FinCEN and OFAC Propose AML and Sanctions Rules for Stablecoin Issuers

The U.S. Treasury's Financial Crimes Enforcement Network and the Office of Foreign Assets Control published a joint notice of proposed rulemaking on April 10, formally treating permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act. The 303-page document, implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act signed into law in July 2025, is Washington's clearest declaration yet that stablecoins are a payments instrument subject to the same regulatory machinery as banks, not a speculative asset operating at the edge of the rules.

What that machinery requires is substantial. Issuers classified as PPSIs would need to build and maintain full know-your-customer programs, file suspicious activity reports, implement recordkeeping systems comparable to those of bank compliance departments, and demonstrate the technical capability to block, freeze, or reject transactions linked to sanctioned individuals or entities. The OFAC obligations carry particular legal weight: civil penalties for sanctions violations apply on a strict liability basis, meaning an issuer can be held liable even without knowing a transaction was prohibited.

"This proposal will protect the U.S. financial system from national security threats without hindering American companies' ability to forge ahead in the payment stablecoin ecosystem," Treasury Secretary Scott Bessent said when the rulemaking was announced.

The compliance burden lands squarely on issuers, and the costs are not trivial. Firms would need designated compliance officers with clean records, risk-based internal controls, routine auditing and testing, and real-time transaction monitoring infrastructure. FinCEN signaled it would generally not pursue enforcement against issuers that already have adequate programs in place, a carve-out that effectively advantages incumbents with existing compliance architecture over newer entrants.

For consumers, the promise of stablecoin payments is speed and low-cost cross-border transfers. The regulatory tradeoff is a surveillance layer that mirrors what governs a checking account: every customer identified, every suspicious pattern flagged, every sanctioned counterparty blocked. Privacy advocates and trade groups are expected to contest how customer due diligence and travel-rule-equivalent requirements apply to retail-scale transactions during the 60-day public comment period, which closes June 9.

The statutory timeline leaves little room for deliberation. Implementing regulations are due by July 18, 2026, with full enforcement beginning no later than January 18, 2027. That compressed schedule is set by the GENIUS Act itself and frames the compliance question as existential for some market participants.

Firms like Tether, which operates outside the United States, face particularly acute choices: restructure operations to meet federal standards or risk losing access to U.S. exchanges and payment rails. Compliance costs and bank-equivalent capital and risk-management expectations tend to favor well-capitalized domestic entities, such as those already holding banking charters or operating under state money-transmitter frameworks. The rule could accelerate consolidation in the stablecoin sector, with smaller or offshore issuers calculating that the U.S. market no longer justifies the overhead.

The FDIC introduced a parallel stablecoin framework around the same time, and regulators have made clear that the AML notice is the companion piece to the reserve, capital, and operational standards already tasked to the OCC, Federal Reserve, and other banking supervisors under the GENIUS Act. Taken together, the rule package represents the most comprehensive attempt yet to integrate digital-asset payments into the existing financial regulatory order, and how issuers respond will likely shape international standard-setting discussions at the Financial Action Task Force on cross-border compliance for tokenized payments.