Modernizing BSA/AML Compliance: OCC Proposes BSA/AML And Sanctions Compliance Standards For Permitted Payment Stablecoin Issuers Under The GENIUS Act

This alert is a part of a series discussing efforts the federal government is taking to modernize the Bank Secrecy Act. Foley Hoag LLP will continue to track and discuss further developments.

Key Takeaways

On June 24, 2026, the Office of the Comptroller of the Currency (“OCC”), in coordination with the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) and the Office of Foreign Assets Control (“OFAC”), published a Notice of Proposed Rulemaking (“NPRM” or “Proposed Rule”) that would impose Bank Secrecy Act/anti-money laundering and countering the financing of terrorism (“BSA/AML/CFT”) and sanctions compliance requirements on permitted payment stablecoin issuers (“PPSIs”) subject to OCC jurisdiction. 

The GENIUS Act defines “payment stablecoins” as digital assets intended for use in transactions that can be exchanged for a set amount of money tied to a national currency.^1. Under the GENIUS Act, federal law now defines who may issue stablecoins and how they must be backed.

Key practical takeaways from this proposal:

• Financial Institutions under OCC’s Jurisdiction Must Implement AML, CFT and OFAC controls. The NPRM implements BSA and sanctions compliance standards for PPSIs subject to the OCC’s jurisdiction.^2. This includes a reasonably designed AML/CFT program, sanctions program, and reporting requirements.^3.
• Federal action setting standards. Following the federal implementation of a vast regulatory framework, states may assess what opportunities remain to overseeing stablecoin issuers.
• Meaningful enforcement safe harbor. The proposed clarification of the “significant or systemic failure” standard provides protection for PPSIs, seeking alignment with FinCEN’s recent actions.
• FinCEN as enforcement gatekeeper. Before initiating an AML/CFT enforcement action or significant supervisory action, the OCC would be required to provide the Director of FinCEN with an opportunity to review the action and would consider any input offered by the Director of FinCEN, creating additional procedural checks before initiating significant supervisory action. 
• Scope of Impacted Entities. There is uncertainty regarding the number of OCC-supervised PPSIs under the Proposed Rule. The OCC estimated that the proposal would affect a total of 29 PPSIs.^4.  

Introduction

The OCC, in coordination with FinCEN and OFAC, published a NPRM that, if finalized, would impose BSA/AML/CFT and sanctions compliance requirements on PPSIs subject to OCC jurisdiction.^5. The Proposed Rule is issued in coordination with FinCEN and OFAC, which have separately issued a proposed rule treating PPSIs as financial institutions under the BSA. 

The OCC’s Proposed Rule is part of a broader effort by the Trump Administration to modernize the Bank Secrecy Act.^6. In April 2026, FinCEN issued a proposed program rule intended to fundamentally reform AML/CFT compliance for financial institutions, and the OCC, Federal Deposit Insurance Corporation (“FDIC”), and National Credit Union Administration (“NCUA”) concurrently issued coordinated proposed rules aligned with FinCEN’s NPRM. A series of parallel rulemakings is building out that agenda and the OCC’s Proposed Rule is another in this sequence of coordinated rulemakings.^7. The OCC’s June 24 Proposed Rule is just one component of an increasingly complex series of AML/CFT-related proposals by federal agencies to establish the fundamental components of the new GENIUS Act financial crimes regulatory regime for PPSIs. 

Background

The GENIUS Act (12 U.S.C. § 5901 et seq.) requires primary Federal payment stablecoin regulators to issue regulations implementing appropriate BSA and sanctions compliance standards. Section 4(a)(4)(A) of the GENIUS Act requires the OCC to issue regulations that are “tailored to [the] business model and risk profile” of PPSIs and “consistent with applicable law.”

On March 2, 2026, the OCC issued a proposed rule to implement the GENIUS Act regarding permitted payment stablecoin issuance.^8. That proposed rule addressed permissible activities, capital and reserve requirements, and related operational standards for PPSIs subject to OCC jurisdiction. However, it did not address BSA/AML/CFT and sanctions compliance requirements. Separately, on April 10, 2026, FinCEN and OFAC issued a joint proposed rule that would designate PPSIs as “financial institutions” under the BSA, subjecting them to AML/CFT program requirements, sanctions compliance obligations, and associated reporting requirements under 31 CFR chapters V and X.^9.

The OCC’s current NPRM builds upon both of these prior rulemakings by adding one paragraph to proposed Part 15 cross-referencing FinCEN/OFAC obligations and making corresponding changes to 12 CFR Parts 4 and 19.

Who Are Permitted Payment Stablecoin Issuers?

To understand the OCC’s Proposed Rule, it is helpful to understand the broader GENIUS Act framework and who qualifies as a PPSI. A “payment stablecoin” is defined under the GENIUS Act as a digital asset designed to be used as a means of payment or settlement, the issuer of which is obligated to convert, redeem, or repurchase the asset for a fixed amount of monetary value and represents that it will maintain a stable value relative to that fixed amount. The Act explicitly clarifies that payment stablecoins are neither securities under federal securities laws nor commodities under the Commodity Exchange Act.

The GENIUS Act restricts the issuance of payment stablecoins in the United States to three categories of “permitted payment stablecoin issuers”: (1) a subsidiary of an insured depository institution approved by the applicable primary federal payment stablecoin regulator (i.e., OCC for national banks, the Federal Reserve for state-chartered member banks, FDIC for state nonmember banks, and NCUA for credit unions); (2) a “federal qualified payment stablecoin issuer,” which includes nonbank entities chartered by the OCC as uninsured national banks or federal branches of foreign banks approved to issue stablecoins; and (3) a “state qualified payment stablecoin issuer” licensed and supervised by a state regulator, subject to a $10 billion cap on outstanding issuance.

