Last updated: October 2026

Stablecoin compliance means meeting the rules that apply to your role. For a US issuer of payment stablecoins, that is the GENIUS Act's approval, reserve, AML and sanctions requirements; for a bank or fintech that holds, moves or pays out stablecoins, it is the AML, sanctions and travel-rule obligations it already has. The GENIUS Act was signed on July 18, 2025 and takes effect on January 18, 2027, but as of October 28, 2026 its AML and sanctions rules are still proposals. In the EU, MiCA has governed e-money tokens and asset-referenced tokens since June 30, 2024.

TL;DR

• Issuers carry the GENIUS Act's program duties; banks and fintechs that hold or move stablecoins keep the AML and sanctions obligations they already have.

• A permitted payment stablecoin issuer is a Bank Secrecy Act financial institution: it needs AML, customer identification and sanctions programs, and the ability to block, freeze and reject unlawful transactions.

• As of October 28, 2026, the OCC's rule is the only final implementing rule, and it leaves BSA, AML and sanctions to a separate rulemaking that is still proposed.

• Under MiCA, the rules for e-money tokens and asset-referenced tokens have applied since June 30, 2024.

What stablecoin compliance means

Stablecoin compliance is the set of obligations that attach to what a firm does with stablecoins. An issuer must meet rules on approval, reserves, redemption, AML and sanctions, and must be able to freeze its tokens. A firm that holds, transfers or pays out stablecoins owes customer due diligence, transaction monitoring, suspicious activity reports, sanctions screening and, where it applies, the travel rule.

• Issuers. The GENIUS Act (Public Law 119-27, July 18, 2025) treats a permitted payment stablecoin issuer as a Bank Secrecy Act financial institution, subject to federal sanctions, AML and customer identification laws.

• Banks, money transmitters and fintechs. They keep their existing obligations. FinCEN's guidance FIN-2019-G001 (May 9, 2019) says exchangers and administrators of virtual currency generally qualify as money transmitters.

• Every firm, for sanctions. OFAC's virtual currency guidance (October 15, 2021) says sanctions obligations apply equally to virtual currency and fiat transactions.

Firms are asking now because the federal framework is close. One SVP risk and compliance officer, commercial banking, at a bank framed the question this way: "with the genius act and probably the clarity act not far behind, you know, what, how can we, what type of tools do we need." An executive at a neobank offering stablecoin rails, pre-launch, was blunter: "Really, the only thing stopping us from launching even more broadly is just compliance, figuring it out."

What the GENIUS Act covers, and who may issue

The GENIUS Act (Public Law 119-27, signed July 18, 2025) regulates payment stablecoins: digital assets used for payment or settlement that the issuer must redeem for a fixed amount of monetary value. The Act makes it unlawful for anyone other than a permitted payment stablecoin issuer to issue one in the United States (section 3(a)). The definition excludes national currencies, securities and deposits, so a deposit recorded using distributed ledger technology, a tokenized deposit, is not a payment stablecoin.

Under section 2(23), a permitted payment stablecoin issuer is a US-formed entity that is one of three things:

• a subsidiary of an insured depository institution approved to issue under section 5;

• a federal qualified issuer: a nonbank entity, uninsured national bank or federal branch approved by the OCC;

• a state qualified issuer, approved by a state payment stablecoin regulator.

A state qualified issuer with no more than $10 billion outstanding may opt for a substantially similar state regime (section 4(c)). Above $10 billion, a state qualified issuer that is not a state-chartered depository institution must move to the federal framework within 360 days or stop issuing new coins until it is back under the threshold, unless the primary federal regulator waives it (section 4(d)). The OCC approves federal qualified issuers, and the FDIC, the Federal Reserve and the NCUA have each proposed rules for the issuers under their jurisdiction, none final as of October 28, 2026.

The GENIUS Act timeline and the status of its rules

The GENIUS Act was signed on July 18, 2025 and takes effect on January 18, 2027, and as of October 28, 2026 only one of its implementing rules is final. Section 20 sets the effective date as the earlier of 18 months after enactment or 120 days after the primary federal regulators issue final rules, and the OCC's final rule (91 FR 67000, October 23, 2026) gives January 18, 2027.

