Table of Contents
Stablecoin attestations now follow a defined framework called the AICPA Criteria for Stablecoin Reporting, published in two parts. Part I, from March 2025, standardises how reserves are reported. Part II, added on 12 January 2026, introduced fifteen operational control criteria covering how the issuer actually runs.
This matters because, for most of the industry's history, the word attestation carried no fixed meaning. Two issuers could both publish one while having their accountants examine entirely different things. This guide explains what each part requires, how the framework connects to the GENIUS Act, and the important detail that it is not yet law.
Part I answers whether the reserves were there on a stated date. Part II asks whether the systems that manage those reserves function at all. Only the second question can be answered about the days nobody is looking.
Key Takeaways
- The framework has two parts. Reserve reporting from 2025, operational controls from 2026.
- Part II added fifteen controls. Labelled SC1 through SC15, published 12 January 2026.
- It is designed for GENIUS Act use. The criteria meet the suitable criteria definition.
- It is a professional standard, not law. The AICPA is urging the OCC to adopt it.
- Scope determines meaning. An attestation is only as informative as the criteria behind it.
The Problem the Framework Solves
Before a common standard existed, an attestation was a document without a fixed scope.
An issuer could commission an accounting firm to confirm a narrow assertion and publish the resulting report alongside language implying broad verification. Two issuers could each publish an attestation while having had very different things examined, and a reader comparing them had no way to tell.
The AICPA's Assurance Services Executive Committee developed the criteria to remove that ambiguity, establishing a common framework so that issuers report the same things in the same way and readers can compare across issuers.
Part I: What Gets Reported
The first part, published in March 2025, covers presentation and disclosure of reserves at a point in time, and it specifies three items.
| Criterion | What it covers |
|---|---|
| Redeemable tokens outstanding | Tokens in circulation eligible for redemption at a point in time |
| Redemption assets available | Assets the issuer holds to meet redemption demands |
| Comparison between tokens and reserves | Reconciliation of the two, including timing and classification differences |
The third item carries more weight than it appears to. A reconciliation that surfaces timing and classification differences is where a mismatch between what was issued and what is held would become visible, rather than being smoothed into a single headline figure.
Part I also covers disclosures on token population, reserve composition, redemption terms, custody arrangements, and risks affecting redeemability, which is the layer our guide to how stablecoins are backed examines from the reader's side.
Part II: The Fifteen Controls
The January 2026 addition is the more significant change because it shifts the question from what was true on one date to whether the operation works continuously.
Formally titled the Criteria for Controls Supporting Token Operations, it establishes fifteen control criteria labelled SC1 through SC15. They span four areas: token lifecycle management, reserve asset management, vendor oversight, and information technology, including cryptographic key management.
The AICPA described the addition as capturing the ongoing risks inherent in stablecoin operations, establishing a framework for issuers to identify those risks and providing control objectives against which they can be measured. The practical scope reaches into minting and burning, key management, custody arrangements, and incident response.
The distinction from Part I is the one that matters. Reserve reporting confirms a balance on a chosen day. Controls testing asks whether the process that produced that balance operates reliably on every other day, which is the difference our guide to what a stablecoin audit verifies explores in the audit context.
How the Engagements Work
The criteria are not self-executing. They define what a CPA examines when an issuer commissions an engagement.
Attestations are performed under the AICPA's Statements on Standards for Attestation Engagements, typically as an examination engagement, and the criteria are specifically designed for use by an independent CPA working at a reasonable assurance level.
One structural detail is worth knowing. The CPA does not write the assertion being tested; the issuer publishes a management statement, and the accountant performs procedures to evaluate whether that statement is fairly stated against the criteria. The issuer chooses what to assert, and the framework constrains how that assertion must be structured.
The Connection to the GENIUS Act
The framework was built with federal regulation in view rather than as an abstract standard.
The criteria meet the definition of suitable criteria for the examination engagements required under the GENIUS Act, which was enacted in July 2025 and takes effect no later than 18 January 2027 or 120 days after regulators issue final implementing rules.
