From guidance to a proposed program requirement: what stablecoin issuers should read in Treasury’s April 2026 proposal.
A joint FinCEN–OFAC proposal would make a sanctions compliance program a binding requirement for permitted payment stablecoin issuers, with penalties measured in days — and it is still a proposal.
Compliance · 12 Sep 2026
A sanctions policy and evidence that its controls work are different things. Treasury’s April 2026 stablecoin proposal would make that difference explicit for permitted payment stablecoin issuers: a defined sanctions compliance program, records that support it, and penalties measured in days for material program failures. What follows reads the proposal as issued. It is not a final rule, and nothing here says it is in force.
What happened
FinCEN and OFAC jointly proposed anti-money laundering, counter-terrorist-financing, and sanctions compliance requirements at 91 Fed. Reg. 18,582 (Apr. 10, 2026), Docket FINCEN-2026-0100, RIN 1506-AB73. The notice concerns implementation of the GENIUS Act and proposes a new 31 C.F.R. pt. 502 for OFAC’s program requirements, alongside FinCEN changes to parts 1010 and 1033.
A closed comment period is not a rule. Comments were due 9 June 2026. That date passing does not make proposed text binding, and it does not tell you whether the text will be adopted unchanged. The notice proposes a compliance date twelve months after a final rule issues — so confirm the current rulemaking status before using any of this to plan a launch or to describe an existing legal obligation.
The proposed definition of a permitted payment stablecoin issuer covers specified categories of U.S.-formed issuers, including approved depository-institution subsidiaries and federal or state qualified issuers. A European business should therefore start by identifying which entity and which regulatory category are actually in scope. Accepting a stablecoin as payment is not, by itself, the same activity as issuing one within the proposed definition.
Five components the proposal would require
Proposed § 502.201 describes an effective program as risk-based and reasonably designed to ensure compliance with applicable U.S. sanctions. Its minimum components would be:
Senior management commitment. Review and approval, adequate resources, operational integration, routine risk reporting, and real authority for the compliance function.
Risk assessments. Periodic assessment of the issuer’s activities and risk profile, updated for identified deficiencies, new products, mergers, acquisitions, and other relevant changes.
Internal controls. Written policies and technical capabilities covering payment stablecoin-related activity in both primary and secondary markets.
Testing and auditing. Independent, adequately resourced review, with records of findings and resulting enhancements available to OFAC on request.
Training. Risk-based instruction at least annually, tailored to roles and updated for relevant findings.
The wording of the internal-control trigger is worth reading closely. Proposed § 502.201(b)(3) reaches activity that is or may be prohibited, and calls for blocking or rejecting, as applicable, activity that violates or would violate sanctions. Those distinctions belong in a control specification. They are not interchangeable instructions to block and reject every alert.
The proposed scope runs from issuance until removal from circulation. The operational question is how an issuer would identify and respond to relevant activity across that whole lifecycle, secondary market included. A program that stops at the issuer’s own onboarding screen would have to be measured against that wider scope.
Certifications and daily penalties
Proposed § 502.102(b) would require an issuer to give OFAC, on request, the certifications it submitted to its primary federal or state payment stablecoin regulator concerning implementation of a sanctions compliance program under 12 U.S.C. § 5904(i)(1). Read that narrowly: the obligation in this paragraph is to hand over existing certifications on request. It is not the separate statutory certification requirement the notice describes elsewhere.
For the company, that is an evidence-management problem before it is anything else — which certification was submitted, what program it described, and what testing and records stood behind it.
The penalty provision is the sharper, better-supported point. Proposed § 502.401(a) would permit up to $100,000 for each day a material violation of the effective-program requirement continues. Subsection (b) would permit a further daily penalty of up to $100,000 for a knowing violation, with knowingly defined to include actual knowledge or circumstances a person should have known. These are proposed issuer program penalties — not an automatic $200,000 a day for every weakness.
What this means for you
Treat the proposal as a structured readiness exercise while you separately confirm current law. Map each proposed component to a responsible owner, the systems involved, and evidence that the control actually operates. A secondary-market control, for instance, needs a defined trigger, an action matched to the applicable restriction, an escalation route, and retained test results.
Keep the legal mechanisms separate. The notice’s discussion of lawful orders under the GENIUS Act includes capabilities to seize, freeze, burn, or prevent transfer. That statutory discussion is not a substitute for the proposed sanctions-control language about blocking or rejecting as applicable — and a FinCEN supervisory policy should not be assumed to supply equivalent OFAC relief.
If you accept stablecoins rather than issue them, the practical question is a diligence one: the issuer’s controls and its regulatory status. The proposal alone does not create a compliance-program duty for every merchant or holder.
A useful preparation file connects the proposed requirements to policies, technical behavior, testing, and certifications — and keeps readiness work distinguishable from a conclusion that an issuer satisfies current law. Contact Zimmermann Law to talk through company-side U.S. sanctions questions.
Sources: FinCEN and OFAC, Notice of Proposed Rulemaking, Anti-Money Laundering/Countering the Financing of Terrorism and Sanctions Compliance Requirements for Permitted Payment Stablecoin Issuers, 91 Fed. Reg. 18,582 (Apr. 10, 2026) (Docket No. FINCEN-2026-0100; RIN 1506-AB73), esp. proposed §§ 502.102, 502.201, 502.301, 502.303–304, and 502.401 at 18,659–18,661. GENIUS Act, Pub. L. No. 119-27 (2025), as described by the notice rather than separately reviewed. Subsequent rulemaking status not conclusively verified; this reads the April proposal only and is not a statement that it is currently binding.
This post is for general information and is not legal advice.
Attorney Advertising. Zimmermann Law PLLC · New York · +1 (917) 426-4625 · contact@zimmermann-law.com