NPRM: Permitted Payment Stablecoin Issuer AML/CFT program and sanctions compliance program requirements (91 FR 18582) (Part 3 of 8)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
development and implementation of that PPSIs operating in the U.S. lawful orders requiring them to take
new technology. implement these obligations to protect action with regards to the secondary
The proposed rule, consistent with U.S. national security and the U.S. market, but does not intend to provide
the GENIUS Act, would require PPSIs to financial system. prescriptive regulatory text relating to
have the infrastructure necessary to Notwithstanding the requirement to technological capabilities, providing
block, freeze, and reject transactions, maintain technical capabilities, policies, PPSIs the flexibility to use various
but does not identify in which instances and procedures to block, freeze, and methods to meet the proposed
PPSIs are required to act on those reject specific or impermissible obligation and account for the
capabilities. Put differently, this transactions that violate Federal or State development and implementation of
provision would not require a PPSI to laws, rules, or regulations, a PPSI would new technology.
make an independent determination not be required to block, freeze, or reject As previously described, FinCEN
that a transaction violates federal or a transaction when it is under no legal proposes promulgating the term ‘‘lawful
state law. Instead, the use of obligation to take action and this order’’ as provided in the GENIUS Act,
technological capabilities will be proposal would not require PPSIs to with limited modifications to account
dictated by other federal or state laws, maintain separate internal policies, for existing regulatory language. The
rules, or regulations, as well as court procedures, or controls as part of GENIUS Act does not define terms used
orders, some of which will require required AML/CFT programs to monitor within that definition, including the
PPSIs to take action with regards to secondary market activity independent word ‘‘burn’’ and ‘‘account.’’ FinCEN
transactions occurring on the secondary of other obligations. believes that ‘‘burn’’ is generally
market. For example, as discussed in FinCEN welcomes comment on this understood in the industry and by law
section V.B, U.S. sanctions administered proposal, including its approach, its enforcement to mean taking action such
by OFAC are a strict liability regime, clarity, and whether it should provide that the payment stablecoin is
meaning that U.S. persons, including greater specificity. permanently removed from circulation,
PPSIs, may be held civilly liable for ii. Proposed 31 CFR 1033.240(b)— which can be effected through different
sanctions violations even without Obligations Relating to Lawful Order tactics. Further, FinCEN is aware that
having knowledge or reason to know Compliance and Technical Capabilities lawful orders often specify particular
that it was engaging in such a violation. addresses or wallets for which an issuer
As such, PPSI’s technical capabilities, Proposed § 1033.240(b) would
implement the GENIUS Act’s is under obligation to take action, and
policies, and procedures should account assess such addresses fall within the
for identifying and blocking or rejecting requirement that a PPSI ‘‘may issue
payment stablecoins only if the issuer meaning of ‘‘account’’ for purposes of
payment stablecoin-related transactions this provision. FinCEN has not
that would violate U.S. sanctions, has the technological ability to comply,
and will comply, with the terms of any proposed regulatory text defining either
including to identify and block
lawful order.’’ 204 A lawful order as ‘‘burn’’ or ‘‘account’’ for the purposes of
stablecoins that are issued to or
defined by the GENIUS Act and lawful orders, but requests comment on
redeemed by blocked persons. This
FinCEN’s proposal, is—in part—an that approach.
would also require PPSIs to have Under this obligation, PPSIs would be
technical capabilities, policies, and order that specifies with reasonable
particularity a payment stablecoin or required to consider and comply with
procedures to identify and block all terms contained in lawful orders. For
stablecoins traded by blocked persons account and requires a person to seize,
freeze, burn, or prevent the transfer of example, a quintessential type of lawful
on the secondary market when PPSIs
payment stablecoins it issued.205 order, assuming it meets the GENIUS
exercise possession or control of such
FinCEN is proposing to promulgate Act’s requirements, would be a seizure
stablecoins, including through smart
this obligation by closely adhering to warrant.206 Those warrants frequently
contracts. Federal or state court or
include requirements to respond within
administrative orders may also require a
204 See 12 U.S.C. 5903(a)(6)(B). Although codified a certain amount of time and
PPSI to act on its block, freeze, and
outside the GENIUS Act section specifically dealing prohibitions on frustrating the
lotter on DSK8BHNXB4PROD with PROPOSALS3
reject capabilities—including with the BSA, Congress provided Treasury general implementation of the warrant.
transactions occurring on the secondary rulemaking authority to implement the GENIUS
Additionally, with some regularity,
market—which should be accounted for Act. See 12 U.S.C. 5913. This provision directly
in policies and procedures, as well as implicates illicit finance considerations and, as Federal court orders require stablecoin
such, is appropriately overseen by FinCEN at
technical capabilities. Treasury as part of efforts to combat money 206 See DOJ, Asset Forfeiture Policy Manual
Because these sources of law may laundering and the financing of terrorism. (2025), chap. 4, sec. I.B., available at https://
require PPSIs to take action on 205 See 12 U.S.C. 5901(16); see also section www.justice.gov/usdoj-media/criminal/media/
secondary market transactions, PPSIs VI.C.1.vii. 1140236/dl?inline.
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00025 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
18606 Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules
issuers to burn and reissue an withdrawal, exchange of currency or and procedures relating to the filing
equivalent amount of stablecoins to a other payment or transfer, by, through, obligation.
government-controlled wallet. Having or to such financial institution which FinCEN’s proposal would require
the technical capabilities and complying involves a transaction in currency of PPSIs to comply with the series of
with terms such as these would be part more than $10,000,’’ unless subject to an provisions comprising CTR obligations.
of a PPSI’s obligations under proposed applicable exemption.209 FinCEN The threshold in § 1010.311 applies to
§ 1033.240(b). FinCEN recognizes that proposes applying the CTR reporting transactions in currency of more than
over time the terms contained in lawful provisions to PPSIs through proposed $10,000 conducted during a single
orders might change and would expect §§ 1033.310 through 1033.315, which business day. Section 1010.312 specifies
that as a PPSI learns of new lawful order would cross reference corresponding when a financial institution is required
terms, such terms will be incorporated provisions in §§ 1010.310 through to verify and record information about
into its lawful order compliance 1010.315. an individual conducting a reportable
processes. Application of §§ 1010.310 through transaction or on whose behalf the
As with the requirement to have 1010.315 would not require reporting of transaction is conducted. Under
technical capabilities and policies and transactions in payment stablecoins. As § 1010.313 a financial institution must
procedures relating to blocking, defined in § 1010.100(bbb)(2), for the treat multiple transactions conducted in
freezing, and rejecting impermissible purposes of provisions related solely to one business day as a single transaction
transactions, this obligation would the report required by §§ 1010.311 and if the financial institution has
apply to any lawful order, including 1010.313, the term ‘‘transaction in knowledge that the transactions are
lawful orders that relate to primary or currency’’ means a transaction involving conducted by, or on behalf of, the same
secondary market activity. FinCEN the physical transfer of currency from person. And § 1010.314 outlines the
believes the vast majority of lawful one person to another. Moreover, the prohibition on structuring transactions
orders currently relate to secondary definition of ‘‘currency,’’ as defined in to avoid the reporting requirement.
market activity and are likely to § 1010.100(m), does not include a Finally, § 1010.315 exempts non-bank
continue to do so in the future. FinCEN payment stablecoin, and thus, financial institutions from filing reports
proposes promulgating language that §§ 1033.310 through 1033.314 do not with respect to transactions between the
would make clear the lawful order require reports of transactions in institution and a commercial bank.
obligations extend to secondary market payment stablecoins.210 This approach Where a PPSI is also a bank, this
activity. Public law enforcement cases is consistent with § 1010.100(bbb)(2) exemption and not the exemptions
demonstrate the value of stablecoin which also states that a physical transfer applicable to banks would control.
issuers having the capability to comply of currency does not include bank FinCEN does not believe it is necessary
with lawful orders and carry out actions checks, bank drafts, wire transfers or to clarify in the regulatory text that
to seize, freeze, and burn or prevent the other written orders. when an entity is acting as a PPSI, the
transfer of their stablecoins in secondary FinCEN recognizes that, presently, non-bank exemptions apply. Notably,
market transactions. Law enforcement stablecoin issuers rarely transact in banks can avail themselves of a greater
has used lawful orders to seize physical transfers of currency. FinCEN number of CTR exemptions,212 and
hundreds of millions of dollars’ worth nevertheless considers it prudent to FinCEN welcomes feedback on whether
of stablecoins involved in illicit allow for the possibility that this could additional exemptions are appropriate
activity.207 change, with PPSI activity expanding to for PPSIs.
FinCEN welcome comment on this
encompass retail, brick-and-mortar 8. Proposed 31 CFR 1033.320—Reports
proposal, including its approach, its
locations where currency could be used, of Suspicious Transactions
clarity, and whether it should provide
greater specificity. or even kiosks that resemble automated The GENIUS Act explicitly requires
teller machines (ATMs).211 If such an PPSIs to be subject to BSA requirements
7. Proposed 31 CFR 1033.310 Through expansion does occur, FinCEN relating to ‘‘monitoring and reporting of
1033.315—Reports of Transactions in considers it prudent to adopt CTR any suspicious transaction relevant to a
Currency obligations for PPSIs as it assesses that possible violation of law or
Beyond suspicious activity reporting, PPSIs should be subject to the same regulation.’’ 213 Under the BSA, FinCEN
the GENIUS Act does not specify currency reporting obligations as most has authority to require any financial
additional reporting obligations to be other financial institutions as cash institution to ‘‘report any suspicious
imposed on PPSIs. The BSA authorizes enables anonymous, difficult to trace transaction relevant to a possible
FinCEN to promulgate regulations transactions. If a PPSI does not transact violation of law or regulation.’’ 214
requiring financial institutions to file in physical transfers of currency, the Nearly all financial institutions subject
reports when they participate in certain PPSI would, of course, not file CTRs and to FinCEN regulations are required to
types of financial transactions.208 would not be expected to create policies identify and report suspicious
Pursuant to this authority, 31 CFR activity.215 These reports provide highly
1010.310 through 1010.314 requires 209 31 CFR 1010.311.
useful information that is leveraged by
210 31 CFR 1010.100(m) (defining, in part,
‘‘financial institutions’’ (other than authorized users as part of criminal, tax,
‘‘currency’’ as ‘‘[t]he coin and paper money of the
casinos) to file currency transaction United States or of any other country’’). and regulatory investigations; risk
reports (CTRs) for ‘‘each deposit, 211 Kiosks, for example, which are ATM-like assessments; and intelligence and
devices that allow customers to exchange real (or counterintelligence activities.216
fiat) currency for virtual currency and vice versa,
lotter on DSK8BHNXB4PROD with PROPOSALS3
207 See U.S. Attorney’s Office EDNC Announces
Seizure of $61 Million Dollars’ Worth of are already used to exchange CVC for fiat currency 212 See 31 CFR 1020.315.
