Freeze it, but don’t file on it: what BSA teams miss in the GENIUS Act rules

Between January 1, 2015 and November 21, 2025, FinCEN received about 55,000 suspicious activity reports that named a specific stablecoin in the narrative, plus about 8,400 more that mentioned stablecoins in general. Over the same stretch, OFAC got about 5,800 blocked property reports and 3,000 rejected transaction reports that named one. Those counts sit in the preamble of the joint FinCEN and OFAC proposal under the GENIUS Act, next to a FATF line that "a majority of all on-chain illicit activity is now transacted in stablecoins."

If you work in BSA/AML, sanctions or bank supervision, a big piece of that activity is about to land inside a new kind of regulated financial institution. The GENIUS Act takes effect January 18, 2027. I read the statute and every Federal Register document Treasury and the banking agencies have put out under it through October. I build products, I'm not a lawyer, so I've stuck to what the text says and marked each point as statute, proposed or final. These are the details that surprised me most.

First, what's actually in force

The statute is law: Public Law 119-27, signed July 18, 2025, now at 12 U.S.C. 5901 to 5916. Section 20 makes it effective on the earlier of 18 months after enactment or 120 days after the primary regulators issue final rules. The OCC issued its final rule on October 21, effective January 18, 2027. So January 18 is the date.

Almost everything a BSA team cares about is still a proposal. The FinCEN and OFAC program rule (April 10, comments closed June 9), the joint customer identification rule (June 22, comments closed August 21), and the OCC and FDIC BSA standards proposals are all unfinished. The OCC's final rule, announced in Bulletin 2026-50, leaves BSA/AML and sanctions to a separate rulemaking. And FinCEN and OFAC propose that their rules take effect 12 months after they're issued in final form. The CIP proposal uses the same 12 months.

So the Act's date and the AML rule's date are not the same date. Plan for both.

1. Congress wrote a sanctions program into law, and OFAC calls it a first

Section 4(a)(5)(A)(vi) requires every permitted issuer to keep "an effective economic sanctions compliance program, including verification of sanctions lists." OFAC's preamble says this "represents the first time that Federal law has explicitly mandated that a particular U.S. person have an effective sanctions compliance program." Until now a sanctions program was strongly expected. For these issuers it's a statutory duty.

OFAC proposes a new 31 CFR part 502 with five program elements at 502.201(b), and penalties at 502.401 that track Section 6(b)(5) of the Act: up to $100,000 a day for a material violation and another $100,000 a day for knowing participation. That sits on top of IEEPA, where OFAC liability is strict.

The scope is the part to read twice. Proposed 502.303 defines "payment stablecoin-related activity" to run "from the time of issuance until the payment stablecoin's removal from circulation, including activity on the secondary market." OFAC gives the example: an issuer can't allow "blocked persons to engage with its smart contracts to facilitate trades of its payment stablecoins." A sanctions officer used to screening customers is being asked to screen a token's whole life.

2. Freeze on the secondary market, but no SAR duty there

FinCEN draws a line that I haven't seen discussed much. Proposed 31 CFR 1033.240 applies the Act's two technical duties to secondary market activity: the ability to "block, freeze, and reject" impermissible transactions (Section 4(a)(5)(A)(iv)) and the ability to comply with lawful orders (Section 4(a)(6)(B)). FinCEN's reason is blunt: it "assesses that most of the illicit activity involving stablecoins occurs on the secondary market," and that issuers today have "a small number of large, generally institutional customers."

Then the SAR rule goes the other way. Proposed 1033.320(g) says a transaction isn't conducted "by, at, or through" an issuer "only because a transfer by third parties results in an interaction with a permitted payment stablecoin issuer's smart contract." FinCEN says a secondary market SAR duty "would essentially require global monitoring of transfers" and could produce "defensive SARs" filed "to avoid criticism from examiners about underreporting." It's also not proposing that the AML program monitor secondary market activity. Voluntary SARs keep the BSA safe harbor, and the proposed SAR threshold is $5,000.

That isn't a free pass. FinCEN still expects an issuer to understand its distribution channels, "including the blockchains on which its payment stablecoins are deployed." And Section 9(d)(3) of the statute tells FinCEN to issue, by July 18, 2028, standards for issuers' "systems and practices to monitor transactions on blockchains, digital asset mixing services, tumblers." Treat today's line as a starting point.

Two smaller points examiners will ask about. CTRs: the proposal applies them, but 31 CFR 1010.100(m) defines currency as coin and paper money, so FinCEN says the CTR sections "do not require reports of transactions in payment stablecoins." They only bite if an issuer takes physical cash. Travel Rule: FinCEN proposes amending the "transmittal order" definition in 1010.100(eee) to add payment stablecoins, so the $3,000 recordkeeping rule and the Travel Rule clearly reach stablecoin transfers.

3. Lawful orders: burn, then reissue to the government

Section 2(16) defines a lawful order as a final and valid order from a court or an authorized federal agency that requires the issuer to "seize, freeze, burn, or prevent the transfer" of its coins, specifies the coins or accounts "with reasonable particularity," and "is subject to judicial or administrative review or appeal." FinCEN proposes reading "account" to include wallet addresses.

