Permitted Payment Stablecoin Issuer Customer Identification Program

DEPARTMENT OF THE TREASURY

Financial Crimes Enforcement Network

31 CFR Part 1033

RIN 1506-AB74

Permitted Payment Stablecoin Issuer Customer Identification Program

AGENCY: Financial Crimes Enforcement Network and Office of the Comptroller of the Currency, Treasury; Board of Governors of the Federal Reserve System; Federal Deposit Insurance Corporation; National Credit Union Administration.

ACTION: Joint proposed rule.

SUMMARY: The Financial Crimes Enforcement Network (FinCEN), together with the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA) are jointly issuing this proposed rule to implement certain provisions of the Guiding and Establishing National and Innovation for U.S. Stablecoins Act (GENIUS Act). Specifically, this rulemaking implements the GENIUS Act's directives to treat permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act and to require issuers to maintain an effective customer identification program.

DATES: Comments must be received by August 21, 2026.

ADDRESSES: Comments should be directed to:

FinCEN: Comments must be submitted in one of the following two ways (please choose only one of the ways listed):

Electronically at https://www.regulations.gov. Follow the “Submit a comment” instructions under Docket FINCEN-2026-0101. If you are reading this document on federalregister.gov, you may use the green “SUBMIT A PUBLIC COMMENT” button beneath this rulemaking's title to submit a comment to the regulations.gov docket.

You may mail written comments to the following address: Regulatory and Strategic Affairs Division, Financial Crimes Enforcement Network, P.O. Box 39, Vienna, VA 22183. Mailed comments must be received by the close of the comment period.

Do not include any personally identifiable information (such as name, address, or other contact information) or confidential business information that you do not want publicly disclosed. All comments are public records; they are publicly displayed exactly as received, and will not be deleted, modified, or redacted. Comments may be submitted anonymously.

Follow the search instructions on https://www.regulations.gov to view public comments.

OCC: Commenters are encouraged to submit comments through the Federal eRulemaking Portal. Please use the title “Permitted Payment Stablecoin Issuer Customer Identification Program” and “RIN 1557- AF53” to facilitate the organization and distribution of the comments. You may submit comments by any of the following methods:

Federal eRulemaking Portal—Regulations.gov: Go to https://regulations.gov. Enter Docket ID OCC-2026-0331 in the Search Box and click “Search.” Public comments can be submitted via the “Comment” box below the displayed document information or by clicking on the document title and then clicking the “Comment” box on the top-left side of the screen. For help with submitting effective comments please click on “Commenter's Checklist.” For assistance with the regulations.gov site, please call 1-866-498-2945 (toll free) Monday- Friday, 9 a.m.-5 p.m. ET, or email regulationshelpdesk@gsa.gov.

Mail: Chief Counsel's Office, Attention: Comment Processing, Office of the Comptroller of the Currency, 400 7th Street SW, Suite 1E-216, Washington, DC 20219.

Hand Delivery/Courier: 400 7th Street SW, Suite 1E-216, Washington, DC 20219.

Instructions: You must include “OCC” as the agency name and Docket ID OCC-2026-0331 in your comment. In general, the OCC will enter all comments received into the docket and publish the comments on the regulations.gov website without change, including any business or personal information provided such as name and address information, email addresses, or phone numbers. Comments received, including attachments and other supporting materials, are part of the public record and subject to public disclosure. Do not include any information in your comment or supporting materials that you consider confidential or inappropriate for public disclosure.

You may review comments and other related materials that pertain to this action by the following method:

Viewing Comments Electronically—Regulations.gov: Go to https://regulations.gov. Enter Docket ID OCC-2026-0331 in the Search Box and click “Search.” Click on the “Documents” tab and then the document's title. After clicking the document's title, click the “Document Comments” tab. Comments can be viewed and filtered by clicking on the “Sort By” drop-down on the right side of the screen or the “Refine Results” options on the left side of the screen. Supporting materials can be viewed by clicking on the “Documents” tab. Click on the “Sort By” drop-down on the right side of the screen or the “Refine Documents Results” options on the left side of the screen checking the “Supporting & Related Material” checkbox. For assistance with the regulations.gov site, please call 1-866-498-2945 (toll free) Monday-Friday, 9 a.m.-5 p.m. ET, or email regulationshelpdesk@gsa.gov.

The docket may be viewed after the close of the comment period in the same manner as during the comment period.

Board: You may submit comments, identified by Docket No. R-1885 and RIN 7100-AH18, by any of the following methods:

Agency Website: https://www.federalreserve.gov. Follow the instructions for submitting comments at https://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm.

Email: regs.comments@federalreserve.gov. Include docket and RIN numbers in the subject line of the message.

Fax: (202) 452-3819 or (202) 452-3102.

Mail: Benjamin W. McDonough, Secretary, Board of Governors of the Federal Reserve System, 20th Street and Constitution Avenue NW, Washington, DC 20551.

Instructions: All public comments are available from the Board's website at https://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm as submitted. Accordingly, comments will not be edited to remove any identifying or contact information. Public comments may also be viewed electronically or on paper in Room M-4365A, 2001 C Street NW, Washington, DC 20551, between 9 a.m. and 5 p.m. during Federal business weekdays. For security reasons, the Board requires that visitors make an appointment to inspect comments. You may do so by calling (202) 452-3684. Upon arrival, visitors will be required to present valid government-issued photo identification and to submit to security screening in order to inspect and photocopy comments. For users of TTY-TRS, please call 711 from any telephone, anywhere in the United States.

FDIC: You may submit comments, identified by RIN 3064-AG28, by any of the following methods:

FDIC Website: https://www.fdic.gov/federal-register-publications. Follow instructions for submitting comments on the agency website.

Email: Comments@fdic.gov. Include RIN 3064-AG28 in the subject line of the message.

Mail: Jennifer M. Jones, Deputy Executive Secretary, Attention: Comments—RIN 3064-AG28, Federal Deposit Insurance Corporation, 550 17th Street NW, Washington, DC 20429.

Hand Delivery to FDIC: Comments may be hand-delivered to the guard station at the rear of the 550 17th Street NW building (located on F Street) on business days between 7 a.m. and 5 p.m.

Public Inspection: Comments received, including any personal information provided, may be posted without change to https://www.fdic.gov/federal-register-publications. Commenters should submit only information that the commenter wishes to make available publicly. The FDIC may review, redact, or refrain from posting all or any portion of any comment that it may deem to be inappropriate for publication, such as irrelevant or obscene material. The FDIC may post only a single representative example of identical or substantially identical comments, and in such cases will generally identify the number of identical or substantially identical comments represented by the posted example. All comments that have been redacted, as well as those that have not been posted, that contain comments on the merits of the proposed rule will be retained in the public comment file and will be considered as required under all applicable laws. All comments may be accessible under the Freedom of Information Act.

NCUA: You may submit comments, identified by RIN 3133-AG09, by any of the following methods (please send comments by one method only):

Federal eRulemaking Portal: https://www.regulations.gov. The docket number for this proposed rule is NCUA-2026-0793. Follow the instructions for submitting comments. A plain language summary of the proposed rule is also available on the docket website.

Mail: Address to Melane Conyers-Ausbrooks, Secretary of the Board, National Credit Union Administration, 1775 Duke Street, Alexandria, Virginia 22314-3428.

Hand Delivery/Courier: Same as mailing address.

Public inspection: You may view all public comments on the Federal eRulemaking Portal at https://www.regulations.gov, as submitted, except for those we cannot post for technical reasons. The NCUA will not edit or remove any identifying or contact information from the public comments submitted. If you are unable to access public comments on the internet, you may contact the NCUA for alternative access by calling (703) 518-6540 or emailing OGCMail@ncua.gov.

FOR FURTHER INFORMATION CONTACT:

FinCEN: The FinCEN Regulatory Support Section by submitting an inquiry at www.fincen.gov/contact.

OCC: Kenneth Kohrs, BSA/AML Lead Expert, Office of the Chief National Bank Examiner; Jina Cheon, Assistant Director, Melissa Lisenbee, Counsel, or Henry Barkhausen, Counsel, Bank Advisory Group, Chief Counsel's Office, (202) 649-5490, Office of the Comptroller of the Currency, 400 7th Street SW, Washington, DC 20219. If you are deaf, hard of hearing, or have a speech disability, please dial 7-1-1 to access telecommunications relay services.

Board: Division of Supervision and Regulation, Lara Lylozian, Deputy Associate Director, (202) 815-9088, Lee Davis, Lead BSA/AML Policy Analyst, (202) 740-8219, lee.h.davis@frb.gov, Legal Division, Jason Gonzalez, Deputy Associate General Counsel, (202) 452-3275, jason.a.gonzalez@frb.gov, Bernard Kim, Special Counsel, (202) 452-3083, Bernard.g.kim@frb.gov.

FDIC: Patricia Colohan, Deputy Director, (202) 898-7283, PColohan@fdic.gov, Division of Risk Management Supervision; Chase Lubbock, Associate Director, (703) 254-0802, clubbock@fdic.gov, Division of Risk Management Supervision; Christy Cornell-Pape, Acting Chief, Financial Crimes, (415) 808-8090, ACornell-Pape@fdic.gov, Division of Risk Management Supervision; Deborah Tobolowsky, Counsel, (571) 309-2415, dtobolowsky@fdic.gov, Legal Division; Chantal Hernandez, Counsel, (202) 898-7388, chhernandez@fdic.gov, Legal Division; Thomas Krepp, Senior Attorney, (678) 916-2265, tkrepp@fdic.gov, Legal Division; Lea Pfeifer, Senior Attorney, (972) 761-8244, lpfeifer@fdic.gov, Legal Division; Maryann Bullion Mitchell, Senior Attorney, (571) 858-8239, mbullionmitchell@fdic.gov, Legal Division; Nicholas Kazmerski, Counsel, (571) 309-3136, nkazmerski@fdic.gov, Legal Division.

NCUA: Michael Dondarski, Associate Director, Office of Examination & Insurance, (703) 772- 4751, mdondarski@ncua.gov; Janell Portare, Director, Fraud and Anti-Money Laundering Division, Office of Examination & Insurance, (703) 548-2752, jportare@ncua.gov; Gira Bose, Senior Staff Attorney, Office of General Counsel, (703) 518-6540, gbose@ncua.gov.

SUPPLEMENTARY INFORMATION:

I. Introduction

This proposal implements the GENIUS Act's directives to treat permitted payment stablecoin issuers (PPSIs) as financial institutions for purposes of the Bank Secrecy Act (BSA) and to require such issuers to maintain an “effective customer identification program, including identification and verification of account holders.” [1] This notice of proposed rulemaking (NPRM) is being issued jointly by FinCEN, along with the OCC, Board, FDIC, and NCUA (each an “Agency” and collectively “the Agencies”) as applied to the PPSIs that each Agency supervises.[2] The proposal would also apply to PPSIs that opt for state supervision under the GENIUS Act.[3]

[1] See 12 U.S.C. 5903(a)(5)(A)(v); see also 31 U.S.C. 5318(l).

[2] The GENIUS Act outlines the reserve, capital, liquidity, and risk management requirements for PPSIs and tasks implementing those requirements to the OCC, Board, FDIC, NCUA, and, as applicable, any State payment stablecoin regulators. See 12 U.S.C. 5903(a)(4). The OCC, Board, FDIC, and NCUA are tasked with establishing a process and framework for the licensing, regulation, examination, and supervision of PPSIs under their respective purviews. See 12 U.S.C. 5901(25) (defining “primary Federal payment stablecoin regulator” and outlining the Agencies' respective jurisdictions for PPSIs).

[3] See 12 U.S.C. 5903(c) (outlining option for state-level regulatory regime for PPSIs with a consolidated total outstanding issuance of not more than $10 billion), 5906 (outlining supervision by State payment stablecoin regulators), 5901(30) (defining “State payment stablecoin regulator”).

Separately, FinCEN issued a rulemaking proposing changes to its existing regulations to effectuate the GENIUS Act's direction to apply BSA obligations to PPSIs. These changes include creation of a new part in chapter X applicable to PPSIs, proposed part 1033, into which this proposed rule would be incorporated.[4]

[4] Office of Foreign Assets Control (OFAC) and FinCEN, Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions Compliance Program Requirements, 91 FR 18582 (Apr. 10, 2026) [hereinafter PPSI AML/CFT NPRM]. The PPSI AML/CFT NPRM was issued jointly by FinCEN with OFAC because it also proposes implementation of the GENIUS Act's sanction compliance program obligation.

II. Background and Authority

The GENIUS Act provides a comprehensive framework for the regulation of payment stablecoins.[5] The GENIUS Act requires that a PPSI “be treated as a financial institution for purposes of the Bank Secrecy Act, and

as such, shall be subject to all Federal laws applicable to a financial institution located in the United States relating to economic sanctions, prevention of money laundering, customer identification, and due diligence.” [6] In addition to this clear, general directive, the GENIUS Act specifies that a PPSI's obligations include “maintenance of an effective customer identification program, including identification and verification of account holders with the permitted payment stablecoin issuer.” [7]

[5] GENIUS Act, Public Law 119-27, 139 Stat. 419 (2025) (codified at 12 U.S.C. 5901-5916).

[6] 12 U.S.C. 5903(a)(5)(A).

[7] 12 U.S.C. 5903(a)(5)(A)(v).

The Bank Secrecy Act, or “BSA,” is the common name for a collection of statutory authorities designed to, among other things, safeguard the national security of the United States by combating money laundering, the financing of terrorism, and other illicit finance activity.[8] The Secretary of the Treasury has delegated the authority to implement, administer, and enforce the BSA and its associated regulations to the Director of FinCEN.[9] The BSA requires the Secretary of the Treasury to prescribe “minimum standards” for financial institutions regarding “the identity of the customer that shall apply in connection with the opening of an account,” commonly referred to as customer identification programs (CIPs).[10] Under the BSA, these minimum standards the Secretary of the Treasury prescribes must include reasonable procedures for: (1) verifying the identity of any person seeking to open an account to the extent reasonable and practicable; (2) maintaining records of the information used to verify a person's identity, including name, address, and other identifying information; and (3) determining whether the person appears on any lists of known or suspected terrorists or terrorist organizations provided to the financial institution by any government agency.[11] In prescribing regulations related to these minimum standards, the BSA directs the Secretary of the Treasury to “take into consideration the various types of accounts maintained by various types of financial institutions, the various methods of opening accounts, and the various types of identifying information available.” [12] For financial institutions engaging in financial activity described in section 4(k) of the Bank Holding Company Act of 1956, such regulations must be jointly prescribed by the Secretary of the Treasury and the appropriate Federal functional regulator.[13]

[8] Certain parts of the Currency and Foreign Transactions Reporting Act, its amendments, and the other statutes relating to the subject matter of that Act, have come to be referred to as the BSA. These statutes are codified at 12 U.S.C. 1829b, 12 U.S.C. 1951-1960, and 31 U.S.C. 5311-5314 and 5316-5336 and notes thereto, with implementing regulations at 31 CFR chapter X. Consistent with that understood meaning, as codified, the GENIUS Act defines the “Bank Secrecy Act” to mean “(A) section 1829b of this title [section 21 of the Federal Deposit Insurance Act]; (B) chapter 2 of title I of Public Law 91-508 (12 U.S.C. 1951 et seq.); and (C) subchapter II of chapter 53 of title 31, United States Code.” 12 U.S.C. 5901(2).

[9] See Treasury Order 180-01 (Jan. 14, 2020), para. 3, available at https://home.treasury.gov/about/general-information/orders-and-directives/treasury-order-180-01; see also 31 U.S.C. 310(b)(2)(I) (providing that the Director of FinCEN shall “[a]dminister the requirements of subchapter II of chapter 53 of this title, chapter 2 of title I of Public Law 91-508, and section 21 of the Federal Deposit Insurance Act, to the extent delegated such authority by the Secretary of the Treasury”).

[10] 31 U.S.C. 5318(l)(1).

[11] 31 U.S.C. 5318(l)(2).

[12] 31 U.S.C. 5318(l)(3).

[13] 31 U.S.C. 5318(l)(4) (referencing section 509 of the Gramm- Leach-Bliley Act for definition of “Federal functional regulator” and noting inclusion of the Commodity Futures Trading Commission). Under section 509 of the Gramm-Leach-Bliley Act, the term “Federal functional regulator” means (A) the Board of Governors of the Federal Reserve System; (B) the Office of the Comptroller of the Currency; (C) the Board of Directors of the Federal Deposit Insurance Corporation; (D) the Director of the Office of Thrift Supervision; (E) the National Credit Union Administration Board; and (F) the Securities and Exchange Commission. 15 U.S.C. 6809(2) (codifying section 509 of the Gramm-Leach-Bliley Act, Pub. L. 106-102, title V, 113 Stat. 1443 (1999)); see also 31 CFR 1010.100(r) (defining “Federal functional regulator”).

FinCEN, jointly with the appropriate Federal functional regulators, has issued implementing regulations imposing CIP obligations on various types of financial institutions under the BSA, including banks,[14] brokers or dealers in securities,[15] mutual funds,[16] and futures commission merchants and introducing brokers.[17] In contrast, money transmitters do not have a CIP obligation, but they are required to, for certain activity, verify an individual's identity.[18] Stablecoin issuers are presently subject to BSA obligations as financial institutions and, more specifically, as money transmitters under FinCEN's regulations, which are a type of money services business (MSB).[19]

[14] 31 CFR 1020.220; 31 CFR 1010.100(d) (defining “bank,” which includes each agent, agency, branch, or office within the United States of banks, savings associations, credit unions, and foreign banks).

[15] 31 CFR 1023.220.

[16] 31 CFR 1024.220.

[17] 31 CFR 1026.220.

[18] MSBs are required, as part of an AML program, to maintain policies, procedures, and internal controls to verify customer identification. 31 CFR 1022.210(d)(1)(i)(A). MSBs are also required to, for transmittals of funds over $3,000, collect identifying information and, at times, verify identity. 31 CFR 1010.410(e)(1)- (3); see also 31 CFR 1022.400. MSBs also must verify and record identifying information for transactions in currency that individually or in aggregate exceed $10,000. See 31 CFR 1010.312; see also 31 CFR 1022.312.

[19] See 31 U.S.C. 5312(a)(2)(R) (defining as a “financial institution,” in part, a “person who engages as a business in the transmission of currency, funds, or value that substitutes for currency”); see also 31 U.S.C. 5312(a)(2)(J) (defining as a “financial institution” a “business engaged in the exchange of currency, funds, or value that substitutes for currency or funds”); 31 CFR 1010.100(ff)(5); FinCEN, FIN-2013-G001, Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies (Mar. 18, 2013), available at https://www.fincen.gov/system/files/shared/FIN-2013-G001.pdf.

The GENIUS Act directs the Secretary of the Treasury to issue regulations, tailored to the size and complexity of the PPSI, to implement the GENIUS Act's treatment of PPSIs as financial institutions for purposes of the BSA, including the requirement that PPSIs maintain effective customer identification programs.[20] The GENIUS Act also directs the Secretary of the Treasury and each primary Federal payment stablecoin regulator—the OCC, Board, FDIC, and NCUA—to issue regulations through appropriate notice and comment rulemaking and to coordinate, as appropriate, to carry out the Act.[21] FinCEN and the Agencies are issuing a single, joint rule, ensuring consistent and uniform application of CIP requirements to all PPSIs subject to each Agency's jurisdiction.[22]

[20] 12 U.S.C. 5903(a)(5)(B). Pursuant to Treasury Order 101-05 and 31 U.S.C. 321(b)(2), the authority vested in the Secretary under the GENIUS Act to issue regulations related to the prevention of money laundering has been delegated to the Director of FinCEN.

[21] 12 U.S.C. 5913(a)-(b); see also 12 U.S.C. 5903(a)(4)(A)(iv); 12 U.S.C. 5903(h).

[22] Certain PPSIs, defined in the GENIUS Act as State qualified payment stablecoin issuers, will not be overseen by a Federal functional regulator. See 12 U.S.C. 5901(31); 12 U.S.C. 5906. Consistent with FinCEN's historical practice, this proposed rule generally treats these institutions in the same way it treats PPSIs with a Federal functional regulator. FinCEN, Customer Identification Program, Anti-Money Laundering Programs, and Beneficial Ownership Requirements for Banks Lacking a Federal Functional Regulator, 85 FR 57129 (Sept. 15, 2020) (amending 31 CFR 1020.220 so banks lacking a Federal functional regulator are covered by the bank CIP rule). For purposes of State qualified payment stablecoin issuers, FinCEN is issuing this proposal without a Federal functional regulator.

III. GENIUS Act Implementation

Treasury issued an advance notice of proposed rulemaking (ANPRM) in September 2025 seeking public comment on potential Treasury regulations implementing the GENIUS Act, including those imposing BSA, anti-money laundering, and sanctions compliance program obligations.[23] In

response to this ANPRM, Treasury received approximately 450 timely comments from a variety of stakeholders, including banks and credit unions, stablecoin issuers, digital asset exchanges, analytics companies, law firms, trade associations, non-governmental organizations, technology firms, academics, and members of the public. In crafting this proposal, Treasury reviewed and considered the pertinent comments, including those related to illicit finance topics.

[23] Treasury, GENIUS Act Implementation, 90 FR 45159 (Sept. 19, 2025). The ANPRM also solicited comment on a range of potential Treasury efforts related to the GENIUS Act that are outside the purview of this rulemaking. For example, the ANPRM included questions related to the GENIUS Act prohibition on digital asset service providers offering and selling a payment stablecoin to any person in the United States unless the payment stablecoin is issued by a PPSI or a foreign payment stablecoin issuer that meets certain requirements. Id. at 45160-61. It also included questions related to Treasury's role in determining whether a state-level regulatory regime is substantially similar to the federal framework and whether a foreign country's regulatory and supervisory regime is comparable to the U.S. framework. Id. at 45162-63.

This NPRM represents one piece of the comprehensive regulatory framework for PPSIs set out in the GENIUS Act.[24] In a separate rulemaking, FinCEN has proposed a rule to implement the GENIUS Act's directive to apply anti-money laundering obligations to PPSIs (referred to as “PPSI AML/CFT NPRM”), including program, reporting, and recordkeeping obligations, among others.[25] The PPSI AML/CFT NPRM proposes adding several new definitions arising from the GENIUS Act to chapter X, which are here used to describe this proposed rule. These definitions include “digital asset,” [26] “distributed ledger,” [27] “payment stablecoin,” [28] “permitted payment stablecoin issuer,” [29] “primary Federal payment stablecoin regulator,” [30] “Federal qualified payment stablecoin issuer,” [31] “State payment stablecoin regulator,” [32] and “State qualified payment stablecoin issuer.” [33] Generally speaking, the proposed definitions in the PPSI AML/CFT NPRM track the language the GENIUS Act uses to define those terms, with a few proposed technical modifications that are intended to be non-substantive.

[24] See, e.g., FDIC, Approval Requirements for Issuance of Payment Stablecoins by Subsidiaries of FDIC-Supervised Insured Depository Institutions, 90 FR 59409 (Dec. 19, 2025); NCUA, Investments in and Licensing of Permitted Payment Stablecoins Issuers, 91 FR 6531 (Feb. 12, 2026); OCC, Implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the Office of the Comptroller of the Currency, 91 FR 10202 (Mar. 2, 2026); Treasury, GENIUS Act Broad-Based Principles for Determining Whether a State-Level Regulatory Regime Is Substantially Similar to the Federal Regulatory Framework, 91 FR 16844 (Apr. 3, 2026); FDIC, GENIUS Act Requirements and Standards for FDIC- Supervised Permitted Payment Stablecoin Issuers and Insured Depository Institutions, 91FR 18534 (Apr. 10, 2026).

[25] See PPSI AML/CFT NPRM, supra note 4.

[26] See 12 U.S.C. 5901(6).

[27] See 12 U.S.C. 5901(8).

[28] See 12 U.S.C. 5901(22).

[29] See 12 U.S.C. 5901(23).

[30] See 12 U.S.C. 5901(25).

[31] See 12 U.S.C. 5901(11).

[32] See 12 U.S.C. 5901(30).

[33] See 12 U.S.C. 5901(31).

IV. Overview of Stablecoins and Issuers

The GENIUS Act only governs a subcategory of stablecoins, namely “payment stablecoins” as defined by the GENIUS Act, and a subcategory of actors in the payment stablecoin ecosystem, most critically for this rulemaking, PPSIs.[34] Thus, under the GENIUS Act, not all stablecoins are payment stablecoins and not all stablecoin issuers will be eligible to be PPSIs. Because the GENIUS Act framework is not yet in place, however, it is not determined which specific stablecoins will be payment stablecoins and which specific stablecoin issuers will be PPSIs. An understanding of the stablecoin ecosystem, uses of stablecoins, and risks associated with stablecoins generally informs the parameters of the proposed rule, including the rationale behind certain proposed obligations.

[34] See, e.g., 12 U.S.C. 5902, 5903.

A. Stablecoins and Their Uses

Stablecoins are a blockchain-based [35] digital asset [36] designed to maintain a stable value relative to an underlying asset, most often—but not always—a fiat currency.[37] Most stablecoin issuers use smart contracts [38] to issue stablecoins, enable or prohibit subsequent transactions in the stablecoin, and redeem stablecoins. The smart contracts underlying most stablecoins maintain a ledger of the number of stablecoins “owned by a set of accounts where each account is owned by a blockchain address” or wallet.[39]

[35] A blockchain is “any technology where data is: (i) shared across a network to create a public ledger of verified transactions or information among network participants; (ii) linked using cryptography to maintain the integrity of the public ledger and to execute other functions; (iii) distributed among network participants in an automated fashion to concurrently update network participants on the state of the public ledger and any other functions; and (iv) composed of source code that is publicly available.” Executive Order (E.O.) 14178, Strengthening American Leadership in Digital Financial Technology, sec. 2(b), 90 FR 8647 (Jan. 31, 2025).

[36] For this proposed rule, a “digital asset” is “any digital representation of value that is recorded on a cryptographically secured distributed ledger.” See 12 U.S.C. 5901(6).

[37] White House, Strengthening American Leadership in Digital Financial Technology, p. 88 (July 2025) [hereinafter E.O. 14178 Report], available at https://www.whitehouse.gov/wp-content/uploads/2025/07/Digital-Assets-Report-EO14178.pdf. This report was issued by the Presidential Working Group on Digital Asset Markets, of which the Secretary of the Treasury is a member, pursuant to E.O. 14178.

[38] A smart contract is a “collection of code and data . . . that is deployed using cryptographically signed transactions” on a blockchain network, which is executed by nodes on a blockchain to perform any given set of pre-determined functions or conditions that are recorded on a blockchain. See National Institute of Standards and Technology (NIST), NISTIR 8202, Blockchain Technology Overview, p. 32 (Oct. 2018) [hereinafter Blockchain Technology Overview], available at https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8202.pdf (“A smart contract can perform calculations, store information, expose properties to reflect a publicly exposed state and, if appropriate, automatically send funds to other accounts.”).

[39] NIST, NISTIR 8408, Understanding Stablecoin Technology and Related Security Considerations, p. 6 (sec. 3.2) (Sept. 2023), available at https://nvlpubs.nist.gov/nistpubs/ir/2023/NIST.IR.8408.pdf. The lynchpin of a blockchain is asymmetric (public key) cryptography, which is used to secure and send transactions on a blockchain. See Blockchain Technology Overview, supra note 38, p. 11. First, a user generates a private key (a string of characters that function like a password) and uses that private key to generate a public key (an account number on a blockchain known as an address). Without the private key associated with an address or public key, a user cannot access the digital assets contained within. Developers have created software or hardware wallets to enable users to manage their public and private keys and safeguard their assets more easily. See E.O. 14178 Report, supra note 37, pp. 9-10.

