GENIUS Act AML & Sanctions Rules Explained: What Stablecoin Issuers Must Do Before FinCEN’s Deadline

The GENIUS Act has changed the compliance outlook for companies issuing payment stablecoins in the United States. Issuers will face direct obligations relating to anti-money laundering, customer identification, suspicious activity reporting, sanctions screening and transaction controls.

However, the compliance timeline is often misunderstood.

The GENIUS Act is already law. Nevertheless, the detailed rules issued by the Financial Crimes Enforcement Network (FinCEN), the Office of Foreign Assets Control (OFAC) and the federal banking regulators remain in the rulemaking process.

Therefore, stablecoin issuers must distinguish between requirements written into the Act, requirements contained in proposed regulations and future obligations that will not become binding until final rules take effect.

This guide explains the current position as of 15 September 2026 and outlines the practical work issuers should complete before the applicable deadlines.

Important: This article provides general educational information and does not constitute legal advice. Stablecoin issuers should obtain advice based on their business model, licence, customers and regulatory status.

What Is the GENIUS Act?

The Guiding and Establishing National Innovation for U.S. Stablecoins Act, commonly called the GENIUS Act, became Public Law 119-27 on 18 July 2025.

It creates a regulatory framework for payment stablecoins in the United States. Under the Act, only an authorised permitted payment stablecoin issuer, or PPSI, may generally issue a payment stablecoin in the country.

A payment stablecoin is broadly a digital asset designed for payment or settlement. Its issuer must undertake to redeem it for a fixed amount of monetary value and represent that it will maintain a stable value relative to that amount.

The framework creates three main categories of permitted issuers:

• Subsidiaries of insured depository institutions or insured credit unions
• Federal qualified payment stablecoin issuers
• State qualified payment stablecoin issuers

In addition to licensing and supervision, issuers will face reserve, redemption, capital, liquidity, risk-management, AML and sanctions requirements. The Act also requires issuers to maintain reserves backing outstanding stablecoins on at least a one-to-one basis.

Most importantly for financial crime compliance, the Act treats a PPSI as a financial institution under the Bank Secrecy Act. Consequently, PPSIs become subject to federal laws concerning AML, economic sanctions, customer identification and due diligence. Read the enacted GENIUS Act.

What Is FinCEN’s Stablecoin Compliance Deadline? 

There is no single date that can accurately be described as “FinCEN’s deadline.” Instead, issuers must monitor several separate dates.

The Act takes effect on the earlier of:

1. 18 months after enactment, which is 18 January 2027; or
2. 120 days after federal payment stablecoin regulators issue final implementing regulations.

Treasury currently describes 18 January 2027 as the expected effective date for the licensing restriction. From that date, a person generally may not issue a payment stablecoin in the United States without the appropriate federal or state approval. See Treasury’s August 2026 proposed rule announcement.

However, FinCEN and OFAC proposed that their detailed AML and sanctions programme rules would become effective 12 months after the final rules are issued. Therefore, issuers must monitor the final Federal Register notices rather than treating 18 January 2027 as the deadline for every individual obligation.

Are the FinCEN and OFAC Rules Final?

No. As of 15 September 2026, the main documents discussed below are proposed rules.

FinCEN and OFAC published their joint AML and sanctions proposal on 10 April 2026. In addition, FinCEN and the federal banking agencies published a separate proposed Customer Identification Program rule on 22 June 2026.

Therefore, thresholds, definitions and implementation details may change before finalisation.

However, the central AML and sanctions duties are written into the GENIUS Act itself. Issuers should not postpone programme development merely because the technical regulations remain proposed.

Furthermore, many stablecoin issuers may already qualify as money transmitters and money services businesses. FinCEN notes that companies administering, issuing and redeeming convertible virtual currency are generally already subject to relevant BSA duties unless an exemption applies. Review FinCEN and OFAC’s proposed rule.

Core GENIUS Act AML Requirements

The GENIUS Act requires permitted payment stablecoin issuers to maintain effective, risk-based AML programmes. FinCEN’s proposal would require four minimum programme elements.

