On June 22, 2026, the Office of the Comptroller of the Currency issued a notice of proposed rulemaking (an “NPR”) addressing the Bank Secrecy Act (“BSA”) and sanctions compliance standards for OCC-supervised permitted payment stablecoin issuers (“PPSIs”), as required under the Guiding and Establishing National Innovation for U.S. Stablecoins Act (the “GENIUS Act”).[1] On June 5, 2026, the Federal Deposit Insurance Corporation published an NPR that similarly addressed BSA and sanctions compliance standards for FDIC-supervised PPSIs.[2]
The OCC and FDIC NPRs are part of a broader set of rulemakings implementing the GENIUS Act generally, and the statute’s anti‑money laundering/countering the financing of terrorism (“AML/CFT”) and sanctions framework specifically. The focus of these NPRs is the implementation of prior draft rulemakings that the Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) and Office of Foreign Assets Control (“OFAC”) issued on April 8, 2026, which would establish AML/CFT and sanctions compliance program requirements for PPSIs.[3] On June 18, 2026, FinCEN and the primary federal payment stablecoin regulators issued a joint NPR to implement the requirement in the GENIUS Act that PPSIs establish customer identification programs.[4] The OCC’s and FDIC’s respective NPRs would establish the principles-based BSA and sanctions compliance standards applicable to the PPSIs each agency supervises, and, to a significant extent, cross reference the requirements that will be applicable to PPSIs under regulations that have been issued or proposed by FinCEN and OFAC.
The GENIUS Act requires that each primary federal payment stablecoin regulator establish, among other things, appropriate principles-based compliance risk management requirements and standards, including BSA and sanctions compliance standards.[5] The OCC’s NPR proposes these standards for OCC-supervised PPSIs, and the FDIC’s NPR proposes these standards for FDIC-supervised PPSIs.[6]
In the rules proposed in their respective NPRs, the OCC and FDIC would require PPSIs to comply with the BSA and provisions of the GENIUS Act addressing compliance by PPSIs with the BSA, sanctions laws, and lawful orders.[7] The OCC and FDIC would also require PPSIs to comply with regulations under the BSA and the GENIUS Act relating to AML/CFT and sanctions programs and related reporting requirements.
In addition, both the OCC and the FDIC would establish a notice and consultation framework for certain enforcement and supervisory actions. Under this framework, the OCC or the FDIC (as applicable) would be required to consult with FinCEN prior to initiating an AML/CFT enforcement action or a significant AML/CFT supervisory action. The framework proposed in the OCC and FDIC NPRs reflects a consultation framework proposed by FinCEN and OFAC in their April 8, 2026 joint NPR. FinCEN also proposed a similar consultation framework in a separate NPR it issued on April 7, 2026, which would amend FinCEN’s regulations to recalibrate AML/CFT program requirements more broadly to provide financial institutions with greater flexibility to allocate compliance resources toward higher-risk activities and away from lower-risk activities.[8]
Comments on the OCC’s NPR are due 30 days after publication in the Federal Register. Comments on the FDIC’s NPR are due on August 4, 2026.
[1] OCC, GENIUS Act: Anti-Money Laundering/Countering the Financing of Terrorism and Sanctions Compliance: Notice of Proposed Rulemaking (June 22, 2026), available at https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-28.html.
[2] FDIC, Bank Secrecy Act and Sanctions Compliance Standards for FDIC-Supervised Permitted Payment Stablecoin Issuers, 91 Fed. Reg. 34,171 (June 5, 2026).
[3] FinCEN, OFAC, Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions Compliance Program Requirements, 91 Fed. Reg. 18,582 (Apr. 10, 2026). For a summary and discussion of this NPR, please refer to our Memorandum to Clients of April 17, 2026.
[4] Federal Reserve, FDIC, FinCEN, NCUA, OCC, Permitted Payment Stablecoin Issuer Customer Identification Program, 91 Fed. Reg. 37,234 (June 22, 2026). For a summary and discussion of this NPR, please refer to our Memorandum to Clients of June 22, 2026.
[5] See 12 U.S.C. § 5903(a)(4)(A)(iv) (requiring that these standards be tailored to the business model and risk profile of PPSIs and consistent with applicable law). The primary federal payment stablecoin regulators are the Board of Governors of the Federal Reserve System, the FDIC, the National Credit Union Administration and the OCC. Id. § 5901(25).
[6] Under the GENIUS Act, the OCC supervises PPSIs that are subsidiaries of OCC-supervised insured depository institutions (“IDIs”) and federally licensed PPSIs that are nonbank entities, uninsured national banks or federal branches of foreign banks. The FDIC supervises PPSIs that are subsidiaries of FDIC-supervised IDIs.
[7] See 12 U.S.C. § 5903(a)(5), (6)(B).
[8] FinCEN, Anti-Money Laundering and Countering the Financing of Terrorism Programs, 91 Fed. Reg. 18,704 (Apr. 10, 2026). For a summary and discussion of this NPR, please refer to our Memorandum to Clients of April 16, 2026.