GENIUS Act AML Rules Close Comment Period as FinCEN Sets Stablecoin Freeze Mandate

The United States stablecoin industry reached a regulatory inflection point on June 9, 2026, as the public comment period closed on a joint proposed rule from the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) that would transform every Permitted Payment Stablecoin Issuer (PPSI) into a full Bank Secrecy Act (BSA) financial institution, complete with a mandatory technical capability to freeze, block, or burn tokens on demand. The 60-day window, which opened when the rule appeared in the Federal Register on April 10, 2026, attracted comment across the industry, with major issuers, trade associations, and law firms filing responses on provisions that reach deeper into on-chain operations than any previous federal financial crime rule.[1]

What the Rule Requires

The proposed rule, issued jointly by FinCEN and OFAC on April 8, 2026, addresses two parallel frameworks: an AML/CFT compliance program under FinCEN and an effective sanctions compliance program under OFAC.[2] Together they would bring PPSIs fully within the BSA regime that currently governs banks, broker-dealers, and money services businesses, while adding stablecoin-specific obligations tied to smart-contract architecture.

Under the FinCEN track, PPSIs must maintain a written AML/CFT program built around four pillars: risk-based internal policies and controls, a designated compliance officer located in the United States, ongoing employee training, and independent testing of the program. Customer due diligence (CDD) and beneficial ownership information (BOI) collection for legal entity customers would also be required, aligning PPSIs with bank-level identity standards, though FinCEN confirmed that the customer identification program (CIP) requirement will be addressed in a separate rulemaking.[3]

PPSIs would be required to file Suspicious Activity Reports (SARs) on transactions of $5,000 or more on their primary market. This threshold exceeds the $2,000 floor currently applicable to stablecoin issuers classified as money services businesses, a deliberate calibration that FinCEN described as reflecting the institutional nature of primary-market minting and redemption activity. Critically, FinCEN declined to extend a blanket SAR obligation to secondary market transactions, noting that the burden of requiring PPSIs to file SARs concerning secondary market activity would potentially outweigh the likely benefits, given that most illicit stablecoin activity occurs precisely there.[3] Currency Transaction Reports (CTRs) for transactions exceeding $10,000 would also apply to PPSIs' direct customer relationships.[4]

The Freeze Mandate

The provision drawing the most industry scrutiny is the requirement that every PPSI maintain the technical capability to block, freeze, and reject specific or impermissible transactions that violate federal or state law, including compliance with any lawful order requiring the issuer to seize, freeze, burn, or prevent the transfer of issued payment stablecoins.[3] Unlike the SAR carve-out, this obligation extends to both primary and secondary market activity, meaning an issuer must be able to act on an OFAC Specially Designated Nationals (SDN) designation on-chain regardless of whether the blocked address acquired the tokens directly from the issuer.

Morrison Foerster noted that under the proposed OFAC framework, a U.S.-person stablecoin issuer would engage in the prohibited provision of services to a blocked person if it allowed that person to interact with the issuer's smart contract to facilitate secondary market trades.[2] The rule would therefore formalize what issuers such as Circle (USDC), Tether (USDT), Ripple (RLUSD), World Liberty Financial (USD1), and PayPal (PYUSD) already exercise as a contractual or policy matter, converting a discretionary capability into a compliance obligation enforceable by OFAC civil penalties of up to $100,000 per day for material violations and an additional $100,000 per day for knowing violations.[3]

The TRM Labs Beacon Network, an industry real-time tracking infrastructure, had disrupted more than $87 million in illicit stablecoin activity as of May 19, 2026, while the T3 Financial Crime Unit, a joint effort involving Tether and the TRON Foundation, had frozen a cumulative $450 million in USDT linked to illicit activity since its August 2024 launch.[4] These figures underscore that freeze capability is already operational at scale; the proposed rule would standardize and legally mandate it across all PPSIs, not just those that have opted in voluntarily.

GENIUS Act as Operational Framework

The GENIUS Act, enacted in July 2025, established the federal licensing framework for payment stablecoins but left AML and sanctions specifics to Treasury rulemaking. The proposed rule represents the first major operational output of that mandate. Treasury Secretary Scott Bessent framed the proposal in national security terms at its release:

"This proposal will protect the U.S. financial system from national security threats without hindering American companies' ability to forge ahead in the payment stablecoin ecosystem." [1]

The rulemaking runs parallel to the CLARITY Act proceeding through Congress, which addresses market structure for digital assets more broadly. Where the CLARITY Act defines what a stablecoin is, the GENIUS Act AML rule determines what compliance obligations that classification imposes. The freeze mandate is particularly salient given the HTX-USD1 dispute that preceded this comment deadline, in which freeze authority over a dollar-pegged stablecoin became the subject of contested claims between an exchange and an issuer. The proposed rule would make such capability a non-negotiable legal baseline rather than a contractual term subject to negotiation.