In effect or final, as of October 28, 2026:

• The OCC's final rule for issuers under its jurisdiction (91 FR 67000, effective January 18, 2027). OCC News Release 2026-92 (October 21, 2026) says it covers everything the OCC must write under the Act except BSA, AML and OFAC sanctions, which will follow in a separate rulemaking with Treasury.

• Treasury's interim final rule on how the Stablecoin Certification Review Committee reviews state certifications (91 FR 61688, effective September 30, 2026).

Still proposals, as of October 28, 2026:

• FinCEN and OFAC's joint AML/CFT and sanctions program rule for permitted issuers (91 FR 18582, April 10, 2026).

• The joint customer identification program rule (91 FR 37234, June 22, 2026).

• The OCC's and FDIC's BSA and sanctions standards for the issuers they supervise (91 FR 37840, June 24, 2026; 91 FR 34171, June 5, 2026).

• Treasury's rule on issuance, offer and sale (91 FR 53368, August 18, 2026).

• The Federal Reserve's two proposals (including 91 FR 61580, September 29, 2026; comments due November 30, 2026).

Section 13(a) of the Act required implementing rules by July 18, 2026; as of October 28, 2026 that deadline has passed with only the OCC's rule final. From July 18, 2028, a digital asset service provider may not offer or sell a payment stablecoin to a person in the United States unless a permitted issuer issued it (section 3(b)(1)). OCC Bulletin 2026-51 (October 21, 2026) says a primary federal regulator may waive the Act's requirements for up to 12 months from January 18, 2027 for an applicant with a pending application.

As a result, as of October 28, 2026, an issuer preparing for January 18, 2027 is building its AML and sanctions program against proposals, because the one final rule leaves BSA, AML and sanctions to a separate rulemaking.

The table compares the three main regimes by coverage, supervisor and status.

Common misreadings of where the rules stand

• The Act is not yet in force. It takes effect on January 18, 2027.

• The OCC's final rule is not the AML rule. It excludes BSA, AML and sanctions, and as of October 28, 2026 the rules that cover them are still proposals.

• OFAC records are now kept for 10 years. OFAC's 2021 virtual currency guidance still says five years, but OFAC's final rule of March 21, 2025 (90 FR 13286) extended recordkeeping to 10 years.

AML and sanctions obligations for stablecoin issuers

A permitted payment stablecoin issuer is treated as a financial institution under the Bank Secrecy Act, so the GENIUS Act requires it to run a full AML and sanctions program and to be able to block, freeze and reject unlawful transactions. Section 4(a)(5) of the Act lists what the issuer must maintain:

• an effective AML program, with appropriate risk assessments and a designated officer to supervise it;

• retention of appropriate records, and monitoring and reporting of suspicious transactions;

• an effective customer identification program, covering account holders, high-value transactions and appropriate enhanced due diligence;

• an effective economic sanctions compliance program, including verification of sanctions lists;

• technical capabilities, policies and procedures to block, freeze and reject transactions that violate federal or state law.

Section 4(a)(6)(B) adds that an issuer may issue only if it can comply, and will comply, with any lawful order. The Act defines a lawful order as a final and valid order from a court or authorized federal agency requiring the issuer to seize, freeze, burn or prevent the transfer of its payment stablecoins, with the coins or accounts specified.

What is still to come

Treasury must adopt rules tailored to issuers' size and complexity (section 4(a)(5)(B)), and FinCEN must issue guidance and rules on novel ways to detect illicit activity by July 18, 2028 (section 9(d)). FinCEN and OFAC's April 10, 2026 proposal (91 FR 18582) would limit FinCEN enforcement against an issuer that has established an AML/CFT program to significant or systemic failures to implement it (proposed 31 CFR 1033.221(b)). As of October 28, 2026, that limit is a proposal, covers the AML/CFT program but not OFAC's sanctions program, and would not protect an issuer that never established a program.