The liquidity and stability of stablecoins relative to other digital assets and rapid settlement of stablecoins make them appealing to illicit actors as well as legitimate users.[40] Currently, most legitimate users primarily rely on stablecoins to store value or facilitate trades in other digital assets. Payment stablecoins have the potential, however, to become a more widely adopted form of payment.[41] Illicit actors have increasingly used stablecoins to facilitate transactions and store proceeds.[42] The U.S. government has linked stablecoins to a range of illicit activities, including money laundering, and bad actors, including scammers and fraudsters; [43] Democratic People's Republic of Korea information technology workers, cybercriminal groups, and related money laundering

networks; [44] drug traffickers; [45] terrorist groups; [46] and sanctions evasion and money laundering networks,[47] among others.

[40] See Treasury, 2026 National Money Laundering Risk Assessment, p. 50 (Mar. 2026) [hereinafter 2026 NMLRA], available at https://home.treasury.gov/system/files/246/2026-NMLRA.pdf; E.O. 14178 Report, supra note 37, p. 94.

[41] E.O. 14178 Report, supra note 37, p. 91.

[42] See 2026 NMLRA, supra note 40, p. 50.

[43] See, e.g., Compl., United States v. Approximately 225,364,961 USDT, No. 25-cv-1907 (D.D.C. June 18, 2025) (civil forfeiture action against more than $225.3 million in stablecoins allegedly involved in concealing proceeds of digital assets investment fraud); United States v. Su, No. 25-cr-362 (C.D. Cal. Jan. 27, 2026) (defendant sentenced to 46 months in prison for role in digital investment scam involving $36.9 million where victim funds were converted to stablecoins).

[44] See, e.g., Indictment, United States v. Sop, No. 23-cr-128 (D.D.C. Mar. 18, 2023) (alleging defendant laundered proceeds of DPRK IT workers in violation of sanctions, including through use of stablecoins); DOJ, Press Release, Department Files Civil Forfeiture Complaint Against Over $7.74M Laundered on Behalf of the North Korean Government (June 5, 2025), available at https://www.justice.gov/opa/pr/department-files-civil-forfeiture-complaint-against-over-774m-laundered-behalf-north-korean; United States of America v. Approximately 1,159,834.52 USDT, No. 25-cv-3771 (D.D.C. Oct. 24, 2025) (civil forfeiture complaint of stablecoins related to virtual currency heists perpetrated by DPRK hacking groups).

[45] See, e.g., United States v. Zhang et al., No. 22-cr-10279 (Aug. 15, 2025) (defendants sentenced to prison in connection with drug trafficking scheme involving conversion of proceeds to stablecoins); see also, DOJ, Press Release, Two Men Sentenced for Role in International Money Laundering and Drug Trafficking Conspiracy (Aug. 15, 2025), available at https://www.justice.gov/usao-ma/pr/two-men-sentenced-role-international-money-laundering-and-drug-trafficking-conspiracy.

[46] See, e.g., DOJ, Press Release, Justice Department Disrupts Hamas Terrorist Financing Scheme Through Seizure of Cryptocurrency (Mar. 27, 2025), available at https://www.justice.gov/opa/pr/justice-department-disrupts-hamas-terrorist-financing-scheme-through-seizure-cryptocurrency; United States of America v. Nine Cryptocurrency Wallets Held by Tether Ltd. and Seven Cryptocurrency Wallets Held by Binance Holdings Ltd., No. 24-cv-01251 (D.D.C. Nov. 13, 2025) (involving a civil forfeiture of approximately $2 million dollars in digital currency connected to a Gaza-based money transfer business that was involved in financially supporting Hamas).

[47] Treasury, Press Release, Treasury Exposes Money Laundering Network Using Digital Assets to Evade Sanctions (Dec. 4, 2024), available at https://home.treasury.gov/news/press-releases/jy2735.

B. Issuers and Interactions With Users

Most stablecoins backed by financial assets, including fiat currency, have centralized control, meaning that one company, or a group of companies, are responsible for governance functions, including defining and ensuring compliance with standards related to the issuance, purchase, redemption, custody, and transfer of the stablecoin.

Currently, many stablecoin issuers generally interact directly with a small number of larger companies—which are often institutional participants in the trading of digital assets (i.e., digital asset exchanges).[48] Those companies, in turn, interact with a larger and more diverse group of users. Many stablecoin issuers predominantly offer issue and redemption services to financial institutions, including digital asset exchanges that may be regulated under the BSA as MSBs.[49] Generally, once an issuer issues stablecoins to such financial institutions, those financial institutions put the stablecoins into broader circulation to other users, such as individual retail users.[50]

[48] See Watsky, Cy, et al., Primary and Secondary Markets for Stablecoins, FEDS Notes, Washington: Board of Governors of the Federal Reserve System (Feb. 23, 2024), available at https://doi.org/10.17016/2380-7172.3447.

[49] See id.; see also E.O. 14178 Report, supra note 37, p. 105.

[50] See, e.g., E.O. 14178 Report, supra note 37, pp. 18-20.

Due to the use of smart contracts underlying stablecoin transactions and how users interact with stablecoin issuers, the ecosystem can, broadly speaking, be divided into two components, the primary market and the secondary market. For purposes of this rulemaking, FinCEN and the Agencies will use the term “primary market” to generally describe a PPSI interacting directly with a user or holder of a payment stablecoin, such as when a PPSI engages in issuing, converting, redeeming, repurchasing, burning, and reissuing payment stablecoins, as well as providing associated services, such as providing custodial services.[51] FinCEN and the Agencies will use the term “secondary market” to describe payment stablecoin activity that does not directly involve the PPSI as a party to the transaction other than via a smart contract. For example, secondary market activity could include an individual purchasing payment stablecoins from intermediaries, an individual sending a payment stablecoin from a self-hosted wallet to a vendor to purchase goods, an individual exchanging payment stablecoins for another digital asset via a digital asset exchange, or person-to-person transactions in payment stablecoins.

[51] If consistent with the law and authorized by a primary Federal stablecoin regulator or the State payment stablecoin regulator, as applicable, PPSIs can also engage in activities as a “digital asset service provider,” as defined by the GENIUS Act, and activities incidental thereto. Such activities include exchanging and transferring digital assets. See 12 U.S.C. 5903(a)(7)(B), 5901(7). Such activity would also constitute primary market activity.

V. Section-by-Section Analysis

As required by the GENIUS Act, this rulemaking proposes a CIP obligation for accounts maintained by PPSIs.[52] Obligations under this proposal are comparable to existing CIP requirements for other financial institutions, such as banks, brokers-dealers, mutual funds, and futures commission merchants and introducing brokers in commodities. PPSIs likely will frequently interact with financial institutions that are already subject to CIP requirements, and in some cases, PPSIs will be subsidiaries of insured depository institutions with CIP requirements.[53] Subjecting PPSIs to CIP requirements similar to such institutions is expected to increase the effectiveness and efficiency of CIP programs and facilitate the ability of PPSIs and other financial institutions with CIP requirements to rely on another institution's performance of any procedure related to a CIP, with the recommended safeguards contained in proposed 31 CFR 1033.220(a)(6).

[52] See 12 U.S.C. 5903(a)(5)(A)(v).

[53] As explained more fully in the PPSI AML/CFT NPRM, supra note 4, in some cases PPSIs will be subsidiaries of insured depository institutions, which have CIP requirements, or be chartered by the OCC as national trust banks. See 12 U.S.C. 5901(11), (23).

In crafting this proposal, FinCEN and the Agencies have considered the statutory factors articulated in the BSA, specifically the various types of accounts PPSIs may maintain, the various methods of opening accounts, and the various types of identifying information available.[54] Most notably, FinCEN and the Agencies recognize that these factors may vary significantly by the size and complexity of the PPSI, the activities in which it engages, and the types of customers it has. Accordingly, rather than prescribe a one-size-fits-all approach, FinCEN and the Agencies direct that a PPSI's CIP should address the types of accounts it intends to maintain, how it allows those accounts to be opened, and the types of identifying information available. In defining “account,” as noted below, the proposal takes into consideration the range of activities in which a PPSI can engage and the types of accounts that a PPSI may maintain.

[54] See 31 U.S.C. 5318(l)(3).

Relatedly, as mentioned above, the GENIUS Act directs the Secretary to tailor BSA obligations to the size and complexity of an issuer.[55] This proposal meets that requirement by proposing regulatory text that requires a PPSI to tailor its CIP to that PPSI's size and type of business, as well as take into consideration the PPSI's risk based on its unique business—including the types of accounts it has, how those accounts are opened, and the identifying information available. Other policy options to tailor for size and complexity were considered including, for example, a CIP obligation that would fluctuate solely based on the size of an issuer. FinCEN and the Agencies have preliminarily assessed, however, that such an approach, however, could harm national security by providing weaker points of entry to the financial system, but request comment on its approach. This CIP proposal necessarily results in tailored obligations, which comports with the GENIUS Act, mitigates the risk of weaker points of entry, and best

protects the U.S. financial system from illicit activity.

[55] 12 U.S.C. 5903(a)(5)(B).

A. Proposed 31 CFR 1033.100—Definitions

FinCEN and the Agencies propose promulgating in Sec. 1033.100 three new definitions with respect to the proposed CIP obligation-- account, customer, and digital asset service provider.[56] The definitions are proposed for purposes of this CIP rulemaking and would only apply to the CIP obligation unless otherwise expressly noted.[57]

[56] This proposal's definitions are in addition to other terms defined in the GENIUS Act and proposed to be codified by FinCEN as part of the PPSI AML/CFT NPRM, see supra note 4, most notably, “digital asset,” “distributed ledger,” “payment stablecoin,” “permitted payment stablecoin issuer,” “primary Federal payment stablecoin regulator,” “Federal qualified payment stablecoin issuer,” “State payment stablecoin regulator,” and “State qualified payment stablecoin issuer.”

[57] As noted in the PPSI AML/CFT NPRM, see supra note 4, for example, the term “account” is used in various FinCEN regulations and in the GENIUS Act, but the definition of account in this proposed CIP rule generally only applies to CIP requirements set out in this proposed rule, part 1033, unless otherwise expressly noted. Compare 31 CFR 1010.230(c) (referencing in beneficial ownership requirement the CIP definitions of “account”) with 1010.605(c)(2) (defining “account” for purposes of special due diligence obligations for correspondent accounts and private banking accounts, without reference to the CIP definitions of “account”). As discussed in the PPSI AML/CFT NPRM, the GENIUS Act directs that PPSIs have the technological capability to comply, and will comply, with the terms of any lawful orders. See 12 U.S.C. 5903(a)(6)(B). Lawful order is defined, in part, by using “account.” See 12 U.S.C. 5901(16)(B). FinCEN is not intending, however, to apply the proposed CIP definition of account to that obligation.

The definitions discussed in this proposal are designed to clarify that a PPSI's CIP obligation extends to direct relationships, i.e., primary market activity, and does not extend to activity where the only interaction is with a PPSI's smart contract. Consistent with the BSA, the CIP requirements for other types of financial institutions extend to where an institution has some sort of formal relationship with an individual or entity.[58] Based on the language in section 4(a)(5) of the GENIUS Act, and the analysis undertaken by FinCEN and the Agencies of the stablecoin ecosystem, FinCEN and the Agencies assess that the term “customer” in section 4(a)(5) related to “customer identification program” pertains to circumstances where the “customer” and a PPSI have a direct interaction and relationship. Put differently, the term “customer” is not meant to apply where a transfer is the result of third parties and a payment stablecoin user's only interaction with the PPSI is through a smart contract.

[58] See, e.g., 31 CFR 1020.100 (defining “account” in bank CIP as “a formal banking relationship”); 1023.100 (defining “account” in broker-dealer CIP as “a formal relationship”); see also 31 U.S.C. 5318(l) (setting forth obligations related to verifying the identity of “customers . . . in connection with the opening of an account”).

Moreover, interaction with a smart contract does not currently result in a PPSI acquiring the kind of information needed to verify an identity. Imposing an obligation where any payment stablecoin transfer could, for purposes of a CIP obligation, result in a customer and account relationship with a PPSI would essentially impose on PPSIs a global obligation to collect and verify identifying information of individual users. FinCEN and the Agencies assess that such a CIP obligation would be nearly impossible for PPSIs to implement and could potentially cripple the industry. FinCEN and the Agencies, however, seek comment on this approach and their assessment of the difficulties of such a globally applicable CIP obligation. 1. Proposed 31 CFR 1033.100(a)—Account

FinCEN and the Agencies propose adding the definition of “account” at Sec. 1033.100(a). The proposed definition resembles how “account” is defined in other CIP rules, but contains unique provisions that reflect the kinds of activities in which PPSIs can engage. It also considers, as the BSA requires, the types of accounts PPSIs may maintain.

The proposed text defines an “account” in paragraph (a)(1) as a formal relationship between a PPSI and a customer, established to provide or engage in services, dealings, or other financial transactions. The “formal relationship” language mimics most other CIP rules promulgated under the BSA.[59] FinCEN and the Agencies are proposing carrying this language over to the PPSI CIP to promote consistency, efficiency, and the ability of institutions to rely on each other for CIP procedures (subject safeguards). FinCEN and the Agencies request comment, however, on whether the formal relationship language is sufficiently clear.

[59] See 31 CFR 1020.100(a)(1) (defining “account” for bank CIP); 31 CFR 1023.100(a)(1) (defining “account” for broker-dealer CIP); 31 CFR 1026.100(a)(1) (defining “account” for futures commission merchants and introducing brokers in commodities CIP); but see 31 CFR 1024.100(a)(1) (defining “account” for mutual fund CIP as a “contractual or other business relationship”).

Similar to the definition of “account” for other financial institutions subject to CIP requirements, the proposed definition of account contains an illustrative list of activities that may fall within “services, dealings, or other financial transactions.” [60] The proposed examples are based on the GENIUS Act's provision limiting PPSI activities, including the GENIUS Act rule of construction that clarifies a PPSI can engage in digital asset service provider activities or activities incidental thereto to the extent where those activities are consistent with all other Federal and State laws and authorized by the appropriate primary Federal or State payment stablecoin regulator.[61] As proposed, the illustrative list would include: (i) issuing or redeeming a payment stablecoin; (ii) managing related reserves, including purchasing, selling, and holding reserve assets or providing custodial services for reserve assets; (iii) providing custodial or safekeeping services for payment stablecoins, required reserves, or private keys of payment stablecoins; (iv) other activities that directly support activities in paragraphs (a)(1)(i), (ii), and (iii); or (v) providing services of a digital asset service provider that are authorized by the primary Federal payment stablecoin regulator or the State payment stablecoin regulator, as applicable, consistent with all other Federal and State laws, provided that the claims of payment stablecoin holders rank senior to any potential claims of non-stablecoin creditors with respect to the reserve assets, consistent with section 11 of the GENIUS Act. FinCEN and the Agencies assess that providing such examples promotes clarity while leaving room for innovations in the industry that could create new, but similar, relationships between a PPSI and a person that involves a formal relationship and could fall under the “account” definition.

[60] See 31 CFR 1020.100(a), 1023.100(a), 1024.100(a), 1026.100(a).

[61] See 12 U.S.C. 5903(a)(7).

Unlike with other types of financial institutions with CIP requirements, an individual with no established relationship with a PPSI could hold a PPSI's product, specifically a payment stablecoin, and then seek to engage directly with a PPSI for a financial service. For example, an individual who has no established relationship with the PPSI could acquire a payment stablecoin from, for example, an exchange, and seek to redeem it with the PPSI. That redemption could establish an account with the PPSI and make the individual a customer. FinCEN requests comment on whether the CIP proposal should be refined or clarified to account for such activity.

The proposed definition also provides instances where activity does not form an account relationship. Two of these

subparagraphs are intended to make clear that purely secondary market payment stablecoin activity does not form a formal relationship between a PPSI and a payment stablecoin user or holder. That list provides that the term “account” does not include a product or service where a formal relationship is not established with a person, such as payment stablecoin activity that does not directly involve the PPSI as a party to the transaction other than via a smart contract. It also specifies that ownership or control of a PPSI's payment stablecoins alone, without other indicators of a formal relationship, does not constitute an account.

Consistent with other CIP rules, the proposed text further provides that the term “account” does not include an account that the PPSI acquires through an acquisition, merger, purchase of assets, or assumption of liabilities from a financial institution regulated by a Federal functional regulator or a bank regulated by a State bank regulator or an account opened for the purpose of participating in an employee benefit plan established under the Employee Retirement Income Security Act of 1974. 2. Proposed 31 CFR 1033.100(b)—Customer

FinCEN and the Agencies propose adding the definition of “customer” at Sec. 1033.100(b) for the purposes of a PPSI's CIP obligation. The proposal would define customer as (i) a person that opens a new account; and (ii) an individual who opens a new account for: (A) an individual who lacks legal capacity, such as a minor; or (B) an entity that is not a legal person, such as a civic club.

The proposed definition also provides that the term “customer” does not include: (i) a financial institution regulated by a Federal functional regulator or a bank regulated by a State bank regulator; (ii) a person described in Sec. 1020.315(b)(2) through (4) of 31 CFR chapter X; (iii) a person that has an existing account with the PPSI, provided the PPSI has a reasonable belief that it knows the true identity of the person; or (iv) a person acquiring or redeeming a payment stablecoin from a means other than directly from or directly to the PPSI. The final provision promotes FinCEN and the Agencies' determination that transfers of payment stablecoins on the secondary market do not make a party to the transfer a customer of a PPSI. 3. Proposed 31 CFR 1033.100(c)—Digital Asset Service Provider

FinCEN and the Agencies propose adding a definition of “digital asset service provider” at Sec. 1033.100(c) for the purposes of a PPSI's CIP obligations because the term is used in the proposed definition of “account.” As discussed, the GENIUS Act expressly reserves the ability of a PPSI to engage in the digital asset service provider activities, where such activities are authorized by the appropriate primary Federal payment stablecoin regulator or State payment stablecoin regulator.[62] To help ensure such activities are appropriately included in activities that could create an account relationship with a PPSI, FinCEN and the Agencies propose defining “digital asset service provider” for CIP purposes.

[62] 12 U.S.C. 5903(a)(7)(B).

The proposed definition of “digital asset service provider” is consistent with the definition provided in the GENIUS Act, with certain modifications in light of preexisting FinCEN regulatory definitions.[63] Under the proposed rule, the term “digital asset service provider” would mean an individual, partnership, company, corporation, association, trust, estate, cooperative organization, or other business entity, incorporated or unincorporated that, for compensation or profit, engages in business in the United States (including on behalf of customers or users in the United States) of: (A) exchanging digital assets for monetary value, meaning a national currency or deposit denominated in a national currency; (B) exchanging digital assets for other digital assets; (C) transferring digital assets to a third party; (D) acting as a digital asset custodian; or (E) participating in financial services relating to digital asset issuance. The proposed definition also provides that the term “digital asset service provider” does not include: (i) a distributed ledger protocol; (ii) developing, operating, or engaging in the business of developing distributed ledger protocols or self-custodial software interfaces; (iii) an immutable and self-custodial software interface; (iv) developing, operating, or engaging in the business of validating transaction or operating a distributed ledger; or (v) participating in a liquidity pool or other similar mechanism for the provisioning of liquidity for peer-to-peer transactions. The proposed definition of digital asset service provider will also state the meaning of “distributed ledger protocol,” as defined by 12 U.S.C. 5901(9).

[63] See 12 U.S.C. 5901(7).

This proposed definition modifies the GENIUS Act language in three respects. None of the changes are intended to substantively change the meaning of the GENIUS Act definition of digital asset service provider.

First, the proposed definition modifies the GENIUS Act definition of digital asset service provider by replacing the statutory term “person” in that definition with the text the GENIUS Act uses to define “person” in 12 U.S.C. 5901(24).[64] This change is proposed because the term “person” is already defined in FinCEN regulations at 31 CFR 1010.100(mm) [65] and differs from the GENIUS Act definition of “person.” [66] FinCEN's regulatory definition of person includes Indian Tribes as defined in the Indian Gaming Regulatory Act, which the GENIUS Act definition of person does not include. Further, FinCEN's regulatory definition also does not characterize the entities that comprise the category as “business” entities, as the GENIUS Act definition does. To ensure the definition of “digital asset service provider” for PPSIs accurately applies to the “persons” that Congress intended, as evidenced by the GENIUS Act definition of the term, FinCEN and the Agencies propose incorporating the GENIUS Act definition of person into the regulatory definition of “digital asset service provider.”

[64] See 12 U.S.C. 5901(24) (defining “person” as “an individual, partnership, company, corporation, association, trust, estate, cooperative organization, or other business entity, incorporated or unincorporated”).

[65] See 31 CFR 1010.100(mm) (defining “Person” as “An individual, a corporation, a partnership, a trust or estate, a joint stock company, an association, a syndicate, joint venture, or other unincorporated organization or group, an Indian Tribe (as that term is defined in the Indian Gaming Regulatory Act), and all entities cognizable as legal personalities”).

[66] See 12 U.S.C. 5901(24).

Second, the proposed definition of “digital asset service provider” incorporates the GENIUS Act definition of “monetary value” as provided in 12 U.S.C. 5901(17).[67] FinCEN has two similar terms, “monetary instruments” and “currency,” that are already defined in its regulations at 31 CFR 1010.100(dd) [68] and 31 CFR

1010.100(m).[69] To avoid confusion between the existing definitions and the definition in the GENIUS Act, FinCEN and the Agencies propose including the GENIUS Act definition of “monetary value” within the definition of “digital asset service provider.”

[67] See 12 U.S.C. 5901(17) (defining “monetary value” as “a national currency or deposit (as defined in section [3 of the Federal Deposit Insurance Act (12 U.S.C. 1813))] denominated in a national currency”).

[68] See 31 CFR 1010.100(dd) (defining “Monetary instruments” as “(1) Monetary instruments include: (i) Currency; (ii) Traveler's checks in any form; (iii) All negotiable instruments (including personal checks, business checks, official bank checks, cashier's checks, third-party checks, promissory notes (as that term is defined in the Uniform Commercial Code), and money orders) that are either in bearer form, endorsed without restriction, made out to a fictitious payee (for the purposes of Sec. 1010.340), or otherwise in such form that title thereto passes upon delivery; (iv) Incomplete instruments (including personal checks, business checks, official bank checks, cashier's checks, third-party checks, promissory notes (as that term is defined in the Uniform Commercial Code), and money orders) signed but with the payee's name omitted; and (v) Securities or stock in bearer form or otherwise in such form that title thereto passes upon delivery. (2) Monetary instruments do not include warehouse receipts or bills of lading.”).

[69] See 31 CFR 1010.100(m) (defining “Currency” as “[t]he coin and paper money of the United States or of any other country that is designated as legal tender and that circulates and is customarily used and accepted as a medium of exchange in the country of issuance. Currency includes U.S. silver certificates, U.S. notes and Federal Reserve notes. Currency also includes official foreign bank notes that are customarily used and accepted as a medium of exchange in a foreign country”).

Third, and finally, the proposed definition of “digital asset service provider” also incorporates the GENIUS Act definition “distributed ledger protocol” as provided in 12 U.S.C. 5901(9).[70] The term “distributed ledger protocol” is not otherwise used in the proposed regulation, so FinCEN and the Agencies propose including the term and its definition within the definition of “digital asset service provider.”

[70] See 12 U.S.C. 5901(9) (defining “distributed ledger protocol” as “publicly available and accessible executable software deployed to a distributed ledger, including smart contracts or networks of smart contracts”).

B. Proposed 31 CFR 1033.220—Customer Identification Program

1. Proposed 31 CFR 1033.220(a) and (a)(1)—Minimum Requirements

Proposed Sec. 1033.220(a) would establish the minimum standards for a CIP. Proposed Sec. 1033.220(a)(1) would require a PPSI to establish and maintain a written CIP. The CIP would be required to be appropriate for a PPSI's size and business.

As with the CIP rule for banks and other financial institutions with CIP obligations, a PPSI's CIP would be required to be a part of the PPSI's anti-money laundering and countering the financing of terrorism (AML/CFT) program. As discussed in the PPSI AML/CFT NPRM, FinCEN and the Agencies recognize the value of enterprise-wide compliance efforts. Where a PPSI is a subsidiary of an insured depository institution, FinCEN and the Agencies anticipate that the enterprise may elect to extend a single AML/CFT program to both entities and that doing so would be permissible so long as a comprehensive AML/CFT program is reasonably designed to identify and mitigate the risks posed by the different aspects of each entity's business and activities and satisfies each of the risk-based AML/CFT program and other applicable BSA and GENIUS Act requirements to which the PPSI or parent is subject. Likewise, an enterprise may elect to implement an enterprise-wide CIP rather than maintain separate CIPs for a parent and subsidiary. In doing so, however, the enterprise-wide CIP would need to account for the legal and regulatory obligations of both the parent and subsidiary. Relatedly, where a PPSI is also a national trust bank, the entity could create a single CIP covering all the entity's regulatory obligations. 2. Proposed 31 CFR 1033.220(a)(2)—Identity Verification Procedures

Proposed Sec. 1033.220(a)(2) would impose obligations related to identity verification procedures, effectuating 31 U.S.C. 5318(l)(2)(A). It would require that the CIP include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. The procedures must enable the PPSI to form a reasonable belief that it knows the identity of each customer. The procedures must be based on the PPSI's assessment of the relevant risks, including those presented by the various types of accounts maintained by the PPSI, the various methods of opening accounts provided by the PPSI, the various types of identifying information available, and the PPSI's size, location, and customer base.

As with existing CIP rules, the rule proposes to include the term “risk-based” as a descriptor of these procedures.[71] The identity verification procedures would need to be based on the PPSI's assessment of the relevant risks, and take into consideration the types of accounts the PPSI maintains, the different methods of opening accounts, and the types of identifying information available.[72] Ultimately the procedures must enable the PPSI to form a reasonable belief that it knows the true identity of the customer.[73] A risk-based framework reflects the fact that variations in customer relationships can present varying levels of risks.[74]

[71] See 31 CFR 1020.220(a)(2), 1023.220(a)(2), 1024.220(a)(2), 1026.220(a)(2).

[72] See 31 U.S.C. 5318(l)(3).

[73] See 31 U.S.C. 5381(l)(2)(A).

[74] See Board, FDIC, FinCEN, NCUA, and OCC, Joint Statement on the Risk-Based Approach to Assessing Customer Relationships and Conducting Customer Due Diligence (July 6, 2022), available at https://www.fincen.gov/news/news-releases/joint-statement-risk-based-approach-assessing-customer-relationships-and.

i. Proposed 31 CFR 1033.220(a)(2)(i)—Customer Information Required

Proposed Sec. 1033.220(a)(2)(i) would specify identifying information that a CIP must account for in procedures for opening an account. The proposed rule would require a PPSI to obtain from each customer the following information prior to opening an account: (1) name; (2) date of birth, for an individual; or date of formation, for a person that is not an individual; (3) address (a residential and mailing address for individuals, or the principal place of business, local office, or other physical address and mailing address for a person other than an individual); and (4) an identification number.

