The Treasury Department is moving the GENIUS Act from legislation into operating rules, and the most important change is not about stablecoin reserves. It is about who must be identifiable when dollars move onto and off blockchain rails.
FinCEN and OFAC have proposed anti-money-laundering, sanctions and customer-identification requirements for permitted payment stablecoin issuers, or PPSIs. The framework would require issuers to identify direct customers, monitor suspicious activity, maintain records and build the technical ability to block, freeze or reject prohibited transactions.
But the rules stop short of eliminating anonymity throughout the stablecoin market. The Federal Register explicitly limits the proposed customer-identification program to customers dealing directly with issuers in the primary market. That distinction matters because regulators estimate roughly 99% of stablecoin activity occurs in the secondary market, where users can transact through exchanges, wallets and other intermediaries without the issuer necessarily knowing their identity.
What the Proposed Rules Require of Issuers and Intermediaries
The April proposal would formally treat permitted stablecoin issuers as financial institutions under the Bank Secrecy Act and require effective AML/CFT and sanctions programs. Issuers would need risk-based compliance systems, customer due diligence, suspicious-activity reporting and controls capable of acting on prohibited transactions, including some transactions involving third parties interacting with an issuer’s smart contract.
A separate June proposal focuses specifically on customer identification. PPSIs would have to maintain written programs for verifying their direct customers, keep records and check identities against government lists. Minimum information would include a customer’s name, address and government identification number, or incorporation information for legal entities.
That could bring exchanges and payment companies into the compliance chain when they are direct minting, redemption or custody customers of an issuer. It does not, however, impose an issuer-level KYC requirement on every person who later acquires USDC, USDT or another stablecoin on an exchange or from a self-hosted wallet.
How the Traceability Standard Changes Existing BSA Obligations
Stablecoin issuers were not operating outside the Bank Secrecy Act before the GENIUS Act. FinCEN says existing issuers generally qualify as money transmitters and therefore money-services businesses already subject to BSA requirements.
The change is that stablecoin issuers would receive their own regulatory category with requirements tailored specifically to how tokens are issued, redeemed and transferred.
The proposed suspicious-activity rule, for example, would require a PPSI to report qualifying suspicious transactions of at least $5,000 conducted or attempted by, at or through the issuer. At the same time, FinCEN deliberately declined to make every secondary-market transfer that touches an issuer’s smart contract automatically subject to issuer-level reporting.
That creates a traceability model built around regulated access points rather than complete identification of every blockchain wallet.
The Comment Window and the Realistic Compliance Timeline
There are two separate rulemakings, with different deadlines.
The April AML/CFT and sanctions proposal is already past its Federal Register comment deadline: “Comments must be received by June 9, 2026.”
The newer customer-identification proposal remains open. The Federal Register states: “Comments must be received by August 21, 2026.”
That rule would not become operational immediately after comments close. FinCEN and the banking agencies propose making the CIP requirements effective 12 months after a final rule is issued, giving issuers time to build and test compliance systems.
The cost is measurable. FinCEN estimates the broader AML/CFT proposal would impose an average annual recordkeeping and reporting cost of about $83,660 per PPSI, while the separate CIP proposal adds an estimated $33,000 per issuer annually.
The US, UK, EU and Hong Kong Are Moving in the Same Direction
The U.S. rules fit a wider move toward identifying the entities behind cross-border crypto transfers.
UK crypto firms already operate under the Travel Rule, which requires identifying information to accompany transfers and obliges firms to collect and retain information even when dealing with jurisdictions that have not implemented equivalent rules.
The EU similarly requires crypto-asset service providers to attach originator and beneficiary information to covered transfers, explicitly describing the objective as ensuring traceability for AML/CFT purposes. Hong Kong’s stablecoin licensing framework also subjects licensed issuers to dedicated AML/CFT requirements.
That matters as stablecoin payment infrastructure becomes institutional. FinanceFeeds reported on August 5 that Mastercard’s acquisition of BVNK brought it a stablecoin platform processing more than $30 billion in annualized volume, while Mastercard and Visa have both joined the Open USD initiative. Mastercard’s $30 billion stablecoin rail and Open USD push shows why compliance is becoming part of payment infrastructure rather than a crypto-specific back-office function.
Who Ultimately Bears the Compliance Cost?
Issuers receive the regulatory bill first, but they are unlikely to absorb all of it.
Exchanges, market makers and payment intermediaries that mint or redeem directly with an issuer will need to provide verifiable identity information and may face more due diligence from their stablecoin counterparties. Those costs can then move downstream through trading fees, redemption charges, spreads or infrastructure pricing.
The scale makes that important. Visa-adjusted data cited by FinanceFeeds showed USDC accounting for roughly 70% of adjusted stablecoin transaction volume in the first half of 2026, compared with about 25% for USDT. Those figures exclude exchange transfers and certain automated activity, making them a measure of adjusted economic transaction activity rather than total blockchain volume.
Banks are simultaneously fighting a separate stablecoin economics battle. Banking trade groups are pushing Congress to prevent exchanges and affiliates from offering yield-like rewards that circumvent the GENIUS Act’s prohibition on issuer-paid interest, warning that stablecoin yield “can reduce U.S. deposits” and banks’ capacity to lend.
The GENIUS Act therefore does more than legalize a stablecoin framework. Its implementing rules determine how expensive compliant distribution becomes—and where anonymity can still survive. Treasury is tightening the regulated entry and exit points, but for now it has deliberately stopped short of identifying every participant in the secondary market.