GENIUS Act: who enforces what in U.S. stablecoin regulation?

The GENIUS Act was signed on July 18, 2025. One year later, the question is no longer whether payment stablecoins will be regulated in the United States, but who regulates them and how. The law does not create a single authority. It divides supervision across several federal agencies and state regulators, depending on the issuer’s legal form, and turns every permitted issuer into a financial institution subject to sanctions law.

This guide is the operational companion to Stablecoins and the GENIUS Act. That guide explains how a stablecoin holds its peg and what a reserve must contain. This one maps the regulators, licensing routes and compliance obligations.

One law, many regulators

The natural assumption is that the GENIUS Act creates a single stablecoin regulator. It does not.

Implementation is shared by the OCC, the Federal Reserve Board, the FDIC, the NCUA, the Treasury and state regulators. The key concept is the primary federal payment stablecoin regulator, assigned according to the issuer’s legal structure.

The OCC has the broadest perimeter. It supervises federally qualified non-bank issuers, national bank subsidiaries, uninsured national banks and trusts, federal branches of foreign banks, and registered foreign issuers. The other banking agencies generally supervise issuing subsidiaries of institutions they already regulate.

The map of supervision

Issuer type	Main supervisor
Federally qualified non-bank payment stablecoin issuer	OCC
National bank or uninsured national trust subsidiary	OCC
State member bank subsidiary	Federal Reserve
State non-member bank or savings association subsidiary	FDIC
Credit union service organisation	NCUA
State-qualified issuer at or below $10 billion	State regulator
Foreign payment stablecoin issuer	OCC registration

On top of that prudential map, two Treasury arms apply across the whole sector: FinCEN for anti-money laundering and countering terrorist financing, and OFAC for sanctions.

Three entry points to issue

To issue a payment stablecoin legally in the United States, an entity must be a permitted payment stablecoin issuer.

There are three main routes. The first is an insured depository institution subsidiary, supervised by the primary federal regulator of the parent institution. The second is a federally qualified non-bank issuer supervised by the OCC. The third is a state-qualified issuer supervised at state level, subject to federal constraints and size thresholds. Foreign issuers need registration to offer tokens into the U.S. market.

The route matters. It decides who grants the licence, who examines the issuer, and which rulebook applies.

Federal versus state supervision

The state route is real but capped. A state-qualified issuer can remain under a state regime while its stablecoin issuance stays at or below $10 billion. Above that threshold, the issuer must move into federal supervision unless the OCC grants an exception.

There is another condition: the state regime must be found “substantially similar” to the federal framework. A Stablecoin Certification Review Committee must determine unanimously that the state framework meets or exceeds federal standards. Without that certification, the state path becomes much narrower.

This is designed to prevent state supervision from becoming a regulatory escape hatch.

Deposit insurance does not pass through to the token holder

A subtle but important FDIC point breaks a common intuition. Dollars deposited at a bank as stablecoin reserves are not automatically insured for the final token holder. Deposit insurance protects the issuer’s bank deposit as a corporate account; it does not transform a stablecoin into an insured bank deposit for the end user.

Holding a stablecoin backed by bank deposits is therefore not the same as holding an insured deposit.

Stablecoin issuers become financial institutions

This is the most consequential shift. The GENIUS Act requires permitted issuers to be treated as financial institutions under the Bank Secrecy Act. FinCEN and OFAC proposals translate that into two obligations.

First, issuers need a bank-like AML/CFT programme. Second, they need an effective sanctions compliance programme. That is a major change for an instrument that often presented itself as technical infrastructure rather than regulated finance.

Issuers must be able to freeze, seize or burn tokens under a lawful order. The law defines that order as a final action by a competent court or federal agency identifying the token or account with reasonable specificity. A stablecoin is therefore not simply code; it is a state-reachable payment instrument.

That is exactly where this guide meets the OFAC and SDN List guide.

Neither security nor commodity

The law classifies a compliant payment stablecoin as neither a security nor a commodity. That moves authorisation away from the SEC and CFTC and into the banking-regulator architecture.

The trade-off is clear. Issuers get legal clarity and access to a dedicated regime. In return, they cannot pay interest or yield to holders simply for holding the token, and they become subject to banking-style supervision, AML and sanctions.

The implementation calendar

Most rules must be issued within one year of enactment, meaning by July 18, 2026. The law becomes fully effective no later than January 18, 2027, or earlier, 120 days after final rules are published by the primary federal regulators.

By mid-2026, the main agencies had published proposed rules and comment periods had largely closed. But timing remains uncertain. A later customer-identification proposal published on June 22, 2026 may not be finalised before 2027, and the statute does not contain an automatic fallback if an agency misses its rulemaking deadline.

The calendar should therefore be read as a likely path, not an ironclad promise.

How to read the architecture in practice

Use five checks. First, identify the issuer’s legal form. Second, map it to the right supervisor. Third, determine whether the relevant rule is proposed or final. Fourth, check when the effective date is triggered. Fifth, remember that AML and sanctions obligations apply to everyone, regardless of the prudential supervisor.

Methodology

This guide maps the regulatory architecture from the GENIUS Act and known federal implementation proposals as of July 1, 2026. It is not legal or investment advice. Proposed rules can change before finalisation, and implementation dates may shift. Thresholds and responsibilities are drawn from the statute and published Federal Register proposals.

---

Main sources: GENIUS Act (S.1582, 119th Congress); Federal Register proposed rules from the OCC, FDIC, FinCEN and OFAC; U.S. Treasury releases; OCC issuer reporting bulletins; Chapman and Cutler GENIUS Act rulemaking tracker; Sullivan & Cromwell, Mayer Brown, Morgan Lewis and Troutman Pepper Locke analyses of implementation proposals.