Cryptocurrency, Cyber Scam Organization including cash. See FinCEN, FIN–2025–NTC1, 213 See 12 U.S.C. 5903(a)(5)(A)(iii).
Disrupted Through Seizure of Nearly $9M in Crypto FinCEN Notice on the Use of Convertible Virtual
214 See 31 U.S.C. 5318(g)(1).
supra note 63; Largest Ever Seizure of Funds Currency Kiosks for Scam Payments and Other
215 See 31 CFR 1020.320, 1021.320, 1022.320,
Related to Crypto Confidence Scam supra note 58. Illicit Activity (Aug. 4, 2025), available at https://
208 See, e.g., 31 U.S.C. 5313(a), 5326. This www.fincen.gov/system/files/2025-08/FinCEN- 1023.320, 1024.320, 1025.320, 1026.320, 1029.320,
proposal also implements the GENIUS Act’s Notice-CVCKIOSK.pdf. Such devices could be 1030.320.
requirements related to high value transactions. See leveraged by PPSIs as an additional means to 216 See 31 U.S.C. 5311(1); see also, e.g., FinCEN,
12 U.S.C. 5903(a)(5)(A)(v). interact with customers. Financial Crimes Enforcement Network (FinCEN)
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00026 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules 18607
This proposed rule would promulgate as to the parties associated with, or the protections from liability provided by
at § 1033.320 a requirement that PPSIs purpose of, the transfer. As such, the the BSA for any SAR voluntarily filed
file SARs for any suspicious transaction information available to PPSIs may reporting a possible violation of law or
relevant to a possible violation of law or present challenges as to how and when regulation in good faith.217 To ensure
regulation. FinCEN expects that they are able to identify and report clarity regarding the SAR reporting
requiring PPSIs to report suspicious suspicious activity for secondary market obligation, FinCEN proposes adding a
activity would similarly provide highly transactions. SARs conveying only new paragraph, § 1033.320(g), to clarify
useful information for investigations limited information are less useful to that, for purposes of the SAR obligation,
and proceedings involving domestic and regulators and law enforcement. a transfer is not a ‘‘transaction’’
international money laundering, Relatedly, at times, secondary market conducted or attempted by, at, or
terrorist financing, and other illicit transfers for which PPSIs have some through a PPSI only due to an
finance activity, as well as for visibility due to the smart contract may interaction with a smart contract. This
intelligence purposes. The proposed be subject to more ready observation by language should not be construed as
requirement is generally consistent with other BSA-regulated institutions or changing or opining on SAR regulations
the existing SAR filing requirements for foreign financial institutions subject to applicable to other types of financial
stablecoin issuers regulated as MSBs, as reporting obligations. Such institutions institutions.
well as other financial institutions with may be better positioned to assess the FinCEN considered alternatives that
SAR filing requirements. suspiciousness of a transaction and may would have instead imposed limited
be obligated to collect identifying secondary market SAR reporting
i. PPSI SAR Obligation With Regards to information associated with a transfer, obligations. For example, FinCEN
Secondary Market Activity which can be reported via a SAR as considered a SAR obligation where a
FinCEN recognizes that the majority appropriate. PPSI has reason to know a transaction
of illicit finance involving payment Still, there may be instances in which to which it is not a party is designed to
stablecoins occurs on the secondary a PPSI has reason to suspect that a evade a lawful order. FinCEN also
market. FinCEN also recognizes that transaction is related to criminal activity considered, requiring a PPSI to file a
certain aspects of how PPSIs and or has no business or apparent lawful SAR when it is notified in some way,
payment stablecoins operate could raise purpose and, thus, could be required to such as through an order, legal process,
questions about the appropriate scope of report the activity. PPSIs may also or via an information sharing channel,
SAR obligations relating to secondary suspect suspicious activity based on that authorities suspect a transfer is
market activity. Specifically, due to the public information, information from associated with illicit activity. But
nature of how transactions occur on the other compliance efforts, or other FinCEN assesses that SAR reporting
secondary market via smart contract, a information sources. FinCEN also where authorities are aware of
PPSI can see the movement of its understands that some PPSIs currently suspicious activity and alert a PPSI to
payment stablecoin even when the devote resources to monitoring activity is of limited utility relative to
transfer occurs between individuals or secondary market activity to identify the reporting burden. FinCEN also
entities with which the PPSI has no illicit finance risks. considered imposing a SAR obligation
established direct customer relationship FinCEN has preliminarily assessed when a PPSI learns through any means,
and when the PPSI is not a party to the that the burden of requiring PPSIs to file such as part of its secondary market risk
transfer other than via operation of its SARs concerning secondary market monitoring, that a secondary market
smart contracts. activity would potentially outweigh the transfer is suspicious. But, as discussed
PPSIs may have less information on likely benefits. The requirement would above, FinCEN assesses such an
secondary market transactions than on essentially require global monitoring of obligation would outweigh the benefit
primary market transactions. When a transfers but could result in SARs accrued from the obligation due to,
payment stablecoin transfer occurs in containing minimal information. While among other things, the information
the secondary market, generally, the in some instances, FinCEN expects the available to the PPSI.
PPSI’s interaction with the transfer is reporting could net highly useful FinCEN, however, seeks comment on
through the smart contract. When such information, particularly where the its preliminary determination that PPSIs
a transfer occurs in the normal course of transfers do not occur through BSA- should not be obligated to provide SAR
business, while the PPSI may be privy regulated institutions, FinCEN reporting on the secondary market. It
to certain information for secondary preliminarily has determined that the also seeks comment on whether its
market transactions, such information substantial burden imposed would proposed regulatory text relating to
may not be highly useful for SAR outweigh the potential benefit it secondary market activity provides
reporting purposes. For example, in reasonably anticipates could be gained sufficiently clear and accurate
many cases the information would not from requiring such reporting. guardrails. FinCEN seeks comment on
enable a PPSI to make an informed Moreover, a blanket obligation to report policy alternatives (including the
assessment of the transfer for SAR suspicious activity on secondary market imposition of limited, bespoke reporting
reporting purposes. At times, a PPSI transactions could lead to PPSIs being obligations about secondary market
could not identify an actor behind a overly cautious and filing a substantial transfers) and the benefits and
secondary market transaction. PPSIs, number of defensive SARs to avoid drawbacks of such alternatives as well.
like other financial institutions and law criticism from examiners about For any such bespoke SAR obligation
enforcement, can rely on the blockchain underreporting. Such defensive SARs recommended, FinCEN requests
lotter on DSK8BHNXB4PROD with PROPOSALS3
and analytical tools to gain greater can have little value for law commenters elaborate on the kinds of
insight into the risk associated with a enforcement and other users attempting information a PPSI could reasonably be
particular transfer, but the PPSI may to combat illicit finance. expected to provide based on current or
Accordingly, this proposal does not expected technical and operational
have limited distinct insight particularly
impose a secondary market SAR capabilities, the uniqueness of such
Year in Review for Fiscal Year 2024, available at
reporting obligation. However, information (i.e., commenters should
https://www.fincen.gov/system/files/2025-08/ consistent with FinCEN’s longstanding
FinCEN-Infographic-Public-2025-508.pdf. position, a PPSI would be afforded the 217 See infra section VI.C.8.ii. and vi.
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00027 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
18608 Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules
identify the useful information a PPSI issuers regulated as MSBs have SAR explanation for the transaction after
could provide about secondary market filing obligations at the monetary examining the available facts; or (iv)
transfers that could not be readily threshold of $2,000.219 FinCEN involves the use of the PPSI to facilitate
obtained from other sources). proposes the $5,000 monetary threshold criminal activity. FinCEN notes that
for PPSIs because $5,000 is the reporting paragraph (iv) is included in all SAR
ii. Proposed 31 CFR 1033.320(a)—
threshold that FinCEN’s regulations use rules enacted after 2001.222 The bank
Reports by PPSIs of Suspicious
for financial institution types that are SAR rule does not contain an equivalent
Transactions
subject to customer identification to paragraph (iv), because it was issued
Proposed § 1033.320(a) sets forth the program requirements, and the GENIUS prior to 2001. To maintain standard
criteria for which a PPSI would be Act requires PPSIs to have customer language across financial institution
obligated to report suspicious identification programs.220 The $2,000 types, FinCEN proposes paragraph (iv)
transactions that are conducted or threshold for MSBs was established in for PPSIs, which FinCEN does not
attempted by, at, or through a PPSI and a March 2000 final rule, which believe adds substantially to the
involve or aggregate at least $5,000 in highlighted specific characteristics for reporting obligation already mandated
funds or other assets. MSBs that do not apply in the PPSI by paragraphs (i) through (iii).
