes or methodologies other than the critical elements described in this proposed rule. Under the proposed rule, PPSIs will be examined for whether they have established and implemented, in all material respects, reasonably designed risk assessment processes—which need not be in the form of a singular risk assessment process. Furthermore, FinCEN is not prescribing any particular timeframe for PPSIs to update their risk assessment processes.

i. Proposed 31 CFR 1033.210(b)(1)(i)(A)—ML/TF Risks

Proposed § 1033.210(b)(1)(i)(A) would require a PPSIs' risk assessment processes to evaluate the ML/TF risks its business activities, including products, services, distribution channels, customers, and geographic locations. These factors are generally well known and often incorporated into current risk assessment processes of some stablecoin issuers and banks. For clarity's sake, FinCEN considers “distribution channels” to refer to the methods and tools through which a PPSI opens accounts and provides products or services (including payment stablecoins), including, for example through remote or other non-face-to-face means. Thus, for example, PPSIs should consider how accounts are opened, as well as the blockchains to which its payment stablecoins are issued.

PPSIs may use a variety of sources to inform their risk assessment processes. Such sources may include information obtained from other financial institutions, such as emerging risks and typologies identified through 314(b) information sharing or payment transactions that other financial institutions returned or flagged due to ML/TF risks.

176

Information a PPSI generates or maintains could be another source, including information acquired from blockchain analytics. Such internal information may include, for example, customer internet protocol (IP) addresses or device logins and related geolocation information.

176

See

FinCEN,

Section 314(b) Fact Sheet,

(Dec. 2020), available at

https://www.fincen.gov/system/files/shared/314bfactsheet.pdf.

Feedback from FinCEN, law enforcement, and financial regulators may also inform risk assessment processes. For example, if a PPSI receives feedback from law enforcement about a report it has filed or potential risks at the PPSI, the PPSI may incorporate that information into its risk assessment processes. Similarly, PPSIs may consider information identified from responding to section 314(a) requests. Certain FinCEN advisories or guidance may also be particularly relevant to the PPSI's business activities, thereby warranting consideration when evaluating ML/TF risks. Regardless of the source, PPSIs should take measures in their risk assessment processes to ensure this information is reasonably current, complete, and accurate.

ii. Proposed 31 CFR 1033.210(b)(1)(i)(B)—AML/CFT Priorities

Proposed § 1033.210(b)(1)(i)(B) would require PPSIs to review and incorporate the AML/CFT Priorities. The AML/CFT Priorities set out the priorities for the U.S. government's AML/CFT policy as required by the AML Act and are designed to ensure that PPSIs' AML/CFT programs are aligned with those priorities. Recognizing the diverse nature of ML/TF threats facing the U.S. financial system and national security, and that PPSI AML/CFT programs will benefit U.S. national security by safeguarding the financial system from ML/TF risk, the AML/CFT Priorities are intended to ensure that PPSIs are focusing on the greatest threats to U.S. national security, as defined by Treasury.

FinCEN understands that the AML/CFT Priorities may not always be applicable to a PPSI's risk profile and activities. Therefore, FinCEN requires the incorporation of the AML/CFT Priorities in PPSI's risk assessment processes,

as appropriate.

This means that, having reviewed the AML/CFT Priorities, a PPSI may determine the extent to which a particular priority is applicable and whether and how a particular AML/CFT Priority should be incorporated into its risk assessment processes.

Further, a PPSI may use its judgment and apply a reasonable, risk-based determination on whether to focus on a specific aspect of an AML/CFT Priority (

e.g.,

cyber-enabled fraud), rather than addressing all aspects of an AML/CFT Priority that may either not be applicable or pose lower risks to the PPSI. However, FinCEN cautions that a surface-level, perfunctory review of an AML/CFT Priority by a PPSI and the foreseeable ways in which it may manifest itself within the PPSI's customers, products and services, geographies, and distribution channels would not satisfy this requirement.

