Five federal agencies closed the 60-day comment window on the first customer identification program (CIP) rule for stablecoin issuers on August 21, 2026. Three days earlier, on August 17, the Treasury Department published a separate notice of proposed rulemaking (NPRM) defining who may legally is...
"Treasury is moving quickly to implement that framework. Treasury welcomes input from stakeholders as we work to provide the regulatory certainty businesses need to innovate and grow in America, cement the role of the U.S. dollar as the world's reserve currency." — Scott Bessent, U.S. Treasury Secretary
Five federal agencies closed the 60-day comment window on the first customer identification program (CIP) rule for stablecoin issuers on August 21, 2026. Three days earlier, on August 17, the Treasury Department published a separate notice of proposed rulemaking (NPRM) defining who may legally issue, offer, or sell payment stablecoins in the United States. Together, the two rulemakings constitute the most extensive federal regulatory build-out ever attempted for the $308 billion stablecoin market.
The stakes are not abstract. Tether's USDT commands roughly 59% of stablecoin supply — approximately $182 billion — but lacks a U.S. license or reciprocity determination from Treasury. Circle obtained an OCC national trust bank charter on July 10, 2026, positioning USDC as the most credentialed domestic issuer. The rules, if finalized on the proposed timelines, would make unlicensed stablecoin issuance a federal crime carrying fines up to $1 million and five years imprisonment per violation, effective January 18, 2027.
The combined effect is a regulatory pincer: one rulemaking dictates how issuers must identify their customers, the other dictates whether those issuers may operate at all.
The GENIUS Act, signed into law in July 2025, authorized but did not self-execute. Implementation requires multiple rulemakings across Treasury, FinCEN, the OCC, the Federal Reserve, the FDIC, and the NCUA. Two of those rulemakings are now live and overlapping in comment periods:
Track One — CIP Rule (FinCEN + banking agencies): Published in the Federal Register on June 22, 2026. Comment period closed August 21, 2026. Requires permitted payment stablecoin issuers (PPSIs) to establish written, risk-based customer identification programs. Final rule expected in 2027. Compliance deadline: 12 months after final rule issuance.
Track Two — Licensing NPRM (Treasury): Published August 17, 2026. Comment period closes October 19, 2026. Defines who may legally issue, offer, or sell payment stablecoins in or to persons in the United States. Statutory effective date for issuer licensing: January 18, 2027. Digital asset service provider compliance deadline: July 18, 2028.
A third parallel rulemaking — the FinCEN/OFAC AML/CFT and sanctions compliance proposal published April 10, 2026 — addresses broader anti-money laundering obligations. That rule explicitly deferred CIP requirements to the standalone June rulemaking.
The CIP proposal, issued jointly by FinCEN, the OCC, the Federal Reserve, the FDIC, and the NCUA on June 18, 2026, imposes bank-grade identity verification obligations on stablecoin issuers for the first time. The core requirements:
Mandatory data collection before account opening:
Risk-based verification: PPSIs must implement procedures enabling them to "form a reasonable belief that [they] know the identity of each customer," per the Federal Register filing. Methods include documentary verification (government IDs) and non-documentary verification (identity vendor services, database checks).
Government list screening: PPSIs must check customers against Treasury-designated terrorist and terrorist organization lists.
Record retention: Two retention periods apply — identifying information must be kept five years after account closure; verification records must be kept five years from creation date.
Reliance framework: PPSIs may outsource CIP procedures to other federally regulated financial institutions, provided they enter contracts requiring annual compliance certification. An asymmetry exists: state-qualified PPSIs cannot rely on other state-qualified PPSIs for CIP, only on federally regulated institutions.
SAR filing obligation: When identity verification fails, PPSIs must file Suspicious Activity Reports.
The agencies explicitly requested comment on several unresolved questions, including whether to extend CIP to secondary market participants and whether digital identity solutions could satisfy verification requirements.
The August 17 NPRM addresses a more fundamental question: who is permitted to issue stablecoins at all.