The proposed rule would require that a PPSI collect a residential or business street address for an individual. If the individual does not have a residential or business street address, the individual may provide an Army Post Office or a Fleet Post Office box number or the residential or business street address of a next of kin or another contact individual. If the customer is a corporation, partnership or trust, it must provide the address of its principal place of business, local office, or other physical location. A Post Office (PO) box is not an acceptable type of address for the purposes of the proposed rule. Similarly, although some virtual offices or commercial mail receiving agencies provide an address for an entity or individual to use, similar to a PO box, the address provided is not an actual place of business or residence for the entity or individual and does not evidence a physical location for the customer.[75] Accordingly, such addresses are not acceptable physical locations for purposes of the proposed rule.

[75] See United States Postal Service, Domestic Mail Manual, section 508.1.8 (Jan. 18, 2026), available at https://pe.usps.com/cpim/ftp/manuals/dmm300/508.pdf.

The proposed rule would also require collection of an identification number. For U.S. persons this would be a taxpayer identification number. For non-U.S. persons the identification number could be one or more of the following: a taxpayer identification number, passport number and country of issuance, alien identification card number, or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard. For a non-U.S. person that is not an individual and that does not have an identification number, the PPSI must request alternative

government-issued documentation certifying the existence of the person.

The proposed rule provides an exception for persons applying for a taxpayer identification number. However, the exception would require that the CIP include procedures for confirming that the application for a taxpayer identification number was filed, as well as obtaining the taxpayer identification number within a reasonable period of time after the account is opened. ii. Proposed 31 CFR 1033.220(a)(2)(ii)—Customer Verification

Proposed Sec. 1033.220(a)(2)(ii) relates to CIP procedures for verifying the identity of a customer using the information the PPSI has collected. The proposed rule would require that the CIP contains procedures for verifying the identity of each new customer within a reasonable period of time after the customer's account is opened. The procedures must describe when the PPSI will use documents, non-documentary methods, or a combination of both methods.

FinCEN and the Agencies recognize the interest in leveraging verifiable credentials and digital identity as part of account opening procedures.[76] Over 20 years ago when the bank CIP final rule was promulgated, FinCEN and staff of the Board, FDIC, NCUA, OCC, and the Office of Thrift Supervision (OTS) recognized in guidance that an “electronic credential” was one method that an institution could use to form a reasonable belief that it knows the true identity of its customer.[77] Since that time, digital identity tools have become more commonplace and more sophisticated. Notably, however, there are a variety of digital identity tools and applications currently in existence, as well as a significant number under development. These tools vary in how they operate and in their trustworthiness.[78]

[76] Treasury, Report to Congress from the Secretary of the Treasury on Innovative Technologies to Counter Illicit Finance Involving Digital Assets, pp. 17-22 (Mar. 2026) [hereinafter Innovation Report], available at https://home.treasury.gov/system/files/246/GENIUS-Act-Illicit-Finance-Innovation-Congressional-Report-March-2026.pdf; see also E.O. 14178 Report, supra note 37, pp. 112-13. The GENIUS Act tasked the Secretary with researching innovative or novel models, techniques, or strategies that regulated financial institutions use, or have the potential to use to detect illicit activity, including money laundering, involving digital assets, including digital identity verification solutions. 12 U.S.C. 5908. Treasury issued a request for comment in August 2025. See Treasury, Request for Comment on Innovative Methods to Detect Illicit Activity Involving Digital Assets, 90 FR 40148 (Aug. 18, 2025). Treasury issued the required congressional report on March 6, 2026.

[77] FinCEN, FAQs: Final CIP Rule, p. 6 (Jan. 2004), available at https://www.fincen.gov/system/files/guidance/finalciprule.pdf.

[78] See E.O. 14178 Report, supra note 37, p. 112.

FinCEN and the Agencies propose that technological variation and innovation are best accounted for by maintaining the flexibility in the proposal relating to how a PPSI verifies a customer's identity. This flexibility will enable individual PPSIs to assess its comfort level with the trustworthiness of various tools and take into consideration variation in tools and differences in risk. FinCEN and the Agencies expect that PPSIs would treat different digital identity tools differently. For example, a mobile ID or driver's license issued by a state could constitute an “unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard” under proposed Sec. 1033.220(a)(2)(ii)(A). A digital identity credential offered by a non-governmental entity that enables a person to prove that they are who they claim to be without revealing information other than that fact could, if appropriate as part of a risk-based procedure, be a non-documentary verification method. Accordingly, FinCEN and the Agencies are not proposing regulatory text related to verifiable credentials and digital identities, but request comment on this approach. a. Proposed 31 CFR 1033.220(a)(2)(ii)(A)—Verification Through Documents

The proposed rule states that if the PPSI is relying on documents to verify a customer's identity, then the CIP must contain procedures that set forth the documents that the PPSI will use. For an individual, the PPSI could use an unexpired government-issued identification evidencing nationality or residence that contains a photograph or similar safeguard, such as a driver's license or passport. For a person other than an individual, such as a corporation, partnership, or trust, the document must show the existence of the entity, such as certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument. b. Proposed 31 CFR 1033.220(a)(2)(ii)(B)—Verification Through Non- Documentary Methods

For a PPSI relying on non-documentary methods to verify a customer's identity, the proposed rule would require the CIP to contain procedures that set forth the non-documentary methods the PPSI will use. These methods may include contacting a customer; independently verifying the customer's identity through the comparison of information provided with respect to the customer with information obtained from a consumer reporting agency, public database, or other source; checking references with other financial institutions; or obtaining a financial statement.

Under the proposed rule, the PPSI's non-documentary procedures would be required to address situations where an individual is unable to present an unexpired government-issued identification document that bears a photograph or similar safeguard; the PPSI is not familiar with the documents presented; the account is opened without obtaining documents; the customer opens the account without meeting in person; or the PPSI is otherwise presented with circumstances that increase the risk that the PPSI will be unable to verify the true identity of a customer through documents. c. Proposed 31 CFR 1033.220(a)(2)(ii)(C)—Additional Verification for Certain Customers

Proposed Sec. 1033.220(a)(2)(ii)(C) would require that a PPSI's CIP address situations where, based on the PPSI's risk assessment of a new account opened by a customer that is not an individual, the PPSI will obtain information about individuals with authority or control over such account to verify the customer's identity. This verification method would apply only when the PPSI cannot verify the true identity of a customer that is not an individual through either documentary or non-documentary methods. iii. Proposed 31 CFR 1033.220(a)(2)(iii)—Lack of Verification

FinCEN and the Agencies believe that, while the majority of customers may be verified through documentary and non-documentary methods, there may be instances where this is not possible. Proposed Sec. 1033.220(a)(2)(iii) relates to CIP procedures in which the PPSI cannot form a reasonable belief that it knows the true identity of a customer. Under the proposed rule, these procedures would be required to describe: (1) when the PPSI should not open an account; (2) the terms under which a customer may use an account while the PPSI attempts to verify the customer's identity; (3) when the PPSI should close an account after attempts to verify a customer's identity fail; and (4) when the PPSI should file a Suspicious Activity Report in accordance with applicable law and regulation.

3. Proposed 31 CFR 1033.220(a)(3)—Records

The proposed rule in Sec. 1033.220(a)(3) states that the CIP must include procedures for making and maintaining a record of all information obtained by the PPSI through the CIP, effectuating 31 U.S.C. 5318(l)(2)(B). At a minimum, proposed Sec. 1033.220(a)(3)(i) would require that the record include: (1) all identifying information about a customer obtained under the CIP; (2) a description of any document relied on to verify the identity of the customer under the CIP, noting the type of document, any identification number contained in the document, the place of issuance, and if any, the date of issuance and expiration date; (3) a description of the methods and results of any measures undertaken to verify the identity of a customer; and (4) a description of the resolution of each substantive discrepancy discovered when verifying the identifying information obtained.

Additionally, the proposed rule states that a PPSI must retain the identifying information about a customer obtained under Sec. 1033.220(a)(3)(i)(A) for five years after the date the account is closed and the information regarding the verification of a customer's identity records collected under Sec. 1033.220(a)(3)(i)(B), (C), and (D) for five years after the record is made. 4. Proposed 31 CFR 1033.220(a)(4)—Comparison With Government Lists

Proposed Sec. 1033.220(a)(4) would require a PPSI's CIP to include reasonable procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal functional regulators, effectuating 31 U.S.C. 5318(l)(2)(C). The procedures would have to require the PPSI to make such a determination within a reasonable period of time after the account is opened, or earlier if required by another Federal law or regulation or Federal directive issued in connection with the applicable list. The procedures also would have to require the PPSI to follow all Federal directives issued in connection with such lists.

Because Treasury and the Federal functional regulators have not yet designated any such lists, the proposed rule cannot be more specific with respect to the lists PPSIs must check in order to comply with this provision. Accordingly, PPSIs would not have an affirmative duty under this proposed regulation to seek out all lists of known or suspected terrorists or terrorist organizations compiled by the Federal government. Instead, PPSIs would receive separate notification regarding the lists that must be consulted for purposes of this provision.

Many PPSIs already have procedures in place for determining whether customers' names appear on some Federal lists, including lists that identify known terrorists and terrorist organizations. For example, under current law, there are substantive legal requirements associated with lists circulated by Treasury's Office of Foreign Assets Control (OFAC). Failure to comply with these requirements may result in criminal or civil penalties. 5. Proposed 31 CFR 1033.220(a)(5)—Customer Notice

The proposed rule states in Sec. 1033.220(a)(5) that the CIP must include procedures for providing customers with adequate notice that the PPSI is requesting information to verify their identities. Under the proposed rule, notice would be considered adequate if the PPSI generally described the identification requirements of this section and provided such notice in a manner reasonably designed to ensure that a prospective customer is able to view the notice, or is otherwise given notice, before opening an account. For example, depending upon the manner in which the account is opened, a PPSI may post a notice on its website, include the notice in its account applications, or use any other form of oral or written notice. The proposed rule provides a sample notice. 6. Proposed 31 CFR 1033.220(a)(6)—Reliance on Another Financial Institution

Proposed Sec. 1033.220(a)(6) would provide that a PPSI's CIP may include procedures specifying when a PPSI may rely on another Federally regulated financial institution's performance of a procedure with respect to any PPSI customer that is opening or has opened an account. Such reliance would have to be reasonable under the circumstances, and the other financial institution on which the PPSI seeks to rely would have to be subject to an AML/CFT program with CIP requirements, as well as regulated by a Federal functional regulator.[79] Additionally, the institutions would have to have a contract requiring the institution on which the PPSI seeks to rely to certify annually to the PPSI that it has implemented an AML/CFT program and will perform (or its agent will perform) the specified requirements of the PPSI's CIP. Critically, this proposed provision would not change a PPSI's CIP obligation, and the PPSI would remain responsible for its compliance.

[79] See 31 CFR 1010.100(r) (defining “Federal functional regulator” as “(1) The Board of Governors of the Federal Reserve System; (2) The Office of the Comptroller of the Currency; (3) The Board of Directors of the Federal Deposit Insurance Corporation; (4) The Office of Thrift Supervision; (5) The National Credit Union Administration; (6) The Securities and Exchange Commission; or (7) The Commodity Futures Trading Commission”).

This proposal is consistent with other CIP requirements under the BSA, including the bank CIP regulation where, critically, some banks-- but not all banks—are overseen by a Federal functional regulator.[80] It does, however, create a disparity between PPSIs that fall under a primary Federal payment stablecoin regulator and a State payment stablecoin regulator.[81] A State qualified payment stablecoin issuer would be able to rely on, for example, a procedure performed by a PPSI that is a subsidiary of an insured depository institution. But a PPSI that is a subsidiary of a Federally regulated depository institution, would not be able to rely on a procedure performed by a State qualified payment stablecoin issuer because such issuers are not overseen by a Federal functional regulator.

[80] See FinCEN, Customer Identification Program, Anti-Money Laundering Programs, and Beneficial Ownership Requirements for Banks Lacking a Federal Functional Regulator, 85 FR 57129 (Sept. 15, 2020) (amending 31 CFR 1020.220 so banks lacking a Federal functional regulator are covered by the bank CIP rule).

[81] Compare 12 U.S.C. 5905 with 12 U.S.C. 5906.

While the proposal would not permit a PPSI to rely on another entity to perform a CIP procedure unless such an entity is another Federally regulated financial institution, it should not be construed as restricting appropriate use of third parties to perform a service related to a PPSI's CIP on the PPSI's behalf.[82] In such cases, however, the CIP obligation would remain with the PPSI.

[82] Such third-party arrangements are contemplated, for example, in FAQs issued by FinCEN, the Board, FDIC, NCUA, OCC, and OTS. See Board, FDIC, FinCEN, NCUA, OCC, and OTS, Interagency Interpretative Guidance on Customer Identification Program Requirement under Section 326 of the USA Patriot Act, Customer Notice FAQ 2 (Apr. 28, 2005), available at https://www.fincen.gov/resources/statutes-regulations/guidance/interagency-interpretive-guidance-customer-identification.

C. Proposed 31 CFR 1033.220(b)—Exemptions

Proposed Sec. 1033.220(b) would provide that the appropriate Federal functional regulator, with the concurrence of the Secretary, may by order or regulation, exempt any PPSI or any type of account from the

requirements of this section. It also provides that the Secretary, with the concurrence of the Federal functional regulator, may exempt any PPSI or any type of account from the requirements of this section.

In issuing such exemptions, the Federal functional regulator and the Secretary would consider whether the exemption is consistent with the purposes of the BSA and with safety and soundness, as well as in the public interest. It would also permit the Federal functional regulator and Secretary to consider other necessary and appropriate factors. Given that the GENIUS Act identifies the OCC, Board, FDIC, and NCUA as a primary Federal payment stablecoin regulator for PPSIs under their respective jurisdictions, in this proposed rule, FinCEN and the Agencies retain “Federal functional regulator” consistent with its use in the BSA CIP exemption provision, providing the Secretary of the Treasury and the Federal functional regulator joint authority to issue an exemption.[83]

[83] See 31 U.S.C. 5318(l)(5).

D. Proposed 31 CFR 1033.220(c)—Other Requirements Unaffected

Proposed Sec. 1033.220(c) clarifies that nothing in Sec. 1033.220 relieves a PPSI of its obligation to comply with any other provision of chapter X, including provisions concerning information that must be obtained, verified, or maintained in connection with any account or transaction, including requirements to have the technological capability to comply with and to comply with the terms of any lawful order.[84]

[84] See 12 U.S.C. 5903(a)(6)(B).

E. Compliance Date

FinCEN and the Agencies propose that the rule would be effective 12 months after issuance of the final rule to allow sufficient time for PPSIs to review and implement the requirements of the proposed rule.

VI. Request for Comments

FinCEN and the Agencies seek comments on all aspects of the proposed rule and specifically seek comments on the following topics. For all responses, commenters are encouraged to provide the basis for any conclusions drawn in their comments.

1. Should any CIP requirement be extended to secondary market activity? If yes, in what circumstances? What would be the benefits and drawbacks of doing so?

2. Should FinCEN and the Agencies refine or clarify its definitions of account, customer, or digital asset service provider? Are additional definitions needed?

3. Should FinCEN and the Agencies retain “formal relationship” as part of the definition of account? What are the hallmarks of a “formal relationship” between a PPSI and a user? Should FinCEN and the Agencies provide examples or attributes of a formal relationship in guidance? Would other concepts be a better foundation for the account definition, such as a contractual or business relationship, and why?

4. Should the proposed rule be clarified or refined to account for situations where a customer's only desired relationship with a PPSI is to redeem a payment stablecoin?

5. Should the regulatory text explicitly discuss digital identity solutions or verifiable credentials? How could it best do so given the range of tools available on the market?

6. What are the benefits and risks of using digital identity solutions or verifiable credentials as part of verifying customers' identities?

7. What is the expected likelihood that a PPSI would rely on another PPSI's CIP or the CIP of another Federal functionally regulated financial institution's CIP?

8. What, if anything, could be changed to make the proposed rule more conducive to industry innovation? Explain how any changes would positively or negatively impact PPSIs expected operations and illicit finance risk to the U.S. financial system.

VII. Executive Order 14294

Section 5 of Executive Order 14294 directs that all future notices of proposed rulemaking (NPRMs) and final rules published in the Federal Register, the violation of which may constitute criminal regulatory offenses, should include a statement identifying that the rule or proposed rule is a criminal regulatory offense and the authorizing statute.[85] Executive Order 14294 directs agencies to draft this statement in consultation with the Department of Justice.

[85] E.O. 14294, Fighting Overcriminalization in Federal Regulations, 90 FR 20363, sec. 5 (May 14, 2025).

Executive Order 14294 further directs that the regulatory text of all NPRMs and final rules with criminal consequences published in the Federal Register after May 9, 2025 should explicitly state a mens rea requirement for each element of a criminal regulatory offense, accompanied by citations to the relevant provisions of the authorizing statute.

Willful violations of the proposed regulations set forth in this proposed rule, if finalized, may be subject to criminal penalties pursuant to 31 U.S.C. 5322 and regulations promulgated in 31 CFR chapter X. The statutory authority for criminal liability requires a mens rea of willfulness as an element pursuant to 31 U.S.C. 5322(a) and 31 U.S.C. 5322(b). FinCEN's existing regulation, 31 CFR 1010.840, that sets out criminal penalties for violations of regulations promulgated in 31 CFR chapter X also includes a mens rea of willfulness. The Department of Justice was consulted in drafting this statement.

VIII. Regulatory Impact Analysis

FinCEN and the Agencies have analyzed the proposed rule as required under E.O. 12866,[86] E.O. 13563,[87] E.O. 14192,[88] the Regulatory Flexibility Act (RFA),[89] the Unfunded Mandates Reform Act of 1995 (UMRA),[90] the Paperwork Reduction Act (PRA),[91] the Riegle Community Development and Regulatory Improvement Act of 1994,[92] the Gramm- Leach-Bliley Act,[93] and the Providing Accountability Through Transparency Act of 2023.[94]

[86] E.O. 12866, Regulatory Planning and Review, 58 FR 51736 (Oct. 4, 1993).

[87] E.O. 13563, Improving Regulation and Regulatory Review, 76 FR 3821 (Jan. 21, 2011).

[88] See E.O. 14192, Unleashing Prosperity Through Deregulation, 90 FR 9065 (Feb. 6, 2025); Office of Management and Budget (OMB), M-25-20, Guidance Implementing Section 3 of Executive Order 14192, Titled “Unleashing Prosperity Through Deregulation,” (Mar. 26, 2025), available at https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-20-Guidance-Implementing-Section-3-of-Executive-Order-14192-Titled-Unleashing-Prosperity-Through-Deregulation.pdf.

[89] 5 U.S.C. 601 et seq.

[90] 2 U.S.C. 1532.

[91] 44 U.S.C. 3506(c)(2)(A), 3507(a)(1)(D).

[92] 12 U.S.C. 4802(a).

[93] Public Law 106-102, section 722, 113 Stat. 1338, 1471 (1999), 12 U.S.C. 4809.

[94] 5 U.S.C. 553(b)(4).

The Office of Information and Regulatory Affairs in the Office of Management and Budget (OMB) has determined this proposed rule to be a “significant regulatory action” under section 3(f) of E.O. 12866. FinCEN and the Agencies have included an Initial Regulatory Flexibility Analysis (IRFA) pursuant to the RFA as the proposed rule may have a significant economic impact on a substantial number of certain types of potentially affected small entities.[95] Pursuant to analysis

required by UMRA, FinCEN and the Agencies conclude it is unlikely that the proposed rule, if implemented, would result in a novel annual expenditure of more than $193 million by State, local, and Tribal governments or by the private sector.[96]

[95] This economic expectation is sensitive to key assumptions about how potentially affected financial institutions would respond to the proposed requirements. FinCEN requests comment on whether it would instead be more reasonable to certify that the proposed rule would not have a significant economic impact on a substantial number of small entities, given that the Agencies are certifying for their respective entities.

[96] The UMRA requires an assessment of mandates with an annual expenditure of $100 million or more, adjusted for inflation. 2 U.S.C. 1532(a). FinCEN and the Agencies have not anticipated material changes in expenditures for State, local, and Tribal governments, insofar as they would not participate in the primary activities of monitoring or enforcing compliance of the newly proposed requirements in a way that differs from current involvement, thereby incurring novel incremental costs. But because the proposed rule would affect entities in the private sector that are covered financial institutions, FinCEN and the Agencies have considered expenditures these private entities may incur, pursuant to UMRA, as part of the regulatory impact in its assessment below.

As described above,[97] the proposed rule would implement the GENIUS Act's directives to treat PPSIs as financial institutions for purposes of the BSA and to require such issuers to maintain an “effective customer identification program, including identification and verification of the identity of account holders.” [98] It includes proposed requirements for a PPSI to establish and maintain a written CIP; maintain risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable; maintain certain records; and compare the customers' identity with government lists. The proposal would also require a PPSI to include procedures for customer notice related to verifying identity, allows reliance on another financial institution's CIP under certain circumstances, and outlines the ability of FinCEN and the Agencies to issue exemptions related to the CIP requirement.

[97] See supra section I; see also supra section V.

[98] See 31 U.S.C. 5903(a)(5)(A), 5903(a)(5)(A)(v); see also 31 U.S.C. 5318(l).

In issuing this proposal, FinCEN and the Agencies contemplate a number of benefits for PPSIs, regulators, other compliance examiners, law enforcement and national security agencies, and the general public. Such benefits include CIPs that effectively contribute to the detection and deterrence of money laundering and terrorist financing, support broader BSA policy goals, and help ensure that CIPs for PPSIs are consistent with those required for other financial institution types with CIP requirements, which should promote efficiencies and reduce opportunities for regulatory arbitrage.

This regulatory impact analysis (RIA) begins by describing the broad economic analysis FinCEN and the Agencies undertook to inform their expectations of the proposed rule's economic impact and burden.[99] This is followed by pieces of additional and, in some cases, more specifically tailored analysis as required by E.O.s 12866, 13563, and 14192; [100] the RFA; [101] the UMRA; [102] and the PRA.[103] Requests for comments related to the RIA—regarding specific findings, assumptions, or expectations, or with respect to the analysis in its entirety—can be found in the final subsection.[104] These requests for comments have been previewed throughout the RIA.

[99] See infra section VIII.A.

[100] See infra section VIII.B.

[101] See infra section VIII.C.

[102] See infra section VIII.D.

[103] See infra section VIII.E.

[104] See infra section VIII.F.

A. Assessment of Impact

Consistent with best practices in regulatory economic analysis, FinCEN and the Agencies' assessment of impact begins with an overview of broad economic considerations, identifying, among other things, the need for the policy intervention.[105] Next, FinCEN and the Agencies (1) establish baseline estimates of the number of covered PPSIs and other entities, including insured depository institutions, that could be affected by the proposed rule, and (2) describe the current regulatory requirements and background practices against which the proposed rule would introduce changes.[106] The analysis then briefly reviews elements of the proposed rule that most directly inform how foreseeable economic impacts would flow from how PPSIs and their respective regulators would engage in activities not expected to otherwise be undertaken in order to comply.[107] Next, the RIA presents the anticipated benefits and estimated costs to the respective affected parties that would be associated with the proposed CIP obligations.[108] Finally, the assessment concludes with a brief discussion of alternative policies FinCEN and the Agencies considered and could have proposed, including an evaluation of the relative economic merits of each against the expected value of the rule as proposed.[109]

[105] See infra section VIII.A.1.

[106] See infra section VIII.A.2.

[107] See infra section VIII.A.3.

[108] See infra section VIII.A.4.

[109] See infra section VIII.A.5.

1. Broad Economic Considerations

In performing its assessment of impact, FinCEN and the Agencies took into consideration certain fundamental economic problems that the proposed rule is expected to address as well as the general social and economic costs that may ensue from an AML/CFT and CIP regime for PPSIs that is ineffective. Because this NPRM is being issued pursuant to statutory obligations,[110] the necessity for FinCEN and the Agencies to independently identify and articulate fundamental economic problems that the proposed rule is intended to address, as the basis for regulatory action,[111] is attenuated because at best this activity would complement the problem identification already performed by Congress.[112] Nevertheless, FinCEN and the Agencies have remained mindful of these animating considerations as well as the general social and economic costs that may ensue from an ineffective AML/CFT regime.[113]

[110] See 12 U.S.C. 5903(a)(5)(A)(v); see also generally, supra section II.

[111] See E.O. 12866, Regulatory Planning and Review, 58 FR 51736, section 1(b)(1) (Oct. 4, 1993) (“Each agency shall identify the problem that it intends to address (including, where applicable, the failures of private markets or public institutions that warrant new agency action) as well as assess the significance of that problem.”).

[112] See 12 U.S.C. 5903(a)(5)(A)(v).

[113] In a related context, with respect to AML/CFT programs, Congress instructed FinCEN to consider the potential economic inefficiencies engendered by the presence of market externalities when promulgating implementing regulations. See 31 U.S.C. 5318(h)(2)(B)(i) (stating financial institutions are spending private compliance funds for a public and private benefit, including protecting U.S. financial system from illicit finance risks); see also 31 U.S.C. 5318(h)(2)(B)(iii) (stating that AML/CFT programs safeguard national security and generate significant public benefits by preventing illicit flows of funds and assisting law enforcement and national security agencies with information).

FinCEN and the Agencies expect that the proposed rulemaking would meaningfully alleviate certain underlying economic problems that could otherwise impair the effective administration of the BSA and potentially distort affected markets. These include potential problems that flow from the incidence of both positive and negative externalities in connection with customer identification activity and the potential for regulatory arbitrage in the absence of uniform minimum standards for financial institutions' CIPs.[114]

[114] See, e.g., FinCEN, Anti-Money Laundering and Countering the Financing of Terrorism Programs, 89 FR 55428, 55450 (July 3, 2024).

The expected benefits of the proposed rule, as discussed below,[115] are therefore linked by the extent to which the proposed requirements would address these fundamental economic problems.

[115] See infra section VIII.A.4.i.

2. Institutional Baseline and Affected Parties

In proposing this rule, FinCEN and the Agencies considered the

incremental impacts of the proposed CIP requirements relative to the current state of the affected markets and their participants.[116] This baseline analysis of the parties that would be affected by the proposed rule, their current CIP-like obligations and activities, and the costs and/or benefits associated with those activities satisfies analytical best practices by describing the alternative of not pursuing the proposed, or any other, novel regulatory action.[117] In each case, the RIA has attempted to identify the incremental expected economic effects of each component of the proposal as precisely as practicable against this baseline. Nevertheless, in certain cases, FinCEN and the Agencies can only make qualitative assessments.

[116] In this context, FinCEN and the Agencies employ the term “market” in its broadest economic sense, referring to any set of exchanges, transactions, or actions that involve counterparties with unique objectives. The baseline here set forth also forms the counterfactual against which the quantifiable effects of the rule are measured; therefore, substantive errors in or omissions of relevant data, facts, or other information may affect the conclusions formed regarding the general and economically significant impacts of the rule. FinCEN and the Agencies invite comment on the accuracy of the baseline population estimates as well as any supporting studies, data, or anecdotes.

[117] See E.O. 12866, supra note 86, at section 1(a) (“In deciding whether and how to regulate, agencies should assess all costs and benefits of available regulatory alternatives, including the alternative of not regulating.”).

