FinCEN Stablecoin KYC Rules Force Issuers to Act like Banks

Stablecoins were supposed to move like crypto, but FinCEN stablecoin KYC rules would make regulated issuers behave much more like banks when they deal directly with customers.

Federal financial regulators are trying to turn the GENIUS Act from statutory architecture into operational compliance. FinCEN, the OCC, Federal Reserve, FDIC and NCUA issued a joint proposed rule that would require permitted payment stablecoin issuers to maintain written customer identification programs, according to PYMNTS. Comments are due Aug. 21, and regulators have proposed a 12-month implementation period after a final rule is issued.

The tension is obvious. Stablecoins promise fast digital-dollar movement. The proposed customer ID regime asks issuers to slow down at the front door, collect identity data, verify it, screen customers and keep records before opening certain relationships.

That doesn't mean every stablecoin transfer becomes a bank onboarding event. The proposal draws a sharp line between direct issuer relationships and secondary-market activity. That line is the story.

Why FinCEN stablecoin KYC would hit the issuer relationship first

The proposed rule focuses on permitted payment stablecoin issuers, or PPSIs. These are the regulated entities that would issue payment stablecoins under the GENIUS Act framework.

The rule would require PPSIs to establish a written customer identification program. In plain English, an issuer would need documented procedures to answer a basic question before opening an account or direct business relationship: who is this customer?

Per a June 30 analysis by Mayer Brown cited by PYMNTS, the proposal would largely mirror existing customer identification rules for banks and broker-dealers, while requiring each issuer to tailor its program to its size, business model and risk profile.

The expected information set is familiar:

• Individuals: name, physical address, date of birth and taxpayer ID or another identifying number.
• Businesses: name, address, date of formation and taxpayer ID or other identifying number.
• Verification: documentary or non-documentary checks, depending on risk.
• Screening: government watch-list review.
• Records: retention procedures that examiners can review.
• Customer notice: disclosure that identity information will be requested and verified.

The policy signal is direct. The agencies are treating regulated stablecoin issuance as payment infrastructure that belongs inside the Bank Secrecy Act compliance perimeter.

"This is the next step to ensure that permitted payment stablecoin issuers are fully integrated into Bank Secrecy Act regulations", said NCUA Chairman Kyle Hauptman, according to the agency’s June announcement.

The rule does not try to KYC every stablecoin transfer

The most important limit in the proposal is what it does not cover.

Regulators would apply the customer identification rules to direct, primary-market relationships between an issuer and its customers. PYMNTS, citing Mayer Brown, lists examples such as issuance, redemption, conversion and custodial services.

Pure secondary-market transactions are treated differently. If users interact only through smart contracts, the proposal would not require the issuer to identify every person in that chain. Regulators concluded that trying to impose customer identification requirements on every secondary-market transfer would create an impractical global compliance obligation.

That distinction matters because stablecoins can circulate far beyond the original issuer relationship. Merely holding or controlling a stablecoin would not, by itself, make someone a customer of the issuer under the proposal. A formal relationship has to exist before the customer ID duty is triggered.

That is the compromise. Regulators want less anonymous access to regulated issuers without pretending that every token movement can be policed at the issuer level.

How a customer would move through issuer onboarding

Under the proposed FinCEN stablecoin KYC model, direct onboarding would look closer to bank account opening than crypto wallet creation.

A customer trying to establish a direct relationship with a PPSI would likely move through several steps:

1. Account request: the customer seeks issuance, redemption, conversion or another direct service.
2. Identity collection: the issuer collects required identifying information.
3. Verification: the issuer checks documents, non-documentary sources or both.
4. Screening: the issuer screens against government lists.
5. Decisioning: the issuer approves, rejects or escalates the customer under its risk-based program.
6. Recordkeeping: the issuer stores required records for examination.

This proposed rule is narrower than the broader anti-money laundering package. FinCEN said in a separate rulemaking that it is also implementing the GENIUS Act’s directive to apply other AML obligations to PPSIs. Those broader obligations are distinct from the customer ID proposal, which centers on identifying and verifying account holders before a covered relationship begins.

XOOMAR analysis: the practical split is that customer identification governs entry into the issuer relationship, while the companion AML and sanctions proposals govern what happens after that relationship exists. The source material supports that division, but the final rule will determine how tightly the pieces fit together.

This matters for fintech payment infrastructure too. Stablecoin rails are increasingly discussed alongside bank-grade settlement systems, as seen in our coverage of 8-Currency Kinexys putting cross-border payments on notice. The proposed rule suggests that any regulated stablecoin issuer playing in that space will need compliance plumbing before scale.

The direct redemption problem is still unresolved

The hardest edge case is direct redemption.

Regulators acknowledge that someone could buy a stablecoin on a secondary-market exchange and later try to redeem it directly with the issuer, despite having no prior relationship with that issuer. The agencies suggest that such a redemption could create a customer relationship requiring identity verification, but they have not reached a final conclusion.

That is not a small drafting issue. It affects how issuers design redemption access.

If redemption creates a customer relationship, issuers will need a process to identify and verify people who did not enter through their own issuance channel. If regulators narrow that trigger, secondary-market holders may face fewer issuer-level checks when seeking redemption. The source material does not say which direction regulators will choose.

The proposal also asks whether the “formal relationship” standard is the right test. Agencies are considering whether another standard, such as a contractual or business relationship, would give more clarity.

This is where the rule could shape market structure without saying so directly. A definition of “customer” can decide when compliance starts.

Banks, credit unions and nonbank issuers would not feel this equally

The proposed framework would have its greatest impact on nonbank stablecoin issuers currently regulated mainly as money transmitters, according to the Mayer Brown analysis cited by PYMNTS.

That distinction matters because banks already operate under more developed customer identification obligations. Money transmitters generally are not subject to the same comprehensive CIP requirements, instead verifying customer identities for certain higher-value transactions. For many stablecoin issuers, the rule would impose formal customer identification duties for the first time.

The agency lineup reinforces that point. FinCEN is writing the financial-crime layer. The banking and credit union regulators are involved because the GENIUS Act places permitted payment stablecoin issuers inside a regulated financial-institution framework, including entities under their respective authority.

NCUA said the GENIUS Act charges it with licensing, regulating and supervising permitted payment stablecoin issuers that are subsidiaries of federally insured credit unions, including for Bank Secrecy Act examination purposes.

That overlaps with a broader fintech banking fight we’ve tracked in Klarna Bank USA Bid Pulls Fintech Banking Into the Fire. The common thread is not that the products are the same. It is that fintech firms moving closer to bank-like services are being pulled toward bank-like supervision.

XOOMAR analysis: larger regulated institutions may be more familiar with examination expectations than nonbank crypto-native issuers, but the proposal itself does not quantify costs, compliance budgets or competitive effects. Those are implementation questions, not settled facts.

A stablecoin launch under the proposed rule would start with compliance design

Take a hypothetical fintech preparing to issue a dollar-backed stablecoin for merchant payments.

Before launch, it would need to write a customer identification program. That means specifying what information it collects from merchants and individuals, how it verifies that information, what documentary and non-documentary