That alignment is why the framework is becoming the industry baseline in advance of any requirement to use it. An issuer preparing for GENIUS Act compliance has a strong reason to adopt criteria already designed to satisfy it, a dynamic our guide to how stablecoins are regulated sets out.
What It Is Not
One clarification prevents overreading, and it is routinely omitted from coverage.
This is a professional standard produced by the accounting profession, not a regulation. On 5 May 2026, the AICPA submitted a comment letter to the Office of the Comptroller of the Currency urging regulators to leverage the criteria in the GENIUS Act rulemaking, in response to the OCC's advance notice of proposed rulemaking.
The framework is therefore the de facto standard, while the de jure position remains open. Whether regulators adopt it, adapt it, or write something different is a decision that has not been made, and until it is, using the criteria remains a choice rather than an obligation.
How to Read an Attestation Against This
Three questions extract most of what a reader needs from any attestation document.
Which criteria were applied? A report referencing Part I covers reserve reporting only. A report also referencing the control criteria covers operations, which is a materially wider scope.
What type of engagement was it? An examination provides an opinion on whether the assertion conforms to the criteria. An agreed-upon procedures report only lists procedures and findings and does not carry the same assurance.
What date does it cover, and how stale is it? A point-in-time examination evaluates an assertion at a stated date rather than continuously, so the interval between that date and publication is a gap in what has been verified.
Conclusion
What standards do stablecoin attestations follow? The AICPA Criteria for Stablecoin Reporting, with Part I from March 2025 covering reserve presentation and Part II from January 2026 adding fifteen operational control criteria across token lifecycle, reserve management, vendor oversight, and key management.
The addition of Part II is a meaningful change because it moves verification from a single-date balance toward the systems that produce it. Reserve reporting alone can only describe a moment, and controls testing is what speaks to the periods between reports.
The framework is not yet law, and the AICPA is actively urging the OCC to adopt it in GENIUS Act rulemaking. Until that is resolved, the practical skill is knowing which criteria a given attestation actually applies, because two documents carrying the same word can cover very different ground.
Read Next:
- How Are Stablecoins Backed? Reserves, Attestations & Audits
- What Does a Stablecoin Audit Actually Verify?
- Stablecoin Issuer Transparency Index 2026
FAQs:
1. What are the AICPA stablecoin criteria?
They are a framework titled the 2025 Criteria for Stablecoin Reporting: Specific to Asset-Backed Fiat-Pegged Tokens, published in two parts. Part I, from March 2025, standardises reserve presentation and disclosure, while Part II, added on 12 January 2026, establishes fifteen control criteria covering operations.
2. What are the SC1 to SC15 controls?
They are the fifteen control criteria introduced in Part II, spanning token lifecycle management, reserve asset management, vendor oversight, and information technology, including cryptographic key management. Their purpose is to establish control objectives against which an issuer's ongoing operations can be examined, rather than only its reserve balance at a point in time.
3. Are the AICPA criteria legally required?
No. They are a professional standard developed by the accounting profession rather than a regulation. The AICPA submitted a comment letter to the OCC on 5 May 2026 urging regulators to leverage the criteria in the GENIUS Act rulemaking, but no requirement to use them currently exists.
4. How do the criteria relate to the GENIUS Act?
They are designed to meet the definition of suitable criteria for the examination engagements the GENIUS Act requires and are intended for use by an independent CPA at a reasonable assurance level. The Act was enacted in July 2025 and takes effect no later than 18 January 2027 or 120 days after regulators issue final implementing rules.
5. How can I tell what an attestation actually covered?
Check which criteria were applied, since a report referencing only Part I covers reserve reporting, while one also referencing the controls criteria covers operations. Also check the engagement type, since an examination provides an opinion while an agreed-upon procedures report only lists procedures and findings without the same level of assurance.
Disclaimer:
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or tax advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation to buy or sell any financial instrument, and readers should conduct their own independent research or consult a qualified professional.