Importantly, the entity that issues a payment stablecoin (the PPSI) is distinct from the banking institution that may hold the issuer’s reserve assets or provide other depository services. Under the GENIUS Act, reserve assets backing stablecoins must be held at “eligible financial institutions” (typically insured depository institutions) and must serve as a custodian, segregating the assets from the issuer’s operational funds. 

The GENIUS Act fills a fragmented gap created by patchwork state money-transmitter regulations and informal federal guidance by establishing uniform prudential standards and designating PPSIs as “financial institutions” under the BSA. However, while the GENIUS Act establishes the statutory mandate for BSA and sanctions compliance, it delegates the mechanics of implementation, including specific program requirements, reporting thresholds, and supervisory frameworks, to the federal regulators. The OCC’s Proposed Rule is a key piece of that implementation, establishing how BSA/AML/CFT and sanctions obligations will be supervised and enforced for PPSIs under OCC jurisdiction.

The Proposed Rule’s Key Components

AML/CFT and Sanctions Compliance Requirements

Under proposed § 15.13(c), each PPSI would be required to comply with the BSA, sections 4(a)(5) and 4(a)(6)(B) of the GENIUS Act, and applicable regulations at 31 CFR chapters V and X, which encompass AML/CFT program requirements, sanctions program requirements, and associated reporting obligations.^10. The OCC would not impose additional requirements beyond those established by FinCEN and OFAC. The Proposed Rule states that compliance with 31 CFR chapters V and X constitutes compliance with § 15.13(c).^11.

This approach reflects the OCC’s determination that FinCEN/OFAC’s framework provides a sufficient set of compliance standards for stablecoin issuers, and that additional, duplicative requirements from the OCC would be unnecessary and potentially burdensome to regulated entities. The OCC noted that this structure ensures consistency across regulatory regimes while avoiding conflicting obligations for issuers subject to multiple federal regulators.

Notice and Consultation Framework with FinCEN

The Proposed Rule establishes a notice and consultation procedure between the OCC and FinCEN before the OCC initiates any AML/CFT enforcement or significant supervisory action against a PPSI.^12. Specifically, the OCC must provide the FinCEN Director with written notice at least 30 days before a proposed action.^13. The OCC must consider any input offered by the FinCEN Director before proceeding.

Mirroring recent rulemakings, this consultation framework reflects the Administration’s effort to position FinCEN as a central coordinating authority for AML/CFT enforcement across the financial system. The Proposed Rule would also revise 12 CFR Part 4 to authorize OCC-supervised stablecoin issuers to share certain confidential supervisory information with the FinCEN Director in connection with existing or potential AML/CFT enforcement or supervisory actions. Disclosure would not waive any applicable privilege.^14.

Footnotes

1. Excluded from this definition are financial instruments such as bank deposits, central bank money, or traditional securities.

2. The OCC charters, regulates, and supervises all national banks, federal savings associations, and federal branches of foreign banks

3. Pursuant to the April 8, 2026 joint rule between FinCEN and OFAC, PPSIs will have a higher suspicious activity reporting threshold of $5,000, rather than the $2,000 threshold for MSBs. See FinCEN and OFAC, Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions Compliance Program Requirements, 91 FR 18608 (April 10, 2026).

4. This figure includes “12 OCC regulated bank affiliates, 12 non-OCC-regulated-bank affiliated issuers and 5 “white-label” issuers or consortiums of issuers subject to OCC supervision as permitted payment stablecoin issuers.” Office of the Comptroller of the Currency, Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism and Sanctions Compliance Risk Management, 91 FR 37844 (June 24, 2026). 

5. Office of the Comptroller of the Currency, Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism and Sanctions Compliance Risk Management, 91 FR 48830 (June 24, 2026). The Proposed Rule would amend the OCC’s March 2, 2026 proposed rule implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act (“GENIUS Act”) by adding a new BSA/AML and sanctions compliance framework to proposed Part 15 of the OCC’s regulations. Guiding and Establishing National Innovation for U.S. Stablecoins Act, 12 U.S.C. § 5901 et seq. (the “GENIUS Act”).

6. For additional information, see Foley Hoag, Modernizing BSA/AML Compliance: FinCEN’s Proposed Program Rule and Coordinated Federal Rulemakings (July 20, 2026), available here. 

7. U.S. Dept. of Treasury, Deputy Secretary Faulkender Lays Out Guiding Principles for Bank Secrecy Act Modernization (June 18, 2025), available here.

8. OCC, Permitted Payment Stablecoin Activities, 91 FR 10202 (Mar. 2, 2026).

9. FinCEN and OFAC, Anti-Money Laundering and Sanctions Compliance for Permitted Payment Stablecoin Issuers, 91 FR 18582 (Apr. 10, 2026).

10. See 31 CFR chapters V and X.

11. Proposed § 15.13(c).

12. Proposed § 19.261.

13. Unless a shorter period is necessary at the Comptroller’s sole discretion to address unsafe or unsound conditions.

14. Proposed revisions to 12 CFR Part 4. The OCC has proposed two alternative information sharing structures: (1) would “authorize the disclosure of covered information…to the FinCEN Director and [] permit the FinCEN Director to use [it]” and (2) would additionally mandate “that any such information shared on the OCC's behalf be contemporaneously disclosed by the permitted payment stablecoin issuer to the OCC.”