The U.S. Department of the Treasury published a joint Notice of Proposed Rulemaking (NPRM) on April 8, 2026, that would classify permitted payment stablecoin issuers (PPSIs) as financial institutions under the Bank Secrecy Act for the first time. The rule, issued jointly by the Financial Crimes E...
"This proposal will protect the U.S. financial system from national security threats." — Scott Bessent, U.S. Secretary of the Treasury
The U.S. Department of the Treasury published a joint Notice of Proposed Rulemaking (NPRM) on April 8, 2026, that would classify permitted payment stablecoin issuers (PPSIs) as financial institutions under the Bank Secrecy Act for the first time. The rule, issued jointly by the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC), implements the anti-money laundering and sanctions compliance mandates of the GENIUS Act, signed into law on July 18, 2025.
The proposed framework imposes obligations on stablecoin issuers that, according to King & Spalding, "largely mirror those applicable to banks." It mandates comprehensive AML/CFT programs, beneficial ownership collection, suspicious activity reporting at a $5,000 threshold, and — for the first time in federal regulatory history — explicitly requires a category of U.S. persons to maintain a formal sanctions compliance program. Civil penalties reach $100,000 per day for material program violations, with criminal exposure up to $250,000 and five years imprisonment for willful non-compliance.
The rule applies to an industry managing approximately $316 billion in aggregate market capitalization across all stablecoins. Comments close June 9, 2026. Final rules would take effect 12 months after issuance, with the GENIUS Act itself becoming operational no later than January 18, 2027.
On April 8, 2026, FinCEN and OFAC published a joint NPRM in the Federal Register establishing a new Part 1033 of the Code of Federal Regulations dedicated to PPSIs. The rule carves stablecoin issuers out of the existing Money Services Business (MSB) classification entirely, creating a standalone regulatory category.
According to Covington & Burling's analysis, this is a deliberate architectural choice: rather than subjecting stablecoin issuers to general money transmitter rules, the framework creates "tailored obligations specific to payment stablecoin issuance."
The rule covers three PPSI pathways defined by the GENIUS Act: insured depository institution subsidiaries, federal qualified issuers, and state qualified issuers. All must implement:
Suspicious activity reports must be filed for transactions of $5,000 or more — a threshold higher than the $2,000 floor applied to traditional MSBs, reflecting Treasury's acknowledgment of the different transaction profile of stablecoin issuance.
The proposed rule introduces a formal distinction between primary and secondary market stablecoin activity — a structural choice with significant operational implications.
Primary market transactions are defined as direct interactions between the PPSI and a user: issuance, conversion, redemption, repurchase, burning, and reissuance of stablecoins. These carry full monitoring obligations, customer due diligence requirements, and mandatory SAR filing above the $5,000 threshold.
Secondary market activity covers everything else — user-to-user transfers, intermediary transactions, and peer-to-peer exchanges conducted without the issuer as a direct counterparty. The rule explicitly states: "A transaction...is not conducted or attempted by...a permitted payment stablecoin issuer only because a transfer by third parties results in an interaction with...smart contract."
This means PPSIs are not required to file SARs for secondary market transactions. However, according to Mayer Brown's analysis, a "see-something-say-something" informal expectation persists. Issuers who observe suspicious patterns in secondary market data flowing through their smart contracts may face regulatory scrutiny for inaction, even absent a formal reporting obligation.
The distinction matters because, as FinCEN acknowledges, most illicit finance activity occurs in secondary markets where issuers have limited visibility into counterparty identity.
The proposed rule's sanctions component carries precedent-setting weight. According to Covington & Burling, this represents "the first time that Federal law has explicitly mandated that a particular U.S. person have an effective sanctions compliance program."
OFAC's proposed framework requires five core elements:
The scope extends beyond primary market interactions. According to Elliptic's analysis, "a PPSI must prevent its stablecoin from being issued to or used by sanctioned parties in secondary markets," including in peer-to-peer transactions between unhosted wallets. This makes issuers liable for OFAC-prohibited conduct occurring on secondary markets via their stablecoin smart contracts.
