The Anti-Money Laundering (AML) Bar for Stablecoin Issuers was Set Long Before The GENIUS Act

Licensed Permitted Payment Stablecoin Issuers (PPSIs) are about to become full citizens of the anti-money laundering world. In April 2026, FinCEN and OFAC jointly proposed a rule implementing the GENIUS Act's instruction to treat permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act.[1] That means an issuer must have a written AML program, a dedicated compliance officer located in the United States, suspicious activity reporting, and a formal sanctions compliance program.[2] A companion proposal followed in June 2026, when FinCEN and the federal banking agencies jointly proposed Customer Identification Program (CIP) requirements for stablecoin issuers, the last piece of the Bank Secrecy Act framework.[3]  

Since the rule is not yet final, some issuers may be tempted to wait for the final text before investing in compliance. Recent enforcement suggests that it would be a mistake, and the clearest warning has nothing to do with crypto. Additionally, for stablecoin issuers, keeping pace also means adapting controls to the nature and complexity of the activity. For example, transactions involving external wallets may require the issuer to connect what it knows about its customer with on-chain activity and counterparties to identify suspicious patterns or exposure to higher-risk addresses.

In May 2026, the OCC released a consent order against Community Federal Savings Bank, a one-branch savings bank in Queens with about $866 million in assets.[4] It is a small financial institution (FI) with big pipes: CFSB is the sponsor FI behind Wise's U.S. dollar accounts and the issuer of Crypto.com's prepaid card, among many other fintech partnerships. Since 2020, its payment processing business grew rapidly, moving heavy wire and ACH volume across borders, but its controls did not grow with it. The OCC found monitoring systems that automatically closed a high share of suspicious activity alerts without human review, a due diligence program that could not determine whether the FI held accounts for foreign financial institutions, weak testing, and thin staffing.

Here is the detail worth remembering: the order came through the OCC's Novel Bank Supervision unit, the team created to watch FIs serving fintech and digital asset companies. Yet the OCC went out of its way to state that its concerns were “largely unrelated to customers involved in digital assets activities.”[5] If the problem were crypto, every other FI could file the order away as someone else's risk. Instead, the message reads as: transaction volume outran the controls, and that is the violation, whoever the customers are.

This is the standard stablecoin issuers will be held to; it is the same test every fast-growing, cross-border payments business has always faced. Does your monitoring, your customer due diligence, and your testing keep pace with your volume? Illicit activity is already in the system: FinCEN's own justification for the proposed rule cites tens of thousands of stablecoin-related suspicious activity reports filed over the past decade.[6] The GENIUS Act changes who is formally responsible for catching it.

The trade-off for issuers and their FI partners is plain. The OCC, in 2025, removed the requirement to ask permission before entering these businesses, and charters are moving faster than they have in years. In exchange, the judgment about whether a compliance program matches the growth of the business now rests entirely with the institution, and the examiner grades that judgment later, in hindsight, with the full transaction history on the table. Institutions can build the program before the volume arrives, or, as CFSB did, grow first and pay for it afterward.