What the program looks like in practice

A head of product, stablecoin platform, at a stablecoin issuance platform (stablecoin and tokenized deposits) put it this way: "there are multiple facets that we have to take care of when it comes to compliance." A senior director, global compliance, at a stablecoin issuer and payments company described three layers: screening before a transaction, monitoring after it, and ongoing monitoring of customers' wallets.

A financial crimes risk lead at a bank that issued its own stablecoin expects the issuer role to bring new tooling: "It's clear that we are thinking about potentially being a ppsi. Once those rules come out, we're going to need both wallet screening capabilities and network monitoring capabilities."

The sanctions side of the program, from which lists to screen to blocking, rejecting and reporting, is covered in our guide to OFAC sanctions screening and list management.

Reserves, redemption and disclosure, in brief

Reserve and redemption rules are prudential requirements, covered here in brief. Section 4(a)(1) of the GENIUS Act requires identifiable reserves of at least 1 to 1, in assets such as US currency, insured deposits and Treasury bills with 93 days or less to maturity. The issuer must publish its reserve composition monthly, examined by a registered accounting firm and certified by its CEO and CFO, and must publish a redemption policy with all fees disclosed. The OCC's final rule of October 23, 2026 defines timely redemption as no more than two business days after the request.

State regimes and New York

States can run their own regimes for state qualified issuers with no more than $10 billion outstanding that opt in, if the regime is substantially similar to the federal framework (GENIUS Act, section 4(c)). Treasury's interim final rule for the Stablecoin Certification Review Committee (91 FR 61688, effective September 30, 2026) sets out how state certifications are reviewed.

New York's Department of Financial Services issued guidance on June 8, 2022 for US dollar-backed stablecoins issued by the virtual currency entities it regulates. Under that guidance, a stablecoin must be fully backed by a reserve at least equal to the outstanding coins at the end of each business day, holders may redeem at par, by default within two full business days, and an independent certified public accountant must examine the reserve at least monthly. Before relying on the 2022 guidance, confirm with the Department whether a later rule has replaced it.

Stablecoins under MiCA

In the EU, MiCA's rules for asset-referenced tokens and e-money tokens have applied since June 30, 2024, and the rest of the regulation since December 30, 2024 (Regulation (EU) 2023/1114, Article 149). An e-money token references the value of one official currency; an asset-referenced token references another value or right, or a combination, including one or more official currencies (Article 3).

Only the issuer of an e-money token may offer it to the public or seek its admission to trading, and that issuer must be authorized as a credit institution or an electronic money institution and have notified a crypto-asset white paper to its competent authority (Article 48). An asset-referenced token may be offered only by its issuer, which must be authorized by its home member state's competent authority under Article 21, or be a credit institution that complies with Article 17 (Article 16).

Tokens classed as significant come under the European Banking Authority, which supervises significant asset-referenced tokens and parts of the regime for significant e-money tokens (Article 117). The transitional period for crypto-asset service providers ended on July 1, 2026 at the latest (Article 143(3)). How the EU applies the travel rule to transfers between these providers is covered in our guide to the crypto travel rule.

Obligations for banks and fintechs that hold or move stablecoins

A bank or fintech that holds, transfers or pays out stablecoins keeps the AML and sanctions obligations it already has, applied to a new rail. FinCEN's guidance FIN-2019-G001 (May 9, 2019) says exchangers and administrators of virtual currency generally qualify as money transmitters under the Bank Secrecy Act; an administrator issues a virtual currency and has the authority to redeem it.

OFAC's Sanctions Compliance Guidance for the Virtual Currency Industry (October 15, 2021) applies sanctions obligations to virtual currency exactly as to fiat and encourages a risk-based program that generally includes sanctions list and geographic screening. Blocked property and rejected transactions must be reported within 10 business days. The guidance's statement that records must be kept for five years is out of date: OFAC's final rule of March 21, 2025 (90 FR 13286) extended that requirement to 10 years.

