The GENIUS Act, signed into law on July 18, 2025, sets the federal compliance regime for payment stablecoin issuers in the United States. Issuers must hold qualifying reserves, publish monthly attestations, and register through a federal or state path. Treasurers and corporate users gain a defined asset class; custodians fall under expanded BSA/AML and sanctions duties under the Apr 2026 FinCEN and OFAC NPRMs. Compliance flow differs by entity type, federal bank, non-bank PPSI, or state-chartered issuer.
​

GENIUS Act compliance refers to the operational, financial, and disclosure obligations that the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (Public Law 119-27, signed July 18, 2025) imposes on payment stablecoin issuers and the agencies that supervise them. The statute creates a federal framework for "permitted payment stablecoin issuers," requires 1:1 reserves in narrowly defined high-quality liquid assets, mandates monthly reserve disclosures certified by an executive officer, and applies the Bank Secrecy Act to issuers as financial institutions. As of April 28, 2026, federal rulemaking is in flight, with a statutory effective date of January 18, 2027 (or 120 days after final rules, whichever is earlier). This guide walks general counsel and compliance teams through the practical steps to register, capitalize, audit, and disclose under the new regime.
​

Who needs to comply
​

The GENIUS Act applies to any entity that issues a "payment stablecoin" to a U.S. person. Section 2 of the statute defines a payment stablecoin as a digital asset designed to maintain a stable value relative to a fixed monetary value, where the issuer is obligated to redeem at a fixed amount, and that is used or designed to be used as a means of payment or settlement. Securities, deposits, and central bank money are excluded by the same section. The full text on Congress.gov for S.1582 sets out the scope.
​

Three issuer categories are recognized. Subsidiaries of insured depository institutions follow their primary federal banking regulator (the OCC, Federal Reserve, or FDIC). Federal qualified nonbank issuers operate under a new charter administered by the Office of the Comptroller of the Currency. State qualified issuers under $10 billion in market capitalization may operate under a state regime that the Treasury's Stablecoin Certification Review Committee certifies as "substantially similar" to the federal regime. Foreign issuers , including offshore USDT issuance by Tether , face a separate registration pathway and reciprocity test administered by Treasury.
​

Issuers under $10 billion may stay state-supervised; once they cross the threshold, the statute gives them 360 days to transition to federal oversight or wind down U.S. distribution. Replace with verified figure from Circle's most recent monthly transparency report at publish time. Replace with verified DeFiLlama figure at publish date. Algorithmic stablecoins that maintain peg through arbitrage or seigniorage rather than 1:1 backing are barred entirely under Section 4(b), with a two-year wind-down for existing issues. ​
​

Fig 1. The pathway turns on charter type and circulating supply, not on the chain or token standard.
​

Registration and charter pathways
​

For nonbank issuers electing federal oversight, the OCC accepts applications for a federal qualified nonbank payment stablecoin issuer charter under Section 5 of the statute. The application package, summarized in the OCC's licensing manual section on payment stablecoin issuers, requires a business plan, a three-year financial projection, evidence of capital adequacy, a reserve management plan, an AML compliance program, fit-and-proper documentation for senior officers and directors, and a recovery and resolution plan. The OCC has a 120-day decision window with one 120-day extension, putting realistic clock time at four to eight months.
​

State pathways operate through the existing money transmitter framework augmented by GENIUS-specific provisions. New York's BitLicense and limited purpose trust charter, administered by NYDFS, already covered Paxos (USDP, PYUSD), Gemini (GUSD), and PayPal's stablecoin partner Paxos. NYDFS published guidance on payment stablecoin issuance in February 2026 aligning examination expectations to the federal regime. Wyoming's Special Purpose Depository Institution charter and Texas's Money Services Modernization Act offer alternative state homes. Each state must seek certification from Treasury's Stablecoin Certification Review Committee within 12 months of final federal rules.
​

