On April 8, 2026, the U.S. Treasury published a joint proposed rule by the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) implementing the GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins Act, enacted July 2025). The rule...
"The proposed rules are fit for purpose—designed to assist law enforcement while minimizing operational burdens on compliant issuers." — Scott Bessent, U.S. Treasury Secretary
On April 8, 2026, the U.S. Treasury published a joint proposed rule by the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) implementing the GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins Act, enacted July 2025). The rule would classify all Permitted Payment Stablecoin Issuers (PPSIs) as financial institutions under the Bank Secrecy Act and, for the first time in U.S. regulatory history, mandate by federal statute that a specific category of entity maintain an effective sanctions compliance program.
The proposed framework requires PPSIs to embed enforcement capabilities directly into stablecoin smart contracts — including the technical ability to freeze, seize, burn, or block transfers of tokens they have issued. Civil penalties reach $100,000 per day for material violations; knowing violations of sanctions compliance carry $100,000 per day plus potential criminal referral. The comment period closes June 9, 2026, with full compliance expected by January 2027.
The rule arrives as the stablecoin market stands at a record $315 billion in total supply (Q1 2026), transaction volumes exceeding $28 trillion annually — surpassing Visa and Mastercard combined — and institutional infrastructure expanding rapidly. Morgan Stanley launched a dedicated Stablecoin Reserves Portfolio (MSNXX) on April 16, 2026, designed to meet GENIUS Act reserve requirements. Tether froze a record $344 million in USDT on April 23, 2026, in coordination with OFAC and U.S. law enforcement, underscoring the operational reality these rules formalize.
FinCEN proposes establishing a standalone regulatory category under 31 C.F.R. Part 1033, carving PPSIs out of the existing money service business classification. This is not a retrofitting of existing rules onto stablecoins. It is a purpose-built regulatory architecture.
The rule published in the Federal Register on April 10, 2026 (Document No. 2026-06963) establishes the following framework:
BSA Classification. PPSIs become financial institutions under the Bank Secrecy Act. They must file Suspicious Activity Reports (SARs) with FinCEN, maintain records consistent with the Travel Rule, and implement full AML/CFT programs.
AML/CFT Program Requirements. Each PPSI must establish a written, risk-based compliance program that includes: internal policies and controls proportional to risk exposure; an independent testing regime; a designated AML/CFT compliance officer based in the United States; ongoing employee training calibrated to the issuer's risk profile; and customer due diligence aligned with national AML/CFT priorities.
Sanctions Compliance Program (Novel). OFAC proposes creating new regulations under 5 C.F.R. Part 502 mandating that PPSIs adopt effective sanctions compliance programs. This includes senior management commitment, risk assessments, internal controls, auditing, and training. According to analysis by Covington & Burling, this represents "the first time that Federal law has explicitly mandated that a particular U.S. person have an effective sanctions compliance program."
Key Definition. The rule defines "digital asset" as "any digital representation of value that is recorded on a cryptographically secured distributed ledger." It also clarifies that stablecoin transfer orders constitute "transmittal orders" for BSA recordkeeping and Travel Rule purposes. Notably, customer identification program (CIP) obligations are excluded from this rule, pending separate rulemaking.
The rule's most consequential provision requires PPSIs to possess the technical capability to "seize, freeze, burn, or prevent the transfer of payment stablecoins it issued" in response to lawful orders. This applies to any stablecoin the issuer has minted, regardless of where that token sits in the ecosystem.
Compliance is no longer a back-office function bolted onto operations. Under this framework, it becomes embedded in the smart contract architecture itself. According to analysis by PYMNTS, "compliance is becoming embedded within the asset mechanism itself at a protocol level."
Blockchain Analytics Integration. The proposed rule specifies that PPSIs can leverage blockchain analytics tools and program smart contracts to identify and prevent transactions involving wallets associated with OFAC-sanctioned parties. This is not a suggestion. It is a compliance expectation with civil liability attached.
Reasonable Particularity Standard. The rule introduces a "reasonable particularity" standard: PPSIs are required to act on freeze or seizure orders only when the targeted stablecoin or wallet can be identified with specificity. According to WilmerHale's analysis, this standard "may provide some protection from liability for the PPSI" — but the operational burden of maintaining real-time identification capabilities across all chains where a stablecoin circulates remains substantial.
Operational Precedent. This is not theoretical. Tether has frozen $4.4 billion in assets since launch, working with over 340 law enforcement agencies across 65 countries. On April 23, 2026, Tether froze $344 million across two Tron-based wallets — $212.9 million and $131.3 million respectively — in coordination with OFAC and multiple U.S. agencies. This was nearly double Tether's previous single-action record of $182 million (January 2026). Circle faced a court-ordered freeze of 16 business wallets in March 2026.
The rule draws a critical distinction between primary and secondary market activity.
Primary Market: Direct PPSI involvement — issuance, redemption, repurchasing, burning, or reissuing stablecoins. Full AML/CFT obligations apply, including SAR filing, customer due diligence, and transaction monitoring.
Secondary Market: Peer-to-peer transfers, exchange activity, and vendor purchases occurring through the stablecoin's smart contract without direct PPSI participation. PPSIs are not required to monitor secondary market activity for AML/CFT purposes and are not expected to file SARs involving secondary transactions.
