The U.S. Treasury is building a regulatory architecture that treats stablecoin compliance not as a back-office function but as an embedded code requirement. A joint notice of proposed rulemaking published April 10, 2026 by the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreig...
"The crypto ATMs is something FinCEN has been very focused on." — Andrea Gacki, Director, Financial Crimes Enforcement Network
The U.S. Treasury is building a regulatory architecture that treats stablecoin compliance not as a back-office function but as an embedded code requirement. A joint notice of proposed rulemaking published April 10, 2026 by the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) would require permitted payment stablecoin issuers (PPSIs) to hardwire transaction-blocking, freezing, and sanctions screening directly into smart contract infrastructure. The proposal classifies PPSIs as a new category of financial institution under the Bank Secrecy Act (BSA), separate from money services businesses.
The regulatory push gained renewed urgency on July 21, 2026, when FinCEN Director Andrea Gacki testified before the House Financial Services Subcommittee on National Security, Illicit Finance, and International Financial Institutions. Lawmakers pressed Gacki on $388 million in crypto ATM scam losses, North Korean hackers moving $280 million through stablecoin networks, and whether issuers like Circle and Tether bear responsibility for intercepting stolen funds in transit. The hearing underscored a policy trajectory that treats on-chain compliance as a matter of national security rather than voluntary corporate practice.
The stablecoin market, now exceeding $316 billion in total supply as of June 2026, sits at the center of this regulatory construction. Tether has frozen $4.4 billion in USDT across 2,300 cases in 65 countries. Circle faces criticism for inconsistent enforcement — on-chain investigators have documented over $420 million in stolen funds that moved through USDC without timely freezes. The proposed rule would formalize what has until now been ad hoc issuer discretion into a mandatory, auditable compliance regime.
On April 8, 2026, FinCEN and OFAC issued a joint notice of proposed rulemaking (NPRM) to implement the anti-money laundering and sanctions compliance provisions of the GENIUS Act, signed into law on July 18, 2025. The rule, published in the Federal Register on April 10, 2026, would create a new Part 1033 of 31 C.F.R. Chapter X — a standalone BSA framework specifically for permitted payment stablecoin issuers.
The proposed rule carries several structural shifts:
New institutional classification. PPSIs would be designated as a distinct category of financial institution under the BSA, separate from the money services business (MSB) classification that currently applies to most stablecoin issuers. This distinction matters because it creates a tailored compliance regime rather than forcing stablecoin issuers into frameworks designed for money transmitters.
Mandatory AML/CFT programs. Issuers must establish and maintain full anti-money laundering and countering-the-financing-of-terrorism programs, including risk assessments, internal controls, independent testing, and designated compliance officers.
Sanctions compliance codification. The proposal would be the first federal regulation to define what constitutes an "effective" OFAC sanctions compliance program in binding regulatory text. PPSIs that fail to maintain required program elements face penalties — even absent an underlying sanctions violation. This is a departure from OFAC's traditional enforcement posture, which has historically penalized only actual sanctions breaches.
Suspicious Activity Report threshold. FinCEN proposes setting the SAR filing threshold for PPSIs at $5,000, higher than the $2,000 threshold currently applied to MSBs. The Crypto Council for Innovation (CCI), in its June 9, 2026 comment letter, supported this threshold as appropriately calibrated.
Extended liability for secondary markets. The proposal extends issuer liability to secondary market transactions involving sanctioned parties that use the issuer's smart contracts — meaning issuers bear responsibility for transactions they did not directly facilitate but whose infrastructure enabled.
The comment period closed June 9, 2026. Final rules have not yet been published.
FinCEN Director Andrea Gacki appeared before the House Financial Services Subcommittee on July 21, 2026 for an oversight hearing that covered three crypto-specific pressure points.