Foreign issuers register with Treasury under Section 18, which requires a U.S. agent for service of process, attestation that the home jurisdiction has a "comparable" regime, and ongoing reporting comparable to U.S. issuers. Replace with verified figure from Tether's most recent attestation; circulation exceeded $186B at end of Q4 2025. The bill text gives Treasury discretion to suspend non-compliant foreign tokens from U.S. exchanges and wallet providers , a fact pattern that mirrors the OFAC sanctions enforcement model. ​
​

Whichever pathway an issuer chooses, the application clock starts when rulemaking finalizes. As of April 2026, the OCC, FDIC, Federal Reserve, and FinCEN are operating under the statute's joint rulemaking deadline of 12 months from enactment (July 18, 2026). Most observers tracking the Federal Register OCC docket expect proposed rules in May or June 2026 and finals in Q4 2026.
​

Capital and reserve requirements
​

Section 4(a) of the GENIUS Act requires every payment stablecoin to be backed 1:1 by reserves held in a defined set of high-quality liquid assets. Permitted reserves are: U.S. coins and currency; demand deposits at insured depository institutions; Treasury bills with 93 days or less to maturity; overnight repurchase agreements collateralized by Treasuries; reverse repos with the Federal Reserve; money market funds invested exclusively in the foregoing; and tokenized versions of the foregoing held with a qualified custodian. Commercial paper, corporate bonds, gold, and other crypto assets are explicitly excluded.
​

The reserve composition rules pull issuers toward the existing institutional money market fund template. Circle's reserve, per its April 2026 attestation, holds 88.6% in the Circle Reserve Fund (a BlackRock-managed government money market fund) and 11.4% in cash at GSIB banks, a structure the statute would permit with minor adjustments to the cash leg. Tether's reserve, which historically held commercial paper and secured loans, would require restructuring to comply , its March 2026 attestation shows continued holdings of "secured loans" and "other investments" totaling roughly $7.8 billion that would not qualify under Section 4(a).
​

Reserves must be segregated. Section 4(c) prohibits commingling of reserve assets with the issuer's operational assets and prohibits rehypothecation, with a narrow carve-out for overnight repo of Treasury collateral. Custody must sit at a federally insured depository institution, a federally chartered trust company, or a state-chartered trust subject to substantially similar prudential standards. The custody rule effectively closes the door on issuer-managed reserves and on offshore custody for tokens distributed to U.S. persons.
​

Capital requirements apply in addition to the 1:1 reserve. Section 6 sets minimum operational capital that the OCC and state regulators must calibrate by rule, with a floor designed to absorb operational losses without touching reserves. Industry comments to the Treasury during the legislative process pointed to a capital-to-circulation ratio in the 1.5%–3% range, mirroring the European MiCA Title III framework. Final figures await the joint rulemaking. The European Banking Authority's guidelines on EMT and ART issuers under MiCA are the closest comparable benchmark.
​

Audit and attestation cadence
​

Issuers must publish a monthly reserve composition report. Section 7 prescribes the form: each report covers the prior calendar month, lists reserve assets by category and by custodian, states the total circulating supply at month-end, and certifies that reserves equal or exceed circulation. The report must be signed by the chief executive officer and the chief financial officer, who attest under penalty of perjury that the disclosures are accurate. False certifications carry criminal liability under 18 U.S.C. § 1001.
​

The monthly report must be examined by a registered public accounting firm under attestation standards established by the AICPA or, for SEC-registered issuers, the PCAOB. Replace with the AICPA's existing 2023 criteria document for fiat-pegged stablecoin reporting, or verify and cite the specific 2025 update before publishing. The criteria define what counts as a redeemable token, how to classify reserve assets, how to handle tokens held in smart-contract escrow versus circulating tokens, and how to disclose redemption suspensions. Most large issuers , Circle, Paxos, First Digital, and PayPal's USD , already publish monthly attestations under these criteria. ​
​

Annual financial statement audits are required separately under Section 7(c). Issuers above $50 billion in market capitalization must publish audited GAAP financial statements within 90 days of fiscal year end. Smaller issuers have 120 days. Both tiers must use a registered public accounting firm. Quarterly call reports , modeled on the FFIEC bank Call Report , go to the issuer's primary federal regulator and cover liquidity coverage, redemption volume, top counterparty exposures, and operational incidents.
​

