US Crypto Regulation Is Being Rewritten: What Firms Must Know in 2026
The pace of US digital asset regulation in 2026 has surprised even experienced Washington hands. The GENIUS Act moved from negotiation to presidential signature in roughly six months, without a financial crisis forcing its hand. At the same time, the OCC, Federal Reserve, and FDIC jointly updated their AML supervisory guidance for the first time since 2011, and the SEC and CFTC signed a written cooperation agreement. Taken together, these three developments signal something more fundamental than new rules: the entire architecture of how digital assets are supervised in the United States is shifting, and compliance programs that are not already adapting are already behind.
The GENIUS Act: Speed as a Signal
Legislation rarely moves at this pace. When the president signed the Executive Order directing federal agencies to build a digital asset framework on 23 January 2025, few observers expected a bill to reach his desk by 18 July the same year. Yet that is what happened, with bipartisan support in both chambers and no systemic crisis driving urgency.
The last time legislation moved at comparable speed was the CARES Act in 2020, passed while the financial system was under acute stress. The GENIUS Act had no equivalent forcing event. Its speed reflects something more durable: a broad political consensus that digital assets are now a serious part of the financial system and that the regulatory vacuum must be closed.
What the GENIUS Act Changes for Stablecoin Issuers
The GENIUS Act is specifically aimed at payment stablecoins. Prudential regulators have issued a series of proposed rules to implement it, covering capital requirements, reserve standards, and application procedures at the OCC and FDIC. These rulemakings are still in progress, which is normal at this stage of the legislative cycle, and the final rules are expected to land over the coming months and quarters.
Separately, FinCEN, OFAC, and Treasury have issued a Notice of Proposed Rulemaking to bring permitted payment stablecoin issuers within the scope of the Bank Secrecy Act. This is a significant structural move: it would place stablecoin issuers alongside banks and money services businesses in terms of AML and sanctions obligations, not as a carve-out but as full participants in the BSA framework. Firms that issue, custody, or settle stablecoins on behalf of clients need to be tracking this NPRM closely. The cross-border stablecoin risks flagged by the FSB earlier this year add an international dimension that prudential planning cannot ignore.
The Joint AML Update: Three Structural Shifts
The April 2026 joint supervisory update from the OCC, Federal Reserve, and FDIC under SR 26-2 is arguably the most operationally significant development of the year. It is the first time since 2011 that the three prudential regulators have moved together on AML expectations, and it signals three changes that affect every institution touching digital assets.
Shift One: Outcome-Based Supervision
The old supervisory model was largely procedural. Examiners checked whether the right processes were in place and whether documentation was current. The new standard asks a different question: is the program actually catching what it was built to catch? This is a meaningful change for institutions that have invested heavily in procedural compliance. A well-documented but underperforming transaction monitoring system is no longer a defensible position.
For firms using blockchain analytics in their screening and monitoring, this raises the bar on how they deploy and govern those tools. It is not enough to have an analytics feed; institutions need to show they understand the outputs, act on them consistently, and can demonstrate the chain of decisions that follows from a positive hit.
Shift Two: Continuous Model Monitoring
Under the prior regime, model validation happened on a fixed schedule tied to risk tier. The updated expectation is ongoing monitoring: regulators want to see how a model behaves over time, not just at the point of its last validation cycle. For any institution ingesting on-chain data into AML screening, this changes the technical architecture required. Batch validations and periodic reviews are no longer sufficient on their own. Monitoring pipelines need to be built for continuity, with clear governance over what triggers a re-evaluation.
Shift Three: Explainability of AI-Driven Decisions
As artificial intelligence moves deeper into transaction monitoring and risk scoring, regulators are centering their attention on explainability. Efficiency gains from AI are welcome, but they are not the test. The test is whether a third party can reproduce a model's decisions, understand why a given output was reached, and verify who approved the action taken as a result. Institutions that cannot answer those questions clearly are exposed, regardless of how well their model actually performs.
In practice, explainability means maintaining detailed audit trails of model governance, being able to reconstruct the logic behind any alert, and having a documented escalation path from the model output to the human decision that followed. This is where robust crypto compliance reporting infrastructure becomes operationally critical rather than a nice-to-have.
Inter-Agency Coordination: What It Means in Practice
The Treasury Secretary chairs the Financial Stability Oversight Council, which gives him a mechanism to convene every major financial regulator in one room. That convening power is being used. The SEC and CFTC cooperation agreement, the joint OCC/Fed/FDIC supervisory update, and the coordinated FinCEN/OFAC/Treasury NPRM on stablecoin issuers are all pieces of the same effort. Getting two independent agencies to put cooperation in writing, as the SEC and CFTC have done, is not a formality. It is a structural commitment that changes how both agencies approach overlapping jurisdiction cases.