Crypto ATM losses. Rep. Sean Casten (D-IL) cited FBI data showing Americans lost $388 million to scams involving cryptocurrency ATMs in 2025, a 58% increase in dollar losses and 23% increase in complaints over 2024. More than half of the complaints came from individuals over 50, accounting for $302 million in losses. Gacki confirmed that FinCEN has been "very focused on" crypto ATM compliance, noting that ATM operators are classified as money services businesses required to register with FinCEN. Separately, 30 states have enacted legislation regulating crypto kiosks since 2023, with 13 of those laws passed in 2026 alone. Indiana, Tennessee, and Minnesota have enacted outright bans.
North Korean stablecoin laundering. Rep. Bill Foster (D-IL) cited an American Banker report that North Korean hackers drained approximately $280 million from a cryptocurrency exchange on April 1 and moved the proceeds through Circle's USDC network. Foster pressed Gacki on whether stablecoin issuers should be required to intervene when stolen digital assets pass through their infrastructure. Gacki confirmed that Treasury has worked directly with Circle and Tether to freeze and seize assets but stopped short of endorsing specific legislative mandates.
Cyber fraud scale. Gacki's testimony noted that Americans lost approximately $21 billion to cyber-enabled crimes in 2025, up from $16 billion in 2024. FinCEN's Rapid Response Program has facilitated the interdiction of nearly $2 billion in stolen proceeds for over 5,700 U.S. individuals and businesses since its inception in 2015. FinCEN also disclosed its action against the Huione Group, a Cambodia-based entity designated as a primary money laundering concern, which the agency said laundered at least $4 billion in illicit proceeds. FinCEN severed Huione from the U.S. financial system in October 2025 and took further action against successor entities in recent months.
The compliance track records of the two dominant stablecoin issuers — Tether (USDT, ~59% of supply) and Circle (USDC, ~24% of supply) — reveal sharply different operational realities.
Tether's enforcement footprint. As of mid-2026, Tether has frozen more than $4.4 billion in USDT linked to illicit activity, supporting over 2,300 cases across 65 countries. In a 30-day period reported in May 2026, Tether blacklisted 370 addresses and froze $514.64 million — 328 addresses on Tron and 42 on Ethereum. The Tron network accounts for 98.3% of frozen value, reflecting its dominance in high-volume, low-cost USDT transfers. In April 2026, Tether froze $344 million across two addresses in coordination with OFAC and U.S. law enforcement. On July 1, 2026, after OFAC expanded its ISIS-K designation to include 134 crypto identifiers, Tether froze USDT balances across all 131 TRON addresses on the list. According to BlockSec analysis, the average time between a seizure order and Tether's on-chain blacklisting is approximately 2.1 days.
Circle's inconsistencies. Circle has faced criticism for uneven enforcement. On-chain investigator ZachXBT has documented over $420 million in stolen funds across 15 incidents since 2022 where Circle either delayed or failed to freeze USDC. The most notable case involved the Drift exploit, in which over $280 million moved across 100+ transactions in approximately six hours without intervention. Conversely, in March 2026, Circle froze 16 business wallets — including DFINITY Foundation's ckETH Minter contract — based on a sealed civil court order, later unfreezing five of them. Circle CEO Jeremy Allaire stated in April 2026 that the company will not freeze USDC without a court order, sanctions designation, or law enforcement request.
The disparity highlights a structural tension the PPSI rule attempts to resolve: absent codified standards, compliance is a function of issuer discretion rather than regulatory mandate.
The Treasury's proposed framework goes beyond traditional compliance by requiring issuers to architect enforcement into their technical infrastructure. The core requirements, as outlined in the NPRM and analyzed by Mayer Brown and Covington & Burling:
Smart contract freeze functions. Stablecoin contracts must include administrator-controlled functions capable of freezing specific wallet addresses, rendering associated tokens immovable. Both USDT and USDC already contain these functions; the rule would make their existence and use mandatory rather than voluntary.
Real-time screening. Issuers must deploy blockchain analytics and smart contract programming to identify and prevent transactions that violate sanctions or AML requirements in real time. The shift is from post-hoc investigation to pre-execution screening.
Automated blocking. Systems must be capable of rejecting transactions at the protocol level when they involve sanctioned addresses or flagged wallets — effectively embedding OFAC's Specially Designated Nationals (SDN) list into the transaction validation process.