As a first step in the process of isolating these anticipated marginal effects, FinCEN and the Agencies assessed the regulatory and market landscape facing the current stablecoin issuers, and potential future PPSIs, that would be affected by the proposed rule, including an estimate of the expected near-term number of potential PPSIs, their existing regulatory requirements, and the burden they either would or currently face in connection with the compliance activities the proposed rule would require. FinCEN and the Agencies also briefly discuss other categories of persons and entities (i.e., regulators, compliance examiners, law enforcement and national security agencies, and certain members of the general public) that are expected to be directly affected by the proposed rule. i. Regulatory Baseline

As discussed in section II, stablecoin issuers are already subject to BSA obligations as MSBs, specifically, money transmitters. As MSBs, stablecoin issuers are currently subject to a range of BSA obligations. MSBs are required to, for instance, (i) establish and maintain written AML programs [118] that include policies, procedures, and internal controls to verify customer identification; [119] (ii) file currency transaction reports; [120] (iii) file Suspicious Activity Reports (SARs); [121] and (iv) maintain certain records, including those relating to certain transmittals of funds.[122] MSBs are required to register with FinCEN [123] and are subject to examination for BSA compliance by the Internal Revenue Service (IRS).[124]

[118] 31 CFR 1022.210.

[119] 31 CFR 1022.210(d)(1)(i)(A).

[120] 31 CFR 1022.310.

[121] 31 CFR 1022.320.

[122] 31 CFR 1022.400, 1010.410(e)-(f).

[123] 31 CFR 1022.380.

[124] 31 CFR 1010.810(b).

While MSBs are not subject to as many customer identification requirements as other types of financial institutions under the BSA, the BSA does require them to maintain policies, procedures, and internal controls to verify customer identification [125] and to collect identification information for transmittals of funds over $3,000—including the name, address, and identification document of an individual requesting transmission [126]—and for transactions in currency of more than $10,000.[127]

[125] 31 CFR 1022.210(d)(1)(i)(A).

[126] 31 CFR 1010.410(e)(1).

[127] 31 CFR 1010.311, 110.312.

ii. Baseline of Expected Affected Parties

FinCEN and the Agencies have identified four distinct populations expected to be directly affected, to varying degree, by the proposed rule, namely: (1) PPSIs, (2) customers of PPSIs, (3) certain other financial institutions, and (4) other less directly affected parties, including regulators (including examiners working for or under the authority of those regulators) and law enforcement and national security agencies. To the extent that economic impact on additional key, directly affected subpopulations of the general public should be considered, FinCEN and the Agencies invite comments, data, studies, or reports that would enhance its ability to identify and quantify such effects. a. PPSIs

FinCEN and the Agencies have conducted independent research with a view to estimating the number of potential PPSIs that would exist in the near-term future.[128] Taking each of those independent exercises into consideration, the proposed rule could be expected to apply to approximately 50 PPSIs in each of the first three years of the GENIUS Act being effective. Table 1 illustrates the anticipated distribution of these potential PPSIs as organized by types as categorized in the GENIUS Act's definition of “permitted payment stablecoin issuer” [129] and proposed definition Sec. 1010.100(ttt). That proposed definition contains three subtypes of PPSIs, specifically those that are subsidiaries of insured depository institutions or credit unions that have been approved to issue payment stablecoins by a primary Federal payment stablecoin regulator (collectively “subsidiaries of insured depository institutions”); Federal qualified payment stablecoin issuers (FQPSIs); and State qualified payment stablecoin issuers (SQPSIs).[130] As explained in proposed Sec. 1010.100(vvv), a FQPSI is an entity approved by the OCC under 12 U.S.C. 5903 to issue payment stablecoins and is either—(1) a nonbank entity, (2) an uninsured national bank, or (3) a Federal branch.[131]

[128] See, e.g., FDIC, Approval Requirements for Issuance of Payment Stablecoins by Subsidiaries of FDIC-Supervised Insured Depository Institutions, 90 FR 59409 (Dec. 19, 2025); NCUA, Investments in and Licensing of Permitted Payment Stablecoins Issuers, 91 FR 6531 (Feb. 12, 2026); OCC, Implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the Office of the Comptroller of the Currency, 91 FR 10202 (Mar. 2, 2026); FDIC, GENIUS Act Requirements and Standards for FDIC- Supervised Permitted Payment Stablecoin Issuers and Insured Depository Institutions, 91 FR 18534 (Apr. 10, 2026).

[129] 12 U.S.C. 5901(23).

[130] See PPSI AML/CFT NPRM, at section VI.C.1.ix, supra note 4; see also 12 U.S.C. 5901(23).

[131] See PPSI AML/CFT NPRM, at section VI.C.1.ix, supra note 4; see also 12 U.S.C. 5901(23).

FinCEN expects that of the 50 anticipated PPSIs, approximately 60 percent should be subsidiaries of insured depository institutions and 40 percent not.132 133 Because FinCEN has not identified, with more certainty than not, currently operating stablecoin issuers that it expects will become SQPSIs within the PPSI regulatory framework (as defined in proposed Sec. 1010.100(ttt)(3) and Sec. 1010.100(xxx)), the population used in this analysis does not further distinguish its estimate for these types of potential future PPSIs from other non-IDI subsidiary expected future PPSIs.[134] Because these projections represent best-effort estimates based on limited information,

the public is strongly encouraged to provide additional comments, data, and other information that could enhance the accuracy and precision of these estimates.

[132] See PPSI AML/CFT NPRM, at sections VI.C.1.xi and xiii, supra note 4; see also 12 U.S.C. 5901(11), (31).

[133] The OCC estimates that within the first year of the GENIUS Act being effective, 12 currently non-OCC regulated institutions would have PPSI-affiliated subsidiaries and 12 OCC-regulated depository institutions would have PPSI affiliated subsidiaries.

[134] See PPSI AML/CFT NPRM, at section VI.C.1.xiii, supra note 4; see also 12 U.S.C. 5901(31). [graphic omitted]

b. Customers of PPSIs

FinCEN and the Agencies expect the general public to be affected by the proposed rule, with certain subpopulations affected more directly than others. In particular, FinCEN and the Agencies considered customers of PPSIs, as the term “customer” is proposed to be defined in this rulemaking. Although estimated payment stablecoin users number in the hundreds of millions, a substantially smaller number (in the hundreds of thousands) are likely to interact with PPSIs in the primary market. Many of these customers are large financial institutions and most large stablecoin issuers set significant financial requirements for primary market participants that exclude retail-level participation. In terms of volume, most primary market activity can be attributed to these large entities. Most primary market activity, as measured in transaction volume, is attributable to these large entities. However, some issuers have increasingly adopted wider-facing mint/redeem models that seek to include smaller investors and businesses.

To estimate the number of expected primary market customers a future PPSI might interact with, FinCEN examined current on-chain minting and redemption activity as observable from publicly available data. Almost all the stablecoin products meeting the GENIUS Act's definitional criteria for future payment stablecoins that FinCEN reviewed had fewer than 1,000 primary market customers in a given year, which is consistent with prior expectations of high institutional barriers. However, a small number of the stablecoins reviewed had significantly more primary market contact (with over 250,000 customers) in a given year. In the sample of issuers FinCEN reviewed, the average number of an issuer's primary market customers was approximately 17,000, but this value appeared to be driven by extreme outliers. The truncated average was approximately 1,000, and the median value was 100.[135]

[135] To address the impact of extreme outliers, the truncated mean was estimated by removing six percent of the sample from the left and right tails of the distribution (the single smallest and largest values). The largest value was more than three standard deviations away from nearest value, making it a significant outlier.

Based on this analysis, FinCEN estimate that the “average” PPSI would have approximately 1,000 primary market customers that it interacts with directly, including issuing and redeeming payment stablecoins and engaging in digital asset service provider activities where those activities are authorized by the appropriate primary Federal or the State payment stablecoin regulator and consistent with all other Federal and State laws. However, some PPSIs are expected to have substantially more or substantially less customers than this estimate. In total, FinCEN does not expect the total number of unique primary market PPSI customers to exceed 300,000. However, FinCEN estimates that a substantial portion of these customers may be affiliates of a single counterparty or associated with non-U.S. entities.[136] FinCEN estimates that the number of customers that are U.S. businesses is likely no more than 10,000. As described earlier, these businesses belong to several categories, including digital asset exchanges, specialized digital asset commodities traders, and other types of investment- and securities-related businesses. Besides digital asset exchanges, FinCEN expects most of a PPSI's other customers are likely to be financial institutions.[137]

[136] In cases where these entities are not U.S. persons, the incremental economic burdens of the proposed rule, while considered as part of the broader economic analysis, are not included in the IRFA because RFA considerations apply to U.S. small entities only.

[137] Such firms would be classified under North American Industry Classification System (NAICS) industry code 523 (“Securities, Commodity Contracts, and Other Financial Investments and Related Activities”).

FinCEN also used publicly available data on on-chain minting and redemption activity to analyze annual rates of customer growth and turnover. Many of the stablecoin issuers reviewed retained the same group of large “core” primary market customers year over year but exhibited significant turnover among their smaller primary market customers. In addition, most stablecoin issuers saw significant growth in their primary market customer base during 2025. For purposes of modeling expected economic effects, FinCEN and the Agencies assume that this growth will continue, particularly among stablecoin issuers that are able to secure PPSI registration. Of the stablecoin issuers FinCEN reviewed, the average rate of new customer inflow, year over year, was approximately 65 percent of the number of existing, previous customers. Therefore, FinCEN and the Agencies apply this rate, where relevant, when estimating the costs in the remaining analysis. c. Other Financial Institutions

Certain other financial institutions may be affected by the proposed rule. Although FinCEN and the Agencies cannot, at this time, provide the specific number of expected affected financial institutions in either category, there are two particular categories that could reasonably be expected to be affected by the proposed CIP requirements for PPSIs.

The first category includes insured depository institutions that have a PPSI as a subsidiary. Because this RIA projects that there may be up to 30 such PPSIs in the next three years, the corresponding number of expected affected insured depository institutions would also be up to 30. It is anticipated that an insured depository institution would arrange for its subsidiary PPSI's CIP to nest within the preexisting overall CIP structure of the parent organization. As such, parent organizations may be economically affected by the need to revise, expand, or otherwise tailor existing CIPs. FinCEN and the Agencies expect, however, that similarities between the existing CIP rule for banks and this proposal would minimize, though not eliminate, this cost.

The second category of financial institutions expected to be affected by the proposed CIP requirements includes those financial institutions already subject to their own CIP obligations on which one or more PPSIs would be able to rely for the performance of aspect of its CIP obligations, pursuant to proposed Sec. 1033.220(a)(6), or which themselves could rely upon a PPSI for the performance of some aspect of their own CIP obligations, pursuant to the provision of the financial institution's CIP regulation analogous to proposed Sec. 1033.220(a)(6).[138] Table 2 presents the total number of financial institutions already subject to CIP obligations, which represents the maximum number of potentially affected parties in this category. FinCEN considers it unlikely that all, or even many, of these 14,575 financial institutions would either be relied upon by PPSIs for some aspect of the PPSI's CIP compliance or rely upon PPSIs for some aspect of the institution's CIP.[139] FinCEN and the Agencies acknowledge, however, that this expectation is somewhat

speculative and are interested in receiving comments on the anticipated likelihood of this outcome.

[138] See, e.g., 31 CFR 1020.220(a)(6) (analogous CIP provision applicable to banks).

[139] Proposed Sec. 1033.220(a)(6)(iii) would require that “[t]he other financial institution [. . .] certify annually to the permitted payment stablecoin issuer that it has implemented its AML/ CFT program, and that it will perform (or its agent will perform) specified requirements of the permitted payment stablecoin issuer's CIP.” A bank that is not examined by a Federal functional regulator (FFR) may rely on another financial institution's CIP where that institution is overseen by an FFR. However, another financial institution cannot rely on the CIP of a bank that is not examined by an FFR. See 31 CFR 1020.220(a)(6)(ii).

Table 2—Estimates of Financial Institution Types With Existing CIP

Requirements

Number of

Financial institution type \a\ financial

institutions

Banks with a Federal functional regulator (FFR) \b\.....       \c\ 8,623
Banks without an FFR \d\................................         \e\ 365
Broker-Dealers \f\......................................       \g\ 3,278
Mutual Funds \h\........................................       \i\ 1,355
Futures Commission Merchants (FCMs) and Introducing              \k\ 954
 Brokers in Commodities (IBCs) \j\......................
                                                         ---------------
    Total...............................................          14,575
------------------------------------------------------------------------

\a\ See 31 U.S.C. 5312(a)(2); 31 CFR 1010.100(t) (definition of

financial institution). \b\ See 31 CFR 1010.100(t)(1); 31 CFR 1010.100(d); 31 CFR 1020.210(a);

31 CFR 1020.220 (CIP requirements for banks). \c\ This includes 4,336 FDIC-insured depository institutions (i.e.,

Federally regulated banks) according to the FDIC's Quarterly Bank

Profile for Q4 2025, p. 2 (https://www.fdic.gov/quarterly-banking-profile/past-quarterly-banking-profiles). It also includes 4,287 NCUA-

chartered credit unions (i.e., Federally regulated credit unions) as

of December 31, 2025, according to the NCUA's Quarterly Credit Union

Data Summary: 2025 Q4, p. i (https://ncua.gov/analysis/credit-union-corporate-call-report-data/quarterly-data-summary-reports). \d\ See 31 CFR 1020.210(b); 31 CFR 1020.220 (CIP requirements for

banks). \e\ The Board of Governors of the Federal Reserve System Master Account

and Services Database (https://www.federalreserve.gov/paymentsystems/master-account-and-services-database-existing-access.htm) contains

data as of November 30, 2025 on financial institutions that use

Federal Reserve Bank financial services, including those with no

additional Federal regulator. FinCEN used this data to identify 365

banks and credit unions with no additional Federal regulator using

Federal Reserve Bank financial services. \f\ See 31 U.S.C. 5312(a)(2)(G); 31 CFR 1010.100(t)(2); 31 CFR 1023.220

(CIP requirements for broker-dealers). \g\ This estimate is based on U.S. Securities and Exchange Commission

(SEC) data on active broker-dealers available at “Company Information

About Active Broker-Dealers” (https://www.sec.gov/foia-services/frequently-requested-documents/company-information-about-active-broker-dealers dealers), which listed 3,278 active broker-dealers registered with the

SEC as of December 31, 2025. \h\ See 31 U.S.C. 5312(a)(2)(I); 31 CFR 1010.100(t)(10); 31 CFR 1024.220

(CIP requirements for mutual funds). \i\ This estimate is based on the number of N-1A registrants in SEC's

Annual Registered Investment Company Update: Form N-CEN Data, Period

Ending December 2024, April 2025, table 1.3, p. 4 (https://www.sec.gov/files/annual-registered-investment-company-update-20250404.pdf). \j\ See 31 U.S.C. 5312(a)(2)(H); 31 CFR 1010.100(t)(8-9); 31 CFR

1026.220 (CIP requirements for FCMs and IBCs). \k\ According to Commodity Futures Trading Commission data on FCMs

available at “Financial Data for FCMs” (https://www.cftc.gov/MarketReports/financialfcmdata/index.htm), there were 66 registered

FCMs as of December 31, 2025. The number of IBCs as of December 31,

2025 (888) was obtained from the National Futures Association “NFA

Membership and Registration” website (https://www.nfa.futures.org/registration-membership/membership-and-directories.html). Because

deduplication of entities registered as both FCMs and IBCs was not

feasible, this estimate may double-count some entities registered in

both categories. FinCEN, however, believes this subpopulation may be

small.

d. Other Affected Parties

Regulators and Compliance Examiners: Examiners required to verify whether CIP obligations are being followed by PPSIs would be directly affected by the proposed rule.[140] In a separate rulemaking, FinCEN is proposing changes to its existing regulations to effectuate the GENIUS Act's direction to apply BSA obligations to PPSIs.[141] FinCEN's PPSI AML/CFT NPRM includes a proposal to (1) amend 31 CFR 1010.810(b) to delegate examination authority to the primary Federal payment stablecoin regulators (the Agencies) and (2) assert that its existing regulations delegates examination authority to the IRS for the SQPSIs.[142] As a function of the proposal in that NPRM, this proposed rule is expected to directly affect FinCEN as well as the primary Federal payment stablecoin regulators, i.e., the Agencies, and their compliance examiners, who number approximately 7,500 from the Agencies, plus several hundred additional examiners from the IRS.[143]

[140] Certain state regulators may be affected in a way that is comparable to the effects on Federal regulators. However, given that the GENIUS Act sets out a federal regulatory framework with certain tasks for Federal regulators, it is difficult at this time to do more than speculate about what actions states may take, and therefore the Agencies did not attempt to estimate the effect of this rule on state regulatory agencies. However, the Agencies are interested in receiving comments offering assessments on this subject.

[141] See PPSI AML/CFT NPRM, supra note 4.

[142] Id.

[143] These figures represent an approximate number of Federal examiners.

Law Enforcement and National Security Agencies: Law enforcement and national security agencies can directly access and use reports provided to FinCEN in compliance with the AML/CFT requirements after entering a memorandum of understanding with FinCEN. As of fiscal year 2024, 432 federal, state, and local law enforcement; regulatory; and national security agencies had access to BSA reports and BSA Search, and the BSA Portal had over 12,000 authorized personnel with access.[144] While CIP obligations do not include express reporting requirements that would provide data directly to law enforcement or regulators, they support overall AML/CFT obligations and are complementary to the direct benefits of those programs for law enforcement. For instance, effective CIP practices include retaining standardized records that may support future law enforcement and national security needs and may improve the efficacy of certain types of BSA reporting, such as SARs, by providing PPSIs with additional data on existing or potential customers.

[144] See FinCEN, Financial Crimes Enforcement Network (FinCEN) Year in Review for Fiscal Year 2024, p. 5, available at https://www.fincen.gov/system/files/2025-08/FinCEN-Infographic-Public-2025-508.pdf. Note that not all users are from external agencies. FinCEN employees are also among the users with access to the BSA Portal.

iii. Current Market Practices

In considering the impact of the proposed rule, FinCEN and the Agencies considered certain relevant features and CIP practices of current stablecoin issuers that could meet the proposed definitional criteria of PPSI.

In defining current practices, it is first important to distinguish stablecoins in general from the narrower concept of a payment stablecoin as defined by the GENIUS Act. As discussed earlier, stablecoins that carry indicators they could be payment stablecoins are only a subset of the overall market of stablecoins, although they represent

over 80 percent of the total market value.[145] Payment stablecoins have several features that make CIP compliance more practical for their issuers. Most importantly, PPSIs are likely to have a centralized issuance structure in which the issuer is obliged to redeem upon demand the advertised fixed value for every coin issued. As opposed to decentralized issuance structures, where users can anonymously mint, trade, and redeem their own coins on a decentralized blockchain largely free of any third-party interface, centralized issuance structures allow a collection point for customer information and transaction records for primary-market transactions.

[145] Among the approximately 352 stablecoin products evaluated by FinCEN, those products with indicia of being a potential PPSI or foreign payment stablecoin issuer payment stablecoin represented about 63 products, or less than 18 percent of all products examined. However, the market value of these products represented approximately 80 percent of the market value of the sample.

In order to collect, screen, and store customer information in the course of business, stablecoin issuers and other financial market participants often employ software technologies especially suited for this purpose. These third-party services provide customer identity information verification and screening to collect and verify personal information such as name or address, and to identify whether someone wishing to open an account is on a list of known or suspected terrorists or terrorist organizations, among other functions. These activities may be performed in the ordinary course of business but are also expected to occur because stablecoin issuers have AML/CFT program obligations as MSBs.[146]

[146] See 31 CFR 1022.210; PPSI AML/CFT NPRM, supra note 4.

Many of the stablecoin issuers evaluated by FinCEN tended to retain the same group of large “core” primary market customers year over year, but exhibited significant turnover among smaller primary market customer institutions focused on market arbitrage or other short-term trading opportunities. Turnover rates were particularly high among issuers whose business models facilitated larger numbers of primary market customers. Stablecoin issuers such as this may see several thousand new primary market participants in a given year, indicating that such issuers are likely to have automated know your customer functions to facilitate large numbers of new customers. Smaller or more centralized issuers generally experienced far fewer numbers of new customers (although retention or growth may be similar from a percentage standpoint), indicating that processes may be more manual. Overall, most issuers saw significant growth in their primary market customer base during 2025, possibly a result of increased adoption rates and greater regulatory clarity following the passage of the GENIUS Act. 3. Description of Proposed Requirements

For purposes of the RIA, FinCEN and the Agencies considered the various components of the proposed rule with a view towards the specific features or elements that are expected to generate, either directly or indirectly, an economic benefit or cost or lead to changes in a market participant's incentives in a way that may generate economic benefits or costs.[147] For completeness, this section presents a brief review of all of the components of the proposed rule and sorts those not anticipated to have a separable incremental effect from those foreseeably expected to impose direct economic effects. The latter are then further discussed in the following subsection (VIII.A.4). For components of the proposed rule that FinCEN and the Agencies' analysis has not assigned a quantified burden (in hours or dollars), the reason for doing so is briefly explained in the description of expected costs.[148]

[147] See infra section VIII.A.4.

[148] See infra section VIII.A.4.ii.

To balance the completeness of the RIA with the desire for expositional clarity and ease of tractability between the proposed regulatory text and sections V (Section-by-Section Analysis) and VIII (Regulatory Impact Analysis), FinCEN and the Agencies have included Table 3, to provide a mapping of the various components of the proposed rulemaking as presented in section V to their analogous categorization in the RIA.

Table 3—Overview/Mapping of the Proposed Rule

                                                                     Discussed in RIA       Proposed regulatory
     Elements of the Proposed Rule         Section V analysis         subsection(s)           text  location
----------------------------------------------------------------------------------------------------------------
Define ``account'' as a formal          V.A.1..................  VIII.A.3.i.............  1033.100(a)(1).

relationship between a customer and a PPSI established to provide or engage in services, dealings, or other financial transactions, including five non-exclusive examples. Define “account” to exclude: (1) a V.A.1.................. VIII.A.3.i............. 1033.100(a)(2). product or service where a formal relationship is not established with a person; (2) an account the PPSI acquires through an acquisition, merger, purchase of assets, or assumption of liabilities from a financial institution; (3) an account opened to participate in an Employment Retirement Income Security Act of 1974 employee benefit plan; or (4) ownership or control of a PPSI's payment stablecoins alone, without other indicators of a formal relationship. Define “customer,” for purposes of V.A.2.................. VIII.A.3.i............. 1033.100(b)(1). PPSI CIP requirements, to include (1) a person that opens a new account and (2) any individual who opens a new account for either: (a) an individual who lacks legal capacity or (b) an entity that is not a legal person.

Define “customer,” for purposes of V.A.2.................. VIII.A.3.i............. 1033.100(b)(2). PPSI CIP requirements, to exclude: (1) a financial institution with an FFR or a bank regulated by a State bank regulator, (2) a defined exempt person as described in 31 CFR 1020.315(b)(2)-(4), (3) a known PPSI customer with an existing account, and (4) a person acquiring/redeeming a payment stablecoin from a means other than directly to/from the PPSI. Define “digital asset service V.A.3.................. VIII.A.3.i............. 1033.100(c)(1). provider,” for purposes of PPSI CIP requirements, to include certain defined persons engaged in select businesses. Incorporate “person” as defined by V.A.3.................. VIII.A.3.i............. 1033.100(c)(1)(i). the GENIUS Act within the PPSI-CIP framework to adopt the meaning set forth in 12 U.S.C. 5901(24) when defining a “digital asset service provider.”. Incorporate “monetary value” as V.A.3.................. VIII.A.3.i............. 1033.100(c)(1)(i)(A). defined by the GENIUS Act to clarify its meaning within the definition of “digital asset service provider” as set forth in 12 U.S.C. 5901(7). Define “digital asset service V.A.3.................. VIII.A.3.i............. 1033.100(c)(2). provider,” for purpose of PPSI CIP requirements, to exclude: (1) distributed ledger protocols; (2) developing, operating, or engaging in the business of developing distributed ledger protocols or self-custodial software interfaces; (3) immutable and self-custodial software interfaces, (4) developing, operating, or engaging in the business of validating transactions or operating a distributed ledger, or (5) participating in a liquidity pool or similar mechanism. Introduce a definition of V.A.3.................. VIII.A.3.i............. 1033.100(c)(3). “distributed ledger protocol” to clarify its meaning within the definition of “digital asset service provider” as set forth in 12 U.S.C. 5901(9).

Require a PPSI to establish and         V.B.1..................  VIII.A.3.ii,             1033.220(a)(1).
 maintain a written CIP appropriate                               VIII.A.4.i,
 for its size and business that is                                VIII.A.4.ii.a, VIII.E..

part of the PPSI's AML/CFT Program.

Require a PPSI's CIP to include risk-   V.B.2..................  VIII.A.3.ii,             1033.220(a)(2).
 based identity verification                                      VIII.A.4.i,
 procedures, including procedures for                             VIII.A.4.ii.a, VIII.E.

opening an account that specify the identifying information that would be obtained with respect to each customer.

Require that a PPSI's CIP contain       V.B.2.i................  VIII.A.3.ii,             1033.220(a)(2)(i).
 procedures for opening an account                                VIII.A.4.i,
 that specify the identifying                                     VIII.A.4.ii.a, VIII.E.

information that would be obtained prior to account opening with respect to each customer, including, at minimum: (1) name, (2) date of birth/ formation, (3) address, and (4) identification number, subject to certain exceptions.

Require a PPSI's CIP to contain         V.B.2.ii...............  VIII.A.3.ii,             1033.220(a)(2)(ii).
 procedures for verifying the identity                            VIII.A.4.i,
 of each customer within a reasonable                             VIII.A.4.ii.a, VII.E.

period of time before or after the customer's account is opened, using information obtained in accordance with its customer identification procedures that describe when the PPSI would use documents, non-documentary methods, or a combination of both methods.

Require that if the PPSI is relying on  V.B.2.ii.a.............  VIII.A.3.ii,             1033.220(a)(2)(ii)(A).
 documents to verify a customer's                                 VIII.A.4.i,
 identity, the CIP must contain                                   VIII.A.4.ii.a, VIII.E.

procedures that set forth the documents the PPSI would use.

Provide non-exclusive lists of          V.B.2.ii.a.............  VIII.A.3.ii............  1033.220(a)(2)(ii)(A)(
 examples of documents a PPSI may use                                                      1) &
 to verify the identity of customers                                                       220(a)(2)(ii)(A)(2).

that are (1) natural persons/ individuals or (2) other persons.

Require that if a PPSI would employ     V.B.2.ii.b.............  VIII.A.3.ii,             1033.220(a)(2)(ii)(B).
 non-documentary methods to verify the                            VIII.A.4.i,
 identity of a customer, its CIP must                             VIII.A.4.ii.a, VIII.E.

contain procedures that set forth the non-documentary methods the PPSI would use.

Provide a non-exclusive list of         V.B.2.ii.b.............  VIII.A.3.ii............  1033.220(a)(2)(ii)(B)(
 examples of non-documentary methods a                                                     1).

PPSI may use to verify customer identity.

Require that a PPSI's non-documentary   V.B.2.ii.b.............  VIII.A.3.ii,             1033.220(a)(2)(ii)(B)(
 procedures must address situations                               VIII.A.4.i,              2).
 where: (1) the customer (a) is an                                VIII.A.4.ii.a, VIII.E.

individual unable to present an unexpired government-issued identification document bearing a photograph or similar safeguard or (b) opens the account without meeting in person; or (2) the PPSI (a) is unfamiliar with the documents presented, (b) opens an account without obtaining documents, or (c) is otherwise presented with circumstances that increase the risk that it will be unable to verify the true identity of a customer through documents.