Three things I didn't know. First, FinCEN writes that "with some regularity, Federal court orders require stablecoin issuers to burn and reissue an equivalent amount of stablecoins to a government-controlled wallet," and that having that capability is part of compliance. Second, Treasury's Section 3 proposal defines "issue" as the issuer's first transfer of a coin "except as required by a lawful order," so a court-ordered reissue isn't a new issuance. Third, FinCEN reads the lawful-order duty as "ongoing rather than only in existence at the time a stablecoin is issued."

Section 4(a)(6)(A) also tells Treasury to coordinate with issuers, "to the best of the Secretary's ability," before it blocks a foreign person's property, so the issuer can block that person's coins. In the same breath it says Treasury "is not required to notify" any issuer in advance. Your list updates still have to be fast.

4. Foreign issuers: one test starts January 18, not 2028

Most people know the July 18, 2028 date in Section 3(b)(1). From then, a digital asset service provider can't offer or sell a payment stablecoin to people in the U.S. unless a permitted issuer issued it. Fewer know Section 3(b)(2). It bars a service provider from offering or making available a foreign issuer's coin unless that issuer "has the technological capability to comply, and will comply," with lawful orders and any Section 18 reciprocal arrangement. Treasury's proposal says 3(b)(2), "unlike section 3(b)(1)," becomes applicable on the effective date of the Act. That's January 18, 2027.

Treasury also proposes how a service provider can rely on a foreign issuer's word. Under proposed 31 CFR 1523.3(c), reliance needs reasonable due diligence that at least confirms no Section 8 trading ban is in effect, and doesn't work if the provider "knows, has reason to know, or should know" the representation is false. Treasury says advising buyers "how to evade generally applicable location detection or restriction mechanisms" counts as an offer or sale. And acting "as a market maker for newly-issued payment stablecoins" of an unlawful issuer may be participation in a crime under Section 3(f): up to $1 million per violation, five years, or both.

Section 8 is the enforcement path, and it runs on a short clock. Treasury may designate a noncompliant foreign issuer within 30 days of identifying it, with written notice. If the issuer doesn't comply with the lawful order within 30 days of that notice, Treasury publishes the finding and a ban on service providers facilitating secondary trading, effective 30 days after the Federal Register notice. A service provider that knowingly keeps facilitating faces up to $100,000 per violation per day. The issuer faces up to $1,000,000 per violation per day and a possible injunction barring it from U.S. financial transactions. Acts with a common cause count as one violation, unless Treasury finds "gross negligence, a reckless disregard for, or a pattern of indifference to" AML, terrorist financing or sanctions requirements.

Why the lawful-order test matters showed up in a FinCEN finding issued October 1. In its Section 9714 proposal on the A7 network, FinCEN found that "more than 180 entities processed A7A5 transactions worth at least USD 179.1 billion, between February 2025 and June 2026," and that the network used the ruble-backed A7A5 "as a non-freezable, bridging asset" into coins like USDT. A coin nobody will freeze is exactly what Section 3(b)(2) is built to keep off U.S. platforms.

5. Certifications with criminal exposure

Section 5(i) requires each issuer, within 180 days of approval and every year after, to certify to its regulator that its AML and sanctions programs are "reasonably designed to prevent" it from facilitating money laundering, "in particular, facilitating money laundering for cartels and organizations designated as foreign terrorist organizations." A knowingly false certification falls under 18 U.S.C. 1001. FinCEN (proposed 1033.210(e)) and OFAC (proposed 502.102(b)) both propose that issuers hand those certifications to them on request.

Section 4(a)(3) adds a monthly one. A registered public accounting firm examines the reserve report each month, and the CEO and CFO certify its accuracy. Knowingly false certification carries the penalties of 18 U.S.C. 1350(c), the Sarbanes-Oxley certification provision.

Then people. Section 4(f) bars anyone convicted of a felony involving insider trading, embezzlement, cybercrime, money laundering, terrorist financing or financial fraud from serving as an officer or director, with up to $1 million and five years for knowingly participating in a violation. FinCEN's proposed 1033.210(b)(3)(iv) applies that bar expressly to the AML/CFT officer, and expects issuers to screen before naming one and keep monitoring after. Section 6(b)(3) lets a federal regulator remove an insider who knowingly violated the BSA, and under 6(b)(5)(E) leaving the company doesn't end that authority for six years.

There is one supervisory point that runs the other way. Under the OCC's proposed new subpart of 12 CFR part 19, an issuer that "has properly established an effective AML/CFT program" wouldn't face AML enforcement or a significant AML supervisory action except for "a significant or systemic failure." The OCC would also give the FinCEN Director at least 30 days' written notice before such an action, unless it decides a shorter period is needed. The FDIC proposed a similar policy. Both are proposals.

6. What lands on the bank side

Reserve deposits. The FDIC's April proposal says a stablecoin reserve deposit "would be insured to the PPSI under the FDIC's coverage rules for corporate deposits, but would not be insured to payment stablecoin holders on a pass-through basis." So $250,000 covers the issuer's corporate deposits at that bank in total, not each holder. That's proposed, and it matters for concentration and liquidity reviews.

