The United States now has a federal law for payment stablecoins, and from its expected effective date of 18 January 2027 issuing one in the US without a licence is a crime. The Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act, Public Law 119-27, S. 1582) was enacted on 18 July 2025. It sets who may issue, what reserves must back each coin, how often reserves are published and certified, and it treats issuers as financial institutions under the Bank Secrecy Act with a duty to be able to freeze, seize and burn coins on lawful order. This guide covers scope, obligations, the dated timeline and current rulemaking, penalties, what the freeze and minting powers mean for the keys and machine identities that control a token contract, and the steps to comply. It is written for compliance, risk and security leaders at issuers, banks, exchanges, wallet providers and payment firms. For EU rules see the MiCA and DORA for Crypto-Asset Service Providers Guide; for technical stablecoin risk see the Stablecoin Security and Risk Guide.
Key takeaways
- Licence or nothing: only a permitted payment stablecoin issuer (a subsidiary of an insured depository institution, a federal qualified issuer or a state qualified issuer) may issue a payment stablecoin in the US, with criminal penalties up to USD 1,000,000 and 5 years for knowing violations.
- One-to-one, short-dated reserves: reserves must back coins at least 1:1 in cash, deposits, Treasuries with 93 days or less to maturity, overnight repos and government money market funds, published monthly and examined by a registered public accounting firm.
- Issuers are BSA financial institutions: they need an AML programme, customer identification, suspicious activity reporting, sanctions compliance and the technical capability to block, freeze and reject transactions.
- Freeze power is a key management problem: the duty to seize, freeze, burn or prevent transfer on lawful order means privileged contract roles and signing keys become regulated controls.
- Two dates matter: the Act is expected to take effect on 18 January 2027, and from 18 July 2028 digital asset service providers generally may not offer or sell payment stablecoins to US persons unless a permitted issuer issued them.
Scope: who and what is covered
Section 2(22) defines a payment stablecoin as a digital asset used or designed to be used as a means of payment or settlement, which the issuer is obliged to redeem for a fixed amount of monetary value and represents will hold a stable value. National currency, deposits and securities are excluded. The Act regulates three groups.
| Who | How the Act applies | Key sections |
|---|---|---|
| Permitted payment stablecoin issuers | Licensing, reserves, disclosure, BSA, activity limits, lawful orders | 2(23), 4 |
| Subsidiaries of insured depository institutions | Approved and supervised by the bank's federal regulator | 2(23)(A), 4 |
| Federal qualified issuers (nonbank) | Federal licence and supervision | 2(23)(B), 4 |
| State qualified issuers | May opt into a substantially similar state regime while consolidated issuance stays at or below USD 10 billion; above that, transition to federal oversight within 360 days or stop new issuance | 4(c), 4(d) |
| Digital asset service providers (exchanges, brokers, custodians) | From 3 years after enactment may not offer or sell non-permitted payment stablecoins to US persons; may not offer foreign coins whose issuer cannot comply with lawful orders | 3(b), 8 |
| Foreign issuers | Must have the technological capability to comply with lawful orders and any reciprocal arrangement; noncompliance leads to a published determination and a secondary trading ban | 3(b)(2), 8 |
| Non-financial public companies | May not issue without a unanimous finding of the Stablecoin Certification Review Committee | 4(a)(12) |
Exemptions: section 3(h) leaves direct peer-to-peer transfers, transfers between a person's own accounts and self-custody wallets outside the offer and sale prohibition. That matters for wallet providers and self-custody users; see the Hardware Wallet Guide.
Key obligations
Reserves, redemption and disclosure
| Requirement | What the Act says | Section |
|---|---|---|
| Reserve ratio | Identifiable reserves at least 1:1 with outstanding coins | 4(a)(1)(A) |
| Eligible assets | US coins and currency or Federal Reserve balances; demand deposits or insured shares; Treasury bills, notes or bonds with remaining maturity of 93 days or less; overnight repos and qualifying reverse repos; registered government money market funds holding these assets; other similarly liquid federal assets approved by the regulator; tokenised forms of these | 4(a)(1)(A) |
| No reuse | Reserves may not be pledged, rehypothecated or reused, with narrow exceptions for margin, custody and short-term repo liquidity | 4(a)(2) |
| Redemption policy | Public policy with clear timely redemption procedures; fees in plain language with at least 7 days notice of changes | 4(a)(1)(B) |
| Monthly disclosure | Total coins outstanding and the amount and composition of reserves, including average tenor and geographic custody location, on the issuer's website | 4(a)(1)(C) |
| Monthly examination and certification | Report examined by a registered public accounting firm; CEO and CFO certify accuracy, with criminal penalties under 18 U.S.C. 1350(c) for knowingly false certification | 4(a)(3) |
| Annual audit | Issuers above USD 50 billion consolidated issuance publish GAAP annual financial statements audited under PCAOB standards | 4(a)(10) |
| No yield | No interest or yield paid solely for holding, using or retaining a coin | 4(a)(11) |
Prudential and activity limits
- Capital, liquidity and risk: regulators must issue tailored rules on capital, liquidity, reserve diversification, interest rate risk and operational, compliance and information technology risk (section 4(a)(4)).