Domestic issuers must qualify as permitted payment stablecoin issuers under one of three pathways:
The $10 billion threshold: Issuers with less than $10 billion in outstanding stablecoin supply may elect state-level supervision rather than OCC or Federal Reserve oversight, provided Treasury certifies the state regime.
Foreign issuers face a distinct compliance path. Digital asset service providers may not offer, sell, or otherwise make available foreign-issued payment stablecoins unless the foreign issuer demonstrates the technological capability to comply with lawful orders and any reciprocal arrangement between the United States and the issuer's home jurisdiction. As of the NPRM's publication, no reciprocity determination has been issued for any jurisdiction.
Criminal enforcement: Unlicensed issuance, offering, or sale of payment stablecoins carries criminal penalties of up to $1 million in fines and five years imprisonment per violation.
Safe harbors: Three ongoing exemptions apply — direct peer-to-peer transfers, same-individual account transactions, and self-custody activities. Limited safe harbors exist for inadvertent issuances and documented good-faith compliance efforts.
The most consequential policy choice in the CIP rulemaking is the line drawn between primary and secondary market activity.
CIP obligations reach only primary market interactions: issuance, redemption, and custodial services where a PPSI interacts directly with a customer. Secondary market activity — the vast majority of stablecoin transaction volume — falls outside CIP requirements. The agencies stated that "a smart contract interaction does not yield the information needed to verify identity."
Sullivan & Cromwell's analysis of the proposal noted that the agencies acknowledged treating every stablecoin transfer as creating a CIP relationship would be "nearly impossible to implement and could cripple the industry."
This distinction has structural implications. It means that the billions of dollars in daily stablecoin volume flowing through decentralized exchanges, lending protocols, and cross-chain bridges will continue to operate without issuer-level identity verification. The compliance burden concentrates at the mint-and-burn layer — on-ramps and off-ramps between fiat and stablecoins — rather than on the peer-to-peer transfer layer.
The agencies sought comment on whether this scope is appropriate, leaving open the possibility that a final rule could expand CIP to secondary market participants.
The two rulemakings create sharply divergent compliance positions for the market's dominant issuers.
Circle (USDC — ~23% market share, ~$71B supply): Circle obtained an OCC national trust bank charter on July 10, 2026, making it the most regulated stablecoin issuer in the U.S. USDC reserves consist primarily of the Circle Reserve Fund, a SEC-registered government money market fund managed by BlackRock and custodied at BNY Mellon. These assets qualify under the GENIUS Act's 93-day maturity ceiling for reserve assets. Circle also holds a MiCA license in the EU through France's ACPR, making it the only major issuer simultaneously compliant with both American and European frameworks.
Tether (USDT — ~59% market share, ~$182B supply): Tether operates as a foreign issuer headquartered in the British Virgin Islands. The licensing NPRM requires a Treasury reciprocity determination before digital asset service providers can offer foreign-issued stablecoins. No such determination exists. Tether must navigate a non-existent reciprocity pathway and, according to TechTimes reporting, faces a reserve restructuring requirement valued at approximately $47 billion to meet GENIUS Act reserve composition standards. The January 2027 issuer licensing effective date creates a tight timeline.
Bank-affiliated issuers: The GENIUS Act's $10 billion state-supervision threshold and the three federal licensing pathways create an entry point for bank-affiliated stablecoin programs. JPMorgan's existing JPM Coin (now Kinexys) and PayPal's PYUSD already operate within regulated banking structures.
The Bank Policy Institute and The Clearing House Association submitted comments urging regulators to strengthen consumer protection requirements and more explicitly recognize fraud risks in the stablecoin ecosystem.
The stablecoin market's aggregate supply stood at $308.0 billion as of August 13, 2026, according to market data aggregators — up 14.3% year over year from $269.4 billion in August 2025, but down approximately $10 billion from the May 2026 peak. This represents the first contraction in stablecoin supply in four years.
