GENIUS Act Stablecoin Law: What's in Force and What's Still Pending

The GENIUS Act stablecoin law has been US federal law since 18 July 2025. Only approved US issuers may issue payment stablecoins. They must hold reserves of at least 1 to 1 and are treated as financial institutions under the Bank Secrecy Act. The Act takes effect by 18 January 2027 at the latest. The wider crypto market-structure bill is still not law.

That is the status as I checked it on 25 October 2026. If your business accepts, holds or pays out stablecoins, or vets a crypto supplier, this is the plain-language version. The second half is for the compliance and security teams who have to build the controls. This summary of US stablecoin law is not legal or investment advice.

What is the GENIUS Act, and is it already law?

GENIUS stands for the Guiding and Establishing National Innovation for U.S. Stablecoins Act. It started as Senate bill S. 1582 and became Public Law 119-27, enacted on 18 July 2025. I read the law text on govinfo, the US Government Publishing Office site, because congress.gov blocked my requests.

The Act regulates one thing: the payment stablecoin. Section 2 defines it as a digital asset that is "used as a means of payment or settlement", where the issuer is obliged to redeem it "for a fixed amount of monetary value". In plain terms, a token meant to be worth one dollar and redeemable for one dollar.

The statute is law. Much of the detail sits in regulations still being written, and that gap is the main thing to understand.

When do the GENIUS Act stablecoin rules start to apply?

Section 20 says the Act takes effect on the earlier of 18 months after enactment or 120 days after the regulators issue final implementing rules. Eighteen months from 18 July 2025 is 18 January 2027.

Date	What happens	Law or pending?	Source
18 July 2025	GENIUS Act enacted	Law	PL 119-27
8 April 2026	FinCEN and OFAC propose the AML and sanctions program rule	Proposed rule	FinCEN
18 July 2026	Deadline for regulators to issue implementing rules (Sec. 13(a))	Law sets the deadline	PL 119-27
18 January 2027	Latest date the Act takes effect (Sec. 20)	Law	PL 119-27
18 July 2028	Crypto service providers may no longer offer non-permitted payment stablecoins to US persons (Sec. 3(b))	Law	PL 119-27
18 July 2028	FinCEN deadline for guidance and rulemaking on detecting illicit activity (Sec. 9(d))	Law sets the deadline	PL 119-27

The FinCEN and OFAC rule was still marked as a proposal on the Treasury pages I opened. I did not find a final version, so check before you rely on the proposed wording.

Who is allowed to issue a payment stablecoin in the US?

Section 3(a) makes it "unlawful for any person other than a permitted payment stablecoin issuer to issue" one in the US. The penalty is up to $1,000,000 per violation, up to 5 years in prison, or both (Sec. 3(f)).

A permitted issuer must be formed in the US and be one of three types (Sec. 2(23)):

A subsidiary of an insured depository institution (a bank) approved under section 5.
A federal qualified issuer: a non-bank approved by the Comptroller of the Currency.
A state qualified issuer: approved by a state payment stablecoin regulator.

State supervision has a size limit. An issuer with "not more than $10,000,000,000" in outstanding stablecoins may opt for a state regime (Sec. 4(c)). Above that, it must move to federal oversight within 360 days or stop issuing new tokens (Sec. 4(d)).

Foreign issuers are not shut out. Under Section 8, US providers may offer their tokens only if the issuer can comply with US lawful orders, and Section 8(b) sets penalties of up to $1,000,000 per violation per day for foreign issuers.

What reserves must a US stablecoin issuer hold?

Section 4(a)(1) requires "identifiable reserves" backing outstanding stablecoins "on an at least 1 to 1 basis". The permitted assets are a short list. It includes US coins and currency, Treasury bills, notes or bonds with "a remaining maturity of 93 days or less", and government money market funds that hold only those assets.