- Narrow activities: issuers may only issue and redeem coins, manage reserves, provide custody and undertake directly supporting activities (section 4(a)(7)).
- Holder priority: holders' claims on reserve assets rank ahead of other creditors in an issuer insolvency (section 4(a)(7)(B), with section 11).
- Marketing: no names combining "United States" that suggest government issue, and no claims of legal tender status, US guarantee, full faith and credit or deposit insurance (sections 4(a)(9) and 4(e)).
Bank Secrecy Act, sanctions and lawful orders
Section 4(a)(5) treats a permitted issuer as a financial institution for Bank Secrecy Act purposes. It must maintain an effective AML programme, retain records, monitor and report suspicious transactions, run customer identification and due diligence, comply with sanctions, and have the technical capability, policies and procedures to block, freeze and reject specific or impermissible transactions. Section 2(16) defines a lawful order as one requiring a person to seize, freeze, burn or prevent the transfer of the issuer's coins, and section 4(a)(6)(B) allows issuance only where the issuer has the technological capability to comply. See AML programme and transaction monitoring and the Crypto Travel Rule Compliance Guide.
Timeline and current status
Status checked on 8 November 2026 against govinfo.gov, Treasury and FinCEN. Rulemaking is in progress and dates may change; confirm on the Treasury and federal regulator sites before relying on them.
| Date | Milestone | Source |
|---|---|---|
| 18 July 2025 | GENIUS Act enacted (Public Law 119-27) | govinfo.gov |
| 18 August 2025 | Treasury request for comment on innovative methods to detect illicit activity involving digital assets | Treasury, FinCEN |
| September 2025 | Treasury advance notice of proposed rulemaking on implementation (no new requirements) | Treasury, FinCEN |
| 17 August 2026 | Treasury proposed rule on section 3: when a stablecoin is "issued in the United States" and "offered or sold" to a person in the United States; 60-day comment period from Federal Register publication | Treasury |
| 18 January 2027 (expected) | Act takes effect; issuing a payment stablecoin in the US generally requires a federal or state licence | Treasury |
| Within 360 days of crossing USD 10 billion | State qualified issuers transition to federal oversight or stop new issuance | Section 4(d) |
| 18 July 2028 | Digital asset service providers generally may not offer or sell payment stablecoins to US persons unless issued by a permitted issuer | Section 3(b)(1); Treasury |
Enforcement and penalties
| Violation | Maximum penalty | Section |
|---|---|---|
| Knowingly participating in unlicensed issuance | Fine up to USD 1,000,000 per violation, up to 5 years imprisonment, or both | 3(f)(1) |
| Issuing without approval (civil) | Up to USD 100,000 per day of violating issuance | 6(b)(5)(A) |
| Material violations by a permitted issuer or affiliated party | Up to USD 100,000 per day, plus up to USD 100,000 per day for knowing participation | 6(b)(5)(B), (C) |
| Marketing an unlicensed product as a payment stablecoin | Up to USD 500,000 per violation (Treasury) | 4(e)(3)(B) |
| Service provider facilitating trading of a noncompliant foreign coin | Up to USD 100,000 per violation per day | 8(b)(4)(A) |
| Foreign issuer continuing to offer after a noncompliance determination | Up to USD 1,000,000 per violation per day | 8(b)(4)(B) |
| Knowingly false monthly reserve certification | Penalties under 18 U.S.C. 1350(c) | 4(a)(3) |
Federal regulators can also bar issuance, and enforcement reach over former institution-affiliated parties lasts six years after separation (section 6(b)(5)(E)). A foreign issuer that does not comply within 30 days of written notice faces a published Treasury noncompliance determination and a secondary trading ban (section 8(b)(1)).
What it means for AI agents and non-human identities
A payment stablecoin is a token contract run by keys. The Act turns several of those keys into compliance controls.
- Mint and burn keys back the reserve certification: if outstanding supply can change without authorisation, the monthly 1:1 certification is false. Mint and burn roles should require multi-party approval (multisig or threshold signing), be held in hardware security modules, and reconcile automatically with reserve movements. See the MPC Wallet and Threshold Signing Security Guide.
