GENIUS Act: what stablecoin issuers and payment platforms need ready by January 2027

What changes on 18 January 2027

The GENIUS Act takes effect on the earlier of 18 months after enactment and 120 days after the primary federal payment stablecoin regulators issue any final regulations.1 Enactment was on 18 July 2025. The OCC says the Act takes effect on 18 January 2027.2 Three prohibitions matter to issuers and to the platforms that move their coins:

• Issuing. Only a permitted payment stablecoin issuer may issue a payment stablecoin in the United States.1
• Foreign issuers. A digital asset service provider may not offer or sell a foreign issuer’s stablecoin in the United States unless the issuer can comply, and will comply, with any lawful order. Treasury reads this as applying from the effective date.3
• Offering. From 18 July 2028, a digital asset service provider may offer or sell a payment stablecoin to a person in the United States only if a permitted payment stablecoin issuer, or a foreign issuer that qualifies under section 18, issued it.1

If you list, route or settle in foreign-issued stablecoins, the January date applies to you as well as to the issuer.

AML and sanctions duties for permitted issuers

The Act treats a permitted payment stablecoin issuer as a financial institution under the Bank Secrecy Act. It must also meet every federal law on sanctions, money laundering, customer identification and due diligence that applies to a US financial institution. The Act lists six duties:1

• an AML program with risk assessments and a designated officer
• retention of appropriate records
• monitoring and reporting of suspicious transfers
• technical capabilities, policies and procedures to block, freeze and reject specific or impermissible transfers
• a customer identification program covering account holders, high-value transfers and enhanced due diligence
• a sanctions compliance program that verifies sanctions lists

A separate condition covers every issuer. It may issue only if it has the technological capability to comply, and will comply, with any lawful order.1 A lawful order is a final and valid federal order that requires an issuer to seize, freeze, burn or prevent the transfer of its stablecoins.1 Treasury must, to the best of its ability, coordinate with issuers before it blocks a foreign person’s property, but it does not have to tell them first.1

Where the AML and sanctions rules stand on 23 October 2026

The OCC finalised its GENIUS Act rule on 21 October 2026. It covers reserves, redemption, risk management and custody, and it leaves Bank Secrecy Act, AML and OFAC sanctions rules to a separate rulemaking with Treasury.2 Those rules are still proposals:

• FinCEN and OFAC proposed the main AML and sanctions rule for issuers on 10 April 2026. Comments closed on 9 June 2026.4
• FinCEN, the OCC, the Federal Reserve, the FDIC and the NCUA proposed an issuer customer identification program on 22 June 2026.5
• The FDIC proposed Bank Secrecy Act and sanctions standards on 5 June 2026 and the OCC on 24 June 2026, each for issuers it supervises.6, 7
• The FDIC, the Federal Reserve and the NCUA have separate issuer rules out as proposals, and none is final.8, 9, 10

The FinCEN and OFAC proposal sets the detail issuers should plan against. It would:

• define issuers as Bank Secrecy Act financial institutions and remove them from the money services business definition. Issuers of stablecoins that are not payment stablecoins would stay under the money services framework4
• set the suspicious activity reporting threshold at $5,000, against $2,000 for stablecoin issuers regulated as money services businesses today, with a 30-day filing clock from initial detection, extendable to 60 days if no suspect is identified4
• apply the Recordkeeping Rule and Travel Rule to payment stablecoin transmittals4
• require a sanctions compliance program, with both rules starting 12 months after the final rule4

For the secondary market, the proposal would not require an issuer to monitor activity or file reports. The block, freeze and reject capability and lawful order compliance would still apply.4

Who the GENIUS Act affects

The Act defines a digital asset service provider as a person that, for compensation or profit, exchanges digital assets, transfers them to a third party, acts as a custodian or takes part in financial services relating to issuance.3 Treasury’s proposal says a person that takes part in issuance without owing redemption, such as a white-label brand, is not the issuer. A platform that lists an unlawfully issued coin shortly after issuance could still be treated as participating in that issuance.3

Foreign issuers and the stablecoins you can offer

A foreign issuer is exempt from the section 3 prohibitions only if all four conditions hold:1

• its regulator runs a regime Treasury has determined is comparable to the Act
• it is registered with the OCC
• it holds reserves in a US financial institution, enough to meet US customer demand, unless a reciprocal arrangement says otherwise
• its home country is not under comprehensive US sanctions or designated a jurisdiction of primary money laundering concern

If a foreign issuer ignores a lawful order for 30 days after written notice, Treasury must publish a determination of noncompliance and prohibit digital asset service providers from facilitating secondary trading in its coins. The ban starts 30 days after Treasury publishes it in the Federal Register.1 A provider that knowingly breaches it faces a civil penalty of up to $100,000 per violation per day.1 Treasury proposed rules on section 3 on 18 August 2026, and comments closed on 19 October 2026.3

GENIUS Act dates, from enactment to 2028

1. 18 July 2025

   The GENIUS Act becomes law.1

2. 19 September 2025

   Treasury publishes an advance notice of proposed rulemaking on implementation.11

3. 10 April 2026

   FinCEN and OFAC propose AML and sanctions rules for permitted issuers.4

4. 22 June 2026

   Five agencies propose a customer identification program for issuers.5

5. 18 August 2026

   Treasury proposes rules on who may issue, offer and sell payment stablecoins.3

6. 21 October 2026

   The OCC finalises its GENIUS Act rule, excluding AML and sanctions.2

7. 18 January 2027Upcoming

   The Act takes effect.1, 2

8. 18 July 2028Upcoming

   Digital asset service providers may offer only coins from permitted issuers, or from foreign issuers that qualify under section 18, in the United States.1

FinCEN and OFAC have not set a date for their final rule. Their proposed start is 12 months after it.4

What to check before 18 January 2027

Sanctions and blocking

• Issuers: test that you can block, freeze or reject a transfer, and act on a seizure or burn order, on every chain you support.1
• Record which sanctions lists you screen against, who verifies them and which list version applied to each decision.
• Platforms: ask each issuer you support whether it is a permitted issuer or a foreign issuer, and how it handles a lawful order.1

Customer identification and risk

• Compare your onboarding with the proposed issuer customer identification program.5
• Add beneficial ownership collection for legal entity customers, which FinCEN proposes.4
• Define what counts as a high-value transfer for enhanced due diligence.1

Investigations and reporting

• Rebuild suspicious activity report triggers around the proposed $5,000 threshold and a 30-day clock from initial detection, or 60 days if no suspect is identified.4
• Check that Travel Rule data is complete for every stablecoin transmittal of $3,000 or more.4

Stablecoins you offer

• List every stablecoin you offer to people in the United States and mark its issuer as permitted or foreign. Plan the exit from any coin that, by 18 July 2028, will come from neither a permitted issuer nor a foreign issuer that qualifies under section 18.1

What FinCEN and OFAC have not settled

What Cogentic handles, and what your team keeps

Stablecoin AML work spans customer identity, transfer history and wallet exposure. A sanctions alert on a wallet means little until you see the customer and the transfers behind it. Cogentic brings KYC results, blockchain analytics and sanctions screening from the providers you already use into one case. Agents follow your SOP for each alert type and record every action. Cogentic drafts the report for your team to review once the case is ready. Your team reviews, decides and submits.