Ten days from now, on July 18, 2026, six US federal agencies hit the GENIUS Act’s statutory deadline to finalise the rules that convert payment stablecoin issuers into Bank Secrecy Act financial institutions — completing a global regulatory realignment that MiCA’s July 1 transition cliff began and that leaves the US, EU, UK and Singapore running four structurally different stablecoin regimes.

The Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act requires the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), the Treasury, the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) to issue implementing rules by July 18, 2026. The centrepiece is the FinCEN–OFAC joint proposal published in the Federal Register on April 10, 2026, which for the first time writes mandatory sanctions-compliance programmes into US federal law for any class of financial institution. This analysis maps what the permitted payment stablecoin issuer (PPSI) regime requires, where the proposal deliberately pulled back, and how the four major jurisdictions now divide the market.

Key Facts:

• July 18, 2026 is the GENIUS Act’s statutory deadline for six agencies — OCC, FDIC, NCUA, Treasury, FinCEN, OFAC — to issue implementing rules — Federal Register / Holland & Knight
• The FinCEN–OFAC joint NPRM published April 10, 2026; comments closed June 9, 2026 — Federal Register docket FINCEN-2026-0100
• PPSIs become Bank Secrecy Act “financial institutions” with a $5,000 suspicious-activity-report threshold — matching banks, not the $2,000 money-services-business line — FinCEN NPRM
• State-qualified issuers are capped at $10 billion of outstanding issuance before mandatory transition to federal supervision — GENIUS Act / Holland & Knight
• Issuers must maintain technical capability to block, freeze and reject transactions in BOTH primary and secondary markets — FinCEN NPRM
• The EU’s parallel regime closed its own door on July 1, 2026, when MiCA grandfathering ended and unlicensed CASPs lost EEA market access — ESMA / iGaming coverage of the transition
• Mandatory sanctions-compliance programmes appear in US law for the first time, built on OFAC’s five 2019 framework elements — Greenberg Traurig

What the PPSI regime actually requires

The proposed rule obliges every permitted payment stablecoin issuer to run a written, board-approved, risk-based anti-money-laundering and countering-the-financing-of-terrorism programme with internal controls, mandatory risk assessments, independent testing, employee training and — notably — a compliance officer who must be US-based and free of convictions for insider trading, cybercrime or financial fraud. Suspicious-activity reporting applies to primary-market transactions at a $5,000 threshold, and Travel Rule recordkeeping follows the banking standard. Layered on top is the sanctions programme: senior-management commitment, risk assessment, internal controls, testing and training — the five elements of OFAC’s 2019 Compliance Framework, transplanted from guidance into binding law for the first time.

The most technically consequential provision is the block-freeze-reject mandate. Issuers must hold “technical capabilities, policies, and procedures to block, freeze, and reject specific or impermissible transactions” — and unlike the SAR obligation, this reaches both primary and secondary markets, an acknowledgment that a stablecoin issuer, uniquely among financial institutions, retains smart-contract control over its liabilities after they leave its hands.

Where FinCEN deliberately pulled back

Is a stablecoin issuer now regulated like a bank? For AML purposes, largely yes — but the NPRM’s most important design choice is what it excluded. FinCEN explicitly declined to require suspicious-activity reporting on secondary-market activity, writing that “a blanket obligation to report suspicious activity on secondary market transactions could lead to PPSIs being overly cautious and filing a substantial number of defensive SARs to avoid criticism from examiners about underreporting.” The result is a two-layer architecture: monitoring and reporting obligations concentrate at the mint-and-redeem boundary where the issuer faces its direct customer, while the sanctions-control obligation follows the token everywhere. For compliance teams, that split is the whole implementation problem — the systems that file SARs watch a narrow pipe, while the systems that freeze tokens must watch the entire chain. Holland & Knight’s open-questions list — what triggers a risk-assessment update, how attempted-but-blocked transactions get reported, what satisfies “technical capability” — is where the final rule’s text will matter most.