The Sullivan and Cromwell analysis noted that the GENIUS Act's sanctions-compliance program requirement represents the first time that federal law has explicitly mandated that a particular U.S. person have an effective sanctions-compliance program, a distinction that applies to PPSIs above and beyond the general OFAC obligations that already bind all U.S. persons.[3] To implement this, OFAC is creating a new Part 502 of its regulations.

GENIUS Act AML Requirements: Key Parameters

Requirement — Standard — Market Scope

AML/CFT Program — Written, risk-based, BSA-compliant — Primary and secondary

SAR Filing Threshold — $5,000 per transaction — Primary market only

CTR Filing Threshold — $10,000 per transaction — Primary market

Beneficial Ownership Collection — Required for legal entity customers — Primary market

Freeze/Block/Reject Capability — Mandatory technical obligation — Primary and secondary

OFAC Sanctions Program — New Part 502 compliance program — Primary and secondary

Recordkeeping Retention — 5 years — All activity

Civil Penalty (material violation) — Up to $100,000 per day — N/A

Final Rule Effective Date — 12 months after issuance — N/A

GENIUS Act Full Effect — Earlier of Jan 18, 2027 or 120 days post-final rule — N/A

Industry Pressure Points

Despite the broadly expected scope of the rule, practitioners identified several provisions generating substantive comment. The American Bankers Association (ABA) and allied trade groups filed a joint letter in April 2026 requesting a 60-day extension of the comment period, citing the complexity of coordinating responses across multiple simultaneous GENIUS Act NPRMs.[5] The request was denied, and the June 9 deadline held.

Key contested issues center on the operational burden of CTR aggregation for sub-$10,000 structured transactions, the mandated freeze response time when OFAC issues a new SDN designation, the speed at which PPSIs must propagate updated sanctions blacklists to their on-chain controls, and whether the secondary market freeze obligation is practically achievable for issuers whose tokens circulate across Ethereum, TRON, Solana, and multiple layer-2 environments simultaneously. Arnold and Porter flagged additional questions around the appropriate scope of BOI collection obligations and whether the Recordkeeping Rule and Travel Rule framework would apply identically to stablecoin transmittal orders as to traditional wire transfers.[2]

FinCEN and OFAC posed nearly 60 specific questions in the NPRM, an unusually wide solicitation that signals the agencies recognize the novelty of applying legacy BSA architecture to programmable money. A final rule is expected later in 2026, with a 12-month implementation runway from issuance before compliance becomes mandatory.[4]

References

[1] U.S. Department of the Treasury, "Treasury Proposes Rule to Implement the GENIUS Act's Requirements to Counter Illicit Finance," April 8, 2026. https://home.treasury.gov/news/press-releases/sb0435

[2] Morrison Foerster, "Treasury Proposes New AML/CFT and Sanctions Obligations for Stablecoin Issuers," May 7, 2026. https://www.mofo.com/resources/insights/260507-treasury-proposes-new-aml-cft-and-sanctions-obligations

[3] Sullivan and Cromwell, "GENIUS Act Implementation: FinCEN, OFAC Propose Rule on AML and Sanctions Compliance Requirements," April 2026. https://www.sullcrom.com/insights/memo/2026/April/GENIUS-Act-Implementation-FinCEN-OFAC-Propose-Rule-AML-Sanctions-Compliance-Requirements

[4] TRM Labs, "What the GENIUS Act PPSI Rule Means for Stablecoin Issuers," May 21, 2026. https://www.trmlabs.com/resources/blog/what-the-genius-act-ppsi-rule-means-for-stablecoin-issuers

[5] American Bankers Association, "Joint Letter Requesting an Extension of Comment Period for GENIUS Act NPRMs," April 21, 2026. https://www.aba.com/advocacy/policy-analysis/extension-request-genius-act-nprms

Explore NextCurrency

• Regulation
• Tether
• USD1
• USDT
• Ethereum
• Circle
• Ripple
• Solana
• PYUSD
• RLUSD