Proposed § 1033.320(a)(1) contains context. In particular, the final rule Section 1033.320(a)(3) recognizes that
the general statement of the obligation explained that the threshold for MSBs one or more financial institutions may
to file reports of suspicious transactions, was less than several other financial have an obligation to report the same
including that transactions must be institution types due to the relationship suspicious transaction and that other
reported if conducted or attempted by, between transmitters and their agents; a financial institutions may have separate
at, or through a PPSI. FinCEN proposes desire to account for transfers below the obligations to report suspicious activity
referencing a clarification to be codified existing $3,000 recordkeeping with respect to the same transaction
in § 1033.320(g) on the meaning of requirement with respect to funds pursuant to other provisions in the BSA.
‘‘transaction’’ for the PPSI SAR transfers conducted through MSBs; the Under this proposed provision, where
reporting obligation, which as proposed fact that BSA regulations for MSBs were more than one financial institution with
would state that ‘‘A transaction is not new and existing state-level regulations a separate suspicious activity reporting
conducted or attempted by, at, or were uneven; and feedback from law obligation 223 is involved in the same
through a permitted payment stablecoin enforcement about serious abuse of transaction, only one report jointly filed
issuer only because a transfer by third money transmission at levels below on behalf of all involved financial
parties results in an interaction with a $2,000.221 The proposed $5,000 institutions would be required,
permitted payment stablecoin issuer’s threshold takes into account the current provided that the joint report contained
smart contract.’’ To clarify that the status of the payment stablecoin all relevant facts and that each
proposed rule imposes a reporting ecosystems, where primary market institution maintained a copy of the
requirement that is consistent with transactions below $5,000 are rare; the report and any supporting
those for other financial institutions, lack of transmitter/agent relationships documentation. Accordingly, where a
§ 1033.320(a)(1) incorporates language in the PPSI ecosystem; and the required PPSI is a subsidiary of a parent insured
from the SAR rules applicable to other imposition of customer identification depository institution and both
financial institutions, such as banks, program obligations on PPSIs. institutions are required to file a SAR,
broker-dealers in securities, mutual Section 1033.320(a)(2)(i) through (iv) the parent will be permitted to file SARs
funds, casinos, and MSBs, including specifies that a PPSI would be required
on behalf of its PPSI subsidiary (and
clarifying that the SAR reporting to report a transaction if it knows,
vice versa).
obligations relates not only to discrete suspects, or has reason to suspect that
transactions but also to patterns of the transaction (or a pattern of iii. Proposed 31 CFR 1033.320(b)—
transactions that in aggregate are transactions of which the transaction is Filing and Notification Procedures
suspicious and meet the reporting a part): (i) involves funds derived from Proposed § 1033.320(b)(1) through (4)
threshold. illegal activity or is intended or sets forth the filing and notification
Proposed § 1033.330(a)(1) makes clear conducted to hide or disguise funds or procedures a PPSI would need to follow
that a PPSI is permitted to report assets derived from illegal activity as a to make reports of suspicious
voluntarily any transaction the PPSI part of a plan to violate or evade any transactions. If the PPSI identifies a
believes is relevant to the possible Federal law or regulation or to avoid
suspect, within 30 days of initial
violation of any law or regulation but any transaction reporting requirement
detection by the reporting PPSI of facts
that is not otherwise required to be under Federal law or regulation; (ii) is
that may constitute a basis for filing a
reported by this proposed rule. Thus, designed, whether through structuring
SAR, the PPSI would need to report the
the rule would afford PPSIs the or other means, to evade the
transaction by completing and filing a
protection from liability for the requirements of the BSA; (iii) has no
SAR with FinCEN in accordance with
voluntary reporting of such suspicious business or apparent lawful purpose,
all form instructions. If a PPSI does not
transactions, including those occurring and the PPSI knows of no reasonable
identify a suspect, a PPSI may delay
on the secondary market. filing for 30 days to identify a suspect.
Proposed § 1033.320(a)(2) would (requiring banks, casinos, broker-dealers in
securities, mutual funds, futures commission The PPSI would also need to collect and
require the reporting of suspicious merchants and introducing brokers, and loan or
activity that involves or aggregates at finance companies to report suspicious transactions 222 See 31 CFR 1021.320(a)(2)(iv),
lotter on DSK8BHNXB4PROD with PROPOSALS3
least $5,000 in funds or other assets. if they involve in the aggregate at least $5,000). 1022.320(a)(2)(iv), 1023.320(a)(2)(iv),
The $5,000 threshold in this proposed 219 31 CFR 1022.320(a)(2).
1024.320(a)(2)(iv), 1025.320(a)(2)(iv),
220 12 U.S.C. 5903(a)(5)(A)(v). 1026.320(a)(2)(iv), 1029.320(a)(2)(iv),
rule is consistent with the SAR filing
221 See FinCEN, Amendments to the Bank Secrecy 1030.320(a)(2)(iv).
requirements for most other financial 223 Other BSA-defined financial institutions, such
Act Regulations–Requirement that Money
institutions.218 Currently, stablecoin Transmitters and Money Order and Traveler’s as banks, broker-dealers in securities, and mutual
Check Issuers, Sellers, and Redeemers Report funds have separate reporting obligations that may
218 See 31 CFR 1020.320(a), 1021.320(a), Suspicious Transactions, 65 FR 13683 (Mar. 14, involve the same suspicious activity. See 31 CFR
1023.320(a), 1024.320(a), 1026.320(a), 1029.320(a) 2000). 1020.320, 1023.320, 1024.320.
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00028 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules 18609
maintain supporting documentation prohibited from disclosing voluntary against disclosure of SAR information
relating to each SAR. reports of suspicious activity. by government authorities that have
For situations requiring immediate Proposed § 1033.320(d)(1)(ii) would access to SARs other than in fulfillment
attention, such as suspected terrorist provide three rules of construction that of their official duties consistent with
financing or ongoing money laundering clarify the scope of the prohibition the BSA. The paragraph would clarify
schemes, PPSIs would be required against the disclosure of a SAR by a that official duties do not include the
under § 1033.320(b)(4) to notify PPSI. The rules of construction disclosure of SAR information in
immediately by telephone the proposed would remain qualified by, response to a request by a non-
appropriate law enforcement authority and subordinate to, the statutory governmental entity for non-public
in addition to filing a timely SAR. mandate that revealing to one or more information 227 or for use in a private
Finally, § 1033.320(b)(5) provides that subjects of a SAR of the SAR’s existence legal proceeding, including a request
a PPSI wishing to voluntarily report would remain a crime.225 The first rule under 31 CFR 1.11.228
suspicious transactions that may relate of construction, in
vi. Proposed 31 CFR 1033.320(e)—
to terrorist activity may call FinCEN’s § 1033.320(d)(1)(ii)(A)(1), would Limitation of Liability
Financial Institutions Hotline at 1–866– authorize a PPSI, or any director, officer,
employee or agent of a PPSI, to disclose Proposed § 1033.320(e) would provide
556–3974 in addition to filing timely a
a SAR, or any information that would protection from liability, also known as
SAR if required by this section. The
reveal the existence of a SAR, to various a safe harbor, for making either required
PPSI may also, but is not required to,
specified authorities provided that no or voluntary reports of suspicious
contact its primary Federal payment
person involved in the reported transactions, or for failures to provide
stablecoin regulator to report such
transaction is notified that the notice of such disclosure to any person
situations.
transaction has been reported. The identified in the disclosure to the full
iv. Proposed 31 CFR 1033.320(c)— second rule of construction, in extent provided by 31 U.S.C.
Retention of Records § 1033.320(d)(1)(ii)(A)(2), would 5318(g)(3).229 This protection would
provide two instances where disclosures extend to a PPSI and any current or
Proposed § 1033.320(c) would provide
of underlying facts, transactions, and former director, officer, employee, or
that PPSIs must maintain copies of filed
documents upon which a SAR was agent of a PPSI.
SARs and the underlying related
documentation for a period of five years based would be permissible: in vii. Proposed 31 CFR 1033.320(f)—
from the date of filing. Supporting connection with (i) preparation of a Compliance
documentation would need to be made joint SAR or (ii) certain employment
Proposed § 1033.320(f) would note
available to FinCEN, any Federal, State, references or termination notices.
The third rule of construction, in that FinCEN or its delegates will
or local law enforcement agency; or any examine PPSIs’ compliance with their
Federal regulatory authority that § 1033.320(d)(1)(ii)(B), would authorize
sharing of a SAR within a PPSI’s obligation to report suspicious
examines the PPSI for compliance with transactions. Proposed § 1033.320(f)
the BSA under the proposed rule, upon corporate organizational structure for
purposes consistent with the BSA as would also provide that a PPSI’s failure
request of that agency or authority. to comply with FinCEN’s SAR filing
determined by regulation or in
v. Proposed 31 CFR 1033.320(d)— guidance. FinCEN proposes specifying requirements may constitute a violation
Confidentiality of SARs in this rule of construction that a PPSI of the BSA and FinCEN’s regulations.
