Introduction
On June 18, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”), together with the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the National Credit Union Administration (collectively, the “Agencies”), jointly issued a notice of proposed rulemaking (the “CIP NPR”) to implement customer identification program (“CIP”) requirements for permitted payment stablecoin issuers (“PPSIs”) under the Guiding and Establishing National Innovation for U.S. Stablecoins Act or GENIUS Act.[1]
The CIP NPR is part of the broader rulemaking effort to implement the GENIUS Act, which was enacted in July 2025 to establish a federal regulatory framework for payment stablecoins and their issuers.[2] The CIP NPR follows an April 2026 proposed rulemaking by FinCEN and the Office of Foreign Assets Control (“OFAC”) addressing anti-money laundering, countering the financing of terrorism (“AML/CFT”), and sanctions-compliance requirements for PPSIs (the “FinCEN/OFAC NPR”), which noted that FinCEN expected to conduct a separate rulemaking to implement the GENIUS Act’s requirement that PPSIs maintain CIPs.[3]
Comments on the CIP NPR are due August 21, 2026.[4]
Overview
The GENIUS Act requires that a PPSI “be treated as a financial institution for purposes of the Bank Secrecy Act” and be subject to federal laws applicable to U.S. financial institutions relating to economic sanctions, money laundering prevention, customer identification, and due diligence.[5] The GENIUS Act also requires PPSIs to maintain an “effective customer identification program, including identification and verification of account holders with the permitted payment stablecoin issuer.”[6]
The CIP NPR proposes to implement these requirements by imposing CIP obligations on PPSIs “comparable to existing CIP requirements for other financial institutions.”[7] In keeping with the FinCEN/OFAC NPR, the CIP NPR would distinguish between primary- and secondary-market payment stablecoin transactions. Consistent with the FinCEN/OFAC NPR’s approach to AML/CFT obligations, the CIP NPR would limit a PPSI’s CIP obligations to primary-market activity.[8]
Analysis
Scope of CIP Obligations for PPSIs: Primary-Market Activities
The CIP NPR explains that three new definitions it proposes—for “account,” “customer,” and “digital asset service provider”—are “designed to clarify that a PPSI’s CIP obligation extends to direct relationships, i.e., primary market activity, and does not extend to activity where the only interaction is with a PPSI’s smart contract.”[9]
- Account. The proposal would define “account” as a “formal relationship” between a PPSI and a customer established to provide or engage in services, dealings or other financial transactions.[10] The proposed definition would include an illustrative list of covered activities, including: issuing or redeeming payment stablecoins; managing related reserves; providing custodial or safekeeping services for payment stablecoins, required reserves, or private keys; activities directly supporting those activities; and authorized digital asset service provider activities.[11] This proposed definition would cover PPSIs acting in a wide range of capacities, and could have broader implications for other U.S. persons serving in those same capacities that may not currently have compliance programs under the Bank Secrecy Act. However, the definition would exclude payment stablecoin activity that does not directly involve the PPSI as a party other than through a smart contract, as well as mere ownership or control of payment stablecoins issued by a given PPSI.[12] The Agencies explain that treating every stablecoin transfer as creating a CIP relationship would effectively impose on PPSIs a “global obligation to collect and verify identifying information of individual users,” which the Agencies preliminarily assess would be “nearly impossible to implement and could cripple the industry.”[13]
- Customer. A “customer” would be a person that opens a new account, including an individual who opens a new account for an individual lacking legal capacity or for an entity that is not a legal person.[14] The proposed definition would exclude, among others: financial institutions regulated by a Federal functional regulator or banks regulated by a state bank regulator, certain exempt persons, persons with existing PPSI accounts where the PPSI reasonably believes it knows the true identity of the person, and persons acquiring or redeeming a payment stablecoin other than directly from or directly to the PPSI.[15] The CIP NPR also recognizes that a person with no prior relationship to a PPSI could become a customer and account holder of the PPSI through certain activities, such as redemption. For example, an individual with no relationship to the PPSI could acquire a payment stablecoin from an exchange and later seek to redeem it directly with the PPSI. The Agencies request comments on whether the proposal should be clarified to address such activity.[16]
- Digital Asset Service Provider. The CIP NPR would define “digital asset service provider” for purposes of the CIP rule because the term is used in the proposed definition of “account.”[17] The proposed definition aligns with the definition in the GENIUS Act[18] and would cover persons engaged, for compensation or profit, in business in the United States (including on behalf of customers or users in the United States) involving the exchange or transfer of digital assets, digital asset custody, or financial services relating to digital asset issuance, among other activities.[19] It would exclude certain protocol, software, validation, and liquidity-pool activities, including distributed ledger protocols, self-custodial software interfaces, and participation in liquidity pools or similar mechanisms for peer-to-peer transactions.[20]
Customer Information Required
The proposal would require each PPSI to establish and maintain a written CIP, appropriate for its size and business, as part of its broader AML/CFT program.[21]
Before opening an account, a PPSI would be required to obtain, at a minimum, the customer’s (1) name; (2) date of birth, for an individual, or date of formation, for a person other than an individual; (3) address, and (4) identification number.[22] For U.S. persons, the identification number would be a taxpayer identification number; for non-U.S. persons, acceptable identification numbers could include a taxpayer identification number, passport number and country of issuance, alien identification card number or other government-issued document number evidencing nationality or residence and bearing a photograph or similar safeguard.[23] The address must be a physical location; a post office box, virtual office, or commercial mail-receiving agency address would not be acceptable.[24]
