KoinlyticsThe Office of the Comptroller of the Currency shut its public comment window on the GENIUS Act BSA and sanctions rulemaking at end of day July 24, 2026, closing a 30-day sprint that industry lobbyists say was engineered to lock in the toughest stablecoin compliance regime in any major jurisdiction before the political weather changes. The joint proposal from federal banking regulators and FinCEN reclassifies permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act, layers on a set of anti money laundering obligations that Congress wrote directly into the GENIUS Act text, and forces every issuer that wants to hold a PPSI charter to run a sanctions compliance program that would not look out of place at a Category II national bank. Circle, Paxos, and any bank subsidiary considering a stablecoin play are now staring at a compliance floor that did not exist ninety days ago, and the timeline for adaptation is measured in months rather than years.
What PPSI status actually means under the GENIUS Act
The GENIUS Act, signed into law earlier in 2026, created a new federal category called the permitted payment stablecoin issuer. On paper it is a licensing regime, but the OCC proposal makes clear that the license comes wrapped in the full weight of federal banking supervision. A PPSI must implement a written BSA compliance program approved by its board, appoint a dedicated BSA officer with reporting lines to the board risk committee, conduct independent testing of the program on at least an annual cadence, and deliver ongoing training to every employee whose function touches customer onboarding, transaction monitoring, or reserve management. None of this is optional and none of it can be outsourced without residual accountability sitting with the issuer.
The customer identification piece is where the rule bites hardest for firms that grew up in a crypto-native operating model. PPSIs will need to verify the identity of any person who directly mints or redeems the stablecoin with the issuer, retain the underlying identity records for five years, and cross-check every counterparty against government watch lists in real time. Transaction monitoring requirements track the FinCEN standard for banks, meaning issuers must maintain risk-based systems that surface unusual activity, generate alerts, and feed a case management workflow that produces Suspicious Activity Reports within the standard thirty-day filing window from initial detection. Currency Transaction Reports apply where cash equivalence is triggered, and the OCC signalled in the preamble that it views large primary market redemptions as squarely within the reportable universe.
Sanctions compliance is the third pillar and arguably the one with the sharpest teeth. Every PPSI must maintain an OFAC compliance program that screens counterparties, blocks prohibited transactions, and enforces address-level blocklists at the smart contract layer where technically feasible. The rule does not say every issuer must implement onchain freeze functionality, but it makes clear that where such functionality exists the issuer is expected to use it on receipt of a valid OFAC designation. For USDC that is already the operating posture. For issuers considering more decentralized designs it is a hard constraint that may kill certain architectural choices before they reach production.
Why thirty days was the fight
The Bank Policy Institute went public within a week of Federal Register publication to argue that a 30-day comment window was structurally inadequate for a rulemaking of this scope. The Administrative Procedure Act sets no fixed minimum but the operational norm at federal banking regulators has been 60 days for rules of moderate complexity and 90 to 120 days for anything that reshapes a supervisory perimeter. This rule does the latter. It creates a new class of supervised entity, imports a compliance regime that took decades to mature at insured depository institutions, and applies it to firms whose engineering culture was built around permissionless finality rather than reversible bank rails.
Legal analysts at Chapman and at Freshfields flagged the same concern in client alerts published mid-comment period. The compressed window meant that trade groups had to file substantive technical objections without the benefit of the working-level dialogue that normally accompanies a rulemaking of this magnitude. It also meant that any smaller firm hoping to become a PPSI, but without a dedicated Washington policy shop, effectively had no chance to shape the outcome. Whether that was deliberate or a scheduling artefact of the GENIUS Act's own statutory deadlines is a question the courts may end up answering if the final rule is challenged under the APA.
The counter-argument from the regulators is straightforward. The GENIUS Act itself imposes hard timelines on implementing regulations and a longer comment window would have pushed final adoption past those statutory bookends. In that framing the 30 days is not a policy choice but a downstream consequence of the statute Congress passed. That defence works legally. It does not soften the operational reality for the issuers who now have to build to the rule.