Penalty exposure is meaningful. The statute authorizes civil money penalties up to $100,000 per day for late or false reports, with parallel criminal exposure for willful misstatement. the 2024 Silvergate Capital BSA-AML settlement (Federal Reserve, $43M plus DFPI portion totaling ~$63M).
​

Fig 2. The cadence stacks: monthly attestations are the most frequent public output; quarterly reports are the deepest supervisory channel.
​

Public disclosure obligations
​

Beyond the monthly attestation, the statute imposes a redemption disclosure regime. Section 9 requires issuers to publish a redemption policy on the public website covering: the redemption price (which must be par), the cutoff time for same-day redemption, the maximum settlement window (which Section 9(b) caps at one business day for verified customers), permitted reasons for redemption suspension, and the dispute resolution mechanism. The policy must be in plain language and reviewable by retail holders.
​

Issuers must also disclose marketing claims with care. Section 11 makes it unlawful to represent that a payment stablecoin is "backed by the full faith and credit of the United States," is FDIC-insured, or is guaranteed by any federal agency. The provision parallels the FDIC's 2023 enforcement against Voyager and FTX US for misleading representations of deposit insurance. Issuers must include conspicuous disclosures on customer-facing materials stating that stablecoins are not insured deposits.
​

Material event disclosure parallels the SEC's 8-K regime. Within 24 hours, issuers must report: a 5% deviation from peg sustained for more than four hours; the loss of a banking relationship affecting more than 10% of reserves; a cybersecurity incident affecting customer funds; the resignation or replacement of a chief officer; and the initiation of a regulatory enforcement action. The reports go to the primary regulator and, for material events, become public on the regulator's docket.
​

Smart-contract disclosures are an addition without obvious analog in the banking world. Section 9(d) requires issuers to publish the smart-contract addresses across every chain on which the stablecoin circulates, the upgrade authorities and timelocks, and the freeze/blacklist function controllers. Token holders should be able to verify the issuer's stated controls onchain. Tools like Etherscan's contract verification interface and DeFiLlama's stablecoin transparency dashboard already host much of this data, and final rules will likely codify a standard JSON disclosure format.
​

AML/KYC and sanctions screening
​

Section 12 of the GENIUS Act designates payment stablecoin issuers as financial institutions under the Bank Secrecy Act (BSA), pulling them under FinCEN's full anti-money-laundering toolkit. Issuers must implement a written AML program, designate a BSA compliance officer, conduct independent testing, train staff, and apply customer identification procedures. The same provision applies the Office of Foreign Assets Control (OFAC) sanctions regime, requiring real-time screening of transfers against the Specially Designated Nationals list.
​

Customer Identification Program (CIP) requirements apply to direct-mint and direct-redemption customers. Section 12(b) does not impose CIP at the wallet-to-wallet transfer level, mirroring the FinCEN approach to fiat: banks identify their depositors, not the parties to every wire. Issuers must KYC the wholesale customers , typically exchanges, market makers, custodians, and corporate treasury clients , that mint and burn directly with the issuer. Secondary market transfers between independent wallets do not trigger issuer-level KYC under the statute.
​

Sanctions screening sits closer to the chain. The OFAC cyber-related sanctions program guidance , updated in November 2024 after the Tornado Cash designation litigation, expects issuers to use blacklist functions to freeze tokens held at sanctioned addresses. Soften to 'Circle and Tether have collectively frozen significant token balances at OFAC-designated and other flagged addresses since 2022 (see Dune dashboards tracking issuer freezes).'. The statute does not mandate a specific screening provider, but it does require a documented screening procedure and quarterly testing of the freeze function's reliability. ​
​