Verification Requirements
The CIP NPR would require a PPSI’s CIP to include risk-based procedures for verifying the identity of each customer “to the extent reasonable and practicable,” sufficient to enable the PPSI to form “a reasonable belief that it knows the true identity” of each customer.[25] The procedures would need to be based on the PPSI’s assessment of relevant risks, including the types of accounts maintained, the methods of account-opening, the types of identifying information available and the PPSI’s size, location, and customer base.[26] The CIP NPR would permit PPSIs to verify identity through documents such as an unexpired government-issued identification for individuals or formation documents for entities, non-documentary methods such as comparing customer-provided information against information from an identity verification vendor, or a combination of both.[27]
Digital Identity Tools
The Agencies expressly recognize the potential use of digital identity tools and verifiable credentials but do not propose specific regulatory text governing those tools.[28] Instead, the CIP NPR would preserve flexibility so that each PPSI can assess the trustworthiness of particular mechanisms and the risks presented.[29] The Agencies explain, for example, that a state-issued mobile driver’s license could constitute documentary verification, while a non-governmental digital credential that allows a person to prove identity without revealing additional information could, if appropriate under a risk-based procedure, serve as a non-documentary verification method.[30]
Reliance
The CIP NPR would permit a PPSI to rely on another federally regulated financial institution, including an affiliate, to perform CIP procedures for a PPSI’s customer, subject to certain requirements: reliance would need to be reasonable under the circumstances; the other financial institution would need to be subject to AML/CFT program and CIP requirements and be regulated by a Federal functional regulator, and the institutions would need to have a contract requiring annual certification that the other institution has implemented its AML/CFT program and will perform the specified CIP requirements.[31] Reliance would not change the PPSI’s own CIP obligation, and the PPSI would remain liable for non-compliance.[32] The reliance framework would also create a potential asymmetry between federally regulated PPSIs and State qualified PPSIs.[33] A State qualified PPSI could rely on CIP procedures performed by a PPSI that is subject to supervision by a Federal functional regulator, but a PPSI that is a subsidiary of a federally regulated depository institution could not rely on a procedure performed by a State qualified PPSI because State qualified PPSIs are not overseen by a Federal functional regulator.[34]
Comments and Effective Dates
The Agencies request comment by August 21, 2026 on all aspects of the CIP NPR, including whether any CIP requirement should extend to secondary-market activity.
The Agencies propose that any final rule become effective 12 months after issuance to allow PPSIs sufficient time to review and implement the rule’s requirements.[35]
[1] Permitted Payment Stablecoin Issuer Customer Identification Program, 91 Fed. Reg. 37,234 (June 22, 2026).
[2] GENIUS Act, Pub. L. No. 119-27, 139 Stat. 419 (2025) (codified at 12 U.S.C. §§ 5901–5916).
[3] FinCEN & OFAC, Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions-Compliance Program Requirements, 91 Fed. Reg. 18,582 (Apr. 10, 2026).
[4] See CIP NPR at 37,234.
[5] 12 U.S.C. § 5903(a)(5)(A).
[6] 12 U.S.C. § 5903(a)(5)(A)(v).
[8] The CIP NPR uses “primary market” to generally describe direct interactions between a PPSI and a user or holder of a payment stablecoin, such as issuing, converting, redeeming, repurchasing, burning, and reissuing payment stablecoins, as well as providing associated services such as custody. The CIP NPR uses “secondary market” to describe payment stablecoin activity that does not directly involve the PPSI as a party to the transaction other than via a smart contract, such as purchases through intermediaries, payments from self-hosted wallets, exchange transactions, and person-to-person transactions. CIP NPR at 37,238; see also Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions-Compliance Program Requirements, 91 Fed. Reg. 18,582, 18,585 (Apr. 10, 2026).
[9] CIP NPR at 37,239. As noted above, the GENIUS Act requires an “effective customer identification program,” including “identification and verification” of “account holders” with the PPSI. See 12 U.S.C. § 5903(a)(5)(A)(v).
[10] CIP NPR at 37,239. The “formal relationship” formulation tracks the existing CIP rules for banks, broker-dealers, and futures commission merchants, and introducing brokers. See 31 C.F.R. §§ 1020.100(a)(1), 1023.100(a)(1), 1026.100(a)(1).
[11] CIP NPR at 37,239; 12 U.S.C. § 5903(a)(7).
[18] See 12 U.S.C. § 5901(7).
[19] CIP NPR at 37,240–41. The proposed definition incorporates the GENIUS Act’s definition of “person,” see 12 U.S.C. § 5901(24), “monetary value,” see 12 U.S.C. § 5901(17) and “distributed ledger protocol,” see 12 U.S.C. § 5901(9).
[20] CIP NPR at 37,240–41.
[21] Id. at 37,241. The Agencies state that, where a PPSI is a subsidiary of an insured depository institution, an enterprise may elect to maintain a single enterprise-wide AML/CFT program or CIP rather than separate programs for the parent and subsidiary, provided the program accounts for the legal and regulatory obligations of both entities. Id.
[33] Under the GENIUS Act, the OCC is the primary federal regulator of PPSIs that are subsidiaries of OCC-supervised insured depository institutions, federally licensed nonbank entities, uninsured national banks, and federal branches of foreign banks; the Federal Reserve Board, the FDIC and the NCUA are similarly the primary Federal regulators of PPSIs that are subsidiaries of, respectively, Federal Reserve Board-supervised, FDIC-supervised and NCUA-supervised insured depository institutions. State qualified PPSIs are not overseen by a Federal functional regulator and may opt for state-only supervision if their consolidated total outstanding issuance does not exceed $10 billion. See 12 U.S.C. §§ 5901(25), 5901(31), 5903(c), and 5906.