Consistent with BSA provisions subsidiaries and its insured depository viii. Proposed 31 CFR 1033.320(g)—
regarding SAR confidentiality,224 institution parent can share SARs Clarification Regarding Transactions
proposed § 1033.320(d) would provide between the two entities as doing so is Proposed § 1033.320(g) would
that a SAR and any information that consistent with Title II of the Bank effectuate FinCEN’s intent to explicitly
would reveal the existence of a SAR are Secrecy Act. Specifically, such sharing scope out secondary market transfers
confidential and shall not be disclosed enables a parent company to discharge from a PPSI’s SAR reporting obligation.
except as authorized in its oversight responsibilities with It would state that, for the purposes of
§ 1033.320(d)(1)(ii). Section respect to enterprise-wide risk the PPSI SAR regulation, ‘‘A
1033.320(d)(1)(i) would generally management.226 This provision is transaction, for purposes of § 1033.320,
provide that no PPSI, and no current or intended to make it clear that PPSIs will is not conducted or attempted by, at, or
former director, officer, employee, or be permitted to share SARs, as well as
agent of any PPSI, shall disclose a SAR the underlying facts, transactions, and 227 For purposes of this rulemaking, ‘‘non-public
or any information that would reveal the documents upon which a SAR was information’’ refers to information that is exempt
existence of a SAR. This provision of based, with its parent insured from disclosure under the Freedom of Information
depository institution (and vice versa). Act.
the proposed rule would further provide 228 31 CFR 1.11 is Treasury’s regulation
that any PPSI and any current or former Section 1032.330(d)(2) would also
governing demands for testimony or the production
director, officer, employee, or agent of incorporate the statutory prohibition of records of Department employees and former
any PPSI that is subpoenaed or employees in a court or other proceeding.
225 See 31 U.S.C. 5318(g)(2)(A)(i), 5322. 229 As previously referenced, to encourage the
otherwise requested to disclose a SAR 226 In reaching this conclusion, FinCEN reporting of possible violations of law or regulation
or any information that would reveal the considered and found persuasive the rationale and the filing of SARs, the BSA contains a safe
existence of a SAR, would decline to underlying interagency guidance issued by FinCEN, harbor provision that shields financial institutions
produce the SAR or such information the Board, FDIC, OCC, and Office of Thrift making such reports from civil liability. In 2001, the
lotter on DSK8BHNXB4PROD with PROPOSALS3
and would be required to notify FinCEN Supervision, which determined ‘‘a U.S. bank or USA PATRIOT Act clarified that the safe harbor
savings association may disclose a Suspicious also covers voluntary disclosure of possible
of such a request and any response Activity Report to its controlling company.’’ See violations of law and regulations to a government
thereto. In addition to reports of FinCEN, the Board, FDIC, OCC, and Office of Thrift agency and expanded the scope of the safe harbor
suspicious activity required by the Supervision, Interagency Guidance on Sharing to cover any civil liability which may exist under
proposed rule, PPSIs would be Suspicious Activity Reports with Head Offices and any contract or other legally enforceable agreement
Controlling Companies (Jan. 20, 2006), available at (including any arbitration agreement). See USA
https://www.fincen.gov/system/files/guidance/ PATRIOT Act, Public Law 107–56, sec. 351(a), 115
224 31 U.S.C. 5318(g)(2). sarsharingguidance01122006.pdf. Stat. 272, 321 (2001); 31 U.S.C. 5318(g)(3).
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00029 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
18610 Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules
through a permitted payment stablecoin high degree of usefulness in criminal, of funds to other financial institutions
issuer only because a transfer by third tax, or regulatory investigations.233 participating in the transfer or
parties results in an interaction with a Consistent with its treatment of other transmittal. As such, the information
permitted payment stablecoin issuer’s financial institutions under the BSA, ‘‘travels’’ with the transmittal to the
smart contract.’’ FinCEN proposes amendments to next financial institution in the payment
FinCEN also considered, instead of § 1010.410 and adding §§ 1033.400 and chain.236 Under the current regulatory
clarifying what transfers are scoped out 1033.410 to apply these recordkeeping regime, stablecoin issuers are subject to
of the rule, specifying transfers scoped requirements to PPSIs. the Recordkeeping Rule and Travel Rule
into the rule, by outlining that Proposed § 1033.400 would state as MSBs. The proposed requirement is
‘‘transactions’’ include (1) issuances or generally that PPSIs are subject to the generally consistent with existing
redemptions of a payment stablecoin; recordkeeping requirement of subpart D recordkeeping requirements for
(2) transfers, payments, or withdrawals of part 1010, which would include stablecoin issuers regulated as MSBs, as
of funds or value related to issuing or § 1010.430 that, among other things, well as other financial institutions with
redeeming a payment stablecoin, (3) requires records to be kept for five years recordkeeping requirements. FinCEN is
transfers, payments, or withdrawals of and § 1010.415. Proposed § 1033.410 not proposing to substantively change
funds or value related to managing would cross-reference § 1010.410 which the Recordkeeping Rule and Travel Rule
reserve assets; (4) transfers, payments, details the specific recordkeeping requirements via this rulemaking other
or withdrawals of funds or value related requirements explained in detail below. than clearly imposing those
to providing custodial or safekeeping requirements on PPSIs, consistent with
services for payment stablecoins, i. Application of Recordkeeping the GENIUS Act, and ensuring it is clear
required reserves; or private keys of Obligations in § 1010.410(a)–(d) that transmittal orders involving
payment stablecoins; (5) transfers, The proposal would require PPSIs to payment stablecoins are covered by the
payments, or withdrawals of funds or comply with the recordkeeping Recordkeeping Rule and Travel Rule.237
value related to any activities that obligations outlined in § 1010.410(a)
support (1)–(4); and (6) transfers, through (c). The recordkeeping a. Proposed Amendment to 31 CFR
deposits or withdrawals relating to any obligations would require PPSIs to 1010.100(eee)—Definition of
activity in which a PPSI is authorized to create and retain certain records for Transmittal Order
engage. FinCEN preliminarily believes, extensions of credit in excess of Both the Recordkeeping Rule,
however, that attempting to further $10,000; 234 and certain records of cross- § 1010.410(e),238 and Travel Rule,
outline ‘‘transaction’’ adds unnecessary border transfers of currency, monetary § 1010.410(f), rely on the definition of
complexity; may result in confusion instruments, funds, checks, investment ‘‘transmittal order’’ in § 1010.100(eee),
because ‘‘transaction’’ is otherwise securities, and credit worth more than which states, in part, that a transmittal
defined in FinCEN’s regulations; and $10,000. Section 1010.410(d) would order causes another financial
could lead to the PPSI SAR obligation require also a PPSI to maintain records institution to pay a fixed amount of
being overly or underly inclusive as the related to any order issued under ‘‘money.’’ FinCEN has clarified in
kinds of activities in which PPSIs § 1010.370(a) for up to five years. guidance that transmittal orders relating
engage, and how they engage in those to transfers involving CVC, of which
activities, could evolve. As indicated ii. Application of Recordkeeping payment stablecoins are one type, are
above, FinCEN welcomes comment on Obligations in § 1010.410(e) and (f) subject to the Recordkeeping and Travel
its proposed approach. The proposal would also require Rules, presuming the Rules’ other
PPSIs to comply with the conditions are met.239 Nevertheless, to
9. Proposed 31 CFR 1033.400 and
Recordkeeping Rule and Travel Rule, avoid any doubt regarding the
1033.410—Recordkeeping Requirements
which are complementary obligations application of the term transmittal order
for PPSIs
codified in §§ 1010.410(e) and to payment stablecoins in light of the
The GENIUS Act requires that PPSIs 1010.410(f), respectfully.235 The GENIUS Act’s direction to issue
be subject to requirements relating to Recordkeeping Rule requires financial regulations setting out requirements for
‘‘retention of appropriate records.’’ 230 institutions to collect and retain records PPSIs, FinCEN proposes amending the
Under the BSA, FinCEN has authority to for funds transfers and transmittals of definition of transmittal order in
impose on financial institutions funds in amounts of $3,000 or more. § 1010.100(eee) to expressly include
obligations relating to requiring, The Travel Rule requires financial payment stablecoins in addition to
retaining, and maintaining records.231 institutions to transmit information on ‘‘money.’’ 240 This change should not be
Financial institutions subject to the BSA certain funds transfers and transmittals
obligations have these recordkeeping 236 See 31 CFR 1010.410(e).
requirements.232 These records enhance 233 See 31 CFR 1010.401. 237 In addition to implementing the GENIUS Act’s
law enforcement’s ability to detect, 234 FinCEN recognizes that it is unlikely PPSIs directive that PPSIs be subject to recordkeeping
will engage in extensions of credit, but in the event obligations, this proposal also implements its
investigate, and prosecute money requirements related to high value transactions by
the ability of PPSI to extend credit is not fully
laundering, financial crimes, and have a foreclosed, FinCEN believes it prudent to apply the requiring collection of information for certain
obligation. A PPSI not engaged in such activity transactions. See 12 U.S.C. 5903(a)(5)(A)(v).
230 See 12 U.S.C. 5903(a)(5)(A)(ii). 238 Section 1010.410(e) applies to ‘‘nonbank
would not be expected to take any action to
231 See 12 U.S.C. 1953; 31 U.S.C. 5318(a)(2); see implement it, including creating policies and financial institutions.’’ FinCEN recognizes that
also 12 U.S.C. 5901(2) (defining ‘‘Bank Secrecy procedures, and accordingly would accrue no some PPSIs may also be banks but believes further
Act’’ to include 12 U.S.C. 1951 et seq.); 31 U.S.C. burden from the application of this obligation. clarifying in the regulatory text that when an entity
lotter on DSK8BHNXB4PROD with PROPOSALS3
5311(1) (stating purpose of the BSA includes 235 The Recordkeeping Rule for nonbank acts as a PPSI it is acting as a nonbank financial
requiring records that are highly useful for law financial institutions is codified at 31 CFR institution is not necessary.
enforcement and regulatory investigations and 239 See 2019 CVC Guidance, supra note 87.