Require that the PPSI's CIP address     V.B.2.ii.c.............  VIII.A.3.ii,             1033.220(a)(2)(ii)(C).
 situations where, based on the PPSI's                            VIII.A.4.i,
 risk assessment of the new account of                            VIII.A.4.ii.a, VIII.E.

a customer that is not an individual, the PPSI determines it cannot verify the customer's true identity using either the its CIP's established documentary and non-documentary verification methods, the PPSI will obtain information about individuals with authority or control over such account in order to verify the customer's identity.

Require a PPSI CIP include procedures   V.B.2.iii..............  VIII.A.3.ii,             1033.220(a)(2)(iii).
 for when it cannot form a reasonable                             VIII.A.4.i,
 belief that it knows the true                                    VIII.A.4.ii.a, VIII.E.

identity of a customer that describe: (1) when the PPSI should not open an account, (2) the terms under which a customer may use an account while the PPSI attempts to verify the customer's identity, (3) when the PPSI should close an account after attempts to verify a customer's identity fail, and (4) when the PPSI should file a SAR in accordance with applicable law and regulation.

Require the PPSI's CIP include          V.B.3..................  VIII.A.3.ii,             1033.220(a)(3)(i).
 procedures for making and maintaining                            VIII.A.4.i,
 a record of all information obtained                             VIII.A.4.ii.a, VIII.E.

under procedures implementing its program, including at minimum: (1) all identifying information about a customer obtained prior to account opening, (2) a description of any document that was relied on to verify a customer's identity, (3) a description of the methods and results of any measures undertaken to verify the identity of a customer (a) via the PPSI CIP's non-documentary methods or (b) by obtaining information about individuals with authority or control over the account of a customer that is not an individual, and (4) a description of the resolution of each substantive discrepancy discovered when verifying the identifying information obtained.

Require the PPSI to retain the records  V.B.3..................  VIII.A.3.ii,             1033.220(a)(3)(ii).
 made using the CIP-specified customer                            VIII.A.4.i,
 identification information obtained                              VIII.A.4.ii.a, VIII.E.

before the opening of an account for five years after the date the account is closed.

Require the PPSI to retain the records  V.B.3..................  VIII.A.3.ii,             1033.220(a)(3)(ii).
 made using CIP-specified methods to                              VIII.A.4.i,
 verify customer identity via: (1)                                VIII.A.4.ii.a, VIII.E.

documentary and non-documentary methods; (2) obtaining information about individuals with authority or control over and account, as applicable; (3) resolving substantive discrepancies discovered when verifying customer identification information for five years after the record is made.

Require the PPSI's CIP include          V.B.4..................  VIII.A.3.ii,             1033.220(a)(4).
 reasonable procedures to: (1)                                    VIII.A.4.i,
 determine within a reasonable period                             VIII.A.4.ii.a, VIII.E.

of time after the account is opened, or earlier if required by another Federal law or regulation or Federal directive issued in connection with the applicable list, whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal Government agency and designated as such by Treasury in consultation with the primary Federal payment stablecoin regulators; and (2) follow all Federal directives issued in connection with such lists.

Require the PPSI's CIP include          V.B.5..................  VIII.A.3.ii,             1033.220(a)(5)(i).
 procedures for providing customers                               VIII.A.4.i,
 with adequate notice that the PPSI is                            VIII.A.4.ii.a, VIII.E.

requesting information to verify their identities.

Provide that customer notice would be V.B.5.................. VIII.A.3.ii............ 1033.220(a)(5)(ii). considered adequate if the PPSI generally describes the CIP rule's identification requirements and is provided in a manner reasonably designed to ensure that a prospective customer is able to view the notice, or is otherwise given notice, before opening an account, such as by: (1) the PPSI posting a notice on its website, (2) including the notice in its account applications, or (3) any other form of oral or written notice, depending upon the manner in which the account is opened. Provide sample language a PPSI may use V.B.5.................. VIII.A.3.ii............ 1033.220(a)(5)(iii). to provide notice to its customer, as appropriate.

Allow for a PPSI's CIP to include       V.B.6..................  VIII.A.3.ii,             1033.220(a)(6).
 procedures specifying when the PPSI                              VIII.A.4.i,
 will rely on the performance by                                  VIII.A.4.ii.a, VIII.E.

another financial institution (including an affiliate) of any procedures of the PPSI's CIP, with respect to any customer of the PPSI that is opening, or has opened, an account or has established an account or similar business relationship with the other financial institution to provide or engage in services, dealings, or other financial transactions, provided that: (1) the reliance is reasonable under the circumstances; (2) the other financial institution: (a) is subject to a rule implementing 31 U.S.C. 5318(h) or 12 U.S.C. 5903(a)(5)(A) and is regulated by an FFR; and (b) enters into a contract with the PPSI requiring it to certify annually to the PPSI that it has implemented its AML/CFT program, and that it will perform (or its agent will perform) specified requirements of the PPSI's CIP.

Permit that, having considered whether  V.C....................  VIII.A.3.i,              1033.220(b).
 the exemption is consistent with the                             VIII.A.4.ii.a,
 purposes of the BSA and with safety                              VIII.A.4.ii.c.

and soundness, in the public interest, and any other necessary and appropriate factors, the appropriate FFR, with the concurrence of the Secretary, may, by order or regulation, exempt any PPSI or any type of account from the requirements of this section, and the Secretary, with the concurrence of the FFR, may exempt any PPSI or any type of account from the requirements of this section. Clarify that nothing in the rule V.D.................... VIII.A.3.i............. 1033.220(c). relieves a PPSI of its obligation to comply with any other provision of 31 CFR chapter X, including provisions concerning information that must be obtained, verified, or maintained in connection with any account or transaction, or its obligations with respect to complying with the terms of any lawful order as set forth in chapter X.

i. New Definitions

As discussed in greater detail in section V.A, FinCEN and the Agencies propose adding three new terms “account,” “customer,” and “digital asset service provider” to the proposed new PPSI part of its regulations, 31 CFR 1033.100.[149] The definitions are proposed for purposes of this CIP and would only apply to the CIP obligation unless otherwise expressly noted.[150]

[149] This proposal's definitions are in addition to other terms defined in the GENIUS Act and proposed to be codified by FinCEN as part of the PPSI AML/CFT NPRM, most notably, “digital asset,” “payment stablecoin,” and “permitted payment stablecoin issuer.” See PPSI AML/CFT NPRM, supra note 4.

[150] As noted in the PPSI AML/CFT NPRM, supra note 4, for example, the term “account” is used in various FinCEN regulations and in the GENIUS Act, but the definition of account in this proposed CIP rule generally only applies to CIP requirements set out in this proposed rule. Compare 31 CFR 1010.230(c) (referencing in beneficial ownership requirement the CIP definitions of “account”) with 1010.605(c)(2) (defining “account” for purposes of special due diligence obligations without reference to the CIP definitions of “account”). As discussed in the PPSI AML/CFT NPRM, the GENIUS Act directs that PPSIs have the technological capability to comply and comply with the terms of lawful orders. See 12 U.S.C. 5903(a)(6)(B). Lawful order is defined, in part, by using the word “account.” See 12 U.S.C. 5901(16)(B). FinCEN is not intending, however, to apply the proposed CIP definition of account to the word “account” with respect to this obligation.

ii. New Requirements

As discussed in section V above, FinCEN and the Agencies are jointly proposing a rule to implement the GENIUS Act's directive that PPSIs maintain an effective CIP.

The proposed rule would require that a PPSI's CIP include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. The procedures must enable the PPSI to form a reasonable belief that it knows the identity of each customer. The procedures must be based on the PPSI's assessment of the relevant risks, including those presented by the various types of accounts maintained by the PPSI, the various methods of opening accounts provided by the PPSI, the various types of identifying information available, and the PPSI's size, location, and customer base.

The proposed rule would require a PPSI to obtain the following information prior to opening an account: (1) name; (2) date of birth, for an individual; or

date of formation, for a person that is not an individual; (3) address (a residential and mailing address for individuals, or principal place of business, local office, or other physical address and mailing address for a person other than an individual); and (4) an identification number.

The proposed rule would require that the CIP contain procedures for verifying the identity of each new customer, using information obtained from the customer, within a reasonable period of time after the customer's account is opened. The procedures must describe when the PPSI would use documents, non-documentary methods, or a combination of both methods.

The proposed rule states that if the PPSI is relying on documents, then the CIP must contain procedures that set forth the documents that the PPSI would use. For an individual, the PPSI could use an unexpired government-issued identification evidencing nationality or residence that contains a photograph or similar safeguard, such as a driver's license or passport. For a person other than an individual, such as a corporation, partnership, or trust, the document must show the existence of the entity, such as certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument.

For a PPSI relying on non-documentary methods, the CIP must contain procedures that set forth the non-documentary methods the PPSI would use. These methods may include, but are not limited to, contacting a customer; independently verifying the customer's identity through the comparison of information provided with respect to the customer with information obtained from a consumer reporting agency, public database, or other source; checking references with other financial institutions; or obtaining a financial statement.

FinCEN and the Agencies believe that while the majority of customers may be verified through documentary and non-documentary methods, there may be instances where this is not possible. The risk that the PPSI would not know the customer's true identity may be heightened for certain types of accounts, such as an account opened in the name of a corporation, partnership, or trust that is created or conducts substantial business in a jurisdiction that has been designated by the United States as a primary money laundering concern or has been designated as non-cooperative by an international body.

The proposed rule states that the PPSI's CIP would be required to include procedures for responding to circumstances in which the PPSI cannot form a reasonable belief that it knows the true identity of a customer. These procedures should describe: (1) when the PPSI should not open an account; (2) the terms under which a customer may use an account while the PPSI attempts to verify the customer's identity; (3) when the PPSI should close an account after attempts to verify a customer's identity fail; and (4) when the PPSI should file a SAR in accordance with applicable law and regulation.

The proposed rule states that the CIP must include procedures for making and maintaining a record of all information obtained under procedures implementing the CIP. This is consistent with the requirement of 31 U.S.C. 5318(l)(2)(B) that CIPs include procedures for maintaining records of the information used to verify a person's identity, including name, address, and other identifying information. At a minimum, proposed Sec. 1033.220(a)(3)(i) requires that the record must include: (1) all identifying information about a customer obtained under the CIP; (2) a description of any document relied on to verify the identity of the customer under the CIP, noting the type of document, any identification number contained in the document, the place of issuance, and if any, the date of issuance and expiration date; (3) a description of the methods and results of any measures undertaken to verify the identity of a customer; and (4) a description of the resolution of each substantive discrepancy discovered when verifying the identifying information obtained.

Additionally, the proposed rule states that a PPSI must retain the identifying information about a customer obtained under Sec. 1033.2210(a)(3)(i)(A) of the proposed rule for five years after the date the account is closed, and the information regarding the verification of a customer's identity records collected under paragraphs (a)(3)(i)(B), (C), and (D) of this section for five years after the record is made.

Consistent with 31 U.S.C. 5318(l)(2)(C), the proposed rule outlines that the CIP would be required to include reasonable procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal functional regulators. The procedures must require the PPSI to make such a determination within a reasonable period of time after the account is opened, or earlier if required by another Federal law or regulation or Federal directive issued in connection with the applicable list. The procedures must also require the PPSI to follow all Federal directives issued in connection with such lists.

Lastly, the proposed rule states that the CIP would be required to include procedures for providing customers with adequate notice that the PPSI is requesting information to verify their identities. The proposed rule considers notice adequate if the PPSI generally describes the identification requirements of this section and provides such notice in a manner reasonably designed to ensure that a prospective customer is able to view the notice, or is otherwise given notice, before opening an account. For example, depending upon the manner in which the account is opened, a PPSI may post a notice on its website, include the notice in its account applications, or use any other form of oral or written notice. The proposed rule provides a sample notice. 4. Anticipated Economic Effects

This section provides FinCEN's and the Agencies analysis of the expected costs and benefits of the proposed rule as attributed to the elements of the regulation with foreseeable incremental effects. While not all costs and benefits are readily quantifiable, in this analysis FinCEN and the Agencies have sought to include an evaluation of certain foreseeable non-quantified economic benefits in addition to quantified costs to more comprehensively assess the potential net benefit of the proposed rule and select alternatives. i. Expected Benefits

The proposed rule aims to clarify and standardize CIP requirements across all issuers of payment stablecoin that apply and are granted registration as PPSIs. This standardized obligation across all types of PPSIs would also harmonize the CIP obligations for payment stablecoin issuers with those applicable to other types of covered financial institutions, including banks. By standardizing CIP requirements for PPSIs, the potential for PPSIs to exploit opportunities to engage in regulatory arbitrage may be reduced. As discussed in section VIII.A.1, the expected economic benefits of the proposed rulemaking hinge on its ability to reduce the potential exploitation of this arbitrage as well as reducing the inefficiencies that the positive externalities of effective customer identification practices and the negative externalities generated by insufficient customer identification and

recordkeeping engender. A more even regulatory playing field might also remove the risk of potential inefficient overinvestment or socially costly underinvestment in the level of customer identification that could otherwise be attributable to regulatory uncertainty. Moreover, such standardization avoids the creation of regulatory gaps that criminals can exploit.

While these anticipated benefits are more difficult to quantify than the costs, the proposed rule is nonetheless expected to generate value insofar as risk-based, effective CIPs can contribute to the detection and deterrence of money laundering and terrorist financing and support broader BSA policy goals. A PPSI's efforts to obtain and verify the identity of account holders or respond to circumstances in which the PPSI cannot form a reasonable belief that it knows the true identity of a customer would help reduce the ability of money launderers, criminals, and other illicit finance actors to access U.S. financial markets through PPSIs. Maintaining records would enhance PPSI's internal compliance efforts and aid PPSI and enforcement personnel in detecting and taking measures to prevent potential illicit finance activity. Establishing a CIP with these elements would help PPSIs systematize, and in some cases automate, practices that facilitate the detection of attempted financial crimes and ensure that PPSIs have effective practices for identifying and verifying the identities of their customers and prospective customers. Insulating this financial market from abuse by bad actors of potentially significant social and monetary value is essential to its growth and longevity and protects the integrity of the broader U.S. financial system. ii. Expected Costs

This section assesses the foreseeable costs to the respective parties expected to be incrementally economically impacted by the proposed rule.[151] This section is organized as follows. First, it estimates select cost profiles likely to be incurred by PPSIs, including both start-up costs and recurring administrative and maintenance costs based on relevant cost information associated with each identified category of required compliance activity. The discussion of expected costs then describes potential costs to PPSI customers and concludes with an estimate of government implementation costs for oversight and enforcement.

[151] Hourly burden figures presented for cost estimates in this section are rounded to the nearest hundredth of an hour for presentation purposes. Total burden figures are produced using unrounded figures for accuracy.

The sum of the proposed rule's expected incremental quantified costs (unadjusted) over a multi-year time horizon are presented in Table 4.[152] This includes expected costs to a static population of 50 PPSIs of approximately $284,000 in the first year, and an average of approximately $239,000 in each year thereafter; [153] expected costs to an anticipated PPSI customer base that increases by 65 percent year over year of approximately $1.0 million annually in the first year, and approximately the same amount each year thereafter; [154] and expected costs to the government of approximately $982,000 in the period leading up to the first effective year of the final rule, approximately $1.3 million in the first effective year, and approximately $913,000 per year thereafter. In total, the quantified economic costs of the proposed rule would amount to an average burden of approximately $2.3 million per year once a final rule became effective. FinCEN and the Agencies invite comment on whether the analysis of the average costs for each component of the CIP as outlined in section VIII.A.4.ii.a is an accurate reflection of the cost faced by issuers of products that may be considered payment stablecoins. In addition, FinCEN and the Agencies request comment on whether there are any additional cost categories that FinCEN and the Agencies have failed to consider.

[152] The corresponding net present value (NPV) of the aggregate costs displayed in Table 4 are $5.8 million ($6.6 million) using a seven percent (three percent) discount rate, or an average annualized aggregate cost of $2.2 million ($2.3 million) in each of the first three years in which a final rule would be effective. Of these costs, the NPV of costs that would be borne by PPSIs is estimated over the same three-year time horizon to be $688,399 ($718,797) using a 7 percent (3 percent) discount rate, respectively. This equates to annualized costs of $254,695 ($254,117) using the same discount rates, or $5,094 ($5,082) per year per PPSI on average.

[153] Note, the incremental costs presented in this subsection differ in several aspects from the PRA recordkeeping and reporting costs presented below (see infra section VIII.E). The cost totals presented here reflect the estimated incremental costs that would result from this proposed rule, while the costs presented in section VIII.E analysis include pro forma accounting of all costs associated with the PRA recordkeeping and reporting activities required by the proposed rule, even if such activities are already being conducted by the respondents.

[154] As described in infra section VIII.A.4.ii.b, these costs are essentially identical to those incurred as a result of general AML/CFT program requirements. Therefore, these costs should not be considered as being in addition to the customer costs contemplated in FinCEN's accompanying rulemaking on general AML/CFT program requirements for PPSIs. See PPSI AML/CFT NPRM, at section XII.4.ii, supra note 4.

Table 4—Quantified Incremental Costs of the Proposed Rule by Year

         Affected party              Year (-1)        Year 1          Year 2          Year 3      3-Year average
----------------------------------------------------------------------------------------------------------------
PPSIs...........................  ..............        $283,572        $238,723        $238,723        $253,673
New PPSI Customers..............  ..............       1,025,400       1,025,400       1,025,400       1,025,400
Government......................         981,698       1,347,789         912,634         912,634       1,057,686
Annual Incremental Costs........         981,698       2,656,761       2,176,757       2,176,757       2,336,758
----------------------------------------------------------------------------------------------------------------

a. PPSIs 1. Establishing and Maintaining a Written CIP

The proposed rule would require a PPSI to establish and maintain a CIP aligned with, and integrated into, its broader risk-based and reasonably designed AML/CFT program. As described in section VIII.3.ii, a PPSI must also use this approach to establish and maintain a well-designed, written CIP that establishes and maintains the operational framework for executing effective identity verification.

If an entity that becomes a PPSI does not already have a CIP that is consistent with the proposed rule's requirements, that prospective PPSI would have to newly establish or else modify its existing customer identification practices. Creating or modifying the policies and procedures detailed in the CIP would entail costs for these entities. Such entities may incur costs both while implementing new or modified policies and procedures, as well as when newly programming, or modifying existing programming of, their automated systems and testing those

systems. These costs are expected to be significantly lower for PPSIs that are subsidiaries of insured depository institutions, which are currently required to have established procedures in place for obtaining identifying information of customers in compliance with BSA requirements.[155] By contrast, other PPSIs are less likely to have policies and procedures in place that meet the minimum requirements in the rule, and are therefore expected to face higher up-front CIP implementation costs.

[155] 31 CFR 1020.220.

These design, implementation, documentation, and maintenance costs are distinct from similar costs to establish and maintain the PPSI's overall AML/CFT program but would generally be expected to be guided by the same principles of risk-based, allocatively efficient construction. As such, CIP implementation costs are expected to vary not just by whether a PPSI is affiliated with or is an institution with a CIP obligation, but also by the nature of the types of accounts the PPSI maintains, the methods it provides to open an account, the types of identifying information available from customers, and the PPSI's own unique size, location, and customer base. However, to simplify the remainder of the analysis, FinCEN and the Agencies distinguish primarily between PPSIs affiliated with a insured depository institution or “IDI” (referred to for simplicity as “IDI-subsidiary PPSIs”) and PPSIs that are not affiliated with a subsidiary of an insured depository institution (referred to for simplicity as “non-IDI subsidiary PPSIs”) in developing compliance-related expected cost profiles. FinCEN and the Agencies request comment on the share of PPSIs that would likely already have CIPs established and would therefore not incur the full costs associated with establishing and maintaining a CIP.

The average burden, measured in time, for a non-IDI subsidiary PPSI to establish and maintain a written CIP that encompasses all the regulatory elements as grouped and described in section VIII.A.3 above is expected to range between approximately 20 to 30 hours per firm (an average of 25 hours per firm). For IDI-subsidiary PPSIs, these activities are expected to require about ten to 15 hours per firm (with an average of approximately 12 hours per firm) in the first year, depending on each institution's existing digital infrastructure. For both PPSI types, FinCEN estimates annually, on average, this activity would take approximately ten hours in subsequent years.

CIP establishment and maintenance activities would therefore be expected to result in an incremental cost of approximately $3,115 per non-IDI subsidiary PPSI, $1,495 per IDI-subsidiary PPSI,[156] and a total collective cost of approximately $107,139 in the first year after the proposed rule is finalized.[157] In each subsequent year, ongoing establishment and maintenance is expected to result in an average cost of approximately $1,246 per PPSI, and a total average annual cost of approximately $62,290 for 50 PPSIs.[158]

[156] FinCEN notes that because, in its approach to calculating expected costs, different costs apply to PPSIs of various (1) types (e.g., whether a PPSI is a subsidiary of an insured depository institution or not) and (2) sizes, average values may not meaningfully represent the economic cost that any single, particular PPSI may expect to incur.

[157] Throughout this analysis, FinCEN and the Agencies apply an hourly wage rate that is a general composite hourly wage rate ($87.61) scaled by a private sector benefits factor of 1.42 ($124.58 = $87.61 x 1.42). This incorporates Bureau of Labor Statistics (BLS) mean wage data associated with six occupational codes (11-1010: Chief Executives; 11-3021: Computer and Information Systems Managers; 11-3031: Financial Managers; 13-1041: Compliance Officers; 23-1010: Lawyers and Judicial Law Clerks; 43-3099: Financial Clerks, All Other) for each of the nine groupings of NAICS industry codes that FinCEN and the Agencies determined are most directly comparable to its 11 categories of potentially affected financial institutions as delineated in 31 CFR parts 1020 to 1030. See BLS, May 2024-- National industry-specific and by ownership, available at https://www.bls.gov/oes/tables.htm. Given that many occupations provide benefits beyond wages (e.g., insurance and paid leave), FinCEN and the Agencies apply the private sector benefit factor to the unloaded wage rate to reflect the total cost to the employer. The benefit factor is the ratio of total compensation (which includes wages and benefits) to wages. Total compensation = 43.94 and Wages and salaries = 30.90 (1.42 = 43.94 / 30.90) as of June 2024, based on the private industry workers series data downloaded from BLS. BLS, Employer Costs for Employee Compensation data, available at https://www.bls.gov/news.release/archives/ecec_09102024.pdf.

[158] See Tables 9 and 10, infra section VIII.E.3.

2. Obtaining and Verifying Customer Identification Information

The proposed rule would require a PPSI's CIP to include the collection of certain information prior to opening a new account. This information would include, at a minimum, the name, date of birth, address, and identification number of each customer opening new accounts. Centralized stablecoin issuers already obtain identifying information from customers, such as their names and addresses, since most issuers need to uniquely identify each of their customers operationally and these particular forms of personally identifiable information are common ways of doing so. Therefore, the associated incremental cost of compliance with the requirement is expected to be relatively small for all PPSIs.

Despite this, some new costs for PPSIs can be anticipated because some may not be obtaining all the information required by the proposed rule or doing so consistently. These issuers would face additional costs in collecting this information and updating their account opening applications to insert procedures requesting that customers provide the required information.

The proposed rule would further require a PPSI's CIP to include procedures to verify the identity of each customer and would provide issuers with multiple possible methods to do so, which would mitigate the costs of such activities.[159] For example, depending on the procedures implemented—including through documentary or non-documentary methods, as provided by the rule—and based on the issuer's assessment of the relevant risks, customers that open accounts with an issuer may simply provide a copy of documents showing its existence as a legal entity. Alternatively, issuers may, for example, obtain a financial statement from the customer or compare the information provided by the customer with information obtained from a consumer reporting agency or public database.

[159] See proposed Sec. 1033.220(a)(2)(ii).

The documentary and non-documentary verification methods set forth in the proposed rule to verify the identities of customers are not meant to be an exclusive list of the appropriate means of verification. Other reasonable methods may be available now or in the future. The purpose of making the rule flexible in this regard is to allow payment stablecoin issuers to select verification methods that are reasonable and practicable. Methods that are appropriate for an issuer with a small, familiar customer base may not be sufficient for an issuer with more customers from many different geographic regions. The proposed rule recognizes this fact and, therefore, allows an issuer to employ such verification methods as would be suitable to form a reasonable belief that it knows the true identities of its customers.

FinCEN and the Agencies recognize that obtaining and verifying the identity of each customer would result in incremental costs for many PPSIs if these firms currently do not use verification methods or do not verify identities in a way that is consistent with the proposed rule's requirements.

FinCEN and the Agencies also note that this requirement for customer identification information collection and verification, which is applied to all customers equally, is distinct from the requirements to conduct customer due diligence as required in the accompanying proposed rule on AML/CFT program requirements for PPSIs. Unlike generalized CIP collection and verification, that due diligence requires prioritized, risk-based screening based on factors identified by the PPSI.

As discussed earlier, FinCEN estimates that the “average” PPSI would have approximately 1,000 legal entity clients that it interacts with directly.[160] The proposed requirements do not require PPSIs to collect information on existing customers,[161] and therefore FinCEN only estimate incremental costs for collecting information on new customers. As described earlier, FinCEN and the Agencies used public data on on-chain minting and redemption activity to examine annual rates of customer growth and turnover, and estimate that the average new customer rate is 65 percent of the number of existing customers. Therefore, FinCEN expects the average PPSI to collect information on approximately 650 new customers per year.

[160] See supra section VIII.A.2.b.

[161] Under the proposed rule, PPSIs would not be required to collect information from existing customers unless there is reason to believe the issuer does not know the true identity of a customer, a scenario that FinCEN anticipates would be uncommon. FinCEN requests comment on whether it is reasonable to assume that all PPSIs would have reason to believe they know the true identity of their customers.

Due to the wide range of models employed by issuers, FinCEN and the Agencies acknowledge a range of costs for customer information collection and verification. However, nearly all stablecoin issuers already collect significant customer information on primary market customers in the ordinary course of business. Nevertheless, the customer information collection requirements in this proposal may still entail a relatively small incremental burden on a per-customer basis for non-IDI subsidiary PPSIs, which may be inherently less familiar with CIP information collection requirements than banks. Nearly all primary market customers interfacing with stablecoin issuers directly are legal entities, and FinCEN estimates that non-IDI subsidiary PPSIs would require an average of three minutes collect any additional required information from each customer. For IDI-subsidiary PPSIs, more streamlined incremental information collection processes associated with the existing CIP program of the parent company can be anticipated. For this reason, FinCEN estimates an average time to correspond with each customer and collect the required information of two minutes. For small PPSIs, FinCEN and the Agencies conservatively assume it would take three minutes per PPSI to collect information from each customer.

In summary, FinCEN expects that the collection of customer information to comply with the proposed rule would cost approximately $4,049 per non-IDI subsidiary PPSI, or a total of $80,977 annually. For IDI-subsidiary PPSIs, FinCEN and the Agencies expect a per-firm cost of approximately $2,699, which results in approximately $80,977 annually for all firms of this type.[162] Table 5 below provides a comparative summary of these costs for each PPSI type.

[162] See also Tables 9 and 10, infra section VIII.E.3.