FinCEN anticipates that some PPSIs may ultimately determine that their business models and risk profiles have limited exposure to some of the threats addressed in the AML/CFT Priorities but instead have greater exposure to other ML/TF risks not addressed in the AML/CFT Priorities. Additionally, some PPSIs' risk assessment processes may determine that their AML/CFT programs already sufficiently take into account some, or all, of the AML/CFT Priorities. In either case, any changes to PPSIs' AML/CFT program, such as internal policies, procedures, or controls, would be based on the results of risk assessment processes and their impact on the AML/CFT program, including how to review and, as appropriate, incorporate the AML/CFT Priorities before making these determinations.

iii. Proposed 31 CFR 1033.210(b)(1)(i)(C)—Update Risk Assessment Processes

Proposed § 1033.210(b)(1)(i)(C) would require PPSIs to update their risk assessment processes promptly upon any change that the PPSI knows or has reason to know significantly changes its ML/TF risk profile. For example, a PPSI may need to update its risk assessment when new products, services, and customer types are introduced; or existing products, services, and customer types undergo significant changes; or when the PPSI adopts new risk mitigation technology; or if the PPSI as a whole expands or contracts through mergers, acquisitions, divestitures, dissolutions, and liquidations. This would include, for example, when a payment stablecoin is deployed on a new blockchain or new features are coded into the smart contract. A PPSI may also need to update its risk assessment process based on factors external to its operations that it knows or has reason to know significantly changes its ML/TF risk profile.

2. Proposed 31 CFR 1033.210(b)(1)(ii)—Mitigate ML/TF Risks

Under the proposed rule, a PPSI's efforts to mitigate its ML/TF risks would involve directing more attention and resources toward higher-risk customers and activities, consistent with the risk profile of the PPSI, rather than toward lower risk customers and activities.

177

The goal of risk-based allocation is for PPSIs to spend less time, energy, and resources on lower priority activities that may result in fewer resources devoted to, and potentially distract from, more serious threats. The proposed rule would thus enable PPSIs to focus more on higher risk customers and activities, which FinCEN has determined should result in PPSIs being more effective at detecting, reporting, and preventing the flow of illicit funds and providing law enforcement with more valuable BSA reporting.

177

31 U.S.C. 5318(h)(2)(B)(iv)(II).

As noted above, FinCEN believes that PPSIs are best positioned to identify and evaluate their ML/TF risk and to make decisions related to risk identification and resource allocation in accordance with risk identification. The proposed rule, therefore, does not contemplate regulatory second-guessing of a PPSI's reasonable determinations regarding appropriate resource allocation or conclusions regarding specific risks. However, while FinCEN does not believe that an examiner should substitute his or her own subjective judgment in place of the PPSIs, examiners will be expected to assess whether: (1) a PPSI's resource allocation decisions are informed by, and consistent with, reasonably designed risk assessment processes; and (2) with respect to implementation, specifically, whether the PPSI knows or should know of resource-related issues involving its internal policies, procedures, and controls and other mandatory elements that may result in the PPSI failing to implement its AML/CFT program in all material respects and failing to address such issues.

3. Proposed 31 CFR 1033.210(b)(1)(iii)—Conduct Ongoing Customer Due Diligence

The GENIUS Act specifies that PPSIs should be subject to all Federal laws applicable to a financial institution located in the United States relating to “due diligence.”

178

The existing program rules for certain financial institutions contain CDD requirements that have commonly been referred to as the “fifth pillar” of AML program rules for those types of financial institutions.

179

Under these requirements, covered financial institutions must establish and maintain a written AML/CFT program that includes: “appropriate risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to: understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.”

180

178

See

12 U.S.C. 5903(a)(5)(A).

179

See

applicable program rules with CDD requirements for covered financial institutions are located at 31 CFR 1020.210(a)(2)(v) and (b)(2)(v) (banks), 1023.210(b)(5) (broker-dealers), 1024.210(b)(5) (mutual funds), and 1026.210(b)(5) (futures commission merchants and introducing brokers in commodities). FinCEN in February 2026 issued an order granting exceptive relief to covered financial institutions from the requirements in 31 CFR 1010.230(b) to identify and verify the identities of beneficial owners of legal entity customers at each new account opening.

See

FinCEN,

Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening

(Feb. 13, 2026), available at

https://www.fincen.gov/system/files/2026-02/FinCEN-Order-CCDExceptiveRelief.pdf.

180

See

31 CFR 1020.210(a)(2)(v) and (b)(2)(v) (banks); 1023.210(b)(5) (broker-dealers); 1024.210(b)(5) (mutual funds); 1026.210(b)(5) (futures commission merchants and introducing brokers in commodities).