1010.410(e). The Travel Rule is codified at 31 CFR
intelligence and counterintelligence activities). 1010.410(f) and applies to both bank and nonbank 240 Under 31 U.S.C. 5318(a)(2), FinCEN can
232 See 31 CFR 1020 subpart D, 1021 subpart D, financial institutions. See Treasury, Board, require financial institutions to maintain
1022 subpart D, 1023 subpart D, 1024 subpart D, Amendment to the Bank Secrecy Act Regulations appropriate procedures, including to collect and
1025 subpart D, 1026 subpart D, 1027 subpart D, Relating to Recordkeeping for Funds Transfers and report information. to guard against money
1028 subpart D, 1029 subpart D, and 1030 subpart Transmittals of Funds by Financial Institutions, 60 laundering, the financing of terrorism, or other
D. FR 220 (Jan. 3, 1995). forms of illicit finance. Additionally, 12 U.S.C. 1953
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00030 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules 18611
construed, including by negative FinCEN guidance, stablecoin issuers do enforcement authorities.250 Section
inference, to imply that orders to pay constitute money for purpose of the 314(b) further provides financial
other kinds of value that substitute for Recordkeeping and Travel Rules,246 institutions with the ability to
currency are not transmittal orders.241 and, accordingly, FinCEN proposes voluntarily share information regarding
FinCEN previously discussed its adding payment stablecoin to the parties suspected of possible terrorist or
treatment of CVCs for purposes of the definition of transmittal order to ensure money laundering activities with
Recordkeeping and Travel Rules. the application to payment stablecoins another financial institution upon
FinCEN’s 2019 guidance clarified the is clear in light of the GENIUS Act. notice to the Treasury under a safe
application of the Recordkeeping and harbor that offers protections from
Travel Rules to CVCs: ‘‘because a b. Proposed Amendment to 31 CFR
liability.
transmittal order involving CVC is an 1010.410(e)(6)—Scope of Recordkeeping
FinCEN’s regulations at 31 CFR
instruction to pay ‘a determinable Obligation
1010.520 and 1010.540 implement
amount of money,’ transactions FinCEN proposes amending sections 314(a) and 314(b) of the USA
involving CVC qualify as transmittals of § 1010.410(e)(6) to add PPSIs to the list PATRIOT Act, respectively. Section
funds, and thus may fall within’’ these of entities excepted from the 1010.520 applies to financial
obligations.242 FinCEN recognizes requirements in § 1010.410(e) when the institutions generally and, as explained
various definitions and treatment of the transfer is between the entities listed. below, requires a financial institution to
term ‘‘money.’’ Notably, under the Under this proposal, PPSIs would be search its records upon receipt of a
GENIUS Act, the term ‘‘money’’ means treated in the same manner—and with request from FinCEN and provide
‘‘(A) [ ] a medium of exchange currently the same exceptions for transfers to information in return. Section 1010.540
authorized or adopted by a domestic or certain other entities—such as banks, applies to financial institutions that are
foreign government; and (B) includes a broker-dealers, futures commission required to have AML/CFT programs, or
monetary unit of account established by merchants, introducing brokers in are treated as having satisfied that
an intergovernmental organization or by commodities, and mutual funds. In requirement, and is a voluntary
agreement between 2 or more other words, the recordkeeping information sharing tool of which a
countries.’’ 243 As FinCEN explained in requirements of the Recordkeeping Rule financial institution may, but is not
its 2020 notice of proposed rulemaking would not apply to transmittals of funds required, to avail itself.
related to the Recordkeeping and Travel in which both the transmittor and the Consistent with its treatment of other
Rules, in the preamble to the original recipient are either a PPSI, bank, broker- financial institutions under the BSA,
Recordkeeping Rule, FinCEN indicated dealer, futures commission merchant, FinCEN proposes adding §§ 1033.500,
non-defined terms should be given the introducing broker in commodities, or 1033.520, and 1033.540 to its
meaning given to the term in Article 4A mutual fund. regulations to expressly apply the
of the Uniform Commercial Code (UCC), information-sharing provisions of
which, at the time, defined ‘‘money’’ as 10. Proposed 31 CFR 1033.520 and
§§ 1010.520 and 1010.540 to PPSIs.
‘‘a medium of exchange currently 1033.540—Special Information-Sharing
FinCEN is proposing to apply these
authorized or adopted by a domestic or Procedures
provisions to PPSIs so that law
foreign government.’’ 244 Since 2020, The GENIUS Act generally directs enforcement would be able to request
however, additional CVCs and digital that PPSIs be treated as financial information from PPSIs where there is
assets have emerged. As recognized by institutions under the BSA and be reasonable suspicious and credible
Congress in the AML Act, these new subject to ‘‘all laws’’ relating to evidence that an individual, entity, or
forms of assets are intended to operate ‘‘prevention of money laundering.’’ 247 organization is involved in terrorist acts
as value that substitutes for traditional Although the GENIUS Act does not or money laundering, potentially
forms of money.245 Based on prior explicitly direct FinCEN to apply its resulting in lead information that might
provisions relating to information otherwise never be uncovered.251
provides the Secretary the ability to, for any
financial institution other than an insured bank,
sharing to PPSIs, information sharing Further, PPSIs would be able to
promulgate rules related to maintenance of authorities are established components participate in voluntary information
appropriate records including relating to funds of the BSA, which, among other sharing arrangements, through which
transfers. While FinCEN assesses its inclusion of purposes, seek to ‘‘prevent laundering of they can share and receive information
‘‘payment stablecoin’’ is no more than a
clarification, it also has and is using its authority
money.’’ 248 Indeed, in the AML Act, from other financial institutions to
under 12 U.S.C. 1953 and 31 U.S.C. 5318(a)(2) to Congress declared that one purpose of identify and, where appropriate, report
independently add payment stablecoin to the the BSA is to ‘‘establish appropriate activities that may involve terrorist
Recordkeeping and Travel Rule’s purview. frameworks for information sharing.’’ 249 activity or money laundering. As
241 See supra section VI.C.1.iv; see also 2019 CVC
The USA PATRIOT Act, which FinCEN has previously noted, under
Guidance, supra note 87, p. 11.
242 See 2019 CVC Guidance, supra note 87, p. 11. amended the BSA, provides in section 314(b) financial institutions can share
243 12 U.S.C. 5901(18). 314(a) that the Secretary should adopt information about transactions
244 See FinCEN, Board, Threshold for the regulations to encourage the further involving the proceeds of specified
Requirement To Collect, Retain, and Transmit cooperation and sharing of information unlawful activities, which include an
Information on Funds Transfers and Transmittals regarding credible evidence of terrorist array of fraudulent and other criminal
of Funds That Begin or End Outside the United
States, and Clarification of the Requirement To
acts or money laundering activities activities, such as fraud against
Collect, Retain, and Transmit Information on among financial institutions, their
Transactions Involving Convertible Virtual regulatory authorities, and law 250 See 31 U.S.C. 5311 note (‘‘Cooperation Among
lotter on DSK8BHNXB4PROD with PROPOSALS3
Currencies and Digital Assets With Legal Tender Financial Institutions, Regulatory Authorities, and
Status, 85 FR 68005, 68009 (Oct. 27, 2020). FinCEN Law Enforcement Authorities’’).
intends to withdraw this proposal. See E.O. 14178 ‘‘value that substitutes for any monetary 251 FinCEN, FinCEN’s 314(a) Fact Sheet (last
Report, supra note 32, p. 100. instrument.’’
246 See 2019 CVC Guidance, supra note 87, p. 11.
updated Feb. 3, 2026), available at https://
245 See, e.g., AML Act, Public Law 116–283 www.fincen.gov/sites/default/files/shared/
247 12 U.S.C. 5903(a)(5)(A).
(2021). Section 6102(d) of the AML Act adding 314afactsheet.pdf. Covered financial institutions
248 31 U.S.C. 5311(2), (5).
‘‘value that substitutes for currency’’ to clarify the are instructed not to reply to the 314(a) request if
application of the BSA to those assets, including 249 See 31 U.S.C. 5311(5); see also AML Act, a search does not uncover any matching accounts
clarifying that ‘‘monetary instruments’’ can include Public Law 116–283. or transactions.
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00031 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
18612 Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules
individuals, organizations, or system when foreign financial provisions relating to enhanced due
governments, computer fraud and institutions or transactions are of diligence for correspondent accounts,
abuse, and other crimes.252 Such primary money laundering concern.258 Congress intended the term
sharing could, for example, enable FinCEN’s regulations implementing ‘‘correspondent account’’ to capture
broader understanding of customer risk these BSA provisions are contained in more than traditional bank
and filing of more comprehensive 31 CFR part 1010, subpart F. FinCEN relationships.261 Rather its goal in
SARs.253 has applied enhanced due diligence and enacting BSA provisions related to
In particular, proposed § 1033.500 special measures to financial correspondent accounts was preventing
would state generally that PPSIs are institutions who typically maintain ‘‘money laundering through accounts
subject to the special information account-based relationships with that give foreign financial institutions a
sharing procedures of subpart E of part customers. base for moving funds through the U.S.
1010. In addition to §§ 1010.520 and Consistent with that practice, FinCEN financial system.’’ 262 Accordingly,
1010.540, subpart E of part 1010 is proposing to apply most of the FinCEN extended the term
contains a brief definition section, provisions in part 1010 subpart F to ‘‘correspondent account’’ to non-bank
§ 1010.505, containing definitions for, PPSIs, including enhanced due financial institutions that ‘‘offer
among other things, account. FinCEN diligence for correspondent and private accounts that provide foreign financial
assesses that the already codified banking accounts and some special institutions a conduit for engaging in
definition of account is sufficiently measures. Proposed § 1033.600 would ongoing transactions in the U.S.
broad to cover accounts established state generally that PPSIs are subject to financial system either on their own
with PPSIs, but requests comment on the special standards of diligence, behalf or for their customers.’’
whether this or any other definition in prohibitions, and special measures of To effectuate the GENIUS Act’s
that section, including transaction, part 1010 subpart F. FinCEN is not requirement that PPSIs maintain
should be modified to clarify obligations proposing to apply to PPSIs § 1010.630, ‘‘enhanced due diligence,’’ FinCEN is
of PPSIs. which prohibits correspondent accounts
Proposed § 1033.520 would cross- proposing to amend the definition of
for foreign shell banks, or § 1010.670, ‘‘correspondent account’’ so that PPSIs
reference § 1010.520 and require a PPSI, which relates to summons and
upon request from FinCEN, to are required to implement obligations
subpoenas on foreign banks, as the related to the BSA’s explicit references
expeditiously search its records for statutory authority authorizing those
specific information to determine to ‘‘enhanced due diligence.’’
provisions apply only to certain types of Accordingly, FinCEN proposes here, as
whether the PPSI maintains or has financial institutions.259
maintained an account for, or has it has before, extending the term
engaged in any transaction with, an i. Definition of ‘‘Correspondent correspondent account beyond its
individual, entity, or organization Account’’ and ‘‘Covered Financial traditional use in banking and
named in FinCEN’s request.254 A PPSI Institution’’ incorporating certain accounts
would then be required to report any established by PPSIs.
