For years, stablecoin issuers operated in a gray zone: registered as money services businesses, screening against OFAC lists as a best practice, but without a purpose-built federal AML rulebook. That era is ending. In April 2026, FinCEN and OFAC issued a joint proposed rulemaking implementing the anti-money laundering and sanctions provisions of the GENIUS Act — the first comprehensive federal compliance framework written specifically for permitted payment stablecoin issuers (PPSIs). The comment period closed on June 9, 2026, with nearly 60 questions posed by the agencies, and the industry is now waiting on a final rule that will take effect 12 months after publication. If your business issues, custodies, converts, or moves stablecoins, the clock has started.
What the Proposal Actually Requires
The joint proposal imposes five broad categories of obligations on PPSIs:
- A written AML/CFT program. Policies and procedures built on a mandatory, documented risk assessment; independent testing; ongoing training; and a designated AML/CFT Officer — with board-level approval required. Notably, the proposal mirrors FinCEN’s broader AML/CFT program modernization effort: customer due diligence folds into the policies-and-procedures pillar, and the program is formally retitled from “BSA/AML” to “AML/CFT.”
- Suspicious activity reporting. PPSIs would file SARs with a $5,000 threshold — but only for transactions on the issuer’s primary market, where the issuer is directly involved. Secondary-market trading of the coin is out of SAR scope.
- Recordkeeping and information sharing. The Recordkeeping and Travel Rules would apply, along with a five-year retention period, and PPSIs would be expressly folded into Sections 314(a) and 314(b) of the USA PATRIOT Act.
- A formal sanctions compliance program. For the first time, OFAC would require a five-element program by regulation: management commitment, periodic sanctions risk assessments, risk-based internal controls, independent testing, and tailored training — covering both primary and secondary markets.
- The ability to block, freeze, and reject. PPSIs must maintain the technical capability to block, freeze, and reject impermissible transactions and comply with any lawful order — again across both primary and secondary markets.
The Detail That Matters: Primary vs. Secondary Market
The most consequential design choice in the proposal is the split between primary-market and secondary-market obligations. SAR duties stop at the issuer’s own mint-and-redeem window, but sanctions controls and freeze capability follow the token wherever it circulates. That asymmetry is deliberate: law enforcement wants issuers to remain the chokepoint for sanctioned wallets even when tokens change hands on exchanges the issuer never sees. Practically, it means every PPSI needs on-chain analytics coverage of its entire token float — not just its direct customers.
A New Enforcement Posture — With a Catch
The proposal adopts FinCEN’s emerging supervisory philosophy: no significant enforcement action for program violations unless the failure is “significant or systemic.” That is genuine relief from gotcha-style exams over isolated technical lapses. But do not misread it as leniency. A missing risk assessment, an untested sanctions screening tool, or a freeze capability that exists on paper but fails in practice is exactly the kind of systemic gap the standard is built to punish. The bar for what counts as a “program” is going up, even as tolerance for minor foot-faults goes down.
Why Non-Issuers Should Care Too
Most of our clients are not stablecoin issuers — they are exchanges, payment platforms, MSBs, and FinTechs that hold or move stablecoins issued by others. The proposal still reshapes their world. Counterparty due diligence expectations will rise: banks and partners will ask whether the coins you support come from a compliant PPSI. Travel Rule interoperability will tighten as issuers standardize data conveyance. And OFAC’s expectation of freeze-capable architecture will cascade into contracts, as issuers push monitoring and attestation duties downstream to distribution partners. If stablecoins touch your rails, your next independent AML audit should test for this.
FinCheck’s Perspective & Way Forward
Our read: the final rule will land close to the proposal, and the 12-month implementation window will be shorter than it feels. Waiting for finalization is a strategy for falling behind. Here is what we recommend doing now:
- Run a gap assessment against the five proposed pillars — especially the formalized risk-assessment process and the five-element sanctions program, which most crypto compliance programs have never documented to OFAC’s framework standard.
- Stress-test your freeze capability. Can you actually block, freeze, and reject a specific token transaction across primary and secondary markets, on order, within hours? If the answer lives in an engineering backlog, that is a finding.
- Extend monitoring to the secondary market. Deploy blockchain analytics across your full token float and define escalation paths for sanctioned-wallet exposure.
- Get board fluency now. Program approval sits with the board. Directors need training on stablecoin-specific illicit finance risk before they are asked to sign.
Regulation is no longer the threat to stablecoins — unpreparedness is. The GENIUS Act framework legitimizes the asset class, and the issuers and ecosystem players who operationalize compliance first will win the banking relationships, the institutional flows, and the regulator’s trust.
FinCheck LLC advises FinTechs, crypto and digital asset firms, MSBs, and gaming businesses on AML program design, independent AML audits, BSA/AML risk assessments, sanctions compliance, and fractional compliance officer support. If stablecoins are on your product roadmap — or already on your rails — let’s talk before the final rule makes the decision for you.