Transparency is built in:

The issuer publishes the monthly composition of its reserves on its website.
A registered public accounting firm examines each monthly report.
The CEO and CFO certify that the monthly report is accurate.
An issuer with more than $50,000,000,000 outstanding must publish audited annual financial statements (Sec. 4(a)(10)).

Two consumer rules matter for anyone holding these tokens. Issuers may not pay "any form of interest or yield" for simply holding the stablecoin (Sec. 4(a)(11)). And if an issuer fails, holders' claims on the reserves rank ahead of other creditors (Sec. 11).

What AML and sanctions duties does the GENIUS Act create?

This is where the Act touches security teams most. Section 4(a)(5) says a permitted issuer "shall be treated as a financial institution for purposes of the Bank Secrecy Act". The Act requires:

An AML program and an "effective economic sanctions compliance program".
"Technical capabilities, policies, and procedures to block, freeze, and reject specific or impermissible transactions".
The technical ability to comply with any lawful order, defined as one that requires the issuer to "seize, freeze, burn, or prevent the transfer" of its stablecoins (Sec. 2(16), Sec. 4(a)(6)).

The April 2026 proposal from FinCEN and OFAC fills in the detail. According to the FinCEN fact sheet, it would require issuers to:

Run a written, risk-based AML/CFT program approved by the board or senior management, with risk assessment, ongoing customer due diligence, independent testing, training and a US-based AML/CFT officer.
File suspicious activity reports (SARs). The proposal would not add a SAR duty for secondary-market activity.
Keep records for funds transfers of $3,000 or more and follow the Travel Rule.
Apply the block, freeze and reject capability, and lawful-order compliance, to both primary and secondary market activity.
Run a sanctions program with five elements: management commitment, risk assessment, internal controls, testing and auditing, and training at least annually.

Comments closed on 9 June 2026 under docket FINCEN-2026-0100. Again, this is a proposal, not the final rule.

How does the GENIUS Act treat custody of stablecoins and private keys?

Section 10 covers anyone in the business of holding reserves, stablecoins used as collateral, or the private keys for them for customers. That person must be supervised by a federal or state regulator.

Customer assets must be treated "as belonging to such customer and not as the property" of the custodian (Sec. 10(b)). They must be "segregated from and not be commingled with" the custodian's own assets, with limited exceptions such as certain omnibus accounts at banks (Sec. 10(c)). Makers of hardware or software that let customers hold their own keys are excluded (Sec. 10(e)).

The custody principle matches the EU's. My MiCA explainer covers how the EU protects client assets and the means of access to them.

Does the GENIUS Act require incident or fraud reporting?

Not as a cyber-incident rule. I did not find a cyber-incident notification duty in the Act's text. The reporting duties are financial-crime ones: SARs under the Bank Secrecy Act, and the records and reports OFAC already requires under 31 CFR part 501, per the fact sheet.

Your existing breach and incident duties still apply alongside it. My guide to breach notification deadlines worldwide covers the clocks. For impersonation fraud aimed at payments, see my guide on spotting deepfake scams. Victims of crypto fraud in the US can report to the FBI at ic3.gov.

Is US crypto market-structure legislation law yet, and what do the SEC and CFTC regulate?

No, it is not law. The main bill is H.R. 3633, the Digital Asset Market Clarity Act. The Senate-reported text on govinfo shows it was received in the Senate on 18 September 2025 and reported by the Banking Committee on 1 June 2026 as Calendar No. 423. As of 25 October 2026, the latest official text I could open was that Senate-reported version. It has not been enacted.

The committee replaced the House text in full, so the final shape is open. The House-passed text added a "digital commodity" category to the Commodity Exchange Act. It required digital commodity exchanges, brokers and dealers to register with the CFTC (the Commodity Futures Trading Commission), and the CFTC and SEC (the Securities and Exchange Commission) to define key terms jointly. I did not read the Senate replacement text in full, so I am not summarising its split.

