The GENIUS Act turns stablecoin compliance into an engineering problem

The GENIUS Act, signed into law in July 2025, created the first US federal framework for payment stablecoins. Regulators missed the July 2026 deadline for a full set of final rules, but proposals from the OCC, FDIC, Treasury, FinCEN and OFAC are out, and the law takes effect on the earlier of 18 January 2027 or 120 days after final rules are issued.

This is a summary for builders, not legal advice. The point is that most of what the law asks for is a system property, and systems are cheaper to design than to retrofit.

What the law asks for

For issuers of payment stablecoins, the framework and the proposals published so far include:

• reserves held one to one in cash and short-term treasuries, with no yield paid to holders;
• monthly public disclosure of reserves, examined by a registered public accounting firm;
• redemption at par on a short timeline, which drafts set at two business days;
• capital and liquidity requirements, with a proposed floor for new federal issuers;
• full Bank Secrecy Act obligations: an AML programme, sanctions compliance and record-keeping;
• the technical ability to comply with lawful orders to freeze, seize or burn tokens.

For businesses that move stablecoins, the burden is lighter but real: AML and sanctions duties where they act as financial institutions, and counterparties that will expect clean data.

The problem: stacks built for speed

Most stablecoin systems were built to move money fast. Freeze powers often sit with a single admin key. Screening happens in a separate tool someone checks by hand. Reserve reports are spreadsheets. Reconciliation between onchain transfers and the ledger is a monthly exercise. Each of those is a finding waiting to happen, and the admin key is a security risk too, as 2026's largest exploits showed.

The proposal: compliance by architecture

1. 01Separate the powers. Freeze, seize, burn, mint and upgrade are distinct roles held by distinct signer sets, with every use logged onchain against a case reference. Freezing can be fast; minting and upgrading go through timelocks.
2. 02Screen at every edge. Sanctions and risk screening runs automatically on every inbound and outbound address, at onboarding and at each transfer, with decisions recorded.
3. 03Carry the data with the payment. Travel-rule information travels with transfers above threshold, so a counterparty never has to ask.
4. 04Publish reserves on a schedule. Reserve composition published monthly and readable onchain through a proof-of-reserve feed, from the same data the auditor examines.
5. 05Reconcile daily. Every onchain mint, burn and transfer matched to the ledger every day, with breaks investigated before they age.
6. 06Rehearse the order. Test the freeze-and-seize path regularly, as you would a backup restore.

What to measure

• Reconciliation breaks. Daily count and age of unmatched onchain events against the ledger. Old breaks are the ones auditors find.
• Screening coverage. The share of inbound and outbound transfers screened automatically before settlement.
• Freeze response time. From a lawful order to an executed, logged freeze, measured in drills.
• Disclosure lag. Days between the reserve snapshot and its publication, onchain and in the report.

How we would start

Write down every action your system can take on a holder's funds, who can take it and what record it leaves. Then compare that list with the obligations above. Our stablecoin and payments work builds these controls in, and the same patterns apply to tokenized funds.