Five U.S. federal agencies on June 18, 2026, published a joint proposed rule requiring permitted payment stablecoin issuers (PPSIs) to establish bank-style Customer Identification Programs (CIPs). The rule, issued by FinCEN jointly with the OCC, Federal Reserve Board, FDIC, and NCUA, mandates ide...
"I remain concerned that the GENIUS Act regulatory framework does not do enough so far to address the risks of illicit finance conducted through secondary market transactions in payment stablecoins." — Michael S. Barr, Federal Reserve Governor
Five U.S. federal agencies on June 18, 2026, published a joint proposed rule requiring permitted payment stablecoin issuers (PPSIs) to establish bank-style Customer Identification Programs (CIPs). The rule, issued by FinCEN jointly with the OCC, Federal Reserve Board, FDIC, and NCUA, mandates identity verification at the point of issuance and redemption — but draws a hard boundary at the primary market. Secondary-market transfers, DeFi swaps, wallet-to-wallet transactions, and exchange trades fall outside the issuer's CIP obligation entirely.
The proposal implements Section 4 of the GENIUS Act, enacted July 18, 2025. FinCEN estimates the rule would initially cover approximately 50 PPSIs, with a $200 million threshold capturing roughly 76% of current issuers meeting the Act's criteria. Comments close August 21, 2026. A final rule is expected in Q3 2026, with a 12-month compliance window after issuance.
At the Federal Reserve Board vote, all governors voted in favor — except Chairman Kevin Warsh, who abstained without explanation less than a month into his tenure. Former Chairman Jerome Powell voted yes.
The proposed CIP rule requires each PPSI to maintain a written, risk-based customer identification program integrated with its AML/CFT program. Before opening an account, a PPSI must collect four data points:
Each issuer must verify this information within a reasonable time before or after account opening, screen customers against designated government lists, maintain CIP and account-closure records for five years, and provide customer notice of verification requirements.
The rule treats PPSIs as "financial institutions" under the Bank Secrecy Act, the same classification applied to banks, broker-dealers, and money services businesses. This means the full BSA compliance apparatus applies: suspicious activity reporting, currency transaction reports, and travel rule obligations at the issuer level.
The CIP obligation attaches to the account relationship, not to the token. Covered activities include:
Once a token leaves the primary-market relationship with the issuer, the PPSI's CIP obligation for subsequent flows is discharged. The agencies define "secondary market" as payment stablecoin activity that does not directly involve the PPSI as a party to the transaction other than via a smart contract.
This means a customer who mints USDC through Circle undergoes full identity verification. That same customer can then send the USDC to a self-hosted wallet, transfer it to a friend, trade it on a DEX, or deposit it into a DeFi lending protocol — all without triggering any additional CIP obligation on Circle's part.
Officials acknowledge that approximately 99% of stablecoin activity occurs in secondary markets. The CIP rule, by design, covers only the remaining 1% — the primary-market on-ramp and off-ramp.
Federal Reserve Governor Michael Barr made his concern explicit in a statement accompanying the vote: he warned that the GENIUS Act framework "does not do enough" to address illicit finance risks in secondary-market stablecoin transactions. Barr further noted that "it is far too easy for bad actors to evade these restrictions and operate without detection when transacting in digital assets."
The structural gap is deliberate. The GENIUS Act's legislative text does not extend CIP obligations to secondary-market intermediaries. Digital asset service providers (exchanges, custodians) are subject to separate AML/CFT requirements under their respective regulatory frameworks, but decentralized protocols operating without centralized intermediaries exist in regulatory ambiguity. Neither the statute nor the NPRM addresses how compliance obligations apply to autonomous smart contracts.
According to analysis from tracee Briefings, the rule draws "KYC at issuance, not at payment" — a framework that mirrors the physical cash analogy: the Federal Reserve knows who withdraws cash from the banking system but does not track its subsequent use.
The Federal Reserve Board voted on the proposed rule on June 18, 2026. The vote produced a notable split:
Warsh's abstention came less than one month into his chairmanship. A Fed spokesperson did not respond to requests for comment on the abstention, according to reporting from Decrypt. The silence is consistent with Warsh's broader posture toward crypto regulation: he has signaled skepticism about expanding the Fed's regulatory perimeter beyond its traditional mandates but has not articulated a position on stablecoin-specific rulemaking.
The abstention carries no procedural consequence — the proposal advanced with majority support — but it signals potential friction between the new chairman and the agencies driving GENIUS Act implementation.
