Table of Contents
Five federal agencies published a joint proposed rule in the Federal Register on June 22, 2026 that treats permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act for the first time in US history, requiring them to maintain formal Customer Identification Programs covering identity verification, recordkeeping, and government list screening for every customer who purchases stablecoins directly from the issuer.
FinCEN, the OCC, the Federal Reserve, the FDIC, and the NCUA jointly issued the proposed rule under 31 CFR Part 1033 with docket number FINCEN-2026-0101, implementing the GENIUS Act's directive that permitted payment stablecoin issuers be treated as Bank Secrecy Act financial institutions subject to the same CIP obligations that banks, broker-dealers, and money services businesses have operated under for decades. Comments are due August 21, 2026, giving stablecoin issuers and financial institutions 60 days to respond before the agencies finalize the rule.
As covered in our GENIUS Act final rules analysis, the June 22 CIP proposed rule publication is separate from the July 18 final rules deadline for the six agencies' primary GENIUS Act rulemaking, meaning the CIP framework will follow a standard notice-and-comment timeline rather than the accelerated statutory deadline that governs the core GENIUS Act framework rules.
Key Takeaways
- Five federal agencies, FinCEN, OCC, Federal Reserve, FDIC, and NCUA, jointly published a proposed rule on June 22, 2026 requiring permitted payment stablecoin issuers to maintain Customer Identification Programs under the Bank Secrecy Act, with comments due August 21, 2026.
- The CIP rule applies exclusively to primary-market activity, meaning it governs the relationship between a stablecoin issuer and a customer who purchases stablecoins directly from the issuer, not secondary-market trading, transfers between existing holders, or retail purchases through exchanges.
- The proposed rule implements the GENIUS Act's mandate that permitted payment stablecoin issuers be treated as financial institutions under the Bank Secrecy Act, creating the same identity verification, recordkeeping, and government list screening obligations that traditional banks and money services businesses already operate under.
What the CIP Rule Requires
The Customer Identification Program requirement for permitted payment stablecoin issuers mirrors the CIP framework that has governed bank customer onboarding since the USA PATRIOT Act's implementation in 2003.
Under the proposed rule, every permitted payment stablecoin issuer must collect identifying information from each customer who purchases stablecoins directly from the issuer, verify that information within a reasonable timeframe, maintain records of the identification and verification process, and screen each customer against government-maintained lists of known or suspected terrorists and other prohibited parties.
The four core CIP elements as proposed apply specifically to primary-market purchasers. A customer who buys USDC from Circle directly, a business that mints SoFiUSD through SoFi's issuance infrastructure, or an institutional investor who redeems BUIDL shares directly from Securitize all represent primary-market activity that the proposed rule covers.
A consumer who buys USDC on Coinbase, transfers USDT between wallets, or receives stablecoin payroll through Gusto represents secondary-market and downstream activity that the proposed rule explicitly does not cover.
The primary-market scope limitation is commercially significant for the stablecoin infrastructure ecosystem.
As covered in our top stablecoin orchestration platforms guide, the vast majority of enterprise stablecoin payment flows involve secondary-market stablecoin usage where the enterprise receives USDC through an orchestration platform rather than minting directly from Circle.
The CIP rule's primary-market scope means that orchestration platforms, payment startups, and enterprise treasury teams using pre-minted stablecoins are not directly subject to the issuer-level CIP requirement, though their own AML and BSA obligations under existing financial institution frameworks remain unchanged.
The Five-Agency Structure and What It Signals
The joint issuance by FinCEN, OCC, Federal Reserve, FDIC, and NCUA is not administrative redundancy. Each agency's participation reflects a specific jurisdictional rationale that mirrors the multi-regulator structure of the GENIUS Act's permitted payment stablecoin framework itself.
FinCEN leads as the primary BSA administrator, establishing the anti-money laundering policy architecture that the CIP requirement sits within. The OCC participates because federally chartered stablecoin issuers including banks issuing stablecoins under national bank charters fall under its supervision.
The Federal Reserve participates because state member banks that issue stablecoins are Federal Reserve-supervised institutions. The FDIC participates because FDIC-insured state nonmember banks that issue stablecoins are FDIC-supervised institutions. The NCUA participates because federally insured credit unions that issue stablecoins fall under its supervision.
The five-agency structure reflects the GENIUS Act's design intent: that stablecoin issuers of different charter types will be supervised by different primary regulators, but all will be subject to identical BSA and CIP obligations regardless of which regulator oversees their stablecoin operations.