FinCEN is proposing to amend two
such identified information to FinCEN proposes adding a new
definitions in § 1010.605, the definition
FinCEN.255 paragraph, § 1010.605(c)(2)(v), defining
section for subpart F. In addition to
Proposed § 1033.540 would cross- ‘‘account,’’ as applied to the meaning of
amending these terms to account for
reference § 1010.540 and permit PPSIs ‘‘correspondent account’’ in
PPSIs, FinCEN is also making non-
to, upon providing notice to FinCEN, § 1010.605(c), to include, as applied to
substantive edits to § 1010.605(c)(2)(ii)
transmit, receive, or otherwise share a PPSI, ‘‘any formal relationship
through (iv) to correct cross
information with other financial established by a permitted payment
references.260
institutions or associations of financial stablecoin issuer to provide regular
First, FinCEN proposes amending the
institutions in order to identify and services, dealings, and other financial
definition of ‘‘account’’ in § 1010.605(c),
report to the federal government transactions.’’ This definition is
as applied to the meaning of
activities that may involve money intended to include the range of
correspondent account to include
laundering or terrorist activity. activities in which a PPSI may engage
accounts with PPSIs. FinCEN recognizes
11. Proposed 31 CFR 1033.600 Through as articulated in 12 U.S.C. 5903(a)(7),
that the term correspondent account is
1033.630—Special Standards of which include issuing and redeeming
not typically used in the stablecoin
Diligence; Prohibitions; and Special payment stablecoin, managing reserves,
industry. In a prior rulemaking FinCEN
Measures and providing custodial services, as
concluded that in enacting the BSA
well as activities that support any of
The GENIUS Act mandated that a those efforts. It would also cover where
258 See 31 U.S.C. 5318A and note; 21 U.S.C.
PPSI maintain ‘‘appropriate enhanced 2313a; see also 31 CFR 1010.651–664. a PPSI engages in activities as a digital
due diligence,’’ 256 and the BSA directs 259 See 31 U.S.C. 5318(j)(1) (specifying asset service provider.
that financial institutions establish prohibition on correspondent accounts for shell Second, FinCEN is proposing to
appropriate enhanced due diligence for banks is limited to financial institutions defined in
amend § 1010.605(e)(1) to include PPSIs
correspondent accounts and private 31 U.S.C. 5312(A) though (G)); 31 U.S.C.
5318(k)(1)(B) (specifying application of subsection in the definition of ‘‘covered financial
banking accounts.257 Congress has also only to covered financial institutions as specified in institution,’’ which results in PPSIs
authorized Treasury to impose special 31 U.S.C. 5318(j)(1)). being subject to provisions
measures to guard the U.S. financial 260 Currently, cross references in
implementing special standards of due
§ 1010.605(c)(2)(ii) through (iv) to corresponding
lotter on DSK8BHNXB4PROD with PROPOSALS3
252 See FinCEN, Section 314(b) Fact Sheet (Dec. paragraphs in (e)(1) are misaligned. For example, diligence for correspondent accounts
2020), available at https://www.fincen.gov/system/ § 1010.605(c)(2)(ii), which deals with broker established or maintained for foreign
files/shared/314bfactsheet.pdf. dealers, should cross the corresponding paragraph financial institutions and private
253 Id. in (e)(1) that deals with broker dealers, paragraph
254 See 31 CFR 1010.520(b)(3)(i).
(e)(1)(ii), but instead references paragraph
261 FinCEN, Anti-Money Laundering Programs;
(e)(1)(viii). FinCEN’s proposed changes to
255 See 31 CFR 1010.520(b)(3)(ii).
paragraphs 1010.605(c)(2)(ii) through (iv) clean up Special Due Diligence Programs for Certain Foreign
256 See 12 U.S.C. 5903(a)(5)(A)(v). Accounts, 71 FR 496, 497–98 (Jan. 4, 2006).
the cross references and do not result in any
257 See 31 U.S.C. 5318(i)(1). substantive change to the rule. 262 Id. at 499.
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00032 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules 18613
banking accounts established or non-U.S. customers, when those and § 1010.653 (relating to the
maintained for non-U.S. persons.263 relationships involve correspondent Commercial Bank of Syria) to apply
As part of its implementation of BSA accounts for foreign financial those special measures to PPSIs.271
obligations related to enhanced due institutions or private banking accounts.
diligence for private banking accounts, FinCEN requests comment on the VII. Proposed Application of Sanctions
FinCEN has already defined the term application of these provisions, Program Requirement
private banking account in including whether additional The GENIUS Act requires PPSIs to
§ 1010.605(m). That definition provides, amendments should be made to account maintain ‘‘an effective sanctions
in part, that a private banking account for any uniqueness of PPSIs. compliance program, including
means an account (or collection of iii. Special Measures verification of sanctions lists, consistent
accounts) with minimum aggregate with Federal law.’’ 272 As discussed in
assets of more than $1 million, Under the BSA, FinCEN can require section V.B above, PPSIs are U.S.
established on behalf of a non-U.S. U.S. financial institutions to implement persons under OFAC’s existing
person, and assigned or administered by certain special measures pursuant to regulations because the GENIUS Act
the covered financial institution. section 311 of the USA PATRIOT Act requires PPSIs to be formed in the
FinCEN assesses that this definition (section 311) if the Secretary finds that United States.273 Accordingly, like all
covers the kinds of account reasonable grounds exist to conclude other U.S. persons, stablecoin issuers
relationships PPSIs could maintain for a that a foreign jurisdiction, institution, that qualify as PPSIs will be required to
non-U.S. person and is proposing no class of transaction, or type of account comply with U.S. sanctions under
changes, but seeks comment on that is a ‘‘primary money laundering existing Federal law, meaning they must
approach. concern.’’ 267 Section 9714(a) of the generally block the property and
Combatting Russian Money Laundering interests in property of blocked persons;
ii. Special Standards for Diligence Act 268 and section 7213A Fentanyl reject prohibited transactions involving
To implement the GENIUS Act’s Sanctions Act (as amended by section certain persons, jurisdictions, or
directive to apply BSA obligations 3201 the of FEND Off Fentanyl Act)— activities; and retain certain records and
related to ‘‘enhanced due diligence,’’ the latter codified in 21 U.S.C. 2313a file reports with OFAC. The sanctions
FinCEN proposes adding §§ 1033.610 and referred to colloquially as section compliance program requirement in the
and 1033.620, which adopt by reference 2313a—allow for similar special GENIUS Act, however, represents the
§§ 1010.610 and 1010.620. Sections measures in the context of Russian first time that Federal law has explicitly
1010.610 and 1010.620 implement BSA illicit finance and illicit opioid mandated that a particular U.S. person
obligations related to enhanced due trafficking, respectively. As financial have an effective sanctions compliance
diligence for correspondent accounts institutions, FinCEN is proposing that program, although IEEPA and other
and private banking accounts, PPSIs be required to comply with
statutory authorities authorize the
respectively. special measures issued pursuant to
President to, among other actions,
Sections 1010.610 and 1010.620 sections 311, 9714(a), and 2313a to
investigate, block, regulate, or prohibit
require that covered financial maintain the options available under
transactions and dealings in property
institutions maintain due diligence these sections to protect the U.S.
subject to U.S. jurisdiction when a
programs for correspondent accounts for financial system from certain illicit
foreign national or country has an
foreign financial institutions and banks finance threats.
Additionally, by incorporating PPSIs interest.274
and for private banking accounts that Accordingly, OFAC is proposing a
include policies, procedures, and into the definition of ‘‘covered financial
institutions’’ in § 1010.605(e)(1), new part 502 to chapter V of the CFR
controls that are reasonably designed to entitled the ‘‘Permitted Payment
detect and report any known or FinCEN consequently imposes the
special measures codified in § 1010.658 Stablecoin Issuer Effective Sanctions
suspected money laundering or Compliance Program Regulations’’ to
suspicious activity conducted through (relating to FBME Bank, Ltd.);
§ 1010.659 (relating to North Korea); effectuate the GENIUS Act’s effective
or involving any such correspondent or sanctions compliance program
private banking accounts.264 These § 1010.660 (relating to Bank of
Dandong); § 1010.661 (relating to Iran); requirement,275 consistent with
provisions also set certain minimum statutory authorities that authorize
standards for such due diligence § 1010.663 (relating to Al-Huda Bank);
and § 1010.664 (relating to Huione OFAC to administer sanctions.276
programs, as well as procedures for
enhanced due diligence for Group).269 FinCEN is also proposing to
institutions to maintain correspondent accounts for
correspondent accounts for foreign amend § 1010.651 (relating to Burma) 270 Burmese banks under certain conditions. See
banks 265 and private banking accounts FinCEN, Conditional Exception to Bank Secrecy Act
267 Section 311 is codified at 31 U.S.C. 5318A.
Regulations Relating to the Burma Section 311
for senior foreign political figures.266 268 Section 9714(a) of the Combating Russian Final Rule, 81 FR 71986 (Oct. 19, 2016).