“This proposal will protect the U.S. financial system from national security threats without hindering American companies’ ability to forge ahead in the payment stablecoin ecosystem.”

— Scott Bessent, Secretary of the Treasury
(US Treasury press release)

The federal-state fork and the $10 billion cliff

GENIUS builds a two-track licensing structure. Federal-qualified issuers — subsidiaries of insured depositories or standalone issuers supervised by the OCC, Federal Reserve, FDIC or NCUA — face no size ceiling. State-qualified issuers may operate under state regimes only while outstanding issuance stays at or below $10 billion; above it, they must transition to federal supervision or obtain a waiver, with the Internal Revenue Service — an unusual choice — examining the state-tier issuers for BSA purposes. Both tracks carry the 1:1 high-quality-liquid-asset reserve requirement. The practical effect resembles the EU’s own tiering: growth converts a light-touch licence into a heavy one automatically, which shapes issuer corporate strategy long before the threshold is hit — the same dynamic our analysis of the CFTC’s split with state gaming regulators traced in the event-contract market, where federal-state boundary lines decide business models. Circle and Tether-scale balance sheets are federal from day one; the state track is a nursery, not a destination.

How four jurisdictions now divide the stablecoin market

The US rulemaking lands in a market the EU has already segmented. MiCA’s e-money-token (EMT) regime has been fully operational through 2025–26, and the July 1, 2026 end of CASP grandfathering — analysed in our report on the MiCA transition deadline — means every euro-denominated stablecoin distribution channel now runs through authorised firms, a shift whose first commercial consequences we covered in Ripple’s full CASP licence. The UK sits a full cycle behind: the Financial Conduct Authority’s (FCA) final cryptoasset rules choreograph an October 2027 authorisation gateway, with stablecoin-specific rules in its sandbox pipeline — see our FCA gateway analysis. Singapore’s Monetary Authority of Singapore (MAS) finalised its single-currency stablecoin framework earliest of the four, but scoped it narrowly to SGD and G10-pegged tokens issued in Singapore.

Jurisdiction / Regulator	Effective date	Scope	Key requirement	Penalty / sanction
US — FinCEN/OFAC + banking agencies	Final rules due July 18, 2026	Permitted payment stablecoin issuers (federal + state ≤$10bn tracks)	BSA financial-institution status; AML programme; $5,000 SAR threshold; block/freeze/reject capability; mandated sanctions programme	BSA civil/criminal penalties; OFAC strict-liability enforcement
EU — ESMA / national regulators (MiCA)	EMT regime live; grandfathering ended July 1, 2026	E-money tokens and asset-referenced tokens across 30 EEA states	EMI/CASP authorisation; 1:1 reserves with 30–60% in bank deposits; usage caps on non-euro EMTs	Withdrawal of authorisation; fines up to 12.5% of turnover (ART tier)
UK — FCA / Bank of England	Authorisation gateway October 2027	Fiat-backed stablecoins used in UK payments	FCA authorisation; backing-asset and redemption rules in consultation; systemic issuers to BoE	Unauthorised business is a criminal offence under FSMA
Singapore — MAS	Framework final since 2023–24 cycle	Single-currency stablecoins (SGD/G10) issued in Singapore	Full reserve backing, 5-day redemption, MAS-labelled “regulated stablecoin” status	Loss of label; MAS enforcement under PS Act

Sources: Federal Register (April 10, 2026 NPRM); ESMA MiCA materials; FCA policy statements; MAS stablecoin framework. Compiled July 8, 2026.