The total stablecoin market stood at approximately $307.5 billion as of June 2026, up from $229.2 billion in April 2025. Market concentration remains extreme:
| Stablecoin | Market Cap (June 2026) | Market Share | |-----------|----------------------|--------------| | USDT (Tether) | ~$188B | ~61% | | USDC (Circle) | ~$75.8B | ~25% | | All others | ~$43.7B | ~14% |
The top two issuers control approximately 86% of total supply. FinCEN estimates the CIP rule would initially apply to roughly 50 PPSIs, with the $200 million threshold capturing about 76% of current issuers meeting the GENIUS Act's criteria.
The rule's practical impact concentrates on a small number of entities. For Tether and Circle, the compliance overhead is marginal relative to existing operations. For smaller issuers and new entrants, the cost of building BSA-grade infrastructure — verification technology, compliance personnel, suspicious activity reporting systems, 24/7 transaction monitoring — could prove prohibitive. The rule may accelerate consolidation toward well-capitalized, bank-affiliated issuers.
The CIP rule reinforces an existing competitive asymmetry between the two dominant issuers.
Circle operates as a regulated financial company holding money transmission licenses across U.S. states. It was the first stablecoin issuer to receive a French license under MiCA for both USDC and EURC. Circle already maintains AML/KYC programs that substantially meet the proposed CIP requirements. For Circle, the rule formalizes what it already does — at minimal incremental cost.
Tether operates through offshore entities with a different compliance posture. While USDT remains dominant by market capitalization at $188 billion, Tether's current model faces increasing friction under the GENIUS Act framework. Tether can continue issuing USDT to U.S. persons through compliant channels, but extending into regulated U.S. payment use cases would require establishing a federally or state-supervised PPSI entity with full CIP capabilities.
The broader regulatory trajectory — the GENIUS Act domestically, MiCA in the EU, and the FCA's final crypto rulebook in the UK — creates a converging compliance standard that favors issuers with existing regulatory licenses. Whether this shifts market share from USDT to USDC remains an open question, but the structural advantage accrues to already-regulated entities.
The CIP rule is one component of a broader GENIUS Act implementation architecture. The OCC, which supervises federally chartered PPSIs, proposed its own rulemaking in February 2026 (Bulletin 2026-3) establishing application and operational standards:
The aggregate regulatory framework — CIP requirements from FinCEN, charter standards from the OCC, AML/CFT programs from Treasury, and prudential supervision from banking agencies — creates a compliance stack comparable to traditional banking. The distinction is that PPSIs are narrower-purpose entities: they issue stablecoins and manage reserves, without the lending and deposit-taking activities of full-service banks.
The GENIUS Act implementation follows a multi-track schedule:
| Date | Milestone | |------|-----------| | July 18, 2025 | GENIUS Act enacted | | February 25, 2026 | OCC issues PPSI charter proposed rule | | April 10, 2026 | FinCEN/OFAC issue AML/CFT proposed rule | | June 18, 2026 | Five agencies issue CIP proposed rule | | July 18, 2026 | GENIUS Act effective date (18 months post-enactment) | | August 21, 2026 | CIP comment period closes | | Q3 2026 (est.) | Final CIP rule expected | | 2027 (est.) | Compliance required (12 months post-final rule) |
A critical date is July 18, 2026 — the GENIUS Act's statutory effective date, 18 months after enactment. After this date, no person other than a PPSI may issue a payment stablecoin in the United States. Issuers that have not obtained federal or state PPSI authorization face potential enforcement action.
The CIP proposed rule operationalizes one component of the GENIUS Act's regulatory architecture: identity verification at the point where dollars convert to stablecoins and where stablecoins convert back to dollars. The framework is narrower than what some policymakers — notably Governor Barr — consider adequate. It knowingly omits the vast majority of transaction volume, which occurs after tokens enter secondary circulation.
The rule's economic logic follows the cash analogy: verify at the gate, not at every subsequent handoff. Whether this approach proves sufficient for a $307 billion market operating on programmable, globally transferable tokens — a fundamentally different instrument than physical currency — will depend on whether secondary-market intermediaries (exchanges, custodians, wallet providers) face parallel obligations under separate rulemakings.
For stablecoin issuers, the immediate question is operational. The compliance clock starts with the final rule, expected in late 2026. Issuers without BSA-grade infrastructure — verification systems, compliance officers, SAR filing capabilities, five-year record retention — have approximately 18 months to build or acquire it. The cost of entry rises. The number of entrants likely falls.