OCC issues final GENIUS Act stablecoin rule; AML and sanctions rules to follow separately
The US bank regulator finalised its rule for payment stablecoin issuers under the GENIUS Act, effective 18 January 2027. The rule leaves out Bank Secrecy Act, anti-money laundering and OFAC sanctions requirements, which will come in a separate rulemaking.
On 21 October 2026, the Office of the Comptroller of the Currency (OCC), the US regulator of national banks, announced a final rule to implement the GENIUS Act, the federal framework for payment stablecoins. Payment stablecoins are digital tokens designed to keep a stable value for use in payments. The rule sets requirements for permitted payment stablecoin issuers and foreign payment stablecoin issuers under the OCC's jurisdiction. It also covers certain custody activities carried out by OCC-supervised entities.
The final rule does not cover the GENIUS Act requirements related to the Bank Secrecy Act (BSA), anti-money laundering (AML) and Office of Foreign Assets Control (OFAC) sanctions. The OCC said those requirements will be addressed in a separate rulemaking with the Treasury Department.
Separately, on 10 April 2026, the Financial Crimes Enforcement Network (FinCEN) and OFAC published a joint proposed rule in the Federal Register on AML/CFT program and sanctions compliance program requirements for permitted payment stablecoin issuers. The proposal would treat these issuers as financial institutions under the BSA, set AML obligations for them, and require them to maintain effective sanctions compliance programs. The comment period on that proposal closed on 9 June 2026.
The OCC said its final rule and the GENIUS Act take effect on 18 January 2027. The OCC said it received hundreds of comments on its proposal and will announce separately when it begins accepting applications and waiver requests from prospective issuers. It published three bulletins with the rule: Bulletin 2026-50 on the final rule, Bulletin 2026-51 on waivers and application guidance, and Bulletin 2026-52 on revised reporting forms.
Why it matters to AML professionals
Stablecoin issuers are moving into the bank regulatory perimeter, and their AML and sanctions duties are being written in a separate track from their licensing and reserve rules. AML professionals at banks, crypto firms and payment companies need to follow both tracks, because a compliance program built only on the licensing rule will miss the BSA and sanctions obligations that come later.
Red flags in this case
- A counterparty presents itself as a regulated stablecoin issuer but cannot show which regulator licenses or supervises it.
- Large stablecoin redemptions or issuances routed through accounts with no clear business link to the issuer's stated customers.
- Stablecoin transfers that pass rapidly through several wallets before reaching an exchange or a bank account, with no clear purpose.
- Wallet addresses linked to sanctioned persons or high-risk jurisdictions appearing in a customer's stablecoin flows.
If this landed in your queue
- Confirm the regulatory status of any stablecoin issuer or custodian involved, using the regulator's own register or announcements.
- Review the customer's stated business and expected activity against the stablecoin volumes and counterparties seen.
- Run blockchain analytics on the relevant wallet addresses and screen counterparties against sanctions lists.
- Document findings and escalate for a suspicious activity report decision if the activity has no reasonable explanation.
Key terms
- Payment stablecoin
- A digital token designed to hold a stable value, usually against a currency such as the US dollar, and used for payments.
- GENIUS Act
- The US federal law that sets up a framework for issuing and supervising payment stablecoins.
- Separate rulemaking
- A different rule, written and consulted on in its own process, that will cover topics left out of the current rule.
Interview angle
How would you build an AML program for a stablecoin issuer when the AML rules are still being finalised?
Explain that you would start from the BSA program pillars (internal controls, a designated compliance officer, training, independent testing and customer due diligence), add sanctions screening of wallets and counterparties, and track the proposed rule so the program can be adjusted when the final version is issued.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.