Five Agencies Propose First KYC Rule for Stablecoin Issuers

What Happened

On June 18, 2026, FinCEN, the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, and the National Credit Union Administration jointly issued a Notice of Proposed Rulemaking (NPRM) requiring permitted payment stablecoin issuers to establish Customer Identification Programs under the GENIUS Act.

The proposed rule applies to any entity designated as a permitted payment stablecoin issuer (PPSI) under the Act. It implements the first mandatory identity-verification requirement specifically designed for stablecoin issuers. The rule is scheduled for Federal Register publication on June 22, 2026.

A 60-day public comment period opens on that date, with responses due August 21, 2026.

The announcement arrives less than a year after the GENIUS Act was signed into law in July 2025. The Act created the PPSI legal category and mandated that stablecoin issuers comply with Bank Secrecy Act anti-money laundering and counter-terrorism financing requirements. Treasury and FinCEN proposed a joint AML and sanctions compliance framework in April 2026.

The June 18 NPRM adds the specific CIP requirements: who must be identified, how, and to what standard. The regulatory infrastructure for the US stablecoin market now exists in draft form.

Freeze authority without a CIP means the issuer can freeze any address. Combined with a CIP, the issuer knows exactly whose address it is. Together, the CIP and the freeze authority make the surveillance complete.

What a CIP Requires

A Customer Identification Program is the foundation of Know Your Customer compliance in the US financial system. For banks, CIP requirements have been mandatory since the Bank Secrecy Act's 2003 implementation rules. Under the proposed rule, stablecoin issuers would be required to maintain written, risk-based procedures for: collecting specified identifying information from each customer before or during account opening; verifying that identity within a reasonable time using documentary or non-documentary methods; screening customer identities against any government-designated list of known or suspected terrorists or sanctioned parties; maintaining records of all information obtained through the CIP; and notifying customers that the issuer is collecting information to verify their identity.

Issuers may also rely, in specified circumstances, on the CIP procedures of other federally regulated financial institutions, a provision that will shape how compliance responsibilities are allocated between issuers and their dealer networks.

These requirements mirror what banks have done since 2003. What is new is the entity being regulated: stablecoin issuers have operated under informal internal AML programs since their founding. After this rule takes effect (assuming it finalizes in something like its proposed form), formal CIP procedures with federal examination authority will apply.

An examiner from the OCC, FDIC, or Federal Reserve will be able to walk into a stablecoin issuer and audit whether the issuer actually knows who its customers are and whether it has screened them against OFAC's Specially Designated Nationals list. The theoretical AML obligation that existed before now has an enforcement architecture behind it.

The Primary Market Frame

The proposed rule focuses on the primary stablecoin market, where permitted payment stablecoin issuers interact directly with institutional clients to mint and redeem large quantities of tokens. Retail users who acquire stablecoins through exchanges, brokers, or peer-to-peer transactions are not directly covered.

That scope may seem like a significant carve-out, but it describes how the surveillance architecture actually works rather than a gap in it. Every USDT or USDC in existence was minted in a transaction between Tether or Circle and an institutional counterparty. After this rule, every such minting event will be tied to a verified institutional identity screened against OFAC lists.

The retail purchaser who buys 500 USDT on any exchange has not identified themselves to Tether. The authorized participant who minted those tokens has. The stablecoin does not carry the identity, but it carries a mint transaction that the issuer must be able to trace.

The secondary market is not unregulated. Exchanges selling stablecoins to retail customers are already subject to their own AML and KYC obligations as money services businesses or, under MiCA in the European Union, as crypto-asset service providers. The June 18 rule completes the identity-capture architecture at the issuing layer, which is the layer that controls supply.

The practical result: the identity of every institutional participant in the primary stablecoin market will be formally documented, screened, and maintained in a federal-examination-accessible record. That is a qualitatively different compliance posture than what existed before the GENIUS Act.