Table 5—Estimated Annual Incremental Cost Associated With Obtaining and Verifying Customer Identification

Information by PPSI Type

                                                                     Number of     Total burden
            PPSI type             Hours per PPSI   Cost per PPSI       PPSIs           hours        Total cost
----------------------------------------------------------------------------------------------------------------
Non-IDI Subsidiary PPSIs........            32.5          $4,049              20             650         $80,977
IDI-Subsidiary PPSIs............            21.7           2,699              30             650          80,977
----------------------------------------------------------------------------------------------------------------

3. Recordkeeping

The proposed rule requires certain records to be retained for a five-year period following the creation of the record [163] and others to be retained for five years following an account closure.[164] While FinCEN and the Agencies generally expect PPSIs to utilize the same technological infrastructure to securely store CIP-specific records as they would all other business/operation-related data, it is nevertheless foreseeable that some incremental costs might accrue. To allow for this, FinCEN includes a PRA recordkeeping cost for non-labor, technology costs that include an annual $100 baseline storage cost for each PPSI and a per-record cost of $0.10 associated with storing customer records.[165] Based on an estimate of 650 new customers per PPSI per year, the corresponding incremental storage cost would be $165 per PPSI per year, or an aggregate total of $8,250 annually for a population of 50 PPSIs.

[163] These records pertain to the methods and information used to verify customer identification information and are described in proposed Sec. 1033.220(a)(3)(i)(B), (C), and (D). For the recordkeeping requirement, see proposed Sec. 1033.220(a)(3)(ii).

[164] These records include the customer identification information required before an account is opened as described in proposed Sec. 1033.220(a)(3)(i)(A). For the recordkeeping requirement, see proposed Sec. 1033.220(a)(3)(ii).

[165] See infra section VIII.E.2.iii.

4. Comparing Customers With Government Lists

The proposed rule would require a PPSI's CIP to include reasonable procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal payment stablecoin regulators. Such a list has not yet been issued.

Nevertheless, similar list-checking activities should already be industry practice by stablecoin issuers and other financial institutions that are U.S. persons because an obligation already exists for such U.S. persons to check their customers against the Specially Designated Nationals (SDN) List administered by OFAC. While the burden associated with this evaluation of customers against the SDN List is also considered as part of the separate proposed rule to impose AML/CFT program and sanctions compliance program requirements on PPSIs,[166] failure to comply with current obligations, such as by engaging in appropriate customer screening, could result in criminal or civil penalties for a stablecoin issuer.

[166] See PPSI AML/CFT NPRM, supra note 4.

Since a list as described in proposed Sec. 1033.220(a)(4) has not yet been issued, and to a certain extent the prospective requirement to compare customers

against a future list reinforces existing market practices, the cost resulting from this requirement is currently expected to be de minimis. 5. Providing Notice to Customers

The proposed rule would require a PPSI's CIP to include procedures for providing its customers with adequate notice that the issuer is requesting information to verify their identities.[167] Proposed Sec. 1033.220(a)(5)(ii) sets forth general adequacy standards for the content of a notice and states that notice may be provided in a manner reasonably designed to ensure that a customer is able to view the notice, or is otherwise given notice, before opening an account. For example, if an account is opened electronically, such as through an internet website, the issuer may provide notice electronically. Because the notice is a standardized disclosure included with all applications, FinCEN does not anticipate a per-customer burden, but rather a one-time upfront cost to add the notice to application materials. FinCEN also allows for an average one-hour ongoing annual burden to review and update the notice if necessary. Because proposed Sec. 1033.220(a)(5)(iii) provides sample notice text, the expected burden of preparing or revising the textual content of a PPSI's notice is expected to take proportionately less time and effort than a PPSI's other presentation-related business-specific decisions, such as location (as banner text online, inline on a form, etc.) and accessibility (including formatting, number of languages/translations to provide, number of distinct locations, methods of messaging, and platforms to place notice), among other attributes, which FinCEN and the Agencies expect to be informed by a PPSI's approach to risk-based and reasonably designed programs, generally.

[167] See proposed Sec. 1033.220(a)(5)(i).

FinCEN estimates that the average annual cost for this activity would be approximately $124.58 per PPSI, yielding an aggregate average annual cost of approximately $6,229 for 50 expected PPSIs.[168]

[168] See Tables 9 and 10, infra section VIII.E.3.

b. PPSI Customers

As presented above in section VIII.A.2.ii.b, the typical stablecoin issuer that could be considered a payment stablecoin issuer would have approximately 100 legal entity clients that it interacts with directly and the population of unique prospective PPSI customers that could be affected parties as U.S. legal persons is no more than 10,000. As described in section VIII.A.2.ii.b, these non-individual persons, legal entities, or other businesses belong to several categories, including digital exchanges, specialized digital commodities traders, and other types of investment- and securities-related businesses that, aside from digital exchanges, would generally all be classified under NAICS code 523 (“Securities, Commodity Contracts, and Other Financial Investments and Related Activities”). Accordingly, $102.54 was used to estimate hourly costs to PPSI customers.[169]

[169] Based on a BLS mean industry hourly wage rate of $72.11. BLS, Occupational Employment and Wage Statistics: Industry: Securities, Commodity Contracts, and Other Financial Investments and Related Activities (May 2024), available at https://data.bls.gov/oes/#/industry/523000. The BLS mean industry hourly wage rate of $72.11 was scaled by a benefits factor of 1.42. See supra note 157.

FinCEN estimates that PPSI customers, which are mostly financial institutions engaged in trading a broad range of stablecoin products as part of their investment portfolios, or exchanges seeking to provide off-chain liquidity to retail customers for a similarly broad range of stablecoin products, will likely initiate at least one new primary market relationship each year, although this frequency may fluctuate. In order to generate a conservative estimate, FinCEN and the Agencies assume for purposes of this analysis that all primary market participants would be required to provide this information at least once during the course of business in a given year when interacting with a new PPSI, while acknowledging significant uncertainty around this estimate. FinCEN and the Agencies request public comment on this assumption.

Assuming that 10,000 customers would spend, on average, approximately one hour to collect, review, and transmit the required customer identification information to its PPSI counterparties each year, this would imply that costs to PPSI customers could be as much as $1.03 million annually.

This estimate is highly conservative and likely to overestimate the true incremental costs of the proposed CIP requirements to PPSI customers for a number of reasons. For one, it assumes that all primary market participants will be required to provide this information once during the course of business in any given year as a function of opening or attempting to newly open an account with a PPSI, which may not be true for many customers. Additionally, these costs may be included, or otherwise indistinguishable from customer costs attributable to other business reasons to collect and provide identifying information to a PPSI, including as necessary to satisfy a PPSI's general AML/CFT program requirements. Some customers may be required to submit information to identify themselves and support a PPSI's required verification activities, and in some cases, submit additional information about select key individuals associated with the customer in order for a PPSI to satisfy its separate needs to meet certain general AML/CFT program requirements and requirements unique to its CIP. However, the collection and production of this information by the customer is generally the same, or a highly overlapping, set of activities. Therefore, the customer costs presented here should not be treated as strictly additive to the customer costs articulated in FinCEN's rulemaking that proposes general AML/CFT program requirements for PPSIs. c. Government Costs

To implement the proposed rule, FinCEN anticipates incurring certain operating costs that would include approximately $0.98 million in the year prior to the final rule's effective date, $1.35 million in the first effective year the rule is in effect, and approximately $0.91 million per average subsequent year. These estimates include anticipated expenses related to rulemaking and maintenance, stakeholder outreach and informational support, compliance monitoring, and potential enforcement activities as well as certain incremental increases to pre-existing administrative and logistic expenses.

FinCEN acknowledges that this treatment of cost estimates implicitly assumes that increased resources commensurate with any novel operating costs would exist. If this assumption does not hold, then operating costs associated with a rule may impose certain economic costs on the public in the form of opportunity costs from the agency's forgone alternative activities and those activities' attendant benefits. Putting that into the context of this proposed rule, and benchmarking against FinCEN's actual appropriated budget for fiscal year 2025 ($190,193,000),[170] the corresponding opportunity cost could resemble forgoing up to 0.7 percent (0.5 percent) of current activities in the first year (each subsequent year) in which a final rule was effective. However, to the

extent that activities FinCEN would undertake as a function of the proposed rule would functionally substitute for or otherwise replace forgone activities, such an estimate likely overstates the potential economic costs to FinCEN and, consequently, the public.

[170] FinCEN, Congressional Budget Justification FY 2026 (May 2025), available at https://home.treasury.gov/system/files/266/11.-FinCEN-FY-2026-CJ.pdf.

These estimates do not include the potential costs borne by other regulators or entities engaged in informational outreach, examinations, or related supervisory actions of enforcement activities as a consequence of the proposal. Consequently, the cost estimates here may understate the burden of activities required to promote compliance with the rules as proposed and the full scope of government costs. 5. Consideration of Policy Alternatives

FinCEN and the Agencies considered several alternatives to the currently proposed version of the rule, but is limiting the presentation here to considerations where public response may be most useful. Some of the alternatives described below are scenarios that may have resulted in reduced burdens for PPSIs but would do so at the expense of forgone benefits or efficiency gains. Other alternatives would have resulted in more significant burdens. For the reasons described below, FinCEN and the Agencies decided not to propose any of these alternatives. FinCEN and the Agencies invite comment on these alternatives, and on any other alternatives that were not considered here. i. Alternative Definitions of “Customer”

FinCEN and the Agencies considered adopting wider definitions of “customer” to encompass additional market activity, namely on the secondary market. While the PPSI AML/CFT NPRM does propose some requirements for PPSIs with regard to secondary market activity,[171] this proposed rule limits customer information collection with regard to the CIP to primary market customers (i.e., such as when a PPSI engages in issuing, converting, redeeming, repurchasing, burning, and reissuing payment stablecoins, as well as providing associated services, such as providing custodial services).[172]

[171] See PPSI AML/CFT NPRM, supra note 4.

[172] PPSIs may also engage in “digital asset service provider” activities (as specified in the GENIUS Act), and activities incidental thereto, that are authorized by a primary Federal payment stablecoin regulator or State payment stablecoin regulator, consistent with applicable law. Such activities include exchanging and transferring digital assets. See 12 U.S.C. 5901(7), 5903(a)(7)(B).

Collecting information on secondary market customers would have significant benefits, but is also practically challenging. Almost all (approximately 99 percent) of stablecoin transaction activity takes place on the secondary market. In addition to most transaction volume occurring in the secondary market, nearly all users of payment stablecoin products are secondary market users, as most large payment stablecoin issuers set significant financial requirements for primary market participants that exclude retail traders.

Despite this being the location of significant activity, and potentially significant risk, issuers have a limited ability to collect customer information on the secondary market. The secondary market includes both “on-chain” transactions (actual blockchain exchanges of digital assets) and “off-chain” transactions (ledger/book transactions made by third-party exchanges for which no evidence appears on the blockchain). Market participants tend to use the two types of secondary trading for different purposes. On-chain transactions typically include digital asset transactions (such as arbitrage trading or institutional flows) and a small portion of direct payments for purposes like remittances across international borders. Off-chain transactions are where most retail trading takes place. The ratio of on-chain to off-chain transaction activity varies significantly by product, but in the aggregate, a majority of transaction volume for likely payment stablecoin products occurs off-chain.[173] Even for products where most transaction volume occurs on-chain, a majority of the actual economic value for these products is typically held in the wallets of exchange providers for off-chain trading. For either type of activity, it is most often the case that no customer information is collected in secondary market transactions by the stablecoin issuer itself.

[173] Among the four largest payment stablecoin products evaluated by FinCEN, about 35 percent of the total trading volume was estimated to occur on-chain. However, this varied significantly by product, and two of the products examined had significantly more relative trading volume on-chain. The location of secondary market activity depends heavily on the way in which the product is used and how it is marketed.

Many exchange operators facilitating off-chain activity collect customer information in a manner similar to the information collected by issuers for their primary market customers. However, exchanges rarely share this information with issuers. For secondary market customers trading stablecoins on the blockchain itself, identities are often anonymous or pseudonymous. Blockchains are by nature decentralized algorithms, so there is often no central collection point at which identifying information is collected.

This being the case, FinCEN and the Agencies opted to confine the definition of customer for the purpose of customer information collection under the proposed rule to those undertaking primary market transactions directly with the issuer. ii. Alternative Information Requirements

Another alternative that FinCEN and the Agencies considered was requiring customers to provide additional information beyond what is required by the proposed rule. The proposed rule would require issuers to collect, at a minimum, the name, address, and government-issued identification number or incorporation document for legal entity customers. For instance, FinCEN and the Agencies might have required customers to provide any blockchain wallet addresses associated with a legal entity, incorporation or tax documents, or certain identifying financial information such as account numbers. However, FinCEN and the Agencies opted not to require these items for several reasons. First, many issuers already collect this additional information in the ordinary course of business, and are best situated to determine what, if any, additional information is necessary to make risk-based decisions about a customer. Second, the absence of this information does not exempt an issuer from the responsibility to assess the money laundering and terrorist financing risks associated with a customer or their transactions. Given this broader programmatic obligation, little may be lost in letting it remain the issuer's prerogative to determine when or whether such additional information is necessary. iii. Size-Related Alternatives

FinCEN and the Agencies considered modifying the proposed rule's requirements for small payment stablecoin issuers or establishing an asset threshold for certain compliance obligations of payment stablecoin issuers that are not bank subsidiaries. As discussed in more detail in the IRFA (section VIII.C.1.ii.b), FinCEN utilizes a threshold of $200 million in total reserve assets to identify small payment stablecoin issuers that are not subsidiaries of insured depository institutions. FinCEN and the Agencies considered using this threshold as a tailoring benchmark, whereby issuers under the threshold would be allowed

to apply for PPSI status under lessened CIP standards designed to reduce compliance cost. However, FinCEN and the Agencies opted against this alternative. Creating some category of PPSI subject to lessened CIP requirements would conceivably result in the targeting of these issuers by illicit actors seeking to circumvent regulatory scrutiny. Further, FinCEN's analysis indicates that most technology services that enable customer information collection as described here are highly scalable, allowing small issuers to readily identify and employ more cost-effective options.

B. Executive Orders 12866, 13563, and 14192

E.O. 12866 directs agencies to assess the costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, and public health and safety effects; distributive impacts; and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, reducing costs, harmonizing rules, and promoting flexibility. E.O. 13563 also recognizes that some benefits are difficult to quantify and provides that, where appropriate and permitted by law, agencies may consider and discuss qualitatively values that are difficult or impossible to quantify.

This proposed rule has been designated a “significant regulatory action” under E.O. 12866; accordingly, it has been reviewed by OMB.

This action, if finalized, is expected to be considered an E.O. 14192 regulatory action.

C. Regulatory Flexibility Analysis

When an agency issues a proposed rulemaking, the RFA requires the agency either to provide an IRFA with a proposed rule or certify that the proposed rule would not have a significant economic impact on a substantial number of small entities. 1. FinCEN IRFA

Because the proposed rule may have a significant economic impact on a substantial number of certain types of PPSIs that may qualify as small entities, FinCEN undertook the following analysis. In the event that FinCEN has potentially overestimated the anticipated scope and significance of the economic burden of the proposed rule on small entities, and certification would instead be more appropriate, comments to this effect—including studies, data, or other evidence—are invited. i. The Proposed Rule: Objectives, Description, and Legal Basis

The proposed rule would implement FinCEN's regulations that prescribe the minimum requirements for CIPs for PPSIs as described earlier in section V.

The legal basis for the proposed rule is the GENIUS Act.[174] The GENIUS Act creates a regulatory framework for payment stablecoins in the United States.[175] Under the GENIUS Act, it generally will be unlawful for any person other than a PPSI to issue a payment stablecoin in the United States.[176] The GENIUS Act outlines certain reserve, capital, liquidity, and risk management requirements for PPSIs and tasks implementing those requirements to the Agencies, and, as applicable, State payment stablecoin regulators.[177]

[174] See supra section II.

[175] See generally 12 U.S.C. 5901-5916.

[176] See 12 U.S.C. 5902(a), 5901(23) (defining “permitted payment stablecoin issuer”); see also 12 U.S.C. 5902(c) (permitting, but not requiring, Treasury to issue regulations providing limited safe harbors from 12 U.S.C. 5902(a)); 12 U.S.C. 5916.

[177] 12 U.S.C. 5903(a)(4).

The GENIUS Act requires that a PPSI “be treated as a financial institution for purposes of the Bank Secrecy Act, and as such, shall be subject to all Federal laws applicable to financial institutions located in the United States relating to economic sanctions, preventing money laundering, customer identification, and due diligence.” [178] In addition to its general directive, the GENIUS Act specifies that a PPSI's obligations must include maintenance of an effective CIP, including identifying and verifying the PPSI's account holders.[179]

[178] 12 U.S.C. 5903(a)(5)(A).

[179] 12 U.S.C. 5903(a)(5)(A)(v).

The proposed rule would implement the GENIUS Act by proposing a requirement for PPSIs to maintain an effective CIP, including identification and verification of account holders. It includes requirements related to documenting customer verification procedures, requisite customer information, required recordkeeping, comparison with government lists, and customer notification. ii. The Expected Impact on Small Entities

The expected impact of the rule on small entities varies across three distinct types of PPSIs: those that are subsidiaries of insured depository institutions; FQPSIs; [180] and SQPSIs.[181] FinCEN has incorporated the Agencies' RFA analyses with respect to their nexuses with these respective types and limited its own further analysis below to the remaining potential future PPSIs that it anticipates. As the proposed rulemaking may also affect the small entities that are customers of PPSIs, this population was also subject to IRFA requirements and is included in section VIII.C.1.ii.c below.

[180] 12 U.S.C. 5901(11). In the PPSI AML/CFT NPRM FinCEN proposes to define this category in its regulations (see proposed Sec. 1010.100(vvv)) using essentially the same language as the statutory definition. See PPSI AML/CFT NPRM, supra note 4, at section VI.C.1.xi.

[181] 12 U.S.C. 5901(31). In the PPSI AML/CFT NPRM, FinCEN proposes to define this category in its regulations (see CFR 1010.100(xxx)) using essentially the same language as the statutory definition. See PPSI AML/CFT NPRM, supra note 4, at section VI.C.1.xiii.

a. Small PPSIs Considered by the Agencies

Analyses of the expected impact on PPSIs that would be subject to their jurisdiction were conducted by each of the Agencies and are appended with their respective certifications in sections VIII.C.2, 3, 4, and 5 below. b. Other Potential Small PPSIs

The U.S. Small Business Administration (SBA) definition of “small entity” as defined in 13 CFR 121.201 includes businesses, nonprofits, and small government entities with fewer than 50,000 residents.[182]

[182] Some stablecoin issuers are organized as nonprofit entities and are included in this count.

Based on analysis of the distributional data separately analyzed by FinCEN in the IRFA accompanying the PPSI AML/CFT NPRM, FinCEN considered applying a functional definition of “small entity” for purposes of this IRFA that would correspond closely to the 80th percentile threshold, which was rounded to $200 million for convenience in that proposed rule and is requesting comment on the appropriateness of the $200 million threshold in both that NPRM and this proposed rule.

The proposed $200 million threshold would capture approximately 76 percent of current stablecoin issuers that meet the GENIUS Act definitional criteria to be eligible for potential future PPSI status. That is, of the pre-GENIUS Act population of 25 stablecoin issuers that may be eligible to meet the GENIUS Act's definitional criteria for future PPSIs (see Table 1), 19 had fewer than $200 million in total circulating payment stablecoin product values. Together, these 76 percent of current

stablecoin issuers hold less than one percent of aggregate market average total assets.

To examine the expected impact of the proposed rule on small entities, FinCEN used two steps: the first step was to estimate the total number of potential future small entities that would be affected by the proposed rule, and the second step was to estimate the significance of this impact on those entities.

In order to contextualize the relative significance of costs associated with the proposed rule for small PPSIs, FinCEN used estimates of total assets to estimate likely revenues for such issuers. Stablecoin issuers generally derive revenue from investment returns on their reserve holdings. As described in the GENIUS Act, PPSIs would be permitted to invest reserve funds in several different types of asset classes, including government-backed securities. Based on prevailing interest rates, FinCEN assumed issuers would likely receive returns of about five percent on invested funds. While actual returns may fluctuate and fall below or above this estimate, this value represents an benchmark for estimation purposes. To validate this assumption, FinCEN examined actual revenue values as reported by current stablecoin issuers and compiled in quarterly MSB Call Report data. While five percent of total assets was generally within the same order of magnitude to actual reported revenue, actual revenues often exceeded five percent.

Returns in excess of prevailing rates for government-issued fixed income securities can be due to several factors. First, stablecoin issuers often “over collateralize” their products, meaning that they hold larger reserve portfolios than are required to redeem every coin at par value. This practice helps protect from market fluctuations and affords issuers greater flexibility during times of financial stress. In such cases, stablecoin issuers have reserve portfolios that are larger than the circulating value of their products, leading to returns in excess of those implied by multiplying their circulating value by prevailing rates of return for common reserve investments. Stablecoin issuers may also invest excess reserves in higher-yielding products or loans whose rates of return exceed those of government-backed securities. In addition to this, several other factors might lead to larger returns. For example, stablecoin issuers may offer certain fee-based services to customers, and may account for certain unrealized gains as revenue, increasing reported revenue levels.

Bearing these factors in mind, FinCEN retained five percent of total assets as a reasonable benchmark for revenue. This parameter was chosen in order to retain an estimate of revenue that does not minimize costs or possible fluctuations in returns. In other words, by using a conservative but realistic estimate, FinCEN avoids underestimating the relative impact of compliance costs associated with the proposed rule. FinCEN requests comment on the appropriateness of using five percent of total reserve assets as an estimate of these firms' revenue.

In section VIII.A.4.ii, FinCEN discussed the expected incremental costs of compliance with the proposed rule for PPSIs. As that section detailed, the incremental first-year costs of the proposed CIP requirements for PPSIs not covered by the Agencies' analyses are expected to be approximately $7,500 per PPSI in the first year, and approximately $5,600 in the average subsequent year.

Table 5—CIP Costs as a Share of Modeled Annual Revenue

Percentage of small issuers for

which Year-1 CIP costs exceed:

                             Year                                 Modeled CIP  ---------------------------------
                                                                 program cost    1% of modeled    3% of modeled
                                                                                    revenue          revenue
----------------------------------------------------------------------------------------------------------------
1.............................................................          $7,500               61               34
2+............................................................           5,600               45               26
----------------------------------------------------------------------------------------------------------------

At this time, FinCEN assesses that there is insufficient data to forecast with meaningful precision the proportion of the total population of potential future PPSIs that would resemble current stablecoin issuers that would qualify as small entities or to consider the potential economic significance of the proposed CIP requirements differentially by type. FinCEN has therefore provided the analysis in Table 5 for illustrative purposes only to facilitate an assessment of how economically significant the proposed CIP requirements might be if future small PPSIs were comparable to current stablecoin issuers whose products meet the GENIUS Act's definitional criteria for a future payment stablecoin. Comments and data are invited to assist analyzing the potential effects of the proposed CIP requirements on small PPSIs, particularly those that would not be the subsidiaries of insured depository institutions. c. Small Business Customers of PPSIs

In addition to these entities, FinCEN expect that the proposed rule, if adopted, to have impacts on the primary market customers of PPSIs. Many of these entities, which include digital asset exchanges, specialized commodities traders, and other investment firms, are small businesses. Using the data described earlier,[183] FinCEN estimates that there are approximately 300,000 primary market customers that interact directly with stablecoin issuers. However, FinCEN estimates that a substantial portion of these may be affiliates of a single counterparty or associated with non-U.S. entities. FinCEN estimates that the number of affected U.S. businesses is no more than 10,000. These businesses belong to several categories, including digital asset exchanges, specialized digital commodities traders, and other types of investment- and securities-related businesses. Aside from digital asset exchanges, FinCEN expects that nearly all of these firms would be part of the NAICS classifications under industry code 523 (“Securities, Commodity Contracts, and Other Financial Investments and Related Activities”).

[183] See supra section VIII.A.2.ii.b.

Table 6—Description of PPSI Customer Small Entities

                                 Approximate                   SBA small-        Percentage      Average annual
 Primary market customer type     number of     NAICS code      business      considered small  revenue of small
                                  customers                     threshold            \a\          entities \b\
----------------------------------------------------------------------------------------------------------------
Other Investment Firms.......          10,000          523  $47 million.....  97.7% (about      $1.55 million.
                                                                               9,770 firms).
Digital Asset Exchanges \c\..             300       523210  $47 million.....  70% (about 210    $5.85 million.
                                                                               firms).
----------------------------------------------------------------------------------------------------------------

\a\ To estimate the number of small entities in NAICS code 523, FinCEN used the U.S. Census 2022 Statistics of

U.S. Businesses Data by Enterprise Receipts Size. U.S. Census, 2022 Statistics of U.S. Businesses Data by

Enterprise Receipts Size, available at https://www.census.gov/data/tables/2022/econ/susb/2022-susb-annual.html. FinCEN calculated the proportion of small businesses in NAICS code 523 with less than $50 million

in annual receipts (the closest available threshold). For Digital Asset Exchanges, FinCEN used internal data. \b\ Revenue data for NAICS code 523 and Digital Asset Exchanges was collected from the U.S. Census 2022

Statistics of U.S. Businesses Data by Enterprise Receipts Size and internal data, respectively. \c\ Note, these 300 customers are a subset of the 10,000 customers captured under NAICS code 523.

While a substantial number of these firms would be required to provide customer information to the PPSIs they wish to engage in direct transactions with, the cost of providing this information is expected to be de minimis relative to the average revenue of these firms.[184] Therefore, while a substantial number of businesses may be providing information to PPSIs, FinCEN does not contemplate that this requirement would constitute a significant effect when considered in relation to their overall revenue.

[184] This cost is estimated to be less than $200 per firm annually, on average. See section VIII.A.4.ii.b.

iii. Other Matters: Duplicate, Overlapping, Conflicting, and Alternative Requirements

FinCEN is unaware of any existing Federal regulations that would overlap or conflict with the proposed rule. As discussed in section III, in a related, complementary rulemaking FinCEN is proposing to apply additional GENIUS Act and BSA obligations on PPSIs, including, for example, AML/CFT program requirements and suspicious activity reporting requirements. This rulemaking deals exclusively with a CIP requirement, which is not contained within the related, complementary rulemaking.

Additionally, FinCEN has considered certain alternatives to the proposed rule that take into consideration the expected costs and potential benefits to small entities. As discussed in greater detail in section VIII.A.5.iii, FinCEN considered modifying the requirements for small entities. As discussed in that section, FinCEN opted against this exclusion for several reasons. By creating some category of PPSI for small issuers that would be subject to lessened CIP requirements could conceivably lead to illicit actors who seek to circumvent regulatory scrutiny targeting these small issuers. Additionally, FinCEN analysis indicates that most technology services that enable customer information collection as described here are highly scalable, allowing small issuers to readily identify and employ more cost-effective options.

In addition, as discussed in greater detail in section VIII.A.5.ii, FinCEN also considered adopting additional information reporting requirements for new customers. Because some primary market customers of potential PPSIs may themselves be small businesses, such a requirement that expanded reporting requirements beyond what information is already provided in the ordinary course of business may have presented an incremental cost for some number of these small entities. However, as discussed in section VIII.A.5.ii, FinCEN opted not to augment these requirements. Many issuers already collect this additional information in the course of business, and are best situated to determine what, if any, additional information is necessary to support overall AML/CFT goals. As a result, FinCEN expect no incremental cost burden to small entity customers of potential PPSIs as a result of the requirements in the proposed rule. 2. OCC Certification

The proposal will apply to entities overseen by the OCC. The OCC currently supervises 997 institutions (national banks, Federal savings associations, and branches or agencies of foreign banks),[185] of which approximately 609 are small entities under the RFA.[186] In general, the OCC classifies the economic impact on an individual small entity as significant if the total estimated impact in one year is greater than five percent of the small entity's total annual salaries and benefits or greater than 2.5 percent of the small entity's total non-interest expense. Furthermore, the OCC considers five percent or more of OCC-supervised small entities to be a substantial number, and at present, 30 OCC-supervised small entities would constitute a substantial number.