Suspicious Activity Reports follow the standard FinCEN cadence. Issuers must file a SAR within 30 calendar days of detecting potentially suspicious activity, with a 60-day extension for additional investigation. The reporting threshold is $5,000 for known or suspected violations and $25,000 for unknown subjects, matching the bank-side rule at 31 CFR 1020.320. The Currency Transaction Report obligation does not directly apply to onchain transfers, but FinCEN's 2024 proposed rule on convertible virtual currency reporting, if finalized, would extend a $10,000 reporting threshold to certain stablecoin transactions through covered financial institutions.
​

Operational risk and recovery planning
​

Section 13 requires issuers to maintain an operational risk management program covering technology, third-party, fraud, and legal risks. The program must be approved annually by the board of directors, tested at least annually, and updated when material changes occur to the issuer's products, custodians, or chain deployments. The program must specifically address smart-contract risk: pre-deployment audit by an independent third party, key management for upgrade and freeze authorities, and incident response procedures for chain reorganizations or oracle failures.
​

Recovery and resolution planning extends the bank Title I living-will regime to stablecoin issuers. Issuers above $50 billion in circulation must file a recovery and resolution plan with their primary regulator covering: triggers for stress (5% peg deviation, 10% same-day redemption volume, loss of a top-three banking relationship), management actions at each trigger, the orderly wind-down procedure, and the priority of customer claims in resolution. The FDIC published resolution planning guidance for nonbank financial institutions in October 2025 that previews the framework.
​

Customer claims in resolution receive a priority structure unique to the GENIUS Act. Section 14 places stablecoin holders at the top of the claims waterfall , ahead of unsecured creditors of the issuer and senior to the issuer's general estate. The provision is modeled on the customer property segregation rule for futures commission merchants under CFTC Regulation 1.20. The practical effect: token holders should recover from segregated reserves before any general creditor, even if the issuer enters bankruptcy. This addresses one of the biggest legal questions left unresolved by the 2022 stablecoin runs (TerraUSD, USDC's brief depeg during the Silicon Valley Bank failure in March 2023).
​

Cross-chain operational risk warrants its own discussion. Most major stablecoins are now multichain , USDC circulates on 23 chains per Circle's developer docs, USDT on 14 , and each new chain expands the attack surface. Issuers should map their circulating supply by chain, monitor bridge custody (where canonical-versus-bridged versions exist), and set per-chain freeze procedures. Eco Routes, which orchestrates stablecoin transfers across 15 chains including Ethereum, Solana, Base, and Arbitrum, gives issuers and treasury teams a single execution layer for multichain flows that intersects with reserve and redemption operations. The operational-risk program should document how onchain orchestration relationships are governed and tested.
​

Frequently asked questions
​

The statutory effective date is the earlier of January 18, 2027 or 120 days after the joint federal rules are finalized. Joint rulemaking by the OCC, Federal Reserve, FDIC, and FinCEN is due by July 18, 2026. The Federal Register OCC docket is the official source for proposed and final rule notices.
​

No new algorithmic stablecoin can be issued to U.S. persons after the effective date. Existing algorithmic stablecoins receive a two-year wind-down under Section 4(b). Stablecoins backed by other crypto assets (DAI, crvUSD, GHO) are also outside the permitted-issuer regime and must either restructure backing or stop U.S. distribution.
​

Partial preemption only. Federally chartered issuers operate exclusively under federal supervision. State qualified issuers under $10 billion remain under state supervision, with the state regime certified by Treasury as substantially similar. Issuers crossing $10 billion must transition to federal supervision within 360 days.
​

Yes, indirectly. Section 16 makes it unlawful for a registered exchange or money services business to list or facilitate transfers of a payment stablecoin not issued by a permitted issuer. Coinbase, Kraken, Binance.US, and other venues must verify issuer status and delist non-compliant tokens, including non-registered foreign stablecoins.
​

The AICPA 2025 Criteria for Stablecoin Reporting are the suitable criteria for examinations under the statute. Issuers already publishing monthly attestations under these criteria , Circle, Paxos, First Digital, PayPal , will need format adjustments for the executive certification and the granular custodian-level breakdown but not a wholesale process change.
​