This obligation has no direct parallel for other BSA-regulated financial institutions, according to King & Spalding. Banks do not bear responsibility for ensuring that U.S. dollar bills are not used in sanctions-violating transactions once the currency leaves their custody. Stablecoin issuers, by contrast, must now monitor and enforce compliance across the full lifecycle of their tokens.
The proposed rule requires PPSIs to maintain the "technical capability to block, freeze, and reject" transactions that violate federal or state law, and to comply with lawful orders affecting stablecoins in both primary and secondary markets.
Treasury identifies blockchain analytics as a viable compliance mechanism. The NPRM states that "PPSIs can leverage capabilities such as blockchain analytics to ensure sanctions compliance, including by programming smart contracts to identify and prevent transactions involving wallets with OFAC-sanctioned parties."
Issuers must also evaluate how "characteristics of their token smart contract (such as its ability to freeze or block funds) influence its risk profile" and assess "how features of the underlying blockchains on which the token is traded influence risk."
This creates a de facto requirement for programmable compliance infrastructure. Stablecoin smart contracts must include administrative functions enabling token freezing, wallet blacklisting, and transaction rejection — capabilities that already exist in contracts deployed by Tether (USDT, $184 billion market cap) and Circle (USDC, $77.3 billion market cap), but that may require development for newer or smaller issuers.
According to PwC's April 2026 analysis, the industry faces "critical capability gaps" in "auditing smart contracts, wallet screening, and digital asset-specific sanctions risks."
The enforcement framework imposes layered civil and criminal penalties:
Sanctions program violations:
AML program failures:
The penalty structure targets program adequacy rather than individual transaction failures. A stablecoin issuer with a deficient AML program faces daily accruing fines regardless of whether specific illicit transactions are identified — a compliance-as-process enforcement model.
The rule affects an industry processing substantial volume. Stablecoins processed over $33 trillion in on-chain transactions in 2025, according to industry data, exceeding Visa's annual network volume. The current aggregate stablecoin market cap stands at approximately $316 billion, with Tether at $184 billion and Circle's USDC at $77.3 billion.
Non-bank issuers not previously subject to BSA requirements face the steepest compliance costs: building AML/CFT programs from scratch, hiring U.S.-based compliance officers, implementing blockchain analytics tools, and establishing independent audit functions. Bank-affiliated issuers will need to supplement existing compliance infrastructure with stablecoin-specific controls.
PwC recommends that issuers shift resources from "lower-value monitoring activities toward emerging technologies including AI and machine learning, blockchain analytics, and more advanced data integration." The firm characterizes the broader FinCEN approach as "focusing on material risk, deprioritizing check-the-box requirements" — a framework that could reduce compliance burden for well-resourced issuers while raising the floor for under-resourced entrants.
The compliance cost differential may accelerate market concentration. Issuers with existing BSA infrastructure (particularly bank subsidiaries) face incremental adjustments. Non-bank issuers — especially those operating offshore or without existing compliance programs — face a binary choice: invest in a full-scope compliance apparatus or exit the U.S. market.
FinCEN has solicited public comment on several unresolved issues:
Comments close June 9, 2026. Approximately 450 comments were received during the GENIUS Act's legislative process, according to FinCEN, from banks, credit unions, stablecoin issuers, digital asset exchanges, analytics companies, law firms, trade associations, NGOs, technology firms, and academics.
The FinCEN/OFAC proposed rule translates the GENIUS Act's legislative framework into operational compliance requirements that functionally align stablecoin issuance with traditional banking regulation. The $316 billion stablecoin market — built largely outside the BSA perimeter — now faces a 12-month implementation window to build or adapt compliance infrastructure that took the banking industry decades to develop.
The rule's most consequential feature may be its secondary market sanctions obligation: requiring issuers to police the use of their tokens in peer-to-peer transactions and unhosted wallets. This imposes a layer of issuer responsibility with no analogue in traditional finance, where currency issuers bear no liability for downstream use of their instruments.
Whether this framework strengthens or constrains the U.S. stablecoin market depends on execution. Well-capitalized issuers with existing compliance teams — Circle, Tether, and bank-affiliated entrants — are positioned to absorb these costs. Smaller issuers and non-U.S. operators face a harder calculus. The comment period closes June 9, 2026.