[185] Financial Institution Data Retrieval System Data, accessed February 20, 2026.

[186] The OCC estimated the number of small entities based on the SBA's size thresholds for commercial banks and savings institutions, and trust companies, which are $850 million and $47 million, respectively. Consistent with the General Principles of Affiliation 13 CFR 121.103(a), the OCC counted the assets of affiliated financial institutions when determining if it should classify an OCC-supervised institution as a small entity. The OCC used December 31, 2024, to determine size because a “financial institution's assets are determined by averaging the assets reported on its four quarterly financial statements for the preceding year.” See footnote 8 of the SBA, Table of Small Business Size Standards (Mar. 17, 2023), available at https://www.sba.gov/document/support-table-size-standards.

In the OCC's NPRM published March 2, 2026, the OCC stated, “Given that all current OCC banks that issue stablecoins generally have issuance of over $1 billion and are not considered small entities and the lack of small entity stablecoin issuers, the OCC will need to wait for more information to determine whether it is likely that there will be a significant number of small entities affected by the proposed rule. At this time, the OCC does not expect that the proposed rule would have a significant impact on a substantial number of small entities under the RFA.” [187]

[187] OCC, Implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act for the Issuance of Stablecoins by Entities Subject to the Jurisdiction of the Office of the Comptroller of the Currency, 91 FR 10202 (Mar. 2, 2026).

The OCC continues to expect that small entities will not be the initial adopters of this technology because of the compliance infrastructure and capital necessary to support stablecoin issuance. As such, the OCC anticipates that future FQPSIs would not be small entities as defined by the SBA (currently $850 million in assets for financial entities). Hence, the proposed rule would not have a significant impact on a substantial number of small entities

under the OCC's purview for purposes of the RFA. 3. Board IRFA

The Board is providing an initial regulatory flexibility analysis with respect to this proposal. The RFA requires an agency to consider whether the rules it proposes will have a significant economic impact on a substantial number of small entities. Under regulations issued by the SBA, a “small” entity includes a depository institution, bank holding company, or savings and loan holding company with total assets of $850 million or less.[188] For purposes of this section, any reference to “small” entities is a reference to this definition.

[188] See 13 CFR 121.201. Consistent with the SBA's General Principles of Affiliation, the Board includes the assets of all domestic and foreign affiliates toward the applicable size threshold when determining whether to classify a particular entity as a small entity. See 13 CFR 121.103.

In connection with a proposed rule, the RFA requires an agency to prepare an IRFA describing the impact of the rule on small entities, unless the head of the agency certifies that the proposed rule, if promulgated, will not have a significant economic impact on a substantial number of small entities and publishes such certification along with a statement providing the factual basis for such certification in the Federal Register. An IRFA must contain (1) a description of the reasons why action by the agency is being considered; (2) a succinct statement of the objectives of, and legal basis for, the proposed rule; (3) a description of, and, where feasible, an estimate of the number of small entities to which the proposed rule will apply; (4) a description of the projected reporting, recordkeeping, and other compliance requirements of the proposed rule, including an estimate of the classes of small entities that will be subject to the requirement and the type of professional skills necessary for preparation of the report or record; (5) an identification, to the extent practicable, of all relevant Federal rules which may duplicate, overlap with, or conflict with the proposed rule; and (6) a description of any significant alternatives to the proposed rule which accomplish its stated objectives and minimize any significant economic impact of the proposed rule on small entities.[189]

[189] 5 U.S.C. 603(b)-(c).

The Board has considered the potential impact of the proposed rule on small entities in accordance with the RFA. Based on its analysis and for the reasons stated below, the Board believes that this proposed rule will not have a significant economic impact on a substantial number of small entities. Nevertheless, the Board is publishing and inviting comment on this initial regulatory flexibility analysis. i. Reasons Why Action Is Being Considered by the Board

As explained above, this proposal implements the GENIUS Act's directives to treat PPSIs as financial institutions for purposes of the BSA and to require such issuers to maintain an “effective customer identification program, including identification and verification of account holders.” [190] The proposed rule would subject PPSIs to CIP requirements that are comparable to existing CIP requirements for other financial institutions, such as banks, broker-dealers, mutual funds, and FCMs and IBCs. It also would require a PPSI to tailor its CIP to that PPSI's size and type of business, as well as take into consideration the PPSI's risk based on its unique business—including the types of accounts it has, how those accounts are opened, and the identifying information available.

[190] See 12 U.S.C. 5903(a)(5)(A)(v); see also 31 U.S.C. 5318(l).

ii. The Objectives of, and Legal Basis for, the Proposal

The proposed rule would prescribe the minimum requirements for CIPs for PPSIs as described earlier in section V.

Section 4(a)(5)(A) of the GENIUS Act (12 U.S.C. 5903(a)(5)(A)) requires that a PPSI “be treated as a financial institution for purposes of the Bank Secrecy Act, and as such, shall be subject to all Federal laws applicable to financial institutions located in the United States relating to economic sanctions, preventing money laundering, customer identification, and due diligence.” [191] Additionally, section 4(a)(5)(A) specifies that a PPSI must maintain an effective CIP, and must identify and verify the PPSI's account holders.[192]

[191] 12 U.S.C. 5903(a)(5)(A); see also 31 U.S.C. 5318(l).

[192] 12 U.S.C. 5903(a)(5)(A)(v).

The proposed rule would implement the GENIUS Act by proposing a requirement for PPSIs to maintain an effective CIP, including identification and verification of account holders. The proposed rule includes requirements related to documenting customer verification procedures, requisite customer information, required recordkeeping, comparison with government lists, and customer notification. iii. Description of the Compliance Requirements of the Proposal and Estimate of the Number of Small Entities

The proposed rule would implement the GENIUS Act by proposing a requirement for PPSIs to maintain an effective CIP, including identification and verification of account holders. The proposed rule includes requirements for Board-supervised PPSIs of all sizes related to documenting customer verification procedures, requisite customer information, required recordkeeping, comparison with government lists, and customer notification. The compliance burdens are described in more detail in section VIII.A.4.ii above.

This NPRM is being issued jointly by FinCEN, along with the Board and other Agencies as applied to the PPSIs that each Agency supervises. The expected impact on PPSIs that are subject to the Board's jurisdiction is analyzed below.

The proposed rule would apply to (i) subsidiaries of insured State member banks that have been approved by the Board to issue payment stablecoins and (ii) State-qualified PPSIs that are uninsured State-chartered depository institutions that have transitioned to the Board's regulatory framework under section 4(d) of the GENIUS Act (12 U.S.C. 5903(d)). By definition, the proposed rule would only apply to a State-qualified PPSIs that have an outstanding issuance value of more than $10 billion, and accordingly, would not be considered small for the purposes of this IRFA. This analysis therefore focuses only on Board-supervised PPSIs that are subsidiaries of State member banks. The Board is not aware of any method of determining the identity, industry, or size of Board-supervised PPSIs that are subsidiaries of State member banks, given that there are no such entities at this time and it is difficult to predict how this market will develop. Further, SBA regulations do not provide small entity thresholds specific to PPSIs. As a result, this section of the IRFA discusses the size of the parent State member banks of such PPSIs. The Board believes this approach is appropriate because, under the GENIUS Act, an insured State member bank must have “control” of a Board-supervised PPSI.[193]

[193] The GENIUS Act defines the term “subsidiary” by reference to the definition of “subsidiary” in the Federal Deposit Insurance Act, which states that a subsidiary includes any company which is owned or controlled directly or indirectly by another company. See 12 U.S.C. 5901(32) (“The term “subsidiary” has the meaning given that term in [12 U.S.C. 1813].”); see also 12 U.S.C. 1813(w)(4). In the Federal Deposit Insurance Act, the term “control” is defined by reference to the Bank Holding Company Act. 12 U.S.C. 1813(w)(5). The Board's Regulation Y sets out the Board's presumptions of control and noncontrol under the controlling influence prong of the Bank Holding Company Act definition of “control.” See 12 CFR part 225, subpart D.

As of December 31, 2025, there were 703 insured State member banks.[194] Of those institutions, 439 are considered small for the purposes of RFA.[195] For this analysis, the Board estimates that between five and ten insured State member banks may, with the Board's permission, form a Board-supervised PPSI subsidiary in the first few years after the finalization of the proposed rule. Given the early stages of the payment stablecoin market, this range accounts for significant uncertainty regarding the volume of future participants. The population of Board-supervised PPSIs that are subsidiaries of State member banks could be higher or lower depending on market demand, strategic operational choices of insured State member banks and other institutions eligible to become PPSIs, and future developments in the digital landscape. By utilizing this range, the Board aims to establish an estimate that serves as the basis for evaluating the economic effects of the proposed rule, while acknowledging the inherent uncertainty resulting from a lack of historical precedent. The Board expects that the insured State member banks that are most likely to seek to form a Board-supervised PPSI subsidiary initially will be larger institutions with the compliance infrastructure and capital necessary to support a new business line to issue payment stablecoins. As such, the Board anticipates that most, if not all, insured State member banks with Board-supervised PPSIs would not be small entities as defined by the SBA. Even assuming the unlikely scenario that all, i.e., the upper-bound number of ten insured State member banks, would be small and that all ten insured State member banks would be significantly impacted by the proposed rule, these impacted entities would comprise a very small percentage of small insured State member banks.

[194] Call Report Data, December 31, 2025.

[195] Call Report Data, December 31, 2025.

iv. Consideration of Duplicative, Overlapping, or Conflicting Rules and Significant Alternatives to the Proposal

The Board has not identified any Federal statutes or regulations that would duplicate, overlap, or conflict with the proposal. The Board is seeking comment on certain potential alternative approaches to discrete aspects of the final rule, as discussed elsewhere in this proposal, most of which would not significantly change the estimated economic impact of the proposed rule. vi. Conclusion

Based on its analysis and for the reasons stated above, the Board believes that the proposed rule is unlikely to have a significant economic impact on a substantial number of small entities. The Board welcomes comment on all aspects of its analysis. In particular, the Board requests that commenters describe the nature of any impact on small entities and provide empirical data to illustrate and support the extent of the impact. Additionally, the Board requests that commenters describe the number of small entities under the RFA and the impact on small entities. 4. FDIC Certification

The RFA generally requires an agency, in connection with a proposed rule, to prepare and make available for public comment an initial regulatory flexibility analysis that describes the impact of the proposed rule on small entities.[196] However, an initial regulatory flexibility analysis is not required if the agency certifies that the proposed rule would not, if promulgated, have a significant economic impact on a substantial number of small entities. The SBA has defined “small entities” to include banking organizations with total assets of less than or equal to $850 million.[197]

[196] 5 U.S.C. 601 et seq.

[197] The SBA defines a small banking organization as having $850 million or less in assets and determines an organization's assets by averaging the assets reported on its four quarterly financial statements for the preceding year. See 13 CFR 121.201 (as amended by 87 FR 69118, effective December 19, 2022). Following these regulations, the FDIC uses an FDIC-supervised institution's affiliated and acquired assets, averaged over the preceding four quarters, to determine whether the FDIC-supervised institution is “small” for the purposes of the RFA.

Generally, the FDIC considers a significant economic impact to be a quantified effect in excess of five percent of total annual salaries and benefits or 2.5 percent of total non-interest expenses. The FDIC believes that effects in excess of one or more of these thresholds typically represent significant economic impacts for FDIC-insured institutions.

The FDIC estimates the effects of the required mandates of the proposed rule on small FDIC-supervised entities. For the purposes of this analysis, the FDIC utilizes a pre-statutory baseline under which the GENIUS Act is considered unenacted. Under this baseline, no formal federal framework exists to coordinate and homogenize the issuance of payment stablecoins, leaving the market to operate under a fragmented regulatory framework and limited federal guidance.

As previously discussed, the proposed rule would apply to all PPSIs, including FDIC-supervised PPSIs, which would be subsidiaries of FDIC-supervised institutions.[198] As of the quarter ending September 30, 2025, there were 2,772 insured State nonmember banks and State savings associations. Of those institutions, 2,064 are considered “small” for the purposes of RFA.[199]

[198] See 12 U.S.C. 5903(a)(7).

[199] Federal Financial Institutions Examination Council Reports of Condition and Income (Call Reports), September 30, 2025.

The FDIC recognizes considerable uncertainty regarding the number of FDIC-supervised PPSIs that would emerge under the proposed framework. For the purposes of this analysis, the FDIC estimates that the number of FDIC-supervised PPSIs would likely range between five and 30 in the first few years after the enactment of the proposed rule. Given the early stages of the payment stablecoin market, this range accounts for significant uncertainty regarding the volume of future participants. The population of FDIC-supervised PPSIs under the proposed rule could be higher or lower depending on market demand, strategic operational choices of eligible institutions, and future developments in the digital landscape. By utilizing this range, the FDIC aims to establish an estimate that serves as the basis for evaluating the economic effects of the proposed rule, while acknowledging the inherent uncertainty resulting from a lack of historical precedent.

Because an FDIC-supervised PPSI must be a subsidiary of an IDI, the FDIC expects that the initial adopters of this technology would likely be larger institutions with the compliance infrastructure and capital necessary to support stablecoin issuance. As such, the FDIC anticipates that most, if not all, future PPSIs would not be small entities as defined by the SBA. Therefore, the FDIC believes the proposed rule is unlikely to have a significant economic impact on a substantial number of small entities.

However, given the lack of historical precedent and the evolving nature of the payment stablecoin market, the FDIC conservatively assumes that, for the purpose of this analysis, all the entities falling within the previously discussed

scope of five to 30 potential FDIC-supervised PPSIs could be small entities. By adopting this conservative assumption, the FDIC aims to provide a comprehensive estimate of the potential economic impact on small entities.

In the unlikely scenario that all, i.e., the upper-bound number of 30 entities, would be small, the estimated impact on each small entity would be a de minimis amount. Even if all 30 entities would instead be significantly impacted by the proposed rule, the FDIC does not consider 30 entities to be a substantial number of small entities.

In light of the foregoing, the FDIC certifies that the proposed rule would not have a significant economic impact on a substantial number of small entities. Accordingly, an initial regulatory flexibility analysis is not required.

The FDIC invites comments on all aspects of the supporting information provided in this RFA section. The FDIC is particularly interested in comments on any significant effects on small entities that the agency has not identified. 5. NCUA Certification

As noted in the FDIC certification, under the RFA an initial regulatory analysis is not required if the promulgating agency certifies the proposed rule (if enacted) would not have a “significant economic impact” on a substantial number of “small entities.” The NCUA certifies the economic burden of the CIP rule—both in terms of likely expenses borne by individual small credit unions and the number of small credit unions facing significant expenses—falls short of the RFA materiality threshold.

Under the GENIUS Act, federally insured credit unions (FICUs) cannot become PPSIs. The credit-union analogue for a bank subsidiary-- at least for purposes of this act—is the credit union service organization (CUSO).[200] Currently, the NCUA does not charter, insure, or collect call-report type data from CUSOs, so there is no formal definition of small for RFA purposes. Following the FDIC, the NCUA relies on its traditional approach to RFA analysis by examining the impact of the CIP rule on FICUs with fewer than $100 million in assets.[201] As of September 30, 2025, the NCUA supervised 4,331 FICUs; of these, 2,553 (or 58.9 percent) qualified as small entities. Compared with commercial banks, credit unions are quite small. Indeed, the industry median asset size (again 2025:Q3) was $63.63 million—roughly one-sixth of the median asset size in the banking industry. Put another way, 3,813 FICUs (88.0 percent of all FICUs) would qualify as small under the FDIC RFA threshold (fewer than $850 million).

[200] A CUSO is an entity that provides various products/ services to credit unions and their members. The goals are to (i) enable credit unions to enjoy economies of scale and (ii) expand the range of product/service offerings for credit-union members. These organizations are typically owned by one or more credit unions. Examples of CUSO products/services include loan origination, operational support, and IT services.

[201] Using this traditional approach implicitly assumes (for analytical purposes only) CUSOs are a formal part of the credit unions they support. The NCUA Board established the definition of “small” (fewer than $100 million in assets) via IRPS 80 FR 57512 in 2015.

Predicting the number of PPSIs in the credit-union sector is difficult because: (i) CUSOs or credit unions have never offered a product quite like stablecoin; and (ii) as noted, the NCUA—with extremely limited authority over CUSOs (as third-party vendors)—has little-to-no anecdotal or formal data to make a forecast. That said, the National Association of Credit Union Service Organizations (NACUSO) reported in its 2020 CUSO Market Report that credit unions holding between $100 and $500 million in assets are by far the largest block of CUSO customers. Moreover, the credit-union sector has historically been conservative in its approach to offering products/services with novel risk dimensions. When such products/services are offered, large credit unions have been in the forefront. In short, qualitative and quantitative data suggest the number of PPSIs in the credit-union sector should be well below that in the banking industry. Specifically, the NCUA expects the actual number to fall between zero and 10, with five being a reasonable point estimate. Five represents 0.2 percent of the total number of small FICUs.

As for the number of small FICUs potentially facing a “significant” burden, applying the FBA materiality threshold of either 5 percent of annual compensation expense or 2.5 percent of total non-interest expense is problematic because small credit unions: (1) tend to rely heavily on volunteers; [202] and (2) often enjoy free office space provide provided by a sponsor. Under the FBA compensation threshold (5 percent), for example, 1,274 small FICUs—49.9 percent of those holding fewer than $100 million—would face a significant burden. Similarly, under the FBA non-interest expense threshold (2.5 percent), 1,226 would face an undue burden. At first, both numbers appear to qualify as “substantial.” But, again, it is important to remember small credit unions typically have relatively simple operations with plain vanilla product/service offerings. The CUSOs serving these credit unions would be extremely unlikely to become PPSIs even if the CIP regulatory burden were zero dollars. So, to arrive at an estimate of small FICUs potentially facing an undue burden, recall the estimate for PPSIs industrywide offered above—zero to 10. Now, assume (unrealistically) the actual number is 10, that all held fewer than $100 million in assets, and all faced marginal compliance expenses exceeding 5 percent of compensation expense or 2.5 percent of non-interest expense. Under these conservative assumptions, only 0.4 percent of small FICUs would face an undue burden. In short, the relatively modest size and simple operations of “small” FICUs—both absolutely and compared with commercial banks—suggest few would be interested in stablecoins even if there were no regulatory burden. Accordingly, it is reasonable to conclude the CIP rule will not have a significant economic impact on a substantial number of small FICUs.

[202] For example, the median number of paid full-time equivalent employees for a small FICU is five.

D. Unfunded Mandates Reform Act

The UMRA requires that an agency prepare a statement before promulgating a rule that may result in expenditure by the state, local, and Tribal governments, in the aggregate, or by the private sector, of $193 million or more in any one year ($100 million in 1995, adjusted for inflation).[203] Section 202 of UMRA also requires an agency to identify and consider a reasonable number of regulatory alternatives before promulgating a rule.

[203] The U.S. Bureau of Economic Analysis reports the annual value of the gross domestic product implicit price deflator for calendar year 1995 (the year UMRA was enacted) as 66.939, and as 128.974 for calendar year 2025 (the most recent available). Thus, the inflation-adjusted estimate for $100 million is 128.974 / 66.939 x $100 million, or $192.7 million. See U.S. Bureau of Economic Analysis, Table 1.1.9. Implicit Price Deflators for Gross Domestic Product, available at https://apps.bea.gov/iTable/?reqid=19&step=3&isuri=1&1921=survey&1903=13#eyJhcHBpZCI6MTksInN0ZXBzIjpbMSwyLDMsM10sImRhdGEiOltbIk5JUEFfVGFibGVfTGlzdCIsIjEzIl0sWyJDYXRlZ29yaWVzIiwiU3VydmV5Il0sWyJGaXJzdF9ZZWFyIiwiMTk5NSJdLFsiTGFzdF9ZZWFyIiwiMjAyNSJdLFsiU2NhbGUiLCIwIl0sWyJTZXJpZXMiLCJBIl1dfQ==.

As discussed above,[204] FinCEN and the Agencies have not estimated the number of potential future SQPSIs given the inherently speculative nature of such an exercise at this time. Consequently, FinCEN and the Agencies

are unable to assess the potential burden to state, local, and Tribal governments of the proposed CIP rule and are, at this time, not expecting any additional expenditures to these parties as an incremental cost of the proposed rule. However, FinCEN and the Agencies' expectation that this rulemaking will not cause material changes in State expenditures, in particular, should be understood as relating only to the impact of this rulemaking and not to the impact of the GENIUS Act writ large. The GENIUS Act envisions an active role for the states in the regulation of PPSIs as a complement to Federal regulation.

[204] See supra sections VIII.A.2.ii.a.

While the analyses above [205] and below,[206] indicate that the proposed rule is not expected to impose incremental novel expenditures on the private sector of $193 million or more, and hence that additional economic analysis pursuant to UMRA requirements is not strictly necessary, FinCEN and the Agencies believe that the preceding assessment of impact, generally, and consideration of policy alternatives, specifically, would satisfy the UMRA's analytical requirements. FinCEN and the Agencies invite public comment on any additional factors that, if considered, would materially alter the conclusions of this assessment.

[205] See supra sections VIII.A through C.

[206] See infra section VIII.E.

E. Paperwork Reduction Act

The recordkeeping requirements in the proposed rule, which qualify as “collections of information” under the PRA, will be submitted to OMB for review in accordance with the PRA.[207] Under the PRA, an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number assigned by OMB.[208] Written comments and recommendations for the proposed information collection can be submitted by visiting https://www.reginfo.gov/public/do/PRAMain. Find this particular document by selecting “Currently Under Review—Open for Public Comments” or by using the search function. Comments are welcome and must be received by August 21, 2026.

[207] See 44 U.S.C. 3506(c)(2).

[208] See 44 U.S.C. 3507(a)(3).

In accordance with requirements of the PRA, 44 U.S.C. 3506(c)(2)(A), and its implementing regulations, 5 CFR part 1320, the following information concerning the collection of information as it relates to the new CIP requirements for covered PPSIs is presented to assist those persons wishing to comment on the information collections. 1. Description of Affected Financial Institutions and OMB Control Numbers

OMB Control Number(s): [1506-XXXX].

Description of Affected Entities: Only those covered financial institutions defined in section 31 CFR 1010.100(t)(11) (i.e., PPSIs) would be affected.

Estimated Number of Respondents: 50 PPSIs.

FinCEN estimates an average annual population of approximately 50 PPSIs in the first three years, comprised of approximately 20 non-IDI subsidiary PPSIs and 30 IDI-subsidiary PPSIs.[209] FinCEN expects these entities to each have an average of 1,000 customers, with an average of 650 new customers annually.[210]

[209] See supra section VIII.A.2.ii.a.

[210] See supra section VIII.A.2.ii.b.

As this is a developing market, FinCEN and the Agencies acknowledge significant uncertainty regarding the number of potential PPSIs. However, as discussed earlier, FinCEN and the Agencies estimate that IDI-subsidiary PPSIs would have reduced CIP-related expenses due to their position within a parent's existing CIP program. 2. Estimated Annual Burden Hours

As described in section VIII.A.4.ii.a, each PPSI is expected to incur recordkeeping burdens associated with the proposed CIP obligations. FinCEN and the Agencies have identified five main cost categories associated with the various incremental recurring costs expected to be incurred by PPSIs to comply with CIP requirements. These cost categories are: (1) establishing and maintaining a written CIP; (2) obtaining and verifying customer identification information, (3) recordkeeping; (4) consulting government lists, and (5) customer notification. i. Establishing and Maintaining a Written CIP

PPSIs subject to this rule would have to establish a CIP in accordance with the proposed rule. FinCEN estimates the average cost for a PPSI to establish and maintain a written CIP as described in section VIII.A.4.ii.a.1 to be between approximately 20 to 30 hours per firm (with an average of 25 hours per firm) in the first year for non- IDI subsidiary PPSIs, and about ten to 15 hours per firm (with an average of approximately 12 hours per firm) in the first year for IDI-subsidiary PPSIs. For both PPSI types, the average burden of these activities is expected to decrease to approximately ten hours per PPSI, irrespective of type, in each subsequent year. This activity would involve tasks such as reviewing the requirements of the rule, establishing and documenting the program, and updating the CIP when necessary. ii. Obtaining and Verifying Customer Identification Information

The proposed rule would require PPSIs to collect and verify certain information from each customer.[211] Because the proposal exempts existing primary market customers from information collection requirements, the agencies estimate information collection costs for primary market customers opening new accounts. FinCEN and the Agencies estimate this cost on a per-customer basis.

[211] See supra section V.B.2.

FinCEN estimates a range of costs for customer identification information collection and verification—most of which would be from legal entities.[212] FinCEN estimates that small issuers would require an average of one hour to correspond with each new customer and collect the required information, while larger issuers would require only ten minutes (0.17 hours) per new customer, owing to more volume and onboarding automation. Thus, FinCEN uses an average of 35 minutes (0.58 hours) per new customer for non-IDI subsidiary PPSIs. For PPSI entities affiliated with insured depository institutions, FinCEN and the Agencies estimate more streamlined information collection processes associated with the existing CIP program of the parent. For this reason, FinCEN estimates an average time to correspond with each new customer and collect the required information ranging from ten minutes for most banks to 20 minutes for some smaller banks. FinCEN uses an average of 15 minutes (0.25 hours) per new customer.

[212] See supra section VIII.A.2.ii.b.

iii. Recordkeeping

The proposed rule would require certain records to be retained for a five-year period following the creation of the record [213] and others to be retained for five years following an account closure.[214] To allocate burden to these obligations, FinCEN PRA estimates allow for non-labor, technology costs that include an annual $100 baseline cost for each PPSI and a per-record cost of $0.10 associated with storing new customer records in accordance with

similar estimates in prior rulemakings.[215]

[213] See supra note 168.

[214] See supra note 169.

[215] See, e.g., FinCEN, Agency Information Collection Activities; Proposed Renewal; Comment Request; Renewal Without Change on Information Sharing Between Government Agencies and Financial Institutions, 90 FR 47125 (Sept. 30, 2025).

iv. Comparison With Government Lists

The proposed rule would require a PPSI's CIP to include reasonable procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal payment stablecoin regulators. While such a list has not yet been issued, a nominal one-hour burden in the PRA section is assigned to this requirement to account for the possible future issuance of such lists. v. Customer Notification

The proposed rule would require a PPSI's CIP to include procedures for providing its customers with adequate notice that the issuer is requesting information to verify their identities. Because the notice is a standardized disclosure included with all applications, FinCEN does not anticipate a per-customer burden, but rather a one-time upfront cost to add the notice to application materials. FinCEN also assigns a nominal average one-hour ongoing annual burden to review and update the notice if necessary.[216]

[216] FinCEN and the Agencies request comment on whether PPSIs would likely incur an annual recordkeeping burden associated with the proposed customer notification requirement, or whether the recordkeeping burden is largely incurred when the notification is initially drafted.

vi. Summary of Annual Burden Hours

Tables 7 and 8 present the estimated average annual burden hours per respondent and the aggregate average annual burden hours for all affected PPSIs in year one and in subsequent years, respectively.[217] FinCEN estimates a three-year average annual burden of 264 hours per PPSI and a three-year average annual burden of 13,178 hours for all 50 PPSIs.[218]

[217] Hourly burden figures presented in Table 7 and Table 8 are rounded to the nearest hundredth of an hour for presentation purposes. Total burden figures are produced using unrounded figures for accuracy.