1. Risk-Based Policies, Procedures and Controls

A PPSI would need written controls designed around its actual money laundering and terrorist financing risks.

Its risk assessment should consider:

• Products and services
• Customer types
• Distribution channels
• Countries and geographic exposure
• Blockchains on which the stablecoin operates
• Primary- and secondary-market activity
• Wallet and counterparty exposure
• Cross-chain and interoperability risks
• Cybercrime, fraud and sanctions-evasion typologies

FinCEN proposes requiring issuers to review applicable national AML/CFT priorities and update their risk assessments when material changes occur.

For example, an update may be necessary when an issuer deploys its stablecoin on a new blockchain, introduces a new redemption channel, enters a new country or changes its smart-contract functionality.

2. A Designated AML/CFT Officer

Every PPSI would need to designate an individual responsible for establishing and operating the AML/CFT programme.

Under the proposal, the officer would need to be located in the United States and accessible to FinCEN or its delegate. However, supporting compliance personnel could perform some functions from other countries.

The officer must have suitable authority, knowledge and resources. Simply assigning the title to an employee without operational independence or sufficient staff would not create an effective programme.

3. Independent Testing

An issuer would need an independent audit function to test its AML/CFT programme against legal requirements and its documented risk profile.

The reviewer may be internal or external. Nevertheless, the reviewer must be independent of the programme functions being tested.

Testing should examine areas such as:

• Customer onboarding
• Transaction-monitoring coverage
• Alert investigation quality
• SAR decisions
• Sanctions screening
• Wallet-risk controls
• Record retention
• Smart-contract intervention capabilities
• Staff training
• Governance and issue remediation

The frequency and scope of testing should reflect the issuer’s size, complexity and risk.

4. Ongoing Employee Training

FinCEN’s proposal also requires ongoing AML/CFT training.

Training should be tailored to each employee’s responsibilities. For example, developers need to understand how product decisions affect freezing and lawful-order capabilities. Meanwhile, investigators need practical training on blockchain tracing, alert escalation and SAR documentation.

Training should also be updated when regulations, sanctions lists, typologies, products or technologies change. 

Customer Identification and Due Diligence

The GENIUS Act requires an effective Customer Identification Program, or CIP. It specifically refers to identifying and verifying account holders, addressing high-value transactions and applying suitable enhanced due diligence.

Under the proposed CIP rule, a PPSI would need a written, risk-based programme that enables it to form a reasonable belief that it knows each customer’s true identity.

Before opening an account, the issuer would generally collect:

• The customer’s name
• Date of birth for an individual or date of formation for an organisation
• Residential, business or mailing address, as applicable
• A tax or other identification number

The issuer would then verify the information using documents, non-documentary methods or a combination of both.

Furthermore, procedures must explain what happens when identity verification fails. They should cover when the issuer will refuse to open an account, limit its use, close it or consider filing a SAR.

The proposed rule mainly defines customers as people dealing directly with the issuer. A person obtaining or redeeming a stablecoin through another channel would not automatically become the issuer’s customer solely because of that activity. See the proposed PPSI Customer Identification Program rule.

Suspicious Activity Reporting

The GENIUS Act requires PPSIs to monitor and report suspicious transactions. FinCEN’s proposal would establish a $5,000 SAR threshold for a transaction or aggregated pattern conducted or attempted by, at or through the PPSI.

A SAR would be required when the issuer knows, suspects or has reason to suspect that activity:

• Involves proceeds of illegal activity
• Is intended to conceal the source, ownership or control of illegal funds
• Is structured to avoid BSA requirements
• Has no apparent lawful or business purpose
• Is inconsistent with the customer’s expected activity
• Uses the issuer to facilitate criminal conduct

Under the proposal, the issuer would generally file within 30 calendar days of initial detection. If no suspect can initially be identified, filing may be delayed for up to another 30 days. However, it could not be delayed beyond 60 days from initial detection.

SARs and information revealing their existence must remain confidential. In addition, the issuer would retain the SAR and supporting documentation for five years.