For compliance teams, greater coordination should translate into more consistency over time: fewer contradictory guidance positions, clearer lines between SEC and CFTC jurisdiction on specific asset types, and a more predictable examination environment. It does not reduce the obligations that are already in place. The law has not changed; it is the implementation that is evolving. But a more coherent supervisory landscape should allow institutions to build more durable programs rather than managing to multiple conflicting standards simultaneously.
The Market Structure Bill: A Separate Track
The bill that would formally clarify the jurisdictional boundary between the SEC and the CFTC on digital assets is on a different legislative timeline. Congressional scheduling is constrained: the August recess and November midterms leave limited floor time, and the bill has been held up by procedural dynamics. Predicting when it will land is genuinely uncertain. But the point for institutions is not to wait for it. The direction is clear. The SEC and CFTC cooperation agreement already reflects the intent to close the jurisdictional gap, even before the statutory language is finalized.
The LIBOR transition offers a useful parallel. That process involved years of rulemaking and required legislation to resolve certain critical points. Institutions that waited for finalized rules before beginning their transition work paid a higher price than those that tracked the direction of travel and built readiness in advance. The same logic applies here.
Accounting and Operational Implications for Firms
The regulatory shifts described above have direct consequences for how firms manage the books and records behind their digital asset activity.
AML Program Documentation and Audit Trails
The move to outcome-based supervision means that audit trails need to capture not just what a system flagged, but what decision was made, by whom, and on what basis. For firms using digital asset accounting software integrated with compliance tooling, the data architecture needs to support this level of reconstruction. A system that records transactions without capturing the compliance workflow attached to each transaction will not meet the new standard.
Institutions that handle client digital assets need to ask whether their current crypto bookkeeping software produces the kind of exportable, examiner-ready record that demonstrates how a suspicious activity determination was reached. If the answer is uncertain, that is worth resolving before the next examination cycle.
Stablecoin Reserve and Capital Accounting
For entities that issue or hold payment stablecoins, the proposed OCC capital and reserve rules under the GENIUS Act introduce accounting questions that are not yet fully resolved at the standard-setting level. Pending final guidance, firms should be tracking how reserve assets are classified on the balance sheet, whether the liability side of a stablecoin issuance is treated as a deposit equivalent or a distinct obligation, and how any capital buffer requirement interacts with existing regulatory capital calculations.
The FinCEN withdrawal of the CVC mixing rule earlier this year is a reminder that the regulatory perimeter is still being drawn. Accounting treatments tied to compliance classifications need to be revisited each time the perimeter moves.
Risk Appetite Documentation
The SR 26-2 update effectively requires that an institution's stated risk appetite be demonstrably enforced, not just documented. If a firm tells its regulator it has zero tolerance for exposure to sanctioned entities, and an examination reveals any such exposure, the conversation will be about why the stated policy was not upheld, not about whether the exposure level is numerically material. For CFOs and heads of compliance, this means risk appetite statements need to be operationally binding and regularly tested, not aspirational language in a policy document.
Frequently Asked Questions
What is the GENIUS Act and who does it affect?
The GENIUS Act is US federal legislation focused on payment stablecoins. It creates a licensing and regulatory framework for stablecoin issuers and directs prudential regulators, including the OCC and FDIC, to issue implementing rules covering capital, reserves, and application procedures. It affects any entity that issues, distributes, or provides custody services for payment stablecoins in the United States.
What changed in the joint OCC, Federal Reserve, and FDIC AML update?
The April 2026 update under SR 26-2 is the first joint AML supervisory revision since 2011. It shifts the supervisory focus from procedural compliance toward demonstrable effectiveness, requires ongoing model monitoring rather than periodic scheduled validation, and raises expectations around the explainability of AI-driven compliance decisions.
Does the SEC and CFTC cooperation agreement resolve the jurisdictional question on digital assets?
Not entirely. The agreement signals a commitment to coordinated oversight and reduces the risk of contradictory enforcement positions, but it does not replace the statutory clarification that the pending market structure bill would provide. Jurisdictional ambiguity on certain asset types remains until that legislation is finalized.
How should compliance teams approach the outcome-based supervisory standard?
Start by stress-testing your transaction monitoring program against its stated objectives: what is it built to catch, and can you show evidence that it is catching it? Document the governance of every model used in AML screening, including how outputs are reviewed, how decisions are escalated, and how the model's performance is tracked over time. Ensure your digital asset accounting software and compliance tooling produce audit trails that support examiner-ready reconstruction of decisions.
What should firms do now, given that several rulemakings are still in progress?
Track the direction of travel rather than waiting for final text. The GENIUS Act implementing rules, the BSA scoping NPRM for stablecoin issuers, and the market structure bill all point in the same direction: a more demanding, outcome-focused compliance environment with higher expectations for explainability and inter-agency coordination. Firms that build toward that standard now will be better positioned than those that wait for every rule to be finalized before acting.
Source: Elliptic