The U.S. Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) and Office of Foreign Assets Control (OFAC) issued a joint Notice of Proposed Rulemaking on April 8, 2026, establishing the first comprehensive anti-money laundering and sanctions compliance framework for permitted payment stablecoin issuers (PPSIs). According to Mayer Brown, this Proposed Rule would treat PPSIs as 'financial institutions' under the Bank Secrecy Act (BSA), marking a significant shift in regulatory treatment. The framework represents the culmination of years of regulatory development, with AML enforcement now overtaking securities classification as the dominant regulatory concern for crypto businesses across major jurisdictions.
The proposed framework establishes risk-based AML/CFT programs that mirror bank-like requirements, with PPSIs required to establish internal policies, procedures, and controls that are reasonably designed to identify, assess, and document money laundering and terrorist financing risks. As per Mayer Brown, programs must include ongoing customer due diligence, independent testing, a designated AML/CFT officer located in the United States, and ongoing employee training. Notably, the SAR filing threshold is set at $5,000—higher than the current $2,000 threshold for money services businesses, reflecting FinCEN's view that PPSIs will have CIP obligations analogous to banks and other higher-threshold institutions. According to CertiK's Skynet report, AML-related fines and settlements exceeded $900 million in the first half of 2025 alone, with headline actions including a combined $504 million in penalties for OKX and $297.4 million for KuCoin, while European AML fines surged 767% over the same period.
The GENIUS Act's requirement for PPSIs to maintain an 'effective sanctions compliance program' represents the first time federal law has explicitly mandated such a program for any category of U.S. persons. According to Mayer Brown, OFAC's proposed framework would require five core elements: senior management commitment, risk assessments, internal controls, testing and auditing, and training. The Proposed Rule authorizes civil monetary penalties of up to $100,000 per day for material violations of sanctions compliance program requirements, with an additional $100,000 per day for knowing violations, representing a significant shift in enforcement landscape. As reported by CertiK, SEC crypto enforcement penalties fell 97% year-over-year as the Department of Justice and FinCEN expanded their roles, with the DOJ and FinCEN now taking the lead in crypto enforcement.
The Proposed Rule applies to the three PPSI pathways established by the GENIUS Act: subsidiaries of insured depository institutions approved by their primary federal regulator, federal qualified payment stablecoin issuers approved by the Office of the Comptroller of the Currency, and state qualified payment stablecoin issuers approved by state regulators. As reported by Mayer Brown, comments are due June 9, 2026, with the final rules expected to become effective 12 months after issuance to allow PPSIs sufficient time to implement the requirements. The framework addresses both primary market transactions directly involving PPSI and secondary market activity via smart contracts, establishing a comprehensive regulatory approach to stablecoin oversight. According to CertiK, independent smart contract security audits have become statutory or quasi-statutory requirements for licensing in most key markets, including Hong Kong, the UAE's VARA and ADGM regimes, the EU's Digital Operational Resilience Act (DORA), and state-level rules from NYDFS and Wyoming in the US.
The world of cryptocurrency is entering a new era where regulation plays a defining role in its growth and stability. According to CertiK's Skynet report, regulatory frameworks across the United States, European Union, Hong Kong, Singapore, the UAE, Japan, Turkey, and Brazil have moved from consultation to live, enforceable regimes that increasingly mirror traditional financial regulation. Regulatory clarity often leads to increased investor confidence, as it reduces uncertainty and the risk of fraud, with institutional investors more likely to enter the market when well-defined rules are in place. However, overly restrictive regulations can have the opposite effect, pushing innovation to more lenient jurisdictions. The Basel cryptoasset framework that took effect on January 1, 2026, introduces a structural divide between 'Group 1' and 'Group 2' assets, with tokenized traditional instruments and qualifying stablecoins receiving standard risk-weighting while unbacked tokens like BTC and ETH face significantly higher capital requirements.