The $5,000 threshold is proposed, not yet final. Stablecoin businesses already operating as MSBs may currently face a different SAR threshold. Therefore, issuers must apply the rules that govern their present regulatory status until replacement requirements become effective.

Recordkeeping, CTRs and the Travel Rule

FinCEN proposes applying standard BSA recordkeeping and reporting provisions to PPSIs.

These include Currency Transaction Reports for qualifying transactions involving more than $10,000 in physical currency, subject to applicable exemptions.

The proposal would also make clear that PPSIs must comply with the BSA Recordkeeping Rule and Travel Rule. For covered funds transfers or transmittals of $3,000 or more, financial institutions must collect, retain and transmit specified originator and beneficiary information.

FinCEN is not proposing a new stablecoin-specific Travel Rule threshold. Instead, it proposes clarifying that payment stablecoin transmittal orders fall within the existing framework.

Issuers should therefore map data flows between their platform, banks, custodians, exchanges, wallet providers and other financial institutions. They must be able to obtain, validate, retain and transmit the required information without losing the link between off-chain customer records and on-chain activity.

OFAC Sanctions Compliance Requirements 

The GENIUS Act separately requires every PPSI to maintain an effective economic sanctions compliance programme, including verification against sanctions lists.

OFAC’s proposal follows five core elements:

1. Senior management commitment
2. Sanctions risk assessment
3. Risk-based internal controls
4. Independent testing or auditing
5. Sanctions compliance training

The programme must cover the complete lifecycle of an issuer’s stablecoin, including issuance, trading, holding, transferring and redemption.

At a minimum, sanctions-screening tools should detect digital currency addresses included on OFAC’s Specially Designated Nationals and Blocked Persons List. However, list screening alone may not identify indirect exposure, sanctioned jurisdictions, nested services or wallets connected to designated actors.

Therefore, issuers may need a combination of:

• Customer and beneficial-owner screening
• Wallet-address screening
• Blockchain analytics
• IP and geolocation controls
• Historical re-screening
• Transaction monitoring
• Escalation and case-management workflows
• Smart-contract intervention controls
• OFAC blocking and rejection reporting procedures

OFAC sanctions can operate on a strict-liability basis. As a result, a company may face civil exposure even when it did not know that a prohibited person or interest in blocked property was involved.

Blocking, Freezing and Rejecting Transactions

One of the most significant GENIUS Act requirements is technological, not merely procedural.

A PPSI must have the capability, policies and procedures to block, freeze or reject specific transactions that violate federal or state law. Moreover, an issuer may issue stablecoins only if it can comply—and will comply—with lawful orders.

A lawful order may require the issuer to seize, freeze, burn or prevent the transfer of specified stablecoins.

FinCEN’s proposal would extend these capabilities to relevant secondary-market activity. Therefore, it may not be enough to screen only customers who mint or redeem directly with the issuer.

The issuer’s architecture should be able to respond when a blocked person controls stablecoins in a self-hosted wallet or when authorities issue an order involving tokens circulating on the secondary market.

However, this does not mean every PPSI would have a general FinCEN duty to file SARs on every secondary-market transfer. The current proposal does not impose a blanket secondary-market SAR obligation solely because a third-party transfer interacts with the issuer’s smart contract.

That distinction is critical:

• AML SAR monitoring: Under the proposal, no blanket requirement applies to every secondary-market transaction.
• Sanctions controls and lawful orders: Technical capabilities must extend to applicable secondary-market activity.

The 180-Day Certification Requirement

After receiving approval as a PPSI, an issuer must submit a certification to its federal or state payment stablecoin regulator within 180 days.

The certification must confirm that the issuer has implemented AML and sanctions programmes reasonably designed to prevent it from facilitating money laundering, terrorist financing and related illicit activity. The issuer must provide a new certification annually.

Failure to submit the certification may lead to revocation of the issuer’s approval. In addition, knowingly submitting a false certification may trigger criminal penalties.

