The U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) and Office of Foreign Assets Control (OFAC) have jointly proposed a rule to implement the GENIUS Act’s anti-money laundering, counter-terrorist financing, and sanctions compliance requirements for permitted payment stablecoin issuers. The proposal would treat these issuers as financial institutions for purposes of the Bank Secrecy Act (BSA) and require them to maintain effective AML and sanctions compliance programs.
The measure remains a proposal; it should not be interpreted as meaning that all related obligations have already become final and effective. However, the regulatory direction is clear: stablecoin issuers must address not only reserve, redemption, and operational requirements, but also the financial crime risks associated with their activities.
Stablecoin Issuers Face More Explicit AML Responsibilities
A central element of the proposal is bringing permitted payment stablecoin issuers within the BSA framework and requiring them to meet applicable AML and counter-terrorist financing obligations. Issuers would need risk assessments, internal controls, designated compliance responsibilities, training, and ongoing review processes consistent with applicable requirements.
Stablecoin issuers may face risks across several activities, including customer onboarding, issuance and redemption, reserve management, third-party services, and relationships with exchanges and payment providers. An effective compliance program should be tailored to the issuer’s business model and risk profile rather than relying solely on written policies or formal customer checks.
For compliance teams, key tasks include defining customer and transaction risk categories, setting standards for identifying unusual activity, documenting investigations, and ensuring that high-risk matters are escalated promptly. Issuers should also review outsourced and technology arrangements so that reliance on third parties does not create gaps in accountability for critical compliance controls.
Sanctions Compliance Must Address Stablecoin-Related Flows
The joint FinCEN and OFAC proposal also addresses sanctions compliance programs for stablecoin issuers. Sanctions exposure may arise through customer relationships, wallet addresses, counterparties, sources of funds, and issuance or redemption processes.
On-chain stablecoin transfers may move through multiple wallets, trading platforms, and blockchain networks. Issuers need to combine customer information, transaction monitoring, address-risk intelligence, and relevant investigative information to identify potential sanctions exposure. Blockchain analytics can provide important leads, but a single address label or automated risk score generally cannot independently establish customer identity, control, or unlawful conduct.
Compliance controls must also account for changing risk information. Address or counterparty risk may evolve as investigations progress, sanctions lists are updated, or new on-chain activity emerges. Screening and monitoring should therefore not be limited to onboarding. Issuers need ongoing review and escalation procedures and, where applicable, processes for recordkeeping, reporting, or restricting activity.
Issuers Should Assess Governance, Data, and Monitoring Capabilities
Although the proposal remains part of the rulemaking process, stablecoin issuers can begin assessing gaps between their existing compliance frameworks and the proposed requirements. First, they should map whether AML and sanctions policies cover key activities such as issuance, redemption, reserve management, and third-party relationships.
Second, issuers should review whether transaction-monitoring and investigation systems can address stablecoin-specific scenarios, including unusual minting or redemption activity, rapid fund movements, links between multiple addresses, and exposure to high-risk service providers. Know Your Transaction (KYT) and blockchain analytics can help identify fund-flow risks, but they should be integrated with customer due diligence, internal data, and human investigation procedures.
Finally, institutions should clarify compliance ownership, management oversight, recordkeeping, and regulatory communication processes. Translating regulatory expectations into operational controls can help issuers adapt more smoothly once final requirements are established and provide clearer risk-management expectations for exchanges, payment providers, and other partners.