The Stablecoin Rules Are All Still Proposals. The Statutory Date Arrives Anyway.
Treasury, FinCEN, NCUA, and the FDIC have each proposed rules implementing the GENIUS Act. As of late September 2026, none of them is final.
The GENIUS Act's effective date does not wait for them. The Act takes effect on the earlier of two triggers: 18 months after enactment, which is January 18, 2027, or 120 days after the primary federal payment stablecoin regulators issue final regulations.
That is roughly sixteen weeks from now, and the rules describing what compliance looks like are still open questions.
If a stablecoin product is anywhere in your plans, the useful work right now is structural. Who would hold the license, what obligations attach, and which entity in your org chart is actually allowed to issue.
What FinCEN proposed, and what it left out
FinCEN published its AML/CFT and sanctions proposal on April 10, 2026, at 91 FR 18582, docket FINCEN-2026-0100, RIN 1506-AB73. Comments closed June 9.
It implements the GENIUS Act's directive to treat permitted payment stablecoin issuers as financial institutions for Bank Secrecy Act purposes. A PPSI falls into one of three categories: a subsidiary of an insured depository institution, an uninsured national bank, or a state-qualified issuer.
The proposed obligations track what any BSA-covered institution would recognize. A written AML/CFT program with a risk assessment, a designated compliance officer, employee training, and independent testing. Customer due diligence including beneficial ownership collection and ongoing monitoring. Recordkeeping, with travel rule data on transmittal orders. A sanctions compliance program, with FinCEN pointing to the standards at 31 CFR 502.201(b).
One distinction matters operationally. FinCEN proposed suspicious activity reporting and currency transaction reporting for primary market activity. It did not propose secondary market SAR obligations. If your model assumes reporting duties follow the coin everywhere it travels, the proposal as written is narrower than that.
FinCEN also proposed a definition of "lawful order" covering orders from a federal agency or court to seize, freeze, burn, or prevent the transfer of a payment stablecoin. A PPSI would need the technological capability to comply. That is an engineering requirement sitting inside a compliance rule, and it typically needs to be designed in rather than added later.
A separate FinCEN proposal addressing customer identification program requirements for PPSIs followed in June.
Which category you land in also determines who supervises you. A subsidiary of an insured depository institution, an uninsured national bank, and a state-qualified issuer each answer to a different primary regulator, and each of those regulators has proposed its own standards on top of FinCEN's. The FDIC published proposals in April and June covering the institutions it supervises. Credit unions run through a separate path entirely.
The structural fact for credit unions
NCUA published a supplemental proposed rule on May 18, 2026, at 91 FR 28956, docket NCUA-2026-1024, RIN 3133-AG10. Comments closed July 17. It follows a licensing proposal NCUA published in February.
The proposal's central structural choice is easy to miss and hard to work around.
Under the NCUA proposal, a federally insured credit union could not issue a payment stablecoin directly. Issuance would run through a licensed subsidiary, and that subsidiary would apply jointly with its FICU parent. The covered subsidiaries include organizations providing routine credit union services, CUSOs, and subsidiaries of state-chartered credit unions. If your planning assumed the credit union itself would hold the license, the proposal says otherwise.
That changes the sequence of work. Before reserve policy, redemption mechanics, or custody arrangements, there is an entity question: does the subsidiary exist, and if it does, is it the right one to carry a licensed issuer's obligations.
Subpart E of the proposal addresses AML/CFT supervision and enforcement policy for NCUA-licensed PPSIs. So a credit union pursuing this would be looking at FinCEN's program requirements and NCUA's supervision framework together, neither of which is final.
What to do in the next sixteen weeks
Nothing described here is binding. Every rule above is a proposal, and the comment periods on the FinCEN AML/CFT and NCUA proposals have already closed, which means the next thing to appear may be a final rule rather than another draft.
Answer the entity question first. If you are a credit union, identify which subsidiary would hold a license, or whether one needs to be formed. A joint application with the parent implies documentation and governance on both sides. That is slow work and it does not depend on which version of the rule lands.
Treat the lawful order capability as an engineering requirement. Seize, freeze, burn, prevent transfer. Ask your platform or vendor whether those functions exist today and how they are controlled. A vendor risk assessment that does not cover this leaves a gap that a final rule would expose immediately.
Map primary and secondary market activity separately. FinCEN's proposed SAR and CTR obligations attach to primary market activity. Knowing which of your flows are which is a prerequisite to sizing the obligation, whatever the final rule says.
Watch the effective date trigger, rather than only the calendar. The Act takes effect on the earlier of January 18, 2027 or 120 days after the primary federal payment stablecoin regulators issue final regulations. Those are two different mechanisms, and which one controls depends on when final rules appear.
Read the proposals rather than the summaries. The three cited here carry full Federal Register citations. Coverage of this rulemaking cluster has generally described the obligations accurately while skipping the structural choices, including the one about who may issue.
Source note
This article is based on the FinCEN NPRM, Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions Compliance Program Requirements, 91 FR 18582, published April 10, 2026, docket FINCEN-2026-0100, RIN 1506-AB73; the NCUA supplemental proposed rule, Implementing the GENIUS Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the National Credit Union Administration, 91 FR 28956, published May 18, 2026, docket NCUA-2026-1024, RIN 3133-AG10; and the Treasury NPRM at 91 FR 53368, published August 18, 2026. Additional proposals from FinCEN on customer identification programs and from the FDIC were identified through Federal Register listings and are referenced generally rather than described in detail. All provisions described here come from proposed rules that have not been finalized.
Disclaimer
This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. This rulemaking cluster is open and unresolved, several comment periods have closed without final rules, and the provisions described here reflect proposals rather than binding requirements. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.