The GENIUS Act: what US stablecoin rules mean for AML

The short version

The Guiding and Establishing National Innovation for U.S. Stablecoins Act, the GENIUS Act, was signed into law on 18 July 2025. It takes effect on 18 January 2027 (or 120 days after final regulations, if sooner). Only a permitted payment stablecoin issuer, or PPSI, may issue a payment stablecoin in the United States.

The prudential rules are landing first. The AML and sanctions rules are still proposals. Here is where things stand, and what it means in AML terms.

Where implementation stands today

• 18 July 2025: GENIUS Act enacted.
• 8–10 April 2026: FinCEN and OFAC publish a joint proposed rule on AML/CFT and sanctions programmes for PPSIs. Comments closed 9 June 2026.
• 22 June 2026: FinCEN and the federal banking agencies propose a joint Customer Identification Program (CIP) rule for PPSIs. Comments closed 21 August 2026.
• 24 June 2026: The OCC proposes its own AML/CFT and sanctions risk-management rule, adopting the FinCEN and OFAC rules by reference.
• 18 July 2026: The statutory deadline for final rules passes without final AML rules.
• 21 October 2026: The OCC finalises its prudential rule (12 CFR part 15) covering reserves, redemption, capital, licensing and supervision. It explicitly leaves BSA, AML and sanctions to the separate Treasury-coordinated rulemaking.
• 18 January 2027: The GENIUS Act and the OCC rule take effect.

FinCEN and OFAC have proposed that their rules apply 12 months after they are finalised. So the dedicated stablecoin AML rules will likely bite after the Act itself is live.

That is not a grace period. Most US stablecoin issuers are already registered money transmitters, so existing FinCEN rules, including the Travel Rule, apply today. And the OCC lists BSA, AML and OFAC compliance among the topics every licence application must cover. AML readiness gets reviewed at licensing, before the AML rules are final.

What the proposed AML rule would require of issuers

The FinCEN/OFAC proposal treats PPSIs as financial institutions under the Bank Secrecy Act. It creates a new category, separate from money services businesses, with obligations that largely mirror those of banks.

An AML/CFT programme that is risk-based and tested

• Internal policies, procedures and controls scaled to the issuer's risk.
• Independent testing of the programme against objective criteria.
• A designated AML/CFT officer located in the United States.
• Ongoing training.

Customer due diligence and reporting

• Identification and verification of account holders, with enhanced due diligence on higher-risk customers. A dedicated CIP rule is on its way.
• Suspicious activity reporting, recordkeeping and Travel Rule obligations.

A formal sanctions compliance programme

For the first time, OFAC would expressly require a particular type of US person, the stablecoin issuer, to maintain a sanctions compliance programme, with independent audit.

Technical control over the token

Issuers must be able to block, freeze and reject prohibited transactions, and comply with lawful orders. Self-hosted wallets remain allowed, but issuers still have to meet these obligations for transfers involving them.

Primary and secondary markets

The proposal splits the stablecoin lifecycle in two. Primary-market activity, issuance and redemption with the issuer's own customers, follows traditional AML programme rules. Secondary-market activity, where tokens move between holders on public blockchains, gets its own treatment. The proposal acknowledges that issuers cannot control every secondary transfer, but expects them to factor secondary-market risk into their risk assessment. If a coin's volume suddenly spikes on a foreign exchange with weak AML controls, that belongs in the issuer's programme.

What this means in AML terms

1. On-chain monitoring becomes an issuer obligation

Until now, most stablecoin issuers performed KYC at mint and redeem, and left secondary-market risk to exchanges and analytics vendors. The secondary-market approach changes that. Issuers will need a defensible view of where their token flows, which counterparties concentrate exposure, and when to act.

2. Freezes become signals for everyone else

With freeze and block capability formalised, issuer actions on an address become meaningful data points. A CASP receiving funds that recently passed near a frozen address should treat that as risk context, with the reasoning recorded.

3. Sanctions risk gets a named owner

A mandatory OFAC programme at issuer level means sanctions screening of on-chain activity is no longer best practice. It is an expectation that supervisors will test.

4. Redemption speed now depends on compliance speed

The OCC kept a two-business-day redemption deadline and expects issuers to onboard and screen promptly, even under stress. A slow alert queue becomes a redemption problem, and a redemption problem becomes a safety-and-soundness problem.

5. Vendors are inside the perimeter

The OCC rule requires issuers to run due diligence on service providers, write GENIUS Act compliance into contracts and review the providers' audit or test results. Screening, monitoring and Travel Rule vendors will be asked to evidence their controls.

Why this matters outside the US

Avus serves CASPs in the EU and Dubai, and the GENIUS Act reaches them in three ways.

Foreign issuers. Under the OCC rule, a foreign issuer serving US persons needs a Treasury comparability determination, OCC registration and sufficient US-held reserves, and cannot be domiciled in a comprehensively sanctioned jurisdiction or one designated a primary money laundering concern. The FinCEN/OFAC rule also extends to non-US issuers seeking to serve US customers.

Counterparty flows. Most stablecoin volume crossing EU and Dubai venues is US-dollar denominated. As US issuers build secondary-market monitoring and exercise freeze powers, EU and Dubai CASPs will see more questions from issuers about their controls, and more on-chain actions that need to feed their own risk scoring.

Regulatory convergence. The direction matches what EU and UAE supervisors already ask for. MiCA governs e-money tokens in the EU, with AMLR and the Transfer of Funds Regulation covering due diligence and the Travel Rule. In the UAE, the Central Bank regulates fiat-backed payment tokens as high money laundering risk, and VARA has told Dubai VASPs with payment-token activity to register with the CBUAE. A CASP handling USDC or USDT across these regimes is answering to several supervisors about the same flows.

What CASPs should do now

1. Map stablecoin exposure by issuer. Know which tokens you list, which issuers stand behind them, and whether those issuers are on track for PPSI status or foreign comparability.
2. Ingest issuer freeze and block events into transaction monitoring, and record how they affect a score.
3. Screen before funds move. Stablecoin transfers settle irreversibly. Counterparty, sanctions and Travel Rule checks belong ahead of settlement, not after.
4. Prepare for issuer due diligence. Expect issuers and banking partners to ask how you monitor, escalate and report. Have the evidence ready.
5. Watch the final FinCEN/OFAC and CIP rules. The proposals may change, particularly on secondary-market duties and the definition of a customer.

How Avus helps

Avus brings blockchain analytics, sanctions screening, Travel Rule data, case management and regulatory reporting into one workflow. A deterministic engine screens every transfer, so every score names the rule behind it. Case AI follows stablecoin flows across hops and bridges and proposes a finding; an analyst confirms it. Every escalation keeps its trail, and every filing writes from it.

Whether the question comes from a US issuer, a bank partner, VARA or an EU supervisor, the answer is the same: here is what happened, here is why we acted, and here is the proof.

Book a demo and bring a real case.

This article is for general information and is not legal advice. The FinCEN/OFAC and CIP rules described here are proposals as of the date above and may change when finalised.