GENIUS Act Stablecoin Compliance: What Banks Must Do Now
The GENIUS Act was signed into law in July 2025 and will be fully operative by January 18, 2027 at the latest. From that date, every stablecoin moving through a US bank — whether the institution issues it, custodies it, or simply processes a payment that touches it — must be classified as either permitted or non-permitted under the federal framework. Getting that classification wrong is a compliance failure, and most bank systems are not yet built to make the distinction. The runway is shorter than it looks.
What the GENIUS Act Actually Does
The Act creates a federal licensing category called a Payment Stablecoin Issuer, or PPSI. Only a PPSI can lawfully issue payment stablecoins to US persons. A PPSI is supervised either by a federal regulator or by a state regulator operating a framework the federal authorities have deemed substantially similar. State-licensed issuers that grow past $10 billion in outstanding issuance shift to federal oversight automatically.
Core issuer obligations
The headline requirements are substantive. Reserves must be held in high-quality liquid assets on at least a 1:1 basis against outstanding stablecoins. Issuers cannot pay yield or interest to holders. Redemption at par must be available under a published policy. And issuers must operate a Bank Secrecy Act-style AML/CFT and sanctions program, treating themselves as financial institutions under the BSA.
Foreign issuers are not excluded. A non-US issuer can reach US persons provided its home jurisdiction is recognised as comparable and it meets additional conditions, including registration with the OCC and maintaining reserves in the United States.
The effective date mechanics
The Act takes effect on the earlier of two triggers: 120 days after the primary federal regulators publish final implementing rules, or January 18, 2027. Regulators were directed to produce those rules within one year of enactment. Through 2026 they have been working through that process, with proposals covering issuance, reserves, custody, and AML/CFT obligations already published. The framework is visible enough to act on now, even before the rules are finalised.
The Permitted vs. Non-Permitted Distinction
This single question sits at the centre of every obligation the Act creates for banks: is this stablecoin permitted, meaning issued by an entity licensed under the US framework, or not?
The answer is not the same as asking whether a stablecoin is legitimate. A non-permitted stablecoin can be a perfectly reputable token whose issuer simply has not obtained a US licence. It can arrive through a correspondent bank, an exchange customer, or a business account without anyone involved setting out to cause a problem. The task is not to prevent non-permitted stablecoins from ever touching the institution — that is not fully achievable — but to recognise them when they appear and handle them correctly.
Why the classification must be dynamic
A stablecoin does not stay still. It moves across wallets and blockchains after it reaches a bank, which means a one-time check at onboarding is not sufficient. The permitted status of a token depends on its issuer, and that status can change as the asset travels through different services and chains. Keeping the classification current as flows move is genuinely new work for most compliance teams, and it is work that static risk-scoring models cannot handle on their own.
A useful mental model is sanctions screening. Just as compliance teams tag counterparties against a sanctions list at the entity level and refresh that tagging as relationships evolve, the Act calls for stablecoins to be tagged at the issuer level as permitted or non-permitted, with that tag feeding into customer risk ratings and transaction alerts in real time.
Four Scenarios Where Banks Are Affected
The Act's reach extends well beyond stablecoin issuers. Four distinct scenarios bring a bank into scope, and the same core question applies in each one.
Banking a stablecoin issuer
Only a small number of banks have launched their own stablecoin so far, though launches and consortiums have been picking up through 2026. For most institutions, the nearer-term exposure is not issuance but providing banking services to an issuer. Due diligence here goes beyond confirming that a customer operates in the crypto space. The bank must establish whether the customer qualifies as a PPSI or an eligible foreign issuer, and whether the tokens it issues fall within the Act's definition of payment stablecoins at all. A firm outside scope cannot lawfully issue payment stablecoins in or from the US, making that determination a prerequisite for onboarding.
Acting as a custodian
The Act identifies two categories of entity that can serve as third-party custodians for stablecoins, reserves, and the private keys used to issue them: a PPSI acting within its authorised activities, and a bank, credit union, or other institution under federal or state banking supervision. For institutions that do not want to issue stablecoins themselves, custody is a direct route into the business. The detailed rules are not yet final, but the direction is clear: stablecoins, reserves, and keys must be held as customer property, kept separate and identifiable, and the custodian must authorise any movement. Stablecoin holders also hold a priority claim on reserves ahead of other creditors if an issuer fails — a provision that shapes how a custodian books and segregates those assets.
Correspondent banking relationships
Encouraging stablecoin adoption is one of the Act's stated aims, so compliant stablecoins will increasingly appear in correspondent payment flows as the regime beds in. The permitted-versus-non-permitted tagging must operate at the level of individual flows, not just at the counterparty level, so banks can see which issuers and assets are moving through correspondent relationships and screen them before they pass through.