Proposed § 1033.210(b)(1)(iii) would require PPSIs to conduct ongoing CDD as part of their AML/CFT program obligations. To effectively mitigate the illicit finance risks in customer relationships, PPSIs need to obtain and maintain information sufficient to develop an understanding of normal and expected customer activity. This in turn requires development of an understanding of the “nature and purpose,” or in other words the intent, of the customer in initiating and maintaining the relationship. The PPSI can draw conclusions about the type of activity and transactions the customer can be expected to engage in, setting a “baseline against which aberrant, suspicious transactions are identified.”

181

These are core elements and fundamental expectations of FinCEN's regulations implementing the BSA.

181

See

FinCEN,

Customer Due Diligence Requirements for Financial Institutions,

81 FR 29398, 29419 (May 11, 2016); FinCEN,

Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions,

Question 36 (Apr. 3, 2018), available at

https://www.fincen.gov/system/files/2018-04/FinCEN_Guidance_CDD_FAQ_FINAL_508_2.pdf.

For PPSIs, some considerations of the nature and purpose of customer relationships will be similar to existing practices for other regulated financial institutions. However, some factors may also be new or unique due to the characteristics of the products and services being offered. PPSIs may need to consider, among other factors, the type of entity seeking to establish a customer relationship, the jurisdiction in which they are domiciled, the AML/CFT obligations they are subject to (and potentially the rigor of supervisory oversight of those obligations), the customer's operating history, the services the customer offers to its users, the markets that the customer serves, and the agents or intermediaries through which the customer may provide its services. Such business, product,

service, and geographic risk considerations are well established components of existing BSA programs. PPSIs may also need to consider information more narrowly tailored to the stablecoin market, including both information available from public blockchains and relevant off-chain considerations. Notably, as stated above, FinCEN assesses that the majority of illicit activity involving stablecoins occurs on the secondary market.

182

Although the proposed rule would not impose a standalone, independent obligation on a PPSI to monitor secondary market transactions, consideration of such activity may be appropriate in the PPSI's development and maintenance of a customer risk profile (

e.g.,

public blockchains may indicate that a digital assets exchange that is a PPSI customer is engaged in deposits or withdrawal activity of the PPSI's stablecoin with addresses attributed to illicit actors).

182

See supra

section IV.D.

b. Proposed 31 CFR 1033.210(b)(2)—Independent Testing

The purpose of independent testing is to assess the PPSI's compliance with AML/CFT statutory and regulatory requirements, relative to its risk profile. This evaluation helps to inform the PPSI of weaknesses or areas in need of enhancement or stronger controls. Typically, this evaluation includes a conclusion about the PPSI's overall compliance with AML/CFT statutory and regulatory requirements and sufficient information for the reviewer (

e.g.,

board of directors, senior management, AML/CFT officer, outside auditor, or an examiner) to reach a conclusion about whether the risk-based set of internal policies, procedures, and controls are reasonably designed and resources are well-allocated consistent with the PPSI's risk assessment processes.

Additionally, while PPSIs retain some flexibility regarding who conducts the audit or testing, the proposed rule would require that testing be independent. PPSIs that do not employ outside auditors or consultants or that do not have internal audit departments may comply with this requirement by using internal staff who are not involved in the function being tested. For these PPSIs and PPSIs with other types of arrangements for independent testing, the AML/CFT officer or any party who directly, and in some cases, indirectly reports to the AML/CFT officer, or an equivalent role, would generally not be considered sufficiently independent. Any individual conducting the testing, whether internal or external, would be required to be independent of other parts of the PPSI's AML/CFT program, including its oversight. For PPSIs that engage outside auditors or consultants, the PPSI would be required to ensure that the outside parties conducting the independent testing are not involved in functions related to the AML/CFT program at the PPSI that may present a conflict of interest or lack of independence, such as AML/CFT training or the development or enhancement of internal policies, procedures, and controls. Additionally, for the purposes of the independent testing component, outside parties would not include government agencies, entities, or instrumentalities, such as a PPSI's primary Federal payment stablecoin regulator or State payment stablecoin regulator. PPSIs with less complex operations, and lower risk profiles may consider utilizing a shared resource as part of a collaborative arrangement to conduct testing, as long as the testing is independent.

183

FinCEN would generally expect, as with the AML/CFT officer component, independent testers to have the expertise and experience to satisfactorily perform such a duty, including having sufficient knowledge of the PPSI's risk profile and AML/CFT laws and regulations.