Operational reality for Circle, Paxos, and the next wave
Circle is the case study everyone is watching. USDC already operates under a New York trust charter and Circle has publicly disclosed a monthly reserve attestation, a live blocklist mechanism, and a BSA program run out of its Boston compliance function. The transition to PPSI status is therefore more evolution than revolution, but the delta is still meaningful. Circle will need to formalize its OFAC screening for primary market participants, extend identity verification to a broader set of counterparties than its current tiered access model requires, and reconcile its existing state-level filings with new federal reporting cadences. Expect staffing announcements. Expect the compliance headcount to move higher as a percentage of total employees.
For Paxos, which issues USDP and operates the PayPal USD stablecoin, the picture is similar. Both firms already run bank-grade compliance stacks and the marginal cost of PPSI qualification is real but manageable. The harder problem sits with the next tier. Any regional bank, fintech, or exchange that has publicly floated the idea of issuing its own stablecoin now faces a build-out cost measured in tens of millions of dollars before it can even file the charter application. Wallet screening tools, blockchain analytics licences, BSA officer recruitment, independent audit engagements, board governance documentation, and a technology stack capable of onchain enforcement all have to be in place at the point of application rather than after approval. That reshapes the competitive landscape. It favours incumbents. It raises the barrier for new entrants in exactly the way the largest existing issuers would want.
Tether sits outside all of this because USDT is not seeking a PPSI charter and its issuance operations are structured offshore. The GENIUS Act does not compel offshore issuers to become PPSIs, but it does create pathways for restricting the domestic distribution and secondary market access of stablecoins that do not qualify. That is a separate regulatory workstream but it is the reason USDT holders should track the OCC rulemaking even though the OCC has no direct authority over the issuer. The rule shapes the ecosystem USDT trades into.
The parallel CFTC window closes July 27
Three days after the OCC deadline, the Commodity Futures Trading Commission closes its own comment period on proposed changes that would permit 24/7 trading of listed futures products and open the door to perpetual style bitcoin futures on regulated US venues. This is a distinct rulemaking with a different statutory basis and a different set of stakeholders, but the timing is not accidental. The federal financial regulatory apparatus is running a coordinated push through the summer of 2026 to finalize the rulebook for both stablecoins and crypto derivatives before the fall calendar closes off legislative and administrative bandwidth.
For traders the CFTC piece matters directly. Perpetual style futures listed on CME or a comparable venue would give US institutional participants access to the funding rate mechanism that has driven so much of the offshore crypto derivatives market. The comment period closing July 27 is the last public input opportunity before the CFTC moves to a final rule that could be published within weeks of that date. Coming so close to the OCC stablecoin deadline, the two together mark the point where the US regulatory framework for onchain finance stops being a proposal and starts becoming an operating constraint.
What happens next
The OCC and its co-authors will now work through the comment file. Given the volume expected and the political sensitivity, a final rule is unlikely before Q4 2026 and could slip into early 2027. Once adopted, the implementation timeline will be staggered. Sanctions compliance and customer identification requirements typically get shorter runways because the underlying obligations already exist for regulated institutions. The full BSA program build out will likely get a longer window, potentially twelve months post-effective date, to accommodate hiring and technology deployment.
Charter applications are the leading indicator to watch. The first wave of PPSI filings will tell the market which firms believe they can meet the compliance bar and which are quietly stepping back from federal issuance ambitions. Expect Circle to file early to lock in first mover advantage. Expect at least one large bank holding company to file within the first six months of the rule taking effect, testing whether the OCC will approve issuance through a bank subsidiary versus requiring a standalone entity. The answers to those structural questions will define the shape of the US stablecoin market for the rest of the decade.
The near term question for traders and treasury teams is simpler. Does the compliance overhang change the risk profile of holding USDC or PYUSD versus offshore alternatives. On the current facts the answer is that regulated US stablecoins become safer collateral for institutional counterparties who were already screening on issuer jurisdiction, while offshore alternatives retain their liquidity edge for use cases that value speed and permissionless access over regulatory clarity. The market bifurcates further along that line.
What Koinlytics tracks: PPSI charter filings, USDC and PYUSD reserve attestations, OFAC designation events that trigger onchain freeze actions, CFTC final rule publication on 24/7 futures, and the compliance staffing signals that reveal which issuers are actually building to the standard versus waiting for enforcement to move.