Digital asset service providers face their own GENIUS Act limits once the Act takes effect. A provider may not offer, sell or otherwise make available in the United States a payment stablecoin from a foreign issuer unless that issuer can, and will, comply with lawful orders (section 3(b)(2)). A provider that knowingly breaches a Treasury prohibition on secondary trading faces civil monetary penalties (section 8(b)(4)).

Role can change inside one firm

The senior director, global compliance, at the stablecoin issuer and payments company described above listed its business lines this way: "We're a payments company. We're a stablecoin issuer, we're an otc trading desk." Each line can carry different obligations.

The financial crimes risk lead at the bank that issued its own stablecoin said the bank knows its direct customers, but holders who acquire the coin in the secondary market bring new, ongoing obligations that should not be mixed up with the direct-customer program. A senior director, product management, at a stablecoin issuer described flows in which an originating institution, the issuer and a beneficiary institution each sit between sender and receiver, which leaves open who screens and monitors whom. A senior financial-crime compliance oversight analyst at a payroll and HR fintech said stablecoin payouts would bring new obligations, starting with screening wallet addresses for sanctions.

Where stablecoin flows meet other programs

Banks and money transmitters that move stablecoins apply the travel rule where it covers their transmittals. FinCEN and OFAC's April 10, 2026 proposal (91 FR 18582), not final as of October 28, 2026, would apply it expressly to permitted issuers. How the travel rule applies to stablecoin transfers, including FinCEN's April 2026 proposal to apply it to permitted issuers, is covered in our guide to the crypto travel rule.

Sponsor banks sit in the chain too: the stablecoin issuance platform quoted earlier said its licensing timeline depended on clearing its sponsor bank's due diligence. How a bank oversees the AML programs of the fintechs it sponsors is covered in our guide to sponsor bank AML oversight.

How AML controls change by corridor and jurisdiction when value moves across borders is covered in our guide to cross-border AML workflows.

How Oscilar fits

Oscilar is the agentic risk platform for fraud, credit, onboarding, and compliance, serving banks, sponsor banks and fintechs, including payments companies. It is a unified platform: real-time data fabric, device and behavior intelligence, rules, and case management in one stack, with agents native to it.

For a stablecoin program, the platform applies to the fiat side of the AML program and to the case work an alert creates. That work is recorded in a full audit trail per decision with stored reasoning, human-in-the-loop by design. See how Oscilar supports AML for fintechs.

Frequently asked questions

When does the GENIUS Act take effect?

The GENIUS Act takes effect on January 18, 2027, 18 months after it was signed on July 18, 2025, the date the OCC's final rule of October 23, 2026 also gives. As of October 28, 2026, the OCC's rule is the only final implementing rule.

Are stablecoin issuers subject to the Bank Secrecy Act?

Yes. The GENIUS Act treats a permitted payment stablecoin issuer as a financial institution for Bank Secrecy Act purposes. The implementing rules, including FinCEN and OFAC's April 10, 2026 proposal, are still proposals as of October 28, 2026.

Who supervises payment stablecoin issuers in the United States?

It depends on the issuer's type. The OCC approves federal qualified issuers, and the FDIC, the Federal Reserve and the NCUA have each proposed rules, not final as of October 28, 2026, for issuers under their jurisdiction. A state qualified issuer with no more than $10 billion outstanding may instead be regulated by its state, under a substantially similar regime.

Can a stablecoin issuer freeze tokens?

Yes, and under the GENIUS Act a permitted issuer must be able to block, freeze and reject transactions that violate federal or state law. It may issue only if it can comply with lawful orders to seize, freeze, burn or prevent the transfer of its payment stablecoins.

Is a tokenized deposit a payment stablecoin?

No. The GENIUS Act excludes deposits from the definition of a payment stablecoin, including a deposit recorded using distributed ledger technology.

Do stablecoin transfers fall under the travel rule?

Often, yes. Banks and money transmitters apply it where it covers their transmittals, and FinCEN and OFAC's April 10, 2026 proposal, not final as of October 28, 2026, would expressly apply it to permitted issuers. The details are covered in our guide to the crypto travel rule.