Everyday customer activity
This is where the Act's reach is widest and arguably hardest to manage. Stablecoin activity already moves through most banks, captured by existing monitoring but not yet sorted by whether the token is permitted. Touchpoints include customers converting fiat to stablecoins through exchange accounts, business clients receiving stablecoin payments from counterparties abroad, and consumer accounts linked to wallets that hold stablecoins. Mapping this exposure is largely a matter of looking at what the institution already processes through the new lens of permitted status. For related context on how stablecoin freezes can create unexpected accounting exposure, see our coverage of how stablecoin freezes create accounting exposure.
What Compliance Teams Need to Update
PPSIs are classified as financial institutions under the BSA and must run risk-based AML/CFT and sanctions programs. But banks that never become PPSIs still need to adapt their own programs, because the permitted/non-permitted distinction must be visible across all four scenarios above. Three areas require attention before the effective date.
Customer risk scoring
Issuers, exchanges, and customers who use stablecoins need to be incorporated properly into BSA/AML programs. That means updating risk models to reflect whether a customer issues, custodies, or transacts in stablecoins, and whether those stablecoins are permitted. A customer who transacts predominantly in non-permitted stablecoins carries different risk characteristics than one transacting in permitted ones, and current scoring frameworks typically do not make that distinction.
Transaction monitoring and screening
Permitted versus non-permitted stablecoins must be separated in transaction monitoring workflows, with sanctioned counterparties and blocked jurisdictions flagged at the flow level. Stablecoin-specific identifiers and risk labels need to be carried into KYC data, monitoring rules, and screening configurations. This is not a bolt-on; it requires changes to the data fields the monitoring system ingests and the rule logic it applies.
Blockchain analytics
Risk scoring updates and monitoring rule changes address the static part of the problem. The dynamic part — tracking permitted status as a stablecoin moves across wallets and blockchains — requires blockchain analytics. Analytics tools can identify a stablecoin's issuer, attribute activity to the services it passes through, and keep risk assessments current as flows cross chains. That capability is what closes the gap between a one-time onboarding check and the continuous classification the Act requires. For accounting teams, the same data that drives compliance classification also feeds the ledger entries that digital asset accounting software must record accurately as positions move. Our analysis of what the Digital Asset Tax Certainty Act means for stablecoin accounting covers the tax-side implications that sit alongside these AML obligations.
Practical Steps Before January 2027
The rules are not yet final, but the direction is clear enough that waiting for finalisation before acting is a risk in itself. Three steps will put most institutions in a stronger position before the effective date.
Map existing stablecoin exposure
Run a review of current transaction data, correspondent relationships, and customer account activity to identify where stablecoins are already appearing. Categorise by issuer and assess which issuers are likely to qualify as permitted under the emerging framework. This is the foundation for every subsequent step.
Update KYC and onboarding for issuer clients
For any existing or prospective customer in the stablecoin space, document whether they qualify as a PPSI or eligible foreign issuer and what tokens they issue. Build this determination into the onboarding workflow so that the question is answered systematically rather than on a case-by-case basis.
Build permitted/non-permitted tagging into monitoring and screening
Work with your transaction monitoring vendor to introduce stablecoin issuer identifiers as a data field, and configure rules that flag non-permitted stablecoin flows for review. Pair this with blockchain analytics coverage that can track issuer attribution across the chains where your customers are active. Document the basis for each classification decision to support audit readiness when regulators begin examining programs under the new regime.
Frequently Asked Questions
What is a permitted stablecoin under the GENIUS Act?
A permitted stablecoin is one issued by a licensed PPSI under the US federal framework, or by a foreign issuer whose home jurisdiction has been recognised as comparable and who has met the additional US conditions including OCC registration and US-held reserves. Any stablecoin issued outside that framework is non-permitted, regardless of whether it is otherwise legitimate.
Does the GENIUS Act apply to banks that do not issue stablecoins?
Yes. The Act reaches banks that provide custody services, maintain correspondent banking relationships where stablecoins flow, or serve customers who hold or transact in stablecoins. In each case the bank must be able to classify the stablecoin as permitted or non-permitted and handle it accordingly.
When does the GENIUS Act actually take effect?
It takes effect on the earlier of 120 days after final implementing rules are published by the primary federal regulators, or January 18, 2027. Given that retooling compliance systems is not a quick process, institutions should treat the effective date as closer than it appears.
How does the custodian role work under the Act?
Banks and credit unions under federal or state banking supervision can act as third-party custodians for stablecoins, reserves, and private keys. Custodied assets must be held as customer property, kept separate and identifiable, and the custodian must authorise any movement. Stablecoin holders hold a priority claim on reserves over other creditors if an issuer fails.
What does a non-permitted stablecoin mean for AML obligations?
Encountering a non-permitted stablecoin is not the same as encountering an illicit asset, but it does require a different risk treatment. Banks must be able to identify non-permitted stablecoins in customer flows, assess the associated risk, and handle them consistently within their BSA/AML programs. Failing to make the distinction at all is itself a compliance gap under the Act.
Source: Elliptic