As covered in our stablecoin treasury report, State Street and Fidelity's reserve management fund launches this week reflect the same multi-regulator dynamic, with different fund structures falling under different regulatory oversight frameworks while all targeting the same GENIUS Act compliance standard.
What Stablecoin Issuers Must Do Before August 21
The 60-day comment period ending August 21, 2026 is the most commercially valuable compliance preparation window available to stablecoin issuers before the CIP rule is finalized. Issuers who submit detailed comments on the proposed rule's implementation challenges have the opportunity to shape the final rule's practical requirements in ways that reduce operational friction for their specific business models.
The most commercially significant open questions in the proposed rule for stablecoin issuers to address in comments include the definition of what constitutes a primary-market customer relationship for different issuance architectures, the timeframe within which identity verification must be completed relative to stablecoin minting, the recordkeeping format and retention period requirements for CIP records, and the government list screening frequency requirements for existing customers following the initial onboarding CIP.
As covered in our GENIUS Act loophole analysis, the CIP requirement is the compliance mechanism by which the GENIUS Act prevents stablecoin issuers from becoming anonymous conduits for illicit finance, and the implementation details the agencies finalize based on comment period responses will determine how operationally burdensome that mechanism is for issuers with different distribution architectures.
Conclusion
The joint CIP proposed rule published on June 22, 2026 is the most direct implementation of the GENIUS Act's Bank Secrecy Act integration mandate and the clearest regulatory signal that permitted payment stablecoin issuers will be subject to the same identity verification, recordkeeping, and sanctions screening obligations that have governed traditional financial institution customer onboarding for more than two decades.
The primary-market scope limitation is the most commercially important structural feature of the proposed rule, protecting secondary-market stablecoin usage from direct CIP obligations while placing the compliance burden on the issuer's direct customer relationship.
As covered in our top companies building with stablecoins guide, every permitted payment stablecoin issuer from Circle and Paxos to SoFi and Revolut US must now evaluate their primary-market customer onboarding infrastructure against the proposed CIP requirements and submit comments by August 21, 2026 to shape the final rule before it takes effect.
FAQ:
1. What is the joint CIP proposed rule published on June 22, 2026?
The joint CIP proposed rule is a proposed regulation from FinCEN, OCC, Federal Reserve, FDIC, and NCUA published in the Federal Register on June 22, 2026 requiring permitted payment stablecoin issuers to maintain Customer Identification Programs under the Bank Secrecy Act, covering identity verification, recordkeeping, and government list screening for customers who purchase stablecoins directly from the issuer, with comments due August 21, 2026.
2. What is the difference between primary-market and secondary-market stablecoin activity under the CIP rule?
The difference between primary-market and secondary-market activity under the CIP rule is that primary-market activity covers direct purchases of stablecoins from the issuer requiring CIP compliance, while secondary-market activity covers transfers between existing holders, retail purchases through exchanges, and downstream enterprise payment usage that the proposed rule explicitly does not subject to the issuer-level CIP requirement.
3. Why did five agencies jointly publish the CIP proposed rule rather than a single agency?
Five agencies jointly published the CIP proposed rule because the GENIUS Act's permitted payment stablecoin framework assigns different primary regulators to different issuer charter types, with FinCEN leading as BSA administrator, OCC overseeing federally chartered bank stablecoin issuers, the Federal Reserve overseeing state member bank issuers, the FDIC overseeing FDIC-insured state nonmember bank issuers, and the NCUA overseeing federally insured credit union issuers, making joint issuance necessary to apply identical CIP obligations across all permitted payment stablecoin issuer types simultaneously.
4. What is the difference between the CIP proposed rule and the GENIUS Act July 18 final rules deadline?
The difference between the CIP proposed rule and the July 18 final rules deadline is that the July 18 deadline is a statutory mandate requiring six agencies to finalize the core GENIUS Act framework rules covering capital, liquidity, reserves, and redemption standards, while the CIP proposed rule follows a standard notice-and-comment rulemaking process with a 60-day comment period ending August 21, 2026 before the agencies finalize it on a separate timeline not bound by the July 18 statutory deadline.
5. What must stablecoin issuers do before the August 21, 2026 comment deadline?
Before the August 21, 2026 comment deadline stablecoin issuers should evaluate their primary-market customer onboarding infrastructure against the proposed CIP requirements and submit detailed comments addressing open implementation questions including the definition of primary-market customer relationships for their specific issuance architectures, identity verification timeframes relative to stablecoin minting, recordkeeping format and retention requirements, and government list screening frequency for existing customers.
Disclaimer:
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or tax advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation to buy or sell any financial instrument, and readers should conduct their own independent research or consult a qualified professional.
