The Financial Crimes Enforcement Network (FinCEN) has proposed a pair of rules in 2026 that would bring permitted payment stablecoin issuers (PPSIs) under existing Bank Secrecy Act (BSA) obligations, formalizing the anti-money laundering (AML), sanctions, and customer identification requirements first mandated by the GENIUS Act signed into law in July 2025.

In April 2026, FinCEN and the Treasury's Office of Foreign Assets Control (OFAC) jointly proposed rules implementing the GENIUS Act's AML, countering the financing of terrorism (CFT), and sanctions compliance requirements. In June 2026, FinCEN followed with a second proposed rule, issued alongside the federal banking agencies, addressing Customer Identification Program (CIP) requirements for stablecoin issuers.

The framework does not build a new AML regime from scratch. It extends decades-old BSA and sanctions principles to a new category of regulated entity, treating PPSIs as financial institutions and requiring risk-based AML programs proportionate to the nature, scale, and complexity of their operations.

What do the proposals actually require?

The April proposal obliges issuers to establish risk-based AML programs, effective sanctions compliance programs, and controls for suspicious activity monitoring and reporting. The June CIP proposal mirrors existing bank CIP regulations rather than creating a cryptocurrency-specific identification framework.

Issuers will need to:

• Conduct enterprise-wide risk assessments
• Establish written policies and procedures
• Build customer due diligence and transaction monitoring processes
• File Suspicious Activity Reports (SARs) when necessary
• Maintain records and ensure governance and independent testing
• Collect and verify customer identifying information through documentary or non-documentary methods

For prospective issuers, the obligations closely resemble those imposed on banks, money services businesses, and other regulated financial institutions. Established fintech firms already operate under comparable frameworks, but newer digital asset companies face significant investment requirements. Digital-native onboarding — automated identity verification tools and blockchain analytics — is expected to play a central role in meeting the CIP obligations efficiently.

Where does the compliance perimeter end?

A defining feature of both proposals is the distinction between primary-market and secondary-market activity. FinCEN has signaled that AML and CIP obligations attach primarily when issuers directly engage with customers through issuance, redemption, custody, conversion, or similar services.

The agency generally avoids imposing obligations on every secondary-market stablecoin transaction occurring on exchanges, decentralized platforms, or peer-to-peer networks. This distinction helps clarify regulatory responsibilities between issuers and the broader trading ecosystem.

Why does the approach look familiar?

The most notable aspect of FinCEN's approach is how little of it is novel. The CIP proposal explicitly models its requirements on existing bank CIP regulations, preserving concepts such as customer identification, verification, record retention, and reliance on third parties. The emphasis remains on establishing a reasonable belief that the issuer knows the true identity of its customers.

The principal difference lies in application, not substance. Stablecoins introduce considerations absent from traditional banking: pseudonymous transactions, digital wallet structures, cross-border transfers, and decentralized ecosystem participants. The proposals address these operational realities while preserving the same risk-based compliance management that regulators have long applied to banks, broker-dealers, and money transmitters.

What happens before finalization?

The rules remain in proposed form, and industry participants can still shape final implementation through the regulatory comment process. Several questions are unresolved, including the treatment of intermediated business models, wallet providers, embedded finance platforms, and the precise boundary between primary-market and secondary-market activities.

Further guidance from the Office of the Comptroller of the Currency, the Federal Reserve, the FDIC, state banking regulators, and potentially Congress may refine the environment further. New York's recent effort to align its stablecoin framework with the GENIUS Act likely foreshadows similar state-level initiatives nationwide. Regulators are expected to weigh substantial industry feedback before finalizing the framework, leaving issuers a limited window to shape the final rules.