[218] FinCEN and the Agencies note that because, in its approach to calculating expected time burdens, different burden estimates apply to PPSIs of various (1) types (e.g., whether a PPSI is a subsidiary of an insured depository institution or not) and (2) sizes, average values may not meaningfully represent the economic burden that any single, particular PPSI may expect to incur.

Table 7—Year-1 Burden Hour Estimates

Total

     Recordkeeping burden attributed to       Hours per    Number of      Hours per       Number of      burden
                                               response    responses     respondent      respondents     hours
----------------------------------------------------------------------------------------------------------------
Establishing and maintaining a written CIP            25            1              25              20        500
 (non-IDI subsidiary PPSIs)................
Establishing and maintaining a written CIP            12            1              12              30        360
 (IDI-subsidiary PPSIs)....................
Obtaining/verifying customer identification         0.58          650             379              20      7,583
 information (non-IDI subsidiary PPSIs)....
Obtaining/verifying customer identification         0.25          650           162.5              30      4,875
 information (IDI-subsidiary PPSIs)........
Consulting government lists................            1            1               1              50         50
Providing notice to customers..............            1            1               1              50         50
                                            --------------------------------------------------------------------
    Total..................................  ...........  ...........  ..............              50     13,418
----------------------------------------------------------------------------------------------------------------


                                     Table 8--Years 2+ Burden Hour Estimates
----------------------------------------------------------------------------------------------------------------
                                                                                                         Total
     Recordkeeping burden attributed to       Hours per    Number of      Hours per       Number of      burden
                                               response    responses     respondent      respondents     hours
----------------------------------------------------------------------------------------------------------------
Establishing and maintaining a written CIP.           10            1              10              50        500
Obtaining/verifying customer identification         0.58          650             379              20      7,583
 information (non-IDI subsidiary PPSIs)....
Obtaining/verifying customer identification         0.25          650             163              30      4,875
 information (IDI-subsidiary PPSIs)........
Consulting government lists................            1            1               1              50         50
Providing notice to customers..............            1            1               1              50         50
                                            --------------------------------------------------------------------
    Total..................................  ...........  ...........  ..............              50     13,058
----------------------------------------------------------------------------------------------------------------

3. Estimated Annual Total Costs

Tables 9 and 10 present the average annual cost per respondent and total annual cost for all affected PPSIs for year one and years two and three, respectively. FinCEN estimates an average annual labor cost of $32,835 per PPSI and an aggregate annual labor cost of $1.64 million. FinCEN additionally estimates an average annual non-labor cost of $165 per PPSI and an aggregate annual non-labor cost of $8,250 to account for storage and technology costs. In total, FinCEN and the Agencies estimate an average annual of $33,000 per PPSI [219] and an aggregate annual cost of $1.65 million.

[219] FinCEN notes again, that due to heterogeneity across the PPSI population, average costs may not meaningfully represent the economic burden that any single, particular PPSI may expect to incur.

Table 9—Total Estimated Cost in Year 1

Total

              Recordkeeping burden attributed to                 Hours per     Cost per     burden    Total cost
                                                                 respondent   respondent    hours
----------------------------------------------------------------------------------------------------------------
Establishing and maintaining a written CIP (non-IDI subsidiary           25       $3,115        500      $62,290
 PPSIs).......................................................
Establishing and maintaining a written CIP (IDI-subsidiary               12        1,495        360       44,849
 PPSIs).......................................................
Obtaining/verifying customer identification information (non-           379       47,237      7,583      944,732
 IDI subsidiary PPSIs)........................................
Obtaining/verifying customer identification information (IDI-           163       20,244      4,875      607,328
 subsidiary PPSIs)............................................
Recordkeeping (Technology)....................................  ...........          165  .........        8,250
Consulting government lists...................................            1          125         50        6,229
Providing notice to customers.................................            1          125         50        6,229
                                                               -------------------------------------------------
    Total.....................................................  ...........  ...........  .........    1,679,906
----------------------------------------------------------------------------------------------------------------


                                Table 10--Total Estimated Annual Cost in Years 2+
----------------------------------------------------------------------------------------------------------------
                                                                                            Total
              Recordkeeping burden attributed to                 Hours per     Cost per     burden    Total cost
                                                                 respondent   respondent    hours
----------------------------------------------------------------------------------------------------------------
Establishing and maintaining a written CIP....................           10       $1,246        500      $62,290
Obtaining/verifying customer identification information (non-           379       47,237      7,583      944,732
 IDI subsidiary PPSIs)........................................
Obtaining/verifying customer identification information by              163       20,244      4,875      607,328
 (IDI-subsidiary PPSIs).......................................
Recordkeeping (Technology)....................................  ...........          165  .........        8,250
Consulting government lists...................................            1          125         50        6,229
Providing notice to customers.................................            1          125         50        6,229
                                                               -------------------------------------------------
    Total.....................................................  ...........  ...........  .........    1,635,057
----------------------------------------------------------------------------------------------------------------

4. Aggregate Burden and Cost Estimates

Estimated Number of Respondents: 50 PPSIs.

Estimated Aggregate Three-Year Average Annual Recordkeeping Burden: Approximately 13,178 hours.

Estimated Aggregate Three-Year Average Annual Recordkeeping Cost: Approximately $1,650,007. 5. General Request for Comments Under the Paperwork Reduction Act

FinCEN and the Agencies invite comments on: (1) whether the collection of information is necessary for the proper performance of the mission of FinCEN, including whether the information would have practical utility; (2) the accuracy of FinCEN's estimate of the burden of the proposed collection of information; (3) ways to enhance the quality, utility, and clarity of the information required to be maintained; (4) ways to minimize the burden of the collection of information, including through the use of automated collection techniques or other forms of information technology; and (5) estimates of capital or start-up costs and costs of operation, maintenance, and purchase of services required to report the information.

F. Riegle Community Development and Regulatory Improvement Act

Pursuant to section 302(a) of the Riegle Community Development and Regulatory Improvement Act of 1994 (RCDRIA), in determining the effective date and administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on IDIs, each Federal banking agency must consider, consistent with principles of safety and soundness and the public interest, any administrative burdens that such regulations would place on affected depository institutions, including small depository institutions, and customers of depository institutions, as well as the benefits of such regulations.[220] In addition, section 302(b) of the RCDRIA requires new regulations and amendments to regulations that impose additional reporting, disclosures, or other new requirements on insured depository institutions generally to take effect on the first day of a calendar quarter that begins on or after the date on which the regulations are published in final form.[221] The Agencies invite comments to further inform their consideration of the RCDRIA.

[220] 12 U.S.C. 4802(a).

[221] 12 U.S.C. 4802(b).

G. Plain Language

Section 722 of the Gramm-Leach-Bliley Act [222] requires the Federal banking agencies to use plain language in all proposed and final rulemakings published in the Federal Register after January 1, 2000. The agencies invite your comments on how to make this proposed rule easier to understand. For example:

[222] 12 U.S.C. 4809.

Have the agencies organized the material to suit your needs? If not, how could the proposed rule be more clearly stated?

Are the requirements in the proposed rule clearly stated? If not, how could the proposed rule be more clearly stated?

Does the proposed rule contain language or jargon that is not clear? If so, which language requires clarification?

Would a different format (grouping and order of sections, use of headings, paragraphing) make the proposed rule easier to understand? If so, what changes to the format would make the proposed rule easier to understand?

What else could the agencies do to make the proposed rule easier to understand?

H. Providing Accountability Through Transparency Act of 2023

The Providing Accountability Through Transparency Act of 2023 requires that a notice of proposed rulemaking include the internet address of a summary of not more than 100 words in length of a proposed rule, in plain language, that shall be posted on the internet website under section 206(d) of the E-Government Act of 2002.[223]

[223] 5 U.S.C. 553(b)(4).

The proposal and the required summary can be found at www.regulations.gov by searching for Docket IDs FINCEN-2026-0101, OCC-2026-0331 or NCUA-2026-0793 or https://www.fdic.gov/federal-register-publications.

I. Additional Requests for Comment

1. Are FinCEN and the Agencies' baseline estimates of the number of market participants accurate? Are there specific sources of data that would suggest any of these population estimates should be revised? Please provide data, studies, or anecdotal evidence that would support any suggested alternatives.

2. Are there other distinct, identifiable subpopulations of the general public that could reasonably be directly affected by the proposed rule and should have been considered in the RIA? Please provide data, studies, or reports that would enhance FinCEN and the Agencies' ability to identify and quantify such effects.

3. FinCEN and the Agencies assume that a number of depository institutions would have affiliates or subsidiaries that seek PPSI status and that other PPSIs would not be subsidiaries of insured depository institutions. How likely are issuers or potential issuers to seek PPSI status as a subsidiary of an insured depository institution versus seeking PPSI status not as a subsidiary of an insured depository institution?

4. FinCEN and the Agencies made certain assumptions, based on data, about the number of primary customers that a typical PPSI would have. How many primary market customers does a typical issuer of payment stablecoin-type products interact with? What costs do issuers face in collecting customer information from these entities? How many are these customers are new to the issuer on an annual basis?

5. Is it likely that any of the 14,575 financial institutions listed in Table 2 would be relied upon by PPSIs for some aspect of their CIP compliance? Please provide data, studies, reports, or anecdotal evidence that would enhance FinCEN and the Agencies' ability to identify and quantify the effects of such reliance.

6. To what extent should the economic impact on state regulatory agencies be considered in the RIA? Please provide data, studies, or reports that would support the identification enhance FinCEN's ability to identify and quantify such effects.

7. Is FinCEN and the Agencies' analysis of the average costs for each component of the CIP as outlined in section VIII.A.4.ii.a reasonable reflection of the cost faced by issuers of products that may be considered payment stablecoins? If not, are there specific sources of empirical evidence or data that would suggest these burden estimates should be revised? Are there any additional cost categories related to establishing and maintaining a CIP that FinCEN and the Agencies have failed to consider? Please provide data, studies, or anecdotal evidence that would support any suggested revisions.

8. What types and share of PPSIs would likely already have CIPs established and would therefore not incur the full costs associated with establishing and maintaining a CIP? Are there certain CIPs or customer identification practices implemented by stablecoin issuers that this analysis should take into account? Please provide data, studies, or reports that would enhance FinCEN and the Agencies' ability to identify this population.

9. Is it reasonable to assume that PPSIs would already have measures in place to form a reasonable belief that they know the true identities of their existing customers and therefore would not need to obtain and verify customer identification information for any of their existing primary market customers in the first year once the rule would become effective? If not, what share of PPSIs would need to obtain and verify customer identification for all or a portion of their existing customers? Are there specific sources of empirical evidence or data that would suggest this assumption should be revised? Please provide data, studies, or anecdotal evidence that would support the suggested alternative assumption.

10. FinCEN and the Agencies request comment on the alternative policy options presented in section VIII.A.5 and their economic effect.

11. FinCEN utilized a threshold of less than $200 million in total reserve assets to define a small payment stablecoin issuer. How appropriate is this threshold? Similarly, is five percent of total reserve assets a good estimation of these firms' revenue?

12. The RIA in this NPRM does not include a forecasted population of potential future SQPSIs due to limitations in data availability. Please provide data, studies, or anecdotal evidence that would enable analysis of the potential effects of the proposed requirements on SQPSIs, generally, and small SQPSIs in particular.

13. The FDIC, Board, NCUA, and OCC invite comments on all aspects of the supporting information provided in sections VIII.C.2-5, particularly related to any significant effects on small entities that the agency has not identified.

14. The economic expectation that the proposed rule may have a significant economic impact on a substantial number of certain types of potentially affected small entities is sensitive to key assumptions about how potentially affected financial institutions would respond to the proposed requirements. FinCEN and the Agencies request comment on whether it would instead be more reasonable to certify that the proposed rule would not have a significant economic impact on a substantial number of small entities.

15. FinCEN and the Agencies do not anticipate that the proposed rule would result in novel incremental aggregate expenditures by State, local, or Tribal governments, or by the private sector of $193 million or more in any one year. Is this assumption reasonable? If not, what studies, data, or anecdotal evidence should be taken into consideration that would update this expectation?

16. Would PPSIs incur ongoing recordkeeping burdens associated with the proposed customer notification requirement? Or is the recordkeeping burden largely incurred when the notification is initially drafted? If it is an ongoing burden, what is the average amount of time spent on the recordkeeping activity per year?

J. NCUA Analysis on Executive Order 13132 on Federalism

Executive Order 13132 encourages certain regulatory agencies to consider the impact of their actions on state and local interests. The NCUA, an agency as defined in 44 U.S.C. 3502(5), complies with the executive order to adhere to fundamental federalism principles. This proposed rule would apply to PPSIs. This scope is set by statute. The NCUA works cooperatively with state regulatory agencies on all supervisory matters, including AML/CFT matters, and will continue to do so. The NCUA expects that any effect on states or on the distribution of power and responsibilities among the various levels of government will be minor. The NCUA welcomes comments on ways to eliminate, or at least minimize, any potential impact in this area.

K. NCUA Assessment of Federal Regulations and Policies on Families

The NCUA has determined that this proposed rule would not affect family well-being within the meaning of section 654 of the Treasury and General Government Appropriations Act,

1999.[224] The proposed rule relates to PPSIs, and any effect on family well-being is expected to be indirect.

[224] Public Law 105-277, section 654, 112 Stat. 2681, 2681-528 (1998).

List of Subjects in 31 CFR Part 1033

Administrative practice and procedure, Banks, banking, Business and industry, Electronic filing, Foreign persons, Investigations, Law enforcement, Reporting and recordkeeping requirements, Terrorism.

For the reason set forth in the preamble, FinCEN and the OCC, Board, FDIC, and NCUA propose that FinCEN amend 31 CFR part 1033, as proposed to be added at 91 FR 18582 (April 10, 2026), as follows:

PART 1033—RULES FOR PERMITTED PAYMENT STABLECOIN ISSUERS

0 1. The authority citation for part 1033 continues to read as follows:

Authority: 12 U.S.C. 1829b, 1951-1959, and 5901-5916; 31 U.S.C. 5311-5314 and 5316-5336; title III, sec. 314, Pub. L. 107-56, 115 Stat. 307; sec. 701, Pub. L. 114-74, 129 Stat. 599.

0 2. In Sec. 1033.100, add paragraphs (a) through (c) to read as follows:

Sec. 1033.100 Definitions.

---

(a) Account. For the purposes of Sec. 1033.220:

(1) Account means a formal relationship between a customer and a permitted payment stablecoin issuer established to provide or engage in services, dealings, or other financial transactions including but not limited to--

(i) Issuing or redeeming a payment stablecoin;

(ii) Managing related reserves, including purchasing, selling, and holding reserve assets or providing custodial services for reserve assets;

(iii) Providing custodial or safekeeping services for payment stablecoins, required reserves, or private keys of payment stablecoins;

(iv) Other activities that directly support activities in paragraphs (a)(1)(i) through (iii) of this section; or

(v) Providing services of a digital asset service provider.

(2) Account does not include:

(i) A product or service where a formal relationship is not established with a person, such as payment stablecoin activity that does not directly involve the permitted payment stablecoin issuer as a party to the transaction other than via a smart contract;

(ii) An account that the permitted payment stablecoin issuer acquires through an acquisition, merger, purchase of assets, or assumption of liabilities from a financial institution regulated by a Federal functional regulator or a bank regulated by a State bank regulator;

(iii) An account opened for the purpose of participating in an employee benefit plan established under the Employee Retirement Income Security Act of 1974; or

(iv) Ownership or control of a permitted payment stablecoin issuer's payment stablecoins alone, without other indicators of a formal relationship.

(b) Customer. For the purposes of Sec. 1033.220:

(1) Customer means:

(i) A person that opens a new account; and

(ii) An individual who opens a new account for:

(A) An individual who lacks legal capacity, such as a minor; or

(B) An entity that is not a legal person, such as a civic club.

(2) Customer does not include:

(i) A financial institution regulated by a Federal functional regulator or a bank regulated by a State bank regulator;

(ii) A person described in 31 CFR 1020.315(b)(2) through (4);

(iii) A person that has an existing account with the permitted payment stablecoin issuer, provided the permitted payment stablecoin issuer has a reasonable belief that it knows the true identity of the person; or

(iv) A person acquiring or redeeming a payment stablecoin from a means other than directly from or directly to the permitted payment stablecoin issuer.

(c) Digital asset service provider. For the purposes of Sec. 1033.220:

(1) Digital asset service provider means an individual, partnership, company, corporation, association, trust, estate, cooperative organization, or other business entity, incorporated or unincorporated that, for compensation or profit, engages in business in the United States (including on behalf of customers or users in the United States) of:

(i) Exchanging digital assets for monetary value, meaning a national currency or deposit denominated in a national currency;

(ii) Exchanging digital assets for other digital assets;

(iii) Transferring digital assets to a third party;

(iv) Acting as a digital asset custodian; or

(v) Participating in financial services relating to digital asset issuance.

(2) Digital asset service provider does not include:

(i) A distributed ledger protocol,

(ii) Developing, operating, or engaging in the business of developing distributed ledger protocols or self-custodial software interfaces;

(iii) An immutable and self-custodial software interface;

(iv) Developing, operating, or engaging in the business of validating transactions or operating a distributed ledger; or

(v) Participating in a liquidity pool or other similar mechanism for the provisioning of liquidity for peer-to-peer transactions.

(3) For purposes of this paragraph (c), the term distributed ledger protocol means a publicly available and accessible executable software deployed to a distributed ledger, including smart contracts or networks of smart contracts. 0 3. Add Sec. 1033.220 to read as follows:

Sec. 1033.220 Customer identification programs for permitted payment stablecoin issuers.

(a) Customer identification program: minimum requirements—(1) In general. A permitted payment stablecoin issuer must establish and maintain a written Customer Identification Program (CIP) appropriate for its size and business that, at a minimum, includes each of the requirements of paragraphs (a)(1) through (5) of this section. The CIP must be a part of the permitted payment stablecoin issuer's anti-money laundering (AML)/countering the financing of terrorism (CFT) program.

(2) Identity verification procedures. The CIP must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. The procedures must enable the permitted payment stablecoin issuer to form a reasonable belief that it knows the true identity of each customer. The procedures must be based on the permitted payment stablecoin issuer's assessment of the relevant risks, including those presented by the various types of accounts maintained by the permitted payment stablecoin issuer, the various methods of opening accounts provided by the permitted payment stablecoin issuer, the various types of identifying information available and the permitted payment stablecoin issuer's size, location, and customer base. At a minimum, these procedures must contain the elements described in this paragraph (a)(2).

(i) Customer information required—(A) In general. The CIP must contain procedures for opening an account that specify the identifying information that

will be obtained with respect to each customer. Except as permitted by paragraph (a)(2)(i)(B) of this section, the permitted payment stablecoin issuer must obtain, at a minimum, the following information from the customer prior to opening an account:

(1) Name;

(2) Date of birth, for an individual; or date of formation, for a person that is not an individual;

(3) Address, which shall be:

(i) For an individual, a residential or business street address;

(ii) For an individual who does not have a residential or business street address, an Army Post Office (APO) or Fleet Post Office (FPO) box number, of the residential or business street address of a next of kin or of another contact individual; or

(iii) For a person other than an individual (such as a corporation, partnership, or trust), a principal place of business, local office, or other physical location; and

(4) Identification number, which shall be:

(i) For a U.S. person, a taxpayer identification number; or

(ii) For a non-U.S. person, one or more of the following: a taxpayer identification number; passport number and country of issuance; alien identification card number; or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard; or

(iii) For a non-U.S. person that is not an individual and that does not have an identification number, the permitted payment stablecoin issuer must request alternative government-issued documentation certifying the existence of the person.

(B) Exception for persons applying for a taxpayer identification number. Instead of obtaining a taxpayer identification number from a customer prior to opening an account, the CIP may include procedures for opening an account for a person that has applied for, but has not received, a taxpayer identification number. In this case, the CIP must include procedures to confirm that the application was filed before the person opens the account and to obtain the taxpayer identification number within a reasonable period of time after the account is opened.

(ii) Customer verification. The CIP must contain procedures for verifying the identity of each customer, using information obtained in accordance with paragraph (a)(2)(i) of this section, within a reasonable time before or after the customer's account is opened. The procedures must describe when the permitted payment stablecoin issuer will use documents, non-documentary methods, or a combination of both methods, as described in this paragraph (a)(2)(ii).

(A) Verification through documents. For a permitted payment stablecoin issuer relying on documents, the CIP must contain procedures that set forth the documents the permitted payment stablecoin issuer will use. These documents may include:

(1) For an individual, an unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard, such as a driver's license or passport; and

(2) For a person other than an individual (such as a corporation, partnership, or trust), documents and any amendments thereto showing the existence of the entity, such as certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument.

(B) Verification through non-documentary methods. For a permitted payment stablecoin issuer relying on non-documentary methods, the CIP must contain procedures that set forth the non-documentary methods the permitted payment stablecoin issuer will use.

(1) These methods may include contacting a customer; independently verifying the customer's identity through the comparison of information provided with respect to the customer with information obtained from a consumer reporting agency, public database, or other source; checking references with other financial institutions; or obtaining a financial statement.

(2) The permitted payment stablecoin issuer's non-documentary procedures must address situations where an individual is unable to present an unexpired government-issued identification document that bears a photograph or similar safeguard; the permitted payment stablecoin issuer is not familiar with the documents presented; the account is opened without obtaining documents; the customer opens the account without meeting in person; and the permitted payment stablecoin issuer is otherwise presented with circumstances that increase the risk that the permitted payment stablecoin issuer will be unable to verify the true identity of a customer through documents.

(C) Additional verification for certain customers. The CIP must address situations where, based on the permitted payment stablecoin issuer's risk assessment of a new account opened by a customer that is not an individual, the permitted payment stablecoin issuer will obtain information about individuals with authority or control over such account in order to verify the customer's identity. This verification method applies only when the permitted payment stablecoin issuer cannot verify the true identity of a customer that is not an individual using the verification methods described in paragraphs (a)(2)(ii)(A) and (B) of this section.

(iii) Lack of verification. The CIP must include procedures for responding to circumstances in which the permitted payment stablecoin issuer cannot form a reasonable belief that it knows the true identity of a customer. These procedures should describe:

(A) When the permitted payment stablecoin issuer should not open an account;

(B) The terms under which a customer may use an account while the permitted payment stablecoin issuer attempts to verify the customer's identity;

(C) When the permitted payment stablecoin issuer should close an account after attempts to verify a customer's identity fail; and

(D) When the permitted payment stablecoin issuer should file a Suspicious Activity Report in accordance with applicable law and regulation.

(3) Recordkeeping. The CIP must include procedures for making and maintaining a record of all information obtained under procedures implementing this paragraph (a).

(i) Required records. At a minimum, the record must include:

(A) All identifying information about a customer obtained under paragraph (a)(2)(i) of this section;

(B) A description of any document that was relied on under paragraph (a)(2)(ii)(A) of this section, noting the type of document, any identification number contained in the document, the place of issuance, and if any, the date of issuance and expiration date;

(C) A description of the methods and results of any measures undertaken to verify the identity of a customer under paragraphs (a)(2)(ii)(B) and (C) of this section; and

(D) A description of the resolution of each substantive discrepancy discovered when verifying the identifying information obtained.

(ii) Retention of records. The permitted payment stablecoin issuer must retain the records made under paragraph (a)(3)(i)(A) of this section for five years after the date the account is closed and the records made under

paragraphs (a)(3)(i)(B) through (D) of this section for five years after the record is made.

(4) Comparison with Government lists. The CIP must include reasonable procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal Government agency and designated as such by Treasury in consultation with the primary Federal payment stablecoin regulators. The procedures must require the permitted payment stablecoin issuer to make such a determination within a reasonable period of time after the account is opened, or earlier if required by another Federal law or regulation or Federal directive issued in connection with the applicable list. The procedures must also require the permitted payment stablecoin issuer to follow all Federal directives issued in connection with such lists.

(5) Notice—(i) Customer notice. The CIP must include procedures for providing customers with adequate notice that the permitted payment stablecoin issuer is requesting information to verify their identities.

(ii) Adequate notice. Notice is adequate if the permitted payment stablecoin issuer generally describes the identification requirements of this section and provides such notice in a manner reasonably designed to ensure that a prospective customer is able to view the notice, or is otherwise given notice, before opening an account. For example, depending upon the manner in which the account is opened, a permitted payment stablecoin issuer may post a notice on its website, include the notice in its account applications, or use any other form of oral or written notice.

(iii) Sample notice. If appropriate, a permitted payment stablecoin issuer may use the following sample language to provide notice to its customers:

IMPORTANT INFORMATION ABOUT PROCEDURES FOR OPENING A NEW ACCOUNT

To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each natural or legal person who opens an account, which may be an individual or a person other than an individual (such as a corporation, partnership, or trust).

What this means for you: When you open an account, we will ask for the name, address, date of birth or formation, tax identification number, and other information pertaining to the accountholder. This information will help us verify the identity of the accountholder. We may also ask to see identifying documents pertaining to the accountholder, such as a driver's license (if you are an individual) or a business license, articles of incorporation, or trust instrument (if the accountholder is not an individual).

(6) Reliance on another financial institution. The CIP may include procedures specifying when the permitted payment stablecoin issuer will rely on the performance by another financial institution (including an affiliate) of any procedures of the permitted payment stablecoin issuer's CIP, with respect to any customer of the permitted payment stablecoin issuer that is opening, or has opened, an account or has established an account or similar business relationship with the other financial institution to provide or engage in services, dealings, or other financial transactions, provided that:

(i) Such reliance is reasonable under the circumstances;

(ii) The other financial institution is subject to a rule implementing 31 U.S.C. 5318(h) or 12 U.S.C. 5903(a)(5)(A) and is regulated by a Federal functional regulator; and

(iii) The other financial institution enters into a contract with the permitted payment stablecoin issuer requiring it to certify annually to the permitted payment stablecoin issuer that it has implemented its AML/CFT program, and that it will perform (or its agent will perform) specified requirements of the permitted payment stablecoin issuer's CIP.

(b) Exemptions. The appropriate Federal functional regulator, with the concurrence of the Secretary, may, by order or regulation, exempt any permitted payment stablecoin issuer or any type of account from the requirements of this section. The Secretary, with the concurrence of the Federal functional regulator, may exempt any permitted payment stablecoin issuer or any type of account from the requirements of this section. In issuing such exemptions, the Federal functional regulator and the Secretary shall consider whether the exemption is consistent with the purposes of the Bank Secrecy Act and with safety and soundness, in the public interest, and may consider other necessary and appropriate factors.

(c) Other requirements unaffected. Nothing in this section relieves a permitted payment stablecoin issuer of its obligation to comply with any other provision of this chapter, including provisions concerning information that must be obtained, verified, or maintained in connection with any account or transaction, or its obligations with respect to complying with the terms of any lawful order as set forth in this chapter.

Andrea M. Gacki, Director, Financial Crimes Enforcement Network.

Jointly issued by:

Office of the Comptroller of the Currency.

Jonathan V. Gould, Comptroller of the Currency.

By order of the Board of Governors of the Federal Reserve System.

Benjamin McDonough, Secretary of the Board.

Federal Deposit Insurance Corporation.

By order of the Board of Directors.

Dated at Washington, DC, on May 13, 2026. Jennifer M. Jones, Deputy Executive Secretary.

By the National Credit Union Administration Board, this 12th day of May 2026. Melane Conyers-Ausbrooks, Secretary of the Board.

[FR Doc. 2026-12460 Filed 6-18-26; 8:45 am]

BILLING CODE 4810-02-P