- Freeze and seize roles must work and must not be abused: the lawful order capability is a privileged action on customer property. Treat the freeze or blocklist role as privileged access: named approvers, a recorded legal basis per order, separation from the team that writes contract code, and alerting on every use.
- Upgrade and admin keys: an upgradeable contract's admin can change all of the above. Its key needs the strongest controls and a timelock where practical.
- Automation and agents: sanctions screening and blockchain analytics services increasingly call freeze functions or queue them automatically. Any service account or AI agent with that ability is a high-value non-human identity: scope it to proposing actions, require human approval to execute, vault its credentials and log every call. See AI Agents with Crypto Wallets Security Guide.
- Agentic payments in stablecoins: agents paying in stablecoins inherit the issuer's freeze and sanctions controls; issuers and service providers should know which wallets belong to agents and which human or organisation is accountable for each. See the Agent Payments Protocols Guide.
| GENIUS Act duty | Machine identity or key | Control | NIST SP 800-53 |
|---|---|---|---|
| 1:1 reserves and monthly certification | Mint and burn role keys | Threshold approval, HSM custody, supply to reserve reconciliation | SC-12, AC-5 |
| Lawful order capability | Freeze, blocklist and seize roles | Privileged access workflow, legal basis recorded, alert on use | AC-6, AU-12 |
| BSA monitoring | Analytics and screening service accounts | Per-service credentials, vaulting, rotation | IA-5, AC-2 |
| Operational and IT risk rules | Contract admin and upgrade keys | Timelocks, multi-party approval, recovery plan | SC-12, CP-10 |
| Third-party custody of reserves and keys | Custodian integrations | Contracted controls and assurance | SA-9, SR-3 |
Compliance steps
- Classify the product: test each token against the section 2(22) definition and decide which licensing route (bank subsidiary, federal, state) fits, including the USD 10 billion state ceiling.
- Read the proposed rules: follow Treasury's section 3 proposal and the federal and state regulators' licensing and prudential rules as they are finalised; record assumptions where text is still a proposal.
- Restructure reserves: move to eligible assets of 93 days or less, remove any rehypothecation and set up monthly reporting with the accounting firm.
- Stand up the certification process: define how CEO and CFO sign monthly, what evidence they rely on and how supply and reserve data are reconciled.
- Build the BSA programme: customer identification, monitoring, SAR filing, sanctions screening and records, sized to the issuer's distribution model.
- Prove lawful order capability: test freeze, seize, burn and transfer prevention on every chain where the coin is deployed, document the runbook, and time a test end to end.
- Harden keys and privileged roles: inventory every contract role and the identity behind it, move to multi-party control and HSMs, and remove standing access.
- Service providers: exchanges and custodians list every stablecoin offered to US persons, map issuer status, and plan delisting or migration before 18 July 2028.
- Test and fall back: rehearse a lawful order and a mass redemption in a test environment, and keep a rollback plan for contract upgrades.
Small versus large issuers: a state qualified issuer under USD 10 billion can use the state regime but must plan its federal transition early. Issuers above USD 50 billion add PCAOB-audited annual statements and, in practice, bank-grade operational risk and key management programmes.
Measures that show it is working
- Days since the last successful end-to-end freeze test on each chain.
- Monthly reserve report published and certified on time (target 100%).
- Difference between on-chain supply and reserve ledger at each reconciliation (target zero).
- Percentage of privileged contract roles under multi-party control.
- Median time from lawful order receipt to execution.
Practitioner checklist
- Confirm whether each token is a payment stablecoin under section 2(22) and choose the licensing route.
- Track the 18 January 2027 expected effective date and the 18 July 2028 service provider deadline.
- Hold reserves only in eligible assets with 93 days or less maturity and stop any reuse.
- Publish monthly reserve composition and obtain accounting firm examination and CEO and CFO certification.
- Implement a full BSA and sanctions programme as a financial institution.
- Test the ability to seize, freeze, burn and prevent transfers on every chain.
- Put mint, burn, freeze and upgrade keys under multi-party control in HSMs with alerting on use.
- Restrict automated screening tools and AI agents to proposing freezes, with human approval to execute.
- Review marketing for prohibited claims of government backing, legal tender or insurance.
Standards and references
- US Government Publishing Office: Public Law 119-27, GENIUS Act
- US Treasury: Proposed rule implementing section 3 of the GENIUS Act
- US Treasury: Advance notice of proposed rulemaking on GENIUS Act implementation
- FinCEN: Treasury seeks public comment on implementation of the GENIUS Act
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Stablecoin Security and Risk Guide · MiCA and DORA for Crypto-Asset Service Providers Guide · Hong Kong Stablecoins Ordinance Guide · Crypto Wallet Security Guide. This guide summarises the US GENIUS Act and is not legal advice.