183

See

Board, FDIC, NCUA, OCC, and FinCEN,

Interagency Statement on Sharing Bank Secrecy Act Resources

(Oct. 3, 2018), available at

https://www.fincen.gov/news/news-releases/interagency-statement-sharing-bank-secrecy-act-resources.

c. Proposed 31 CFR 1033.210(b)(3)—Designate an AML/CFT Officer

Under the GENIUS Act and the BSA, an “officer” oversees an AML/CFT program.

184

See

12 U.S.C. 5903(a)(5)(A)(i); 31 U.S.C. 5318(h)(1)(B).

1. Proposed 31 CFR 1033.210(b)(3)(iii)—Duties of the AML/CFT Officer

Proposed § 1033.210(b)(3)(iii) would require PPSIs to designate an individual (referred to as an AML/CFT officer) responsible for establishing and implementing the AML/CFT program and coordinating and monitoring day-to-day compliance with the requirements and prohibitions of the BSA and FinCEN's implementing regulations. FinCEN's view is that the individual serving as the AML/CFT officer must be qualified for that role and not overburdened with other responsibilities at the institution.

The proposed rule is not intended to be primarily concerned about the formal title of the individual responsible for establishing and implementing the AML/CFT program and coordinating and monitoring day-to-day compliance; instead, the proposed rule focuses on the AML/CFT officer's position in the PPSI's organizational structure that enables the AML/CFT officer to effectively establish and implement the PPSI's AML/CFT program. The AML/CFT officer's authority, independence, and access to resources within the PPSI are critical. An AML/CFT officer should have decision-making capability regarding the AML/CFT program and sufficient functional stature within the organization to ensure that the program meets BSA requirements.

The AML/CFT officer's access to resources may include the following: adequate compliance funds and staffing with the skills and expertise appropriate to the PPSI's risk profile, size, and complexity; an organizational structure that supports compliance and effectiveness; and sufficient technology and systems to support the timely identification, measurement, monitoring, reporting, and management of the PPSI's ML/TF risks. An AML/CFT officer with conflicting responsibilities that adversely impact the officer's ability to effectively coordinate and monitor day-to-day AML/CFT compliance generally would not fulfill this requirement.

2. Proposed 31 CFR 1033.210(b)(3)(i) and (ii)—The AML/CFT Officer Located in the United States and Accessible to Regulators

Proposed § 1033.210(b)(3)(i) and (ii) would require a PPSI's AML/CFT officer be located in the United States and accessible to, and subject to oversight and supervision by FinCEN and its designee. Under the proposed rule, while the AML/CFT officer must be located in the United States, personnel located outside of the United States would still be permitted to perform certain AML/CFT functions. This language does not alter existing regulations and guidance that generally prohibit the sharing of SARs with personnel located outside of the United States other than limited circumstances such as a bank's foreign head office or controlling company.

185

See, e.g.,

FinCEN,

Financial Crimes Enforcement Network; Confidentiality of Suspicious Activity Reports,

75 FR 75593 (Dec. 3, 2010);

see also

FinCEN, the Board, FDIC, OCC, and Office of Thrift Supervision,

Interagency Guidance on Sharing Suspicious Activity Reports with Head Offices and Controlling Companies

(Jan. 20, 2006), available at

https://www.fincen.gov/system/files/guidance/sarsharingguidance01122006.pdf.

3. Proposed 31 CFR 1033.210(b)(3)(iv)—Restriction on Officers With Felony Convictions

Under the GENIUS Act, PPSIs must designate an “officer” to supervise its AML/CFT program.

186

This GENIUS Act provision reflects the BSA requirement that a financial institution designate a “compliance officer” for its AML/CFT program.

187

The GENIUS Act further provides that no individual who has been convicted of a “felony offense involving insider trading, embezzlement, cybercrime, money laundering, financing of terrorism, or financial fraud” may serve as an “officer” or director of a PPSI.

188

186

See

12 U.S.C. 5903(a)(5)(A)(i).

187

See

31 U.S.C. 5318(h)(1)(B).

188

See

12 U.S.C. 5903(f).

Given the use of the term “officer” in the GENIUS Act's prohibition on individuals being convicted of felonies involving certain activity and the use of the

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.