Three Rules, One Architecture

The June 18 CIP NPRM is the third piece of a regulatory architecture that has been assembling since July 2025. The GENIUS Act established the PPSI legal category and required Bank Secrecy Act compliance. In April 2026, Treasury and FinCEN proposed a joint AML program and sanctions compliance framework requiring stablecoin issuers to maintain formal AML policies, conduct transaction monitoring, and file Suspicious Activity Reports.

The OCC issued parallel prudential standards for nationally chartered PPSIs covering capital, liquidity, and reserve requirements. The June 18 CIP rule adds the identity-verification front end: who must be identified, when, and to what standard before a mint or redemption executes.

Together, the three frameworks establish the complete compliance architecture: know who your customers are (CIP), monitor their activity for suspicious patterns (AML program), and report when something looks wrong (Suspicious Activity Report filing). That is the same three-layer structure that governs banks.

Stablecoin issuers will operate under the same surveillance architecture as a nationally chartered bank, applied to the specific mechanics of stablecoin minting and redemption. The public comment period through August 21 is the last point at which the industry can argue for carve-outs or scope limitations before the rule finalizes.

What This Means for You

If you self-custody Bitcoin in your own keys on the Bitcoin network, the June 18 NPRM has no operational impact on your posture. Bitcoin has no issuing layer. There is no entity that can be designated a permitted payment stablecoin issuer under the GENIUS Act. A Bitcoin UTXO you control through your own private keys is not a claim on any issuer's reserves.

The CIP requirement cannot reach your hardware wallet because your hardware wallet has no institutional counterparty who can be subjected to a CIP examination. The dual-track the GENIUS Act establishes makes the structural distinction explicit: stablecoins have issuers; Bitcoin does not.

Regulation that attaches to issuers does not attach to Bitcoin.

If you hold USDT, USDC, or any GENIUS Act-compliant stablecoin, the June 18 rule completes the picture of what holding those instruments means in 2026. The freeze authority Tether and Circle possess was the first layer: issuers can revoke your access to your balance at any point they are compelled to do so.

The KYC architecture built by the June 18 rule is the second layer: every institutional participant in the minting chain is identity-verified and OFAC-screened, and that record is subject to federal examination. These 2 layers are not independent. An OFAC designation affects the freeze authority.

A CIP record is what makes the designation actionable against a specific customer. Freeze authority without a CIP means the issuer can freeze any address. Freeze authority combined with a CIP means the issuer knows exactly whose address it is. The combination is a complete surveillance and enforcement system.

The practical question for anyone holding meaningful value in stablecoins is whether the use case justifies the surveillance exposure. For payments and short-term transfers, the surveillance trade-off is often worth it. The speed and stability of a stablecoin for a 72-hour cross-border transfer may outweigh the CIP and freeze authority implications for that transaction.

For longer-term value storage, the June 18 rule adds another reason to consider the structural alternative: native Bitcoin in self-custody, where the issuer surveillance architecture does not exist because no issuer exists.

What to Watch

Watch the public comment period through August 21, 2026, for whether major stablecoin issuers (Tether, Circle, Paxos) propose changes to the primary-market-only scope or seek carve-outs for specific transaction types. A follow-on rulemaking from FinCEN or any agency could extend CIP obligations to secondary-market participants (exchanges, brokers), because the current rule focuses on issuers and secondary market actors remain under separate frameworks.

The parallel MiCA implementation deadline of July 1, 2026, is a key marker, where more than 80% of EU crypto-asset service providers are still unlicensed, because the global convergence of stablecoin compliance requirements will drive where issuers choose to domicile and which markets they can serve.

The FATF Travel Rule implementation pace also bears watching, since the CIP requirement creates the identity data that Travel Rule compliance will eventually require stablecoin issuers to transmit when transactions move between counterparties. And watch whether any non-GENIUS-Act stablecoin architecture (decentralized, algorithmic, non-custodial) attempts to position itself outside the issuer-obligation framework, because the structural question of what counts as an issuer under the Act will determine how broadly the surveillance architecture eventually extends.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.