Table of Contents
The comment period on the joint rule that would impose bank-style customer identification requirements on stablecoin issuers closes today, August 21, 2026. Five federal agencies published the proposal in the Federal Register on June 22, opening a 60-day window that ends this evening.
The rule implements the GENIUS Act's directive that permits payment stablecoin issuers to be treated as financial institutions under the Bank Secrecy Act. If finalised, it would take effect twelve months after issuance.
One question dominates the filings. The proposal covers primary-market activity only, meaning the moment a customer mints or redeems directly with an issuer, and the agencies explicitly asked whether it should reach secondary-market transactions instead.
Federal Reserve Governor Michael Barr said the GENIUS Act framework does not do enough so far to address the risks of illicit finance conducted through secondary market transactions in payment stablecoins.
Key Takeaways
- Comments close today on the CIP proposed rule, filed jointly by FinCEN, OCC, the Federal Reserve, FDIC, and NCUA.
- The rule covers primary-market activity only, applying when customers mint or redeem directly with an issuer.
- Agencies asked whether to extend it to secondary markets, the question drawing the most industry attention.
- A Federal Reserve governor publicly flagged the gap, saying the framework does not yet address secondary-market illicit finance.
- Final rules would take effect twelve months after issuance, pushing compliance into 2027 at the earliest.
What the Rule Would Require
The proposal establishes minimum standards drawn directly from bank practice. Issuers would maintain a written, risk-based customer identification program tailored to their size and business, collect specified identifying information before opening an account, and verify identity within a reasonable time before or after opening.
Recordkeeping, screening, and notice obligations follow. Issuers would retain related records, screen customers against any government lists designated for CIP purposes, provide customer notice, and could place limited reliance on other federally regulated financial institutions for verification.
The statutory basis is narrow and specific. Section 4(a)(5)(A) of the GENIUS Act requires issuers to maintain an effective customer identification program, and this rulemaking translates that instruction into operational requirements.
The change is more consequential than it first appears. Stablecoin issuers have been subject to Bank Secrecy Act obligations since 2019 guidance naming them money services businesses, but money services businesses are exempt from the CIP mandate, so this proposal closes a gap that has existed for seven years, layering onto the compliance standards we covered in our FDIC compliance standards analysis.
The Primary-Market Boundary
The agencies drew the perimeter deliberately and explained why. Treating every stablecoin transfer as creating a customer relationship with the issuer would impose what they described as a near-impossible global obligation to identify and verify every holder worldwide.
Their technical reasoning was equally direct. A smart contract interaction does not yield the information needed to verify identity, so a CIP obligation triggered by any transfer would be unworkable in practice regardless of policy preference.
That leaves an enormous volume of activity outside the rule. Stablecoins circulate overwhelmingly on secondary markets, moving between wallets, exchanges, and protocols without touching the issuer, and none of that activity would trigger CIP obligations under the proposal as drafted.
The dissent from within the Federal Reserve is the most significant marker of that tension. Governor Barr's statement that the framework does not yet address secondary-market illicit finance came from a sitting governor rather than an outside critic, which gives the comment file a specific question to answer.
Why This Matters for Stablecoins
Recent enforcement has demonstrated exactly what falls through the gap. Blockchain analytics traced more than $6.3 billion through Shelbit, the Dubai-registered exchange sanctioned by the Treasury on August 7, with roughly 88% moving on Tron in dollar-pegged stablecoins.
None of that flow would have triggered a CIP obligation. The activity ran between wallets and exchanges on secondary markets, never touching an issuer's mint or redeem function, which is precisely the perimeter this rule establishes.
The counterargument from issuers is that enforcement worked anyway. Tether has frozen hundreds of millions in sanctioned addresses this year, and the freeze function operates regardless of whether the holder ever completed a CIP process with the issuer, a capability we tracked through this year's enforcement actions in our June 2026 stablecoin report.
The rule also sits within a larger compliance framework taking shape in parallel, including anti-money laundering and sanctions standards proposed separately for the same class of issuers earlier this year.
Where This Sits in the Rulemaking Calendar
The GENIUS Act framework remains substantially incomplete more than a year after enactment. Agencies missed the July 18 statutory deadline for final rules, a delay we tracked in our GENIUS Act rulemaking analysis, with full effect not expected until July 2028.
Today's deadline is one of several closings across the summer. The OCC's separate compliance standards proposal ran a 30-day window that closed July 24, and the FinCEN and OFAC anti-money laundering proposal closed June 9.
Bank trade associations have been active across all of them. The Bank Policy Institute and The Clearing House filed comments on the OCC proposal in July, recommending that regulators address existing gaps in the anti-money laundering and sanctions framework rather than layering requirements on issuers alone.
The twelve-month implementation runway matters for planning. Even if agencies finalise quickly, issuers would not face compliance obligations until well into 2027, which is a long horizon in a market this fast-moving.
Conclusion
The deadline itself is procedural, and the question sitting in the comment file is not. Whether stablecoin identity requirements stop at the issuer's door or extend into the markets where tokens actually circulate determines how much of the illicit finance problem this framework addresses.
The agencies have made a defensible technical argument for the narrow perimeter. Verifying every holder of a bearer instrument that moves through smart contracts is genuinely difficult, and the alternative risks a rule that cannot be complied with.
What today closes is the window for anyone to argue otherwise. The next public step is a final rule, and whether it moves the boundary will be the clearest signal yet of how far US regulators intend to push stablecoin identity requirements.
FAQ:
1. What is the CIP proposed rule for stablecoin issuers?
FinCEN, the OCC, the Federal Reserve, the FDIC, and the NCUA jointly proposed a rule requiring permitted payment stablecoin issuers to maintain a customer identification program, published in the Federal Register on June 22, 2026. It implements the GENIUS Act's directive that issuers be treated as financial institutions under the Bank Secrecy Act, and comments close August 21, 2026.
2. What would issuers have to do?
Issuers would maintain a written, risk-based customer identification program tailored to their size and business, collect specified identifying information before opening an account, verify customer identity within a reasonable time, retain records, screen against designated government lists, provide customer notice, and could rely to a limited extent on other federally regulated financial institutions.
3. Does the rule cover secondary market transactions?
No. As drafted it applies to primary-market activity only, meaning direct minting and redemption with the issuer. The agencies reasoned that treating every transfer as creating a customer relationship would impose a near-impossible global identification obligation, though they specifically requested comment on whether the requirements should extend to secondary markets.
4. Why does the secondary market question matter?
Most stablecoin activity happens on secondary markets, moving between wallets, exchanges, and protocols without touching the issuer. Federal Reserve Governor Michael Barr said the GENIUS Act framework does not do enough so far to address illicit finance risks in secondary-market transactions, and recent sanctions cases have traced billions in flows that would fall entirely outside the proposed perimeter.
5. When would the rule take effect?
The agencies have proposed that a final CIP rule take effect twelve months after issuance. Since the comment period is only closing now and no final rule has been published, compliance obligations would not begin until 2027 at the earliest, with the broader GENIUS Act framework not in full effect until July 2028.
Disclaimer:
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or tax advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation to buy or sell any financial instrument, and readers should conduct their own independent research or consult a qualified professional.