The contraction appears driven by yield-seeking rather than loss of confidence. Forbes reported in late July that "idle money went looking for yield, exactly as designed," as stablecoin holders rotated into higher-yielding instruments during a period of elevated Treasury rates.
Transaction velocity tells a different story from supply. June 2026 on-chain stablecoin volume reached a record $1.79 trillion, according to Forbes. USDT holds roughly 74% of on-chain trading volume despite 59% of supply. USDC leads by annual transaction volume at $18.3 trillion versus USDT's $13.3 trillion as of year-end 2025 data.
An estimated 269 million on-chain addresses hold a stablecoin balance as of mid-2026. The market remains approximately 99.5% dollar-denominated.
Neither the CIP proposal nor the licensing NPRM includes a quantified cost-benefit analysis. The compliance burden is, however, directionally clear.
For established issuers: Circle's existing banking infrastructure and OCC charter mean incremental CIP costs are likely manageable. The company already operates under bank-grade KYC/AML frameworks. Tether faces a categorically different calculus — the cost of obtaining a license (or securing a reciprocity determination), restructuring reserves, and implementing CIP procedures from a standing start as a foreign entity is orders of magnitude larger.
For new entrants: The $10 billion state-supervision threshold creates a tiered entry structure. Sub-$10B issuers can avoid direct OCC or Fed oversight, but must still implement full CIP and AML/CFT programs. The minimum compliance apparatus — identity verification systems, SAR filing procedures, five-year record retention, government list screening — represents a meaningful fixed cost that may deter small issuers.
For DeFi protocols: The primary/secondary market distinction is the critical variable. If the final CIP rule maintains the current scope, decentralized protocols that interact with stablecoins only at the secondary market level face no direct CIP obligations. If the scope expands to secondary market activity, the compliance implications for DeFi could be severe.
12-month implementation clock: PPSIs will have 12 months from the final CIP rule to implement compliant programs. Given that the final rule is expected in 2027, full CIP compliance could be required as late as 2028 — roughly aligning with the July 18, 2028 deadline for digital asset service providers under the licensing NPRM.
Two parallel GENIUS Act rulemakings are live simultaneously. The CIP comment period closed August 21, 2026. The Treasury licensing NPRM comment period closes October 19, 2026. Together, they form the first comprehensive federal regulatory framework for stablecoin issuance and customer identification.
CIP applies only to primary market activity. Issuance, redemption, and custody trigger identity verification. Secondary market stablecoin transfers — including DeFi protocol interactions — are currently excluded. This scope is subject to change in the final rule.
Circle holds a structural regulatory advantage. Its OCC charter, SEC-registered reserve fund, and MiCA license position it as the most compliance-ready issuer in both U.S. and European markets.
Tether faces an existential regulatory timeline. No reciprocity determination, no U.S. license, and a potential $47 billion reserve restructuring, with issuer licensing effective January 18, 2027.
Criminal enforcement gives the framework teeth. Unlicensed stablecoin issuance carries up to $1 million in fines and five years imprisonment per violation — a penalty structure modeled on existing banking law, not securities regulation.
The $308 billion stablecoin market contracted from its May 2026 peak, but transaction velocity hit record levels in June at $1.79 trillion monthly volume, suggesting structural demand remains intact.
The GENIUS Act is no longer a legislative aspiration. It is becoming operational infrastructure. The CIP and licensing rulemakings together define who can issue stablecoins, how they must identify their customers, and what happens if they fail to comply. The comment period that closed today — and the one that closes in October — will determine the final contours of a regulatory framework governing a market that processes trillions of dollars annually.
The primary/secondary market distinction is the hinge variable. If it holds, the stablecoin market bifurcates into a heavily regulated mint-and-burn layer and a largely unregulated transfer layer. If it does not, the compliance surface area expands to encompass the entirety of on-chain stablecoin activity — a prospect the agencies themselves described as potentially crippling.
For Circle, this is the regulatory environment it invested years to prepare for. For Tether, it is a countdown. For the 269 million addresses holding stablecoins globally, the operational reality of their holdings may look materially different by January 2027.