However, secondary market obligations are not zero. PPSIs must maintain the technical capability to freeze, block, or reject secondary market transactions in response to lawful orders. They must also prevent their stablecoin from being issued to or used by sanctioned parties in secondary markets. This encompasses blocking transactions with OFAC-sanctioned jurisdictions (e.g., Iran) and preventing peer-to-peer transactions involving sanctioned wallets.
According to Elliptic's analysis, PPSIs face potential liability for "any conduct prohibited by U.S. sanctions occurring in secondary markets using their stablecoin." The practical consequence: issuers must maintain real-time visibility into how their tokens move across decentralized infrastructure, even where they have no direct counterparty relationship.
The GENIUS Act and proposed rules establish a graduated enforcement framework:
| Violation Type | Penalty | |---|---| | Unlicensed stablecoin issuance | Up to $100,000 per day | | Material violation of GENIUS Act or rules | Up to $100,000 per day (continuing) | | Knowing participation in violation | Up to $1,000,000 per violation, up to 5 years imprisonment, or both | | Knowing sanctions compliance failure | $100,000 per day | | OFAC sanctions violation (strict liability) | Civil monetary penalties regardless of knowledge or intent |
The strict liability provision for OFAC sanctions violations is significant. According to OFAC's existing enforcement framework, U.S. persons — including stablecoin issuers — may be held civilly liable for sanctions violations "even if such person did not know or have reason to know that it was engaging in a prohibited transaction." Applied to a $315 billion market circulating across permissionless infrastructure, this creates material and persistent legal exposure.
Primary federal regulators also retain authority to prohibit an issuer from issuing stablecoins entirely, initiate cease-and-desist proceedings, remove affiliated parties from participation, or impose additional civil monetary penalties.
The rule targets a market at its historical peak:
The market is also shifting. USDT's first quarterly supply contraction coincides with USDC's accelerating growth — a dynamic some analysts attribute to regulatory clarity favoring U.S.-domiciled, fully compliant issuers.
Over 200 stablecoins exist, but USDT and USDC represent more than 80% of total market supply. Enterprise adoption remains early: according to PYMNTS, only 13% of mid-market firms surveyed report using stablecoins for payments.
The proposed rule's compliance requirements impose fixed costs that do not scale linearly with stablecoin supply. An issuer with $500 million in circulation faces roughly equivalent compliance burdens as one with $50 billion — AML teams, monitoring technology, legal counsel, audit functions, sanctions programs, and on-chain transaction controls.
According to data cited by RWA Times, community banks — the closest analog — spend between 11% and 15.5% of total payroll on compliance tasks. Data processing costs for compliance consume 16% to 22% of small banks' budgets. U.S. financial institutions collectively face approximately $50 billion annually in compliance expenses post-2008 regulatory expansion.
The implication is structural consolidation. Tether ($184 billion) and Circle ($112 billion) can absorb these costs as basis points on revenue. Tether generated $5.2 billion in net income in H1 2025 primarily from Treasury yields on reserves. Smaller issuers operating on thinner margins face existential pressure.
Tether has already moved to create a U.S.-compliant entity, launching a new stablecoin (USAT) through Anchorage Digital Bank specifically for U.S. market compliance. This dual-entity strategy — offshore USDT plus onshore USAT — is resource-intensive and available only to issuers with Tether's scale.
The GENIUS Act does not ban small stablecoin issuers. It prices them out.
The institutional ecosystem is building around the new framework:
Morgan Stanley launched the Stablecoin Reserves Portfolio (MSNXX) on April 16, 2026 — a government money market fund investing exclusively in cash, U.S. Treasury bills (93 days or less maturity), and overnight Treasury-backed repurchase agreements. The fund charges a net expense ratio of 0.20% and targets a stable $1.00 NAV. It launched with approximately $1 million in assets but is positioned as reserve infrastructure for the GENIUS Act compliance ecosystem. Weighted average maturity: approximately 12 days.
Baker McKenzie published a detailed analysis on April 23, 2026, noting the rule brings PPSIs "within the BSA and OFAC frameworks in a manner tailored to the unique characteristics of stablecoins."
Sullivan & Cromwell, Gibson Dunn, DLA Piper, King & Spalding, and WilmerHale each published client alerts within days of the rule's publication, signaling significant anticipated demand for compliance advisory services from the stablecoin industry.
The volume of major law firm client alerts — at least six within two weeks — is itself a data point. It signals that institutional legal infrastructure perceives this rule as a structural event, not a marginal regulatory adjustment.
The FinCEN/OFAC proposed rule transforms stablecoins from bearer-like digital instruments into programmable financial products with embedded government enforcement capabilities. The $315 billion stablecoin market is being wired into the same compliance architecture that governs traditional banking — with the added requirement that enforcement logic be coded into the token itself.
The economic consequences are measurable. Compliance costs that run into millions annually will filter the market, concentrating issuance among entities with the capital base to absorb them. The primary-secondary market distinction creates a new category of liability where issuers must police activity they do not directly facilitate. The strict liability standard for sanctions violations means that a single undetected transaction with a sanctioned wallet carries financial and potentially criminal consequences regardless of the issuer's awareness.
Tether's $344 million freeze on April 23, executed across Tron-based wallets in coordination with OFAC, demonstrates the operational capability these rules now require by statute. The question is no longer whether stablecoin issuers will comply with U.S. financial enforcement. It is whether the approximately 200 issuers currently operating can afford to.
The comment period closes June 9, 2026.