Introduction
The regulatory perimeter around digital assets continues to tighten, and the GENIUS Act / April 8, 2026 proposed rule from FinCEN and OFAC marks a pivotal moment.
For the first time, Permitted Payment Stablecoin Issuers (PPSIs) are being formally brought into a bank-like AML/CFT under the Bank Secrecy Act, and, for the first time, the proposal creates a mandatory sanctions compliance program requirement. The proposed sanctions program requirement is grounded in OFAC’s established sanctions compliance program model, including senior management commitment, risk assessment, internal controls, testing and auditing, and training. What is different here is that the GENIUS Act and proposed rule would make such a program mandatory for PPSIs and would apply those expectations to payment stablecoin activity, including technical capabilities to identify, block, freeze, or reject transactions that may violate U.S. sanctions.
This is not a marginal adjustment. It is a fundamental shift in how regulators expect stablecoin ecosystems to manage financial crime risk.
From Innovation to Integration: A Structural Shift
Historically, stablecoin issuers operated in a fragmented compliance environment, often relying on downstream intermediaries such as exchanges and custodians for key controls.
That model is changing. Under the proposed rule, stablecoin issuers are treated as financial institutions as defined in the BSA, must implement risk-based AML/CFT programs, are expected to maintain sanctions compliance capabilities, and must have the ability to block or freeze transactions.
In effect, regulators are signaling that stablecoin issuers must operate with compliance maturity comparable to banks while navigating a far more complex, decentralized ecosystem.
Customer Identification: KYC Meets Wallet Intelligence
The rule does not introduce a bespoke Customer Identification Program. Instead, it implicitly imports traditional KYC expectations through AML program requirements.
Stablecoin issuers must verify customer identity for direct relationships, screen against sanctions lists, and maintain due diligence processes capable of connecting customer risk profiles with relevant stablecoin activity where that activity is available and relevant to the relationship.
In the digital asset environment, identity is not just who the customer is; it may also involve understanding how the customer uses stablecoin products, distribution channels, and blockchain-based activity where those factors inform the customer's risk profile. The proposed rule does not require issuers to identify every secondary-market holder or map every wallet to a customer, but it does support a more integrated, risk-based view of customer and transaction activity.
Customer Due Diligence: From Static Profiles to Continuous Monitoring
The proposed rule reinforces the expectation for risk-based Customer Due Diligence.
That includes understanding the nature and purpose of the relationship, establishing expected activity profiles, identifying beneficial ownership where applicable, and conducting ongoing monitoring.
However, stablecoins introduce a new layer of complexity. The proposed rule does not prescribe specific CDD analytics such as wallet clustering, counterparty exposure scoring, or velocity analysis. It does, however, require PPSIs to conduct ongoing CDD, maintain customer risk profiles, and evaluate money laundering and terrorist financing risks across customers, products, services, geographies, and distribution channels, including the blockchains on which their stablecoins are deployed.
The shift is clear: CDD is no longer only a point-in-time exercise. In practice, blockchain analytics, wallet-risk indicators, counterparty exposure analysis, and transaction-flow monitoring may become important tools for demonstrating a risk-based and effective AML/CFT program where those tools are relevant to the issuer's customers and distribution channels.
Enhanced Due Diligence: A Transaction-Centric Model
While Enhanced Due Diligence is not explicitly defined in the rule, it is clearly required within a risk-based framework.
Traditional EDD focuses heavily on the customer. In the stablecoin environment, EDD becomes transaction-centric, network-aware, and real-time or near real-time.
Likely triggers include high-velocity or high-volume activity, cross-border flows, interaction with high-risk jurisdictions, exposure to DeFi protocols, and use of mixers or privacy tools.
The implication is that EDD may need to extend beyond traditional customer profiles into relevant transaction activity, distribution channels, and digital counterparties. PPSIs should be prepared to explain how higher-risk activity is identified, escalated, and incorporated into customer risk profiles and ongoing monitoring.
Customer Risk Rating: Not Explicit — But Absolutely Required
The rule does not explicitly mandate a customer risk rating system. But make no mistake: it is functionally required.
A risk-based AML program cannot operate without customer segmentation, risk scoring, and dynamic updates based on behavior.
For stablecoin issuers, this means building multi-factor risk models that may combine customer attributes, transaction behavior, geography, product usage, and, where appropriate, blockchain or counterparty risk indicators.
Static KYC risk ratings will not meet regulatory expectations in a stablecoin environment.
A New Compliance Architecture
The most important takeaway is not any single requirement. It is the need for an integrated financial crime architecture.
Stablecoin issuers need an architecture capable of connecting customer information, relevant stablecoin activity, risk scoring outputs, sanctions controls, case management, and reporting. Where blockchain activity is available and relevant, that architecture should be able to incorporate blockchain analytics in a defensible, risk-based manner.
This is a materially different challenge than traditional AML. It is not just about compliance; it is about data integration, technology enablement, and operating model transformation.
What This Means for the Industry
For stablecoin issuers, fintechs, and supporting technology providers, the message is clear.
AML expectations are rising to bank-level standards. Crypto-specific risks demand enhanced, not simplified, controls. Regulators expect control over transactions, not just monitoring. Compliance must be dynamic, integrated, and real-time capable.
This is not an incremental upgrade. It is a step change in regulatory expectations.
Final Thought
The April 8 proposal signals the next phase of digital asset regulation: moving from perimeter-based oversight to embedded financial crime control within the ecosystem itself.
Organizations that recognize this shift early and invest in the right risk frameworks, technology, and governance models will be best positioned to lead in a regulated digital asset future.
