Banking and Finance Law Daily Wrap Up, FINANCIAL TECHNOLOGY—FinCEN, other federal regulators, propose GENIUS Act Customer Identification Program rule, (Jun 18, 2026)

By Justin Marcus Smith, J.D.

Federal Reserve Board Governor Michael S. Barr questioned whether the overall GENIUS Act regulatory framework sufficiently mitigates AML/CFT risk in the stablecoin secondary market.

Federal agencies, led by the Treasury Department’s Financial Crimes Enforcement Network (FinCEN), have announced a joint proposed rule to implement the Customer Identification Program (CIP) provisions of the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act). Comments are due Aug. 21, 2026.

The agencies say they are proposing an “appropriately tailored” rule for mitigating illicit finance risks while protecting the U.S. financial system and national security interests. The proposed rule would treat permitted payment stablecoin issuers (PPSIs) as financial institutions for purposes of the Bank Secrecy Act (BSA) and require such issuers to maintain an effective CIP. The rule would only apply to issuers of payment stablecoins as defined in the GENIUS Act. Federal Reserve Board Governor Michael S. Barr issued a largely supportive statement; however, he expressed concern that the GENIUS Act regulatory framework “does not do enough” to address stablecoin illicit finance risks in the secondary market. FinCEN issued a Fact Sheet in conjunction with its announcement. FinCEN said the proposed rule complements a separate proposed rule that would implement the GENIUS Act directive to apply additional anti-money laundering obligations to permitted issuers of payment stablecoins.

CIP requirement. Section 4(a)(5)(A) of the GENIUS Act, 12 U.S.C. § 5903(a)(5)(A), requires BSA treatment for PPSIs. As such, PPSIs shall be subject to all Federal laws applicable to financial institutions located in the United States relating to economic sanctions, preventing money laundering, customer identification, and due diligence.

FinCEN, the Office of Comptroller of the Currency, the Federal Reserve Board, the Federal Deposit Insurance Corporation, and the National Credit Union Administration (NCUA), issued the joint proposed rule to implement the BSA treatment requirement. The proposed rule would apply to the PPSIs that each federal agency supervises as well as PPSIs that opt for GENIUS Act state supervision.

Accordingly, each PPSI must have a written Customer Identification Program (CIP) appropriate to the PPSI’s size and business. The CIP will be part of the anti-money laundering and countering the financing terrorism (AML/CFT) program of each PPSI.

Verifying identities. The proposed rule would require that a PPSI CIP identify each customer to the extent “reasonable and practicable” based on a risk assessment. To open an account, each customer must provide name and date of birth for an individual; date of formation for an entity; address; and an identification number. PPSIs must then verify the identity of the customer within a reasonable period of time. Depending on the risk assessment for an entity customer, the proposed rule would require a CIP to obtain information about individuals in control of the entity customer’s account to verify customer identity.

In case a PPSI cannot verify customer identity, the CIP must include procedures describing when the PPSI should close an account, or not even open one in the first place; terms of account use during the attempt to verify identity; and when the PPSI should file a Suspicious Activity Report (SAR).

PPSIs must have reasonable procedures for checking whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any federal agency and designated as such by Treasury in consultation with the other federal payment stablecoin regulators. Although the proposed rulemaking states that such a list has not yet been issued pursuant to 31 C.F.R. § 1033.220(a)(4), the rulemaking acknowledged that the Treasury Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list-checking obligation should already be familiar practice. According to the agencies, PPSIs would receive separate notification regarding the lists that must be consulted for purposes of this provision.

The proposed rule would provide a PPSI CIP may include procedures for relying on another federally regulated financial institution’s performance of a customer identification procedure, but such reliance must be circumstantially reasonable.

The proposed rule would also require the CIP to address customer notice and record keeping of all information the PPSI obtains in the course of following its CIP.

Expected burden. FinCEN said it anticipates most PPSIs will already know the true identity of existing customers. To the extent that is true, PPSIs will not be required to collect information from those already known.

The agencies collectively estimate the proposed rule will apply to about 50 PPSIs in each of the first three years. More than half are expected to be subsidiaries of insured depository institutions. The number of likely state qualified issuers is uncertain.

As for the potential burden on small entities, the proposed rule said the OCC does not expect small entities to be the initial adopters of stablecoin technology because of the compliance infrastructure and capital requirements. To the extent small entities do participate, FinCEN expects the impact will vary depending on whether they are subsidiaries of insured depository institutions, federal qualified payment stablecoin issuers (FQPSIs), or state qualified payment stablecoin issuers (SQPSIs).

FinCEN said there is not enough data to forecast how many PPSIs will be small entities or to consider the economic impact of the proposed CIP requirement by type. However, it predicted generally low incremental first-year costs of the proposed CIP requirements of about $7,500 in the first year, and about $5,600 in the average subsequent year. These estimates were based on a 5% of total assets revenue benchmark, and other assumptions, for example, that stablecoin issuers tend to have reserve portfolios larger than the circulating value of their products.

PPSIs distinguished. The proposed rulemaking noted that, unlike with other types of financial institutions that follow other CIP requirements, an individual with “no established relationship” with a PPSI may hold a PPSI’s product. PPSI stablecoin redemption would establish an account with the PPSI and make the individual a customer. FinCEN requested comment on whether the CIP proposal should be refined or clarified to account for such activity.

Potential exemptions. The proposed rule provides for possible exemptions, either by order of a federal functional regulator with the concurrence of the Treasury Secretary, or conversely, by Treasury Secretary exemption with the concurrence of a federal functional regulator.

Barr comment. In a June 18 statement, Fed Governor Barr noted the stablecoin CIP requirements are similar to the CIP requirements imposed on Board-supervised banks; however, in foreign jurisdictions, he distinguished that it is “far too easy for bad actors to evade [local AML/CFT] restrictions and operate without detection when transacting in digital assets.” Barr said he would “carefully review” public comments about extending the CIP rule to secondary market activity and expressed broader skepticism about whether the overall GENIUS Act regulatory framework offers adequate safeguards against the abuse of stablecoins in illicit finance. The agencies say they use the term “secondary market” to describe stablecoin activity that does not directly involve the PPSI as a party to the transaction, other than via a smart contract. Examples of secondary market activity include individuals sending a payment stablecoin from a self-hosted wallet to a vendor to buy goods.

In a separate rulemaking, FinCEN proposed a rule to implement the GENIUS Act’s directive to apply other anti-money laundering obligations for permitted payment stablecoin issuers. That proposed PPSI AML/CFT notice of proposed rulemaking also involves program, reporting, and record keeping obligations, and provides several new GENIUS Act definitions, like “digital asset,” “distributed ledger,” “payment stablecoin,” and so forth. Governor Barr’s statement about the CIP requirements and concerns about the secondary market did not explicitly address that separate FinCEN PPSI AML/CFT rulemaking.

MainStory: TopStory BankingFinance BankingOperations BankSecrecyAct Blockchain FederalReserveSystem FedTracker FinancialIntermediaries FinTech GCNNews PrudentialRegulation SecuritiesDerivatives