What this means for issuers, banks and payment firms

For issuers, the July 18 rules end the era of AML-by-analogy. Money-transmitter registrations and state MSB programmes do not translate: the PPSI regime imports bank-grade expectations — board-approved programmes, independent testing, a US-resident compliance officer — and adds the sanctions layer no US financial institution has previously been statutorily required to run. Mid-tier issuers face the hardest maths; compliance-cost analyses circulating ahead of the deadline argue the fixed cost of a full BSA-plus-OFAC stack is existential for issuers without scale, pointing toward consolidation around a handful of federal-track balance sheets. For banks and credit unions, the subsidiary pathway converts stablecoin issuance from a reputational question into a supervised product line — the same normalisation dynamic that pulled custody in-house after the OCC’s earlier interpretive letters. For payment firms and exchanges, the block-freeze-reject mandate is the operational headline: any venue integrating a PPSI token inherits a counterparty whose contracts can be frozen by legal order, and treasury desks will need to price that admin-control risk into how they hold working balances. Foreign issuers face the sharpest edge — offshore tokens without a US-supervised issuer lose access to the “permitted” label that the Act ties to US distribution.

“While its adoption remains uncertain, if enacted, it could establish a layered digital cash ecosystem based on risk and regulatory profiles.”

— Warren Kornfeld, Senior Vice President, Moody’s Ratings
(Decrypt)

The forward view: three markers between now and October

What happens on July 18 matters less than how it happens. First marker: whether the six agencies land complete final rules on the statutory date or split the package — a partial finalisation with the FinCEN–OFAC AML rule held for a second round would leave issuers formally licensed but operationally unguided into 2027. Second: the secondary-market question. Comment letters pressed FinCEN from both directions — banks arguing the SAR carve-out under-polices the chain, issuers arguing the block-freeze-reject mandate over-polices it — and any movement in the final text redraws compliance budgets immediately. Third: the cross-border collision. A dollar stablecoin that is a “permitted” PPSI in the US, an authorised EMT under MiCA, and unregulated in the UK until October 2027 will run three rulebooks on one token; FATF’s next plenary review of stablecoin implementation will pressure the gaps. The likeliest medium-term equilibrium is the one Moody’s sketches — a layered market where regulatory profile, not technology, sets each token’s addressable geography.

FAQ

What is the GENIUS Act’s July 18, 2026 deadline?

It is the statutory date by which the OCC, FDIC, NCUA, Treasury, FinCEN and OFAC must issue rules implementing the GENIUS Act’s stablecoin regime, including the FinCEN–OFAC anti-money-laundering and sanctions-compliance framework proposed on April 10, 2026.

What is a permitted payment stablecoin issuer (PPSI)?

A PPSI is an issuer authorised under the GENIUS Act — either federally supervised (OCC, Fed, FDIC, NCUA) with no size limit, or state-qualified with outstanding issuance capped at $10 billion — treated as a financial institution under the Bank Secrecy Act.

Do stablecoin issuers have to file suspicious activity reports?

Yes, for primary-market transactions at a $5,000 threshold. FinCEN deliberately declined to require SARs on secondary-market activity, warning that a blanket obligation would generate defensive over-filing — though sanctions controls still apply chain-wide.

What is the block-freeze-reject requirement?

Issuers must maintain technical capability, policies and procedures to block, freeze and reject impermissible transactions in both primary and secondary markets — reflecting issuers’ smart-contract control over tokens after issuance. It is the proposal’s most operationally demanding provision.

How does the US regime compare with MiCA?

MiCA regulates stablecoins as e-money tokens with authorisation, reserve and usage-cap rules across 30 EEA states, and closed its transition window on July 1, 2026. The US regime layers bank-grade AML and first-ever statutory sanctions programmes onto a two-track licensing structure finalising July 18.

What happens to issuers above $10 billion on the state track?

They must transition to federal supervision or obtain a waiver. The threshold effectively makes the state pathway a starting tier: any nationally scaled issuer ends up under a federal banking agency.

This article is informational analysis only and is not legal, financial, investment, or trading advice. Regulatory frameworks change frequently and interpretations vary by jurisdiction. Consult qualified legal counsel before making compliance decisions.