Tokenized deposits. Section 2(22) excludes "a deposit," including one "recorded using distributed ledger technology," from the payment stablecoin definition. The FDIC adds: "Although a tokenized deposit is a deposit, there may be tokenized bank liabilities that are not deposits." Check the product, not the label.

Redemption and yield, final. The OCC's final 15.12(c)(1) says timely redemption "may not exceed two business days," and it declined a longer window for cross-border redemptions. On yield, the OCC dropped its proposed rebuttable presumption on affiliate and third-party payments, chose not to define "interest" or "yield," and adopted no de minimis safe harbor or cure period. It "declines to presume that rewards programs that predated the GENIUS Act comply." It also says the prohibition "does not extend to paying interest on deposits, including deposits in tokenized form."

Enterprise programs. Where an issuer is a subsidiary of an insured depository institution, FinCEN says the group "may elect to extend a single AML/CFT program to both entities," as long as it covers each entity's distinct duties, including the freeze and lawful-order capabilities.

7. What FinCEN found in issuers' own filings

The regulatory impact section is the most useful exam prep in the whole proposal. FinCEN and OFAC looked at 352 stablecoin products. Only 43 were fiat-backed, dollar-pegged and centrally issued. After reserve and yield screens, 30 products from 25 entities looked like potential payment stablecoins. The median issuer had about 100 primary market customers.

About half the stablecoin-issuing entities FinCEN identified appeared registered as MSBs. Products with no MSB registration activity made up less than one percent of the market cap of likely payment stablecoins. For 17 likely products, annual SARs per entity in 2025 ran from zero to over 4,000, with an average of about 350 and a truncated average of 104. Within the past five years, only one likely issuer kept filing CTRs to the end of the sample.

The structure finding is the one I'd put on an exam's first-day list. Issuers averaged about two legal entities in their BSA filings, and some had as many as eight. "In several cases, the legal entities filing SARs were distinct from the legal entities registering as MSBs." FBAR data showed "indications that a number of these issuers maintain offshore accounts." FinCEN also notes one issuer reported freezing a secondary market user's coins at law enforcement's request.

What I'd do or ask now

1. Map the legal entities. Which entity issues, which holds reserves, which files SARs, which is registered? Tie it to Section 2(23) and the entity findings in the FinCEN proposal.
2. Test the lawful-order runbook. Freeze by wallet address, burn, and reissue to a government wallet, with timestamps. Section 2(16), Section 4(a)(6)(B), proposed 1033.240(b).
3. Screen the token, not just the customer. Can blocked persons interact with your smart contracts? Section 4(a)(5)(A)(vi), proposed 31 CFR 502.303.
4. Write down your secondary market position. No SAR duty is proposed, but you still need to know the chains you're deployed on, and voluntary SARs keep the safe harbor. Proposed 1033.320(g), Section 9(d)(3).
5. Build a foreign coin diligence file now. For every foreign issuer's coin you list, document lawful-order capability and watch the Federal Register for Section 8 notices. Section 3(b)(2), Section 8, proposed 1523.3(c).
6. Set up a sub-certification chain. Who signs under the CEO and CFO, and who backs the annual AML and sanctions certification? Section 4(a)(3), Section 5(i).
7. Run the felony check on the AML officer. Before appointment and on an ongoing basis. Section 4(f), proposed 1033.210(b)(3)(iv).
8. Bank side: size the reserve deposits. Assume corporate coverage only, not pass-through, until the FDIC finalizes. FDIC proposal, April 10, 2026.
9. Check Travel Rule data fields. Make sure stablecoin transfers of $3,000 or more carry originator and beneficiary data. Proposed 1010.100(eee) amendment.
10. Re-paper any rewards program. The OCC won't presume pre-GENIUS rewards comply. Section 4(a)(11), final 12 CFR part 15.

What's still open

As of November 1, the FinCEN and OFAC program rule, the CIP rule, and the OCC and FDIC BSA standards are proposed, with no final versions published. Treasury's Section 3 rule is proposed, and comments closed October 19. The Federal Reserve's September 29 proposal, which includes the Section 4(a)(8) tying rule for all permitted issuers, takes comments until November 30. Treasury's interim final rule on state certification reviews took effect September 30, and also takes comments until November 30. The A7 proposal takes comments until November 4.

Two older ideas are gone. On October 6, FinCEN withdrew its 2020 proposal on unhosted wallet reporting and withdrew its 2023 Section 311 proposal on mixing. On mixing, it cited concerns that the definition "could have a chilling effect on legitimate activity," and said it will keep monitoring. The Section 9(d) guidance and rules, including risk management standards for financial institutions that deal with DeFi protocols, are due by July 18, 2028. Treasury delivered its Section 9(e) report in March 2026.

The short version: the freeze is the control the law was built around, and it now reaches the secondary market. The SAR duty doesn't, yet. If you're on the compliance side, the work between now and the final rule is proving you can freeze, burn, reissue and screen on demand, across every entity in the group.

Related on the site: The Binance hack: $2.7 billion frozen, $2.4 billion beyond any freeze. This essay is a plain-language reading of public documents, not legal advice.