For stablecoins, one point is already settled in law. Section 17 of the GENIUS Act says a payment stablecoin from a permitted issuer is not a "security" under the federal securities laws and not a "commodity" under the Commodity Exchange Act. Those issuers answer to banking regulators, including the Comptroller, or to state regulators.

Going deeper: for security and IT teams

This section assumes you know what a smart contract admin role and a signing key are. Section numbers come from the law text on govinfo. The program detail comes from the FinCEN fact sheet, and it describes a proposal.

The lawful-order capability is a high-value key. Sections 2(16) and 4(a)(6) require an issuer to be able to seize, freeze, burn or stop transfers of its tokens. In most token designs that is an administrative function in the contract, controlled by a privileged key or role. Threat model: whoever controls that role can freeze customer funds or destroy tokens. That puts it in the same class as the minting key. Controls to evidence: multi-party approval for every freeze or burn, keys in hardware security modules, separate roles for mint, freeze and upgrade, and a log entry linking each action to the order reference that authorised it.

Screening covers the secondary market. The proposed OFAC internal-controls element applies to "all payment stablecoin-related activity, whether on the primary or secondary market". For an issuer, that means monitoring on-chain transfers between third parties, not just its own customers. In practice, the FBI's February 2025 alert on the Bybit theft (I-022625-PSA) attributed "approximately $1.5 billion USD in virtual assets" to North Korean actors it calls TraderTraitor. It asked exchanges, node providers, bridges and analytics firms to "block transactions with or derived from" the Ethereum addresses it listed. Your screening needs to ingest lists like that quickly, not only the sanctions list. The scale explains the urgency: the FBI's IC3 2025 report logged $11,366,669,732 in reported losses involving cryptocurrency. My crypto fraud breakdown shows where that money went. The full attack path is in the Bybit case file.

Data model for 314(a) and the Travel Rule. Under the proposal, a FinCEN 314(a) request requires a search of records for named people or entities. The Travel Rule and the $3,000 recordkeeping threshold require originator and beneficiary data on transfers. Design so that customer identity, wallet addresses and transfers join in one query, with retention that matches your recordkeeping period.

Custody segregation you can prove. Section 10(c) bans commingling. Run on-chain reconciliation of customer balances against custodial wallets on demand. Keep key-ceremony records showing who holds key shares and backups.

Reserve reporting is a financial control. Monthly composition, an accountant's examination and CEO/CFO certification (Sec. 4(a)) make the reserve data pipeline audit evidence. Apply change control and access reviews to the systems that produce it, and keep the source-to-report trail.

What to ask a stablecoin issuer or custodian:

Which regulator approved you, and are you a bank subsidiary, a federal or a state qualified issuer?
Where is the monthly reserve report, and which accounting firm examines it?
Who can trigger a freeze or burn, and how many approvals does it take?
How do you screen secondary-market transfers, and how fast do new law-enforcement address lists go live?
How are customer keys and assets segregated, and can you show a reconciliation?

What should a US business do about stablecoin rules now?

List every stablecoin you accept, hold or pay out, and record the issuer and its regulator.
From 18 July 2028, US crypto service providers may offer only permitted payment stablecoins to US persons. Map your exposure now.
Ask custodians for their Section 10 segregation evidence.
Add new law-enforcement address lists to your sanctions screening process.
Track the final FinCEN and OFAC rule. Proposed wording can change.
Re-check market-structure status before you plan around it. It is a bill, not a law.

Key takeaways

The GENIUS Act is law (PL 119-27, 18 July 2025) and takes effect by 18 January 2027 at the latest.
Only bank subsidiaries, federal qualified and state qualified issuers may issue payment stablecoins in the US.
Reserves must be at least 1 to 1 in cash and short-dated Treasuries, published monthly and examined by an accounting firm.
Issuers are financial institutions under the Bank Secrecy Act and must be able to block, freeze and reject transactions.
The detailed AML and sanctions program rule was a proposal on the pages I checked.
The CLARITY Act market-structure bill has not been enacted.

Display and accessibility