Audit and testing. Issuers must maintain records of all compliance actions and submit to independent testing of their sanctions compliance programs. The proposal mandates that these programs be subject to ongoing, rather than periodic, assessment.
Ryan Rugg, global head of digital assets at Citi Treasury and Trade Solutions, has described this as ensuring "safety and soundness" standards from traditional finance now apply to the crypto space. The practical effect is that stablecoin networks would function less like neutral payment rails and more like regulated financial infrastructure with built-in enforcement capabilities.
The comment period drew responses from major industry participants. The Crypto Council for Innovation, in its June 9, 2026 letter to FinCEN Director Gacki, took a generally supportive stance toward the framework while raising implementation concerns.
CCI recommended that FinCEN issue guidance clarifying how existing MSB compliance programs will be treated during the transition period, and how the agency will assess "innovative compliance activities" — a reference to AI-powered and blockchain-native monitoring tools that don't map cleanly to traditional BSA compliance frameworks.
The FinCEN/OFAC proposal itself acknowledged that compliance costs would be material. The NPRM noted that "some commenters acknowledged meaningful upfront costs associated with complying with the BSA, sanctions program obligations, and the GENIUS Act, particularly for new or unregulated entrants."
This cost structure favors incumbents. Larger, well-capitalized issuers like Circle and Tether already maintain compliance teams and freeze capabilities. Smaller entrants face a choice between absorbing significant infrastructure costs or exiting the U.S. market. The likely result is market consolidation — a dynamic already visible in the stablecoin sector, where USDT and USDC together control approximately 83% of total supply.
The stablecoin market crossed $322 billion in total supply in June 2026, having added $75 billion in 2024 and $102 billion in 2025. The GENIUS Act, which restricts payment stablecoin issuance to licensed entities whose reserves consist of cash, insured bank deposits, and short-dated U.S. government securities, provided the statutory foundation. The PPSI rule provides the enforcement mechanism.
Three implications follow:
Compliance becomes infrastructure cost. Issuers that cannot build or purchase programmable enforcement capabilities will be unable to operate as PPSIs. This creates a new category of compliance-technology providers — firms selling sanctions screening, smart contract monitoring, and automated freeze capabilities as a service.
Neutral rails become enforcement channels. The proposal's extension of liability to secondary market transactions means stablecoin networks cannot function as passive infrastructure. Every transaction that touches a PPSI's smart contracts is, in effect, a supervised financial transaction. This is a fundamental departure from the design philosophy of most token networks.
International regulatory arbitrage narrows. The PPSI framework applies to any issuer whose stablecoins are used in U.S. commerce, regardless of the issuer's domicile. Tether, incorporated in the British Virgin Islands, already cooperates with OFAC. The rule would formalize that cooperation as a legal obligation, reducing the space for offshore issuers to operate with lighter compliance burdens.
FinCEN receives approximately 5 million suspicious activity reports annually and 21 million currency transaction reports. The addition of PPSIs to the BSA reporting framework will expand this volume, with unknown implications for the agency's processing capacity.
The U.S. Treasury is constructing a framework in which stablecoin compliance is not an overlay on existing infrastructure but a design specification built into the code itself. The April 2026 PPSI proposed rule, combined with the pressure applied during the July 21 congressional hearing, signals a policy direction in which on-chain financial enforcement is mandatory, auditable, and embedded at the protocol level.
The practical question is execution. Tether's $4.4 billion freeze track record demonstrates that programmable enforcement is technically feasible. Circle's documented inconsistencies demonstrate that it is not automatic. The proposed rule attempts to close that gap by converting issuer discretion into regulatory obligation.
For the $316 billion stablecoin market, the implications are structural. Compliance infrastructure becomes a prerequisite for market participation, not a competitive advantage. Neutral payment rails become enforcement channels. And the distinction between a stablecoin network and a regulated financial institution narrows toward zero.
Whether this framework achieves its stated goals — deterring illicit finance while preserving the efficiency gains that stablecoins offer — depends on implementation details that remain unpublished.