Therefore, certification should be supported by documented evidence, including:

• Approved programme documents
• Current risk assessments
• Board or senior management approval
• Testing results
• Training records
• Monitoring and screening configurations
• Issue-remediation records
• Compliance staffing and accountability
• Evidence of operational freezing and lawful-order capabilities

What Stablecoin Issuers Should Do Now

Stablecoin issuers should not wait for the final rules before building their compliance framework.

1. Confirm the Regulatory Perimeter

Determine whether the product meets the Act’s definition of a payment stablecoin and whether issuance occurs in the United States. Also assess current MSB, money-transmitter and state licensing obligations.

2. Select the Correct Licensing Route

Evaluate whether the issuer will apply as a depository-institution subsidiary, federal qualified issuer or state qualified issuer. The choice affects the application process and primary regulator.

3. Complete an Enterprise Risk Assessment

Document customer, product, geographic, transaction, blockchain, distribution and technology risks. Include primary-market relationships and the ways the stablecoin may be used after issuance.

4. Build AML, CIP and Sanctions Programmes

Prepare written programmes that clearly separate legal requirements, operational responsibilities and system controls. Nevertheless, integrate overlapping areas such as risk assessment, customer screening and investigations.

5. Test the Technology

Issuers should test whether their systems can screen wallets, detect risky exposure, restrict transactions, freeze assets and respond to lawful orders across every supported blockchain.

Controls that exist only in policy documents will not meet a requirement for technological capability.

6. Prepare for Examination and Certification

Create an evidence register connecting each requirement to its policy, control owner, system, testing record and management approval. This will make regulatory examination and the 180-day certification process more manageable.

Frequently Asked Questions

Is 18 January 2027 FinCEN’s AML compliance deadline?

Not exactly. It is the expected general effective date of the GENIUS Act unless final implementing regulations trigger an earlier date. FinCEN and OFAC separately proposed that their detailed AML and sanctions rules take effect 12 months after the final rules are issued.

Are FinCEN’s stablecoin AML rules final?

No. As of 15 September 2026, the main AML, sanctions and CIP requirements remain proposed. However, the underlying GENIUS Act is law, and many issuers already have BSA obligations as MSBs.

Will stablecoin issuers have to file SARs?

Yes. The Act requires suspicious transaction monitoring and reporting. FinCEN has proposed a $5,000 threshold for covered suspicious transactions conducted or attempted by, at or through a PPSI.

Must issuers monitor secondary-market stablecoin transfers?

The proposal does not create a blanket AML or SAR-monitoring duty for every secondary-market transfer. However, sanctions controls and the technical ability to block, freeze, reject or comply with lawful orders would extend to applicable secondary-market activity.

Are sanctions screening and AML monitoring the same?

No. They may use shared data and technology, but they serve different legal purposes. AML monitoring focuses on identifying and reporting suspicious activity. Sanctions compliance focuses on preventing or controlling prohibited dealings involving sanctioned persons, property or jurisdictions.

What happens if an issuer cannot freeze its stablecoins?

The GENIUS Act states that a PPSI may issue payment stablecoins only if it has the technological capability to comply with lawful orders. Therefore, an issuer whose architecture cannot perform required interventions may face a fundamental licensing and compliance problem.

Final Takeaway

The GENIUS Act moves stablecoin compliance beyond registration and written AML policies. Permitted issuers will need operational customer identification, transaction monitoring, SAR reporting, sanctions screening, recordkeeping and effective technical controls.

Although the final FinCEN and OFAC rules remain pending, the direction is clear. Issuers must be able to connect customer information with blockchain activity, identify financial crime risks and intervene when transactions violate sanctions or lawful orders.

Starting early is essential. The most difficult controls, particularly multi-chain monitoring, secondary-market sanctions detection, asset freezing and lawful-order response, cannot be designed and tested shortly before a regulatory deadline.

To strengthen your understanding of stablecoin regulation, reserves and compliance risk, explore Crypto Compliance Academy’s Stablecoin Issuance, Reserves and Prudential Risk Controls training and build the practical knowledge needed for the next stage of US stablecoin regulation.