Applying these special standards of Money Laundering Act, as amended by section 271 In May 2025, FinCEN issued conditional
due diligence to PPSIs would help 6106(b) of the National Defense Authorization Act exceptive relief permitting covered financial
PPSIs in understanding risk and for Fiscal Year 2022. Section 9714 (as amended) can institutions to open and maintain correspondent
be found in a note to 31 U.S.C. 5318A. accounts for the Commercial Bank of Syria under
identifying illicit activity in certain 269 Additionally, FinCEN has proposed special
certain conditions. FinCEN, Exception to
relationships with foreign financial measures that, if finalized, could also require PPSIs Prohibition Imposed by Section 311 of the USA
institutions. Specifically, these to take special measures. See FinCEN, Proposal of PATRIOT Act Against the Commercial Bank of
standards would address relationships Special Measure Regarding MBaer Merchant Bank Syria (May 23, 2025), available at https://
lotter on DSK8BHNXB4PROD with PROPOSALS3
AG as a Financial Institution Operating Outside of www.fincen.gov/system/files/2025-08/Commercial-
with high-net worth non-U.S. customers the United States of Primary Money Laundering Bank-of-Syria-Exceptive-Relief.pdf.
and foreign financial institutions that Concern, 91 FR 10034 (Mar. 2, 2026); FinCEN, 272 12 U.S.C. 5903(a)(5)(A)(vi).
may be acting on behalf of higher-risk Proposal of Special Measure Regarding 273 12 U.S.C. 5901(23) (defining, in part,
Transactions Involving Ten Mexican Gambling
Establishments as a Class of Transactions of ‘‘permitted payment stablecoin issuer’’ as ‘‘a person
263 See 31 CFR 1010.610–620. formed in the United States’’).
Primary Money Laundering Concern, 90 FR 51234
264 See 31 CFR 1010.610–620. 274 See 50 U.S.C. 1702.
(Nov. 17, 2025).
265 See 31 CFR 1010.610(b). 270 In October 2016, FinCEN issued conditional 275 12 U.S.C. 5903(a)(5)(A)(vi).
266 See 31 CFR 1010.620(c). exceptive relief permitting covered financial 276 See, e.g., 50 U.S.C. 1702.
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00033 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
18614 Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules
Section VII.A below describes the consistent with how those terms are the Virtual Currency Industry’’ (‘‘Virtual
recordkeeping and reporting defined in the GENIUS Act.282 Currency Industry Guidance’’) and
requirement for a PPSI in line with several Frequently Asked Questions on
B. Effective Sanctions Compliance
standard OFAC requirements for all U.S. Virtual Currency.286 One of OFAC’s
Program
persons,277 as well as an additional main objectives in issuing the Virtual
requirement that PPSIs provide to OFAC The GENIUS Act requires both that Currency Industry Guidance was to
upon request certain certifications PPSIs maintain an ‘‘effective sanctions explain how actors in the broader digital
required by the GENIUS Act and compliance program’’ 283 and that assets industry could mitigate sanctions
relevant to OFAC’s role administering regulations promulgated under the Act risk by adopting a risk-based approach
and enforcing the requirement that are ‘‘tailored to the size and to sanctions compliance. The Virtual
PPSIs maintain an effective sanctions complexity’’ 284 of a PPSI. Based on Currency Industry Guidance also
compliance program.278 Section VII.B decades of experience administering highlighted specific risks facing actors
then outlines the five elements of an and enforcing U.S. sanctions, OFAC has in the digital assets industry and
effective sanctions compliance program found across multiple sectors that an identified best practices to support
proposed at § 502.201(b), including an entity’s size and complexity are industry stakeholders with sanctions
explanation and rationale for each significant factors in assessing sanctions
compliance, such as the use of
component. Section VII.C discusses risk. A larger sized entity can mean
geolocation and blockchain analytics
terms OFAC proposes to define in the greater exposure to transactions that
tools for screening and transaction
definitions section in subpart C to part could involve a blocked person,
monitoring.287 Many in the compliance
502. Finally, section VII.D provides an sanctioned jurisdictions, or interaction
with other OFAC-administered community noted that the document
overview of the proposed penalties for provided clear guidance on digital asset
materially or knowingly violating the prohibitions or restrictions. Likewise,
greater complexity in an entity’s providers’ sanctions obligations and
effective sanctions compliance program valuable best practices for ensuring
requirement contained in proposed 31 operations can necessitate more
sophisticated controls to mitigate compliance in that space.
CFR part 502, consistent with the
GENIUS Act 279 and pursuant to sanctions risk. Therefore, based on In addition to OFAC’s existing
statutory authorities authorizing OFAC OFAC’s historical experience, OFAC guidance, OFAC’s extensive experience
to impose civil monetary penalties, assesses that the best way to implement administering and enforcing U.S.
including IEEPA.280 the GENIUS Act’s instructions is to sanctions has also demonstrated that a
delineate effective sanctions compliance risk-based approach is an effective way
A. Recordkeeping and Reporting elements that provide PPSIs discretion to mitigate sanctions risk. Promoting
Consistent with OFAC’s requirements to make risk-based judgments in light of, compliance is a core objective in
for all U.S. persons, proposed among other factors, their size and pursuing enforcement actions. As
§ 502.102(a) imposes on PPSIs standard complexity. outlined in the preamble to the Final
recordkeeping and reporting In 2019, OFAC published ‘‘A Rule establishing OFAC’s Enforcement
requirements as found in 31 CFR part Framework for OFAC Compliance Guidelines,288 the purpose of OFAC’s
501. These requirements align with Commitments’’ (the ‘‘2019 Compliance enforcement actions are to raise
PPSIs’ status as U.S. persons, making Framework’’) to support the regulated awareness, increase compliance, and
them subject to the requirements found public’s development of effective deter ‘‘conduct that undermines the
in subpart C of part 501. OFAC’s sanctions compliance programs with goals of [U.S.] sanctions programs.’’ 289
experience in enforcing U.S. sanctions guidance on tailoring risk-based Accordingly, OFAC’s enforcement
and supporting compliance by regulated principles to an organization’s unique settlement agreements with parties
persons has found these requirements to characteristics and sanctions risk usually insist on implementation of a
be essential to the integrity of the U.S. exposure.285 In addition to being a sanctions compliance program in line
sanctions regime. cornerstone of OFAC’s public outreach with the 2019 Compliance Framework.
Proposed § 502.102(b) would require to all regulated industries, the Consequently, across both OFAC’s
PPSIs provide to OFAC upon request, compliance guidance and expectations history of guidance and enforcement,
given OFAC’s role in administering and detailed in the 2019 Compliance OFAC has consistently observed that an
enforcing economic sanctions and Framework consistently form the basis effective sanctions compliance program
issuing sanctions compliance program of OFAC’s published guidance (e.g., contains certain key elements.
requirements under the GENIUS Act, sanctions advisories, compliance
any and all certifications submitted to communiqués, and frequently asked Based on that experience, OFAC is
the PPSI’s primary Federal payment questions), as well as specific guidance now proposing requiring PPSIs adopt a
stablecoin regulator or State payment issued in response to public inquiries. sanctions compliance program
stablecoin regulator certifying, pursuant Subsequently, in 2021, OFAC including the five key elements in line
to the GENIUS Act, that the PPSI has provided additional guidance to the with the 2019 Compliance Framework:
implemented an effective sanctions digital assets industry grounded in the
286 See OFAC, Sanctions Compliance Guidance
compliance program.281 OFAC intends Framework by publishing the
for the Virtual Currency Industry (Oct. 2021)
to interpret the terms ‘‘primary Federal ‘‘Sanctions Compliance Guidance for
[hereinafter Virtual Currency Industry Guidance],
payment stablecoin regulator’’ and available at https://ofac.treasury.gov/media/
282 See 12 U.S.C. 5901(25), 5901(30).
‘‘State payment stablecoin regulator’’ 913571/download?inline; see also OFAC, Questions
lotter on DSK8BHNXB4PROD with PROPOSALS3
283 12 U.S.C. 5903(a)(5)(A)(vi).
on Virtual Currency, available at https://
284 12 U.S.C. 5903(a)(5)(B).
277 See, e.g., 31 CFR 525.102, 583.102, 587.601. ofac.treasury.gov/faqs/topic/1626.
285 See OFAC, A Framework for OFAC
278 See 12 U.S.C. 5904(i)(1). 287 See Virtual Currency Industry Guidance,
Compliance Commitments (May 2, 2019)
279 12 U.S.C. 5905(b)(5)(B)–(C). supra note 286, at pp. 14, 16.
[hereinafter 2019 Compliance Framework],
280 See, e.g., 50 U.S.C. 1705(b), 4315(b). 288 OFAC, Economic Sanctions Enforcement
available at https://ofac.treasury.gov/media/16331/
281 See 12 U.S.C. 5904(i)(1). download?inline. Guidelines, 74 FR 57593 (Nov. 9, 2009).
289 Id. at 57594.
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00034 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules 18615
(1) Senior Management and to carry out the requirement that PPSIs compliance by establishing ultimate
Organizational Commitment; (2) Risk conduct risk assessments, maintain responsibility at the PPSI’s senior levels.
Assessment; (3) Internal Controls; (4) internal controls, conduct testing and Furthermore, the proposed
Testing and Auditing; and (5) Training. auditing, and maintain a risk-based § 502.201(b)(1) would require senior
OFAC assesses that a risk-based sanctions compliance training program, management to support the sanctions
approach and a sanctions compliance as described in the proposed compliance program’s effective
program grounded in the five § 502.201(b)(2) through (b)(5) (see implementation by ensuring the
enumerated elements best implements sections VII.B.2 through VII.B.5 below); program includes, at a minimum,
the GENIUS Act’s requirement that (iii) is fully integrated into the PPSI’s certain key components. First, senior
Treasury adopt rules tailored to the size ongoing stablecoin-related operations; management would be required to
and complexity of PPSIs while ensuring (iv) routinely provides risk updates, ensure the sanctions compliance
that PPSIs maintain an effective including test results, to senior program applies to all payment
sanctions compliance program.290 management and other appropriate stablecoin-related activity. As outlined,
Specifically, by mandating the five a PPSI’s senior management operates
personnel within the PPSI; and (v)
elements as a minimum for an effective from a distinct vantage point compared
provides sufficient authority and
sanctions compliance program, the to other personnel, enabling broader
autonomy to the compliance function to
proposed rule intentionally sets a awareness and oversight across an entire
manage effectively U.S. sanctions risk organization that uniquely positions
necessary floor for an effective sanctions
for the entire PPSI. them to monitor the creation and
compliance program while leaving
space for PPSIs to take additional or A PPSI’s senior management includes implementation of a sanctions
refined compliance measures that individuals responsible for monitoring compliance program. That perspective
account for the specific circumstances performance across the organization, supports making sure the compliance
of individual PPSIs. Finally, OFAC including its sanctions compliance program does not only apply to discrete
notes the proposed rule’s focus on a program. As applicable, senior parts of a PPSI’s operations. While, as
risk-based approach and the five management could include supervisory, outlined below in this section, an
enumerated elements of an effective managerial, and executive employees, effective sanctions compliance program
sanctions compliance program intends and can also include its board of requires a measure of delegation and
to provide flexibility to account for directors, owners, operators, and other autonomy to the compliance function to
rapidly evolving payment stablecoin leadership personnel depending on the deploy established compliance policies
technologies in the digital assets PPSI’s governance structure. The and procedures, senior management’s
ecosystem. As PPSIs utilize the GENIUS particular composition of a PPSI’s visibility across a PPSI’s operations
Act’s framework to support innovation senior management is a fact-specific during the creation of a sanctions
and the responsible growth and use of matter depending on each individual compliance program is vital to avoiding
payment stablecoins, OFAC anticipates PPSI, and in this proposed rule, OFAC gaps that create heightened risks of
the development of new stablecoin- proposes to provide PPSIs with sanctions violations.
related products and services that may Second, senior management would be
flexibility in determining which
differ from those provided or used by required to ensure the sanctions
members of senior management ensure
stablecoin issuers today. Such products compliance program has adequate
an effective sanctions compliance
and services, in turn, may require new resources. OFAC’s experience has
program. Nevertheless, based on its demonstrated that adequate resourcing
approaches to sanctions compliance to experience administering and enforcing
mitigate sanctions risks and meet is particularly crucial for PPSIs given
U.S. sanctions, including providing the nature of the rapidly evolving
OFAC’s regulatory obligations.
In sections VII.B.1 through VII.B.5 guidance to industry, OFAC views technologies underpinning payment
below, OFAC provides further details senior management engagement as stablecoins and attendant sanctions
regarding the five elements that essential to the effectiveness of any risks. OFAC does not propose to
constitute the effective sanctions person’s sanctions compliance prescribe specific resourcing levels or
compliance program requirements that program.291 A PPSI’s senior breakdowns in resources for various
OFAC proposes for PPSIs pursuant to management’s combination of its elements of a compliance program.
the GENIUS Act and consistent with vantage point across the entire Senior management should tailor those
statutory authorities that OFAC organization’s activities and its decisions to a PPSI’s particular
administers as described above. decision-making authority uniquely circumstances. Nonetheless, ensuring
positions it to review a sanctions adequate resources would entail senior
1. Proposed 31 CFR 502.201(b)(1)— compliance program with a management knowledge of and
Senior Management and Organizational comprehensive understanding of the engagement on how the PPSI allocates
Commitment PPSI’s operations and credibly approve resources for compliance functions
Proposed § 502.201(b)(1) would a program as meeting that PPSI’s across the organization and how that
require a PPSI’s senior management to particular circumstances. Additionally, allocation is commensurate with current
review and approve a PPSI’s sanctions the requirement that senior management levels of sanctions risk exposure,
compliance program and to support the approve the sanctions compliance including in the form of human capital,
sanctions compliance program’s program demonstrates senior expertise, information technology, such
effective implementation, including by management support and buy-in, which as the tools described in section VII.B.3
lotter on DSK8BHNXB4PROD with PROPOSALS3
ensuring the sanctions compliance is critical to building a culture of below, and other resources, as
program, at a minimum: (i) applies to all appropriate.
payment stablecoin-related activity; (ii) 291 See, e.g., OFAC, OFAC Settles with Murad, Third, senior management would be
has sufficient resources, including LLC for $3,334,286 and with a Former Senior required to ensure the sanctions
necessary investments in human capital, Executive of Murad, LLC for $175,000 Related to compliance program is fully integrated
Apparent Violations of the Iranian Transactions
expertise, and information technology, and Sanctions Regulations (May 17, 2023),
into a PPSI’s ongoing stablecoin-related
available at https://ofac.treasury.gov/media/ operations. The active incorporation of
290 12 U.S.C. 5903(a)(5)(B). 931761/download?inline=. the compliance program into ongoing
VerDate Sep<11>2014 18:56 Apr 09, 2026 Jkt 268001 PO 00000 Frm 00035 Fmt 4701 Sfmt 4702 E:\FR\FM\10APP3.SGM 10APP3
18616 Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules
operations is critical to both timely and proposed in § 502.201(b)(1)(i) through is grounded in the most current
effective responses to sanctions risk. In (v) constitute a minimum set of understanding of the various sources of
line with section VII.B.3 below, a senior activities that OFAC would expect when sanctions risks. As OFAC has
management commitment with respect considering whether a PPSI’s sanctions determined through various
to ongoing operations would entail compliance program is effective. enforcement actions, a sanctions
ensuring a sanctions compliance Additional activities may be relevant to compliance program’s internal controls
function has the necessary tools to a PPSI’s compliance program under a (see section VII.B.3) and training (see
identify and respond to sanctions risks risk-based approach. In accordance with section VII.B.5) are only effective if an
judiciously. Simultaneously, in addition the GENIUS Act’s mandate to tailor organization has an accurate
to resourcing necessary tools, this rules to the size and complexity of each understanding of the sanctions risks it
commitment could also be expressed by PPSI’s operations,292 the proposed rule faces. Therefore, holistic and
ensuring written policies and leaves discretion for PPSI’s to adopt appropriately frequent risk assessments
procedures (see section VII.B.3) that additional measures in line with their are essential to the proper
enable PPSI personnel to respond circumstances. implementation of the other elements of
expeditiously when confronting an effective sanctions compliance
2. Proposed 31 CFR 502.201(b)(2)—Risk
sanctions risk. program outlined in this section VII.B.
Fourth, senior management would be Assessments
Additionally, to be effective, risk
required to ensure senior management, Proposed § 502.201(b)(2) would assessments themselves must be revised
and other appropriate personnel, require a PPSI conduct sanctions-related to account for new information or
routinely receive risk updates, including risk assessments by: (i) conducting changing circumstances that impact a
test results, from the sanctions holistic assessments of U.S. sanctions PPSI’s risk profile. Identification of U.S.
compliance program. OFAC’s risks at appropriate intervals; (ii) using sanctions violations or deficiencies in
experience providing guidance to the the risk assessments to inform the an existing compliance program
regulated public and enforcing U.S. PPSI’s operation of its sanctions naturally suggest the presence of
sanctions has shown that absent a senior compliance program, including revising vulnerabilities necessitating revisions or
management commitment to an entity’s internal controls and training as remediation. Similarly, with respect to
sanctions compliance program, staff appropriate; and (iii) revising risk new products, services, mergers, or
implementing the program will have assessments as appropriate to account acquisitions, OFAC has on multiple
less routine access to senior for any identified U.S. sanctions occasions entered into settlement
management to provide risk updates, violations or deficiencies, new products, agreements with entities in the digital
including test results. Such routine services, mergers, or acquisitions, and assets industry for apparent violations
updates are necessary to support senior any other factors that may affect a PPSI’s that arose from the development and
management’s continued appreciation risk profile. release of a product or service without
of the organization’s sanctions In the sanctions context, risks are
having given sufficient consideration of
obligations and timely awareness of potential threats or vulnerabilities that,
attendant sanctions risks or compliance
sanctions risks, as well as then if ignored or not properly handled, can
implications.295 A holistic assessment of
facilitating informed decisions. In the lead to violations of the regulations
the sanctions-related risks that such a
proposed rule OFAC does not prescribe administered by OFAC. Holistic risk
new product or service could create is
a cadence for these routine risk updates, assessments allow an organization to
necessary to understand what additional
as they should be tailored to the identify these threats or vulnerabilities.
or revised controls may be necessary.296
particular circumstance of each PPSI. OFAC has found, through its
Finally, while routine updates to Without these steps pre-launch, the new
enforcement actions for violations of
senior management are essential, under products or services themselves may
sanctions and engagement with private
the proposed rule, senior management immediately give rise to sanctions
industry, that regular risk assessments
would also be required to ensure that compliance-related gaps, possibly
are foundational for sanctions
the sanctions compliance program has seriously undermining the effectiveness
compliance programs to be effective. In
sufficient authority and autonomy to of a sanctions compliance program.
keeping with the GENIUS Act’s
function and conduct timely and requirement to tailor rules to the size 3. Proposed 31 CFR 502.201(b)(3)—
effective operations. The proposed rule and complexity of each PPSI’s Internal Controls
would require that a PPSI’s sanctions operations,293 OFAC does not propose a Proposed § 502.201(b)(3) would
compliance program be empowered to uniform frequency for conducting risk
work independently to take appropriate require a PPSI 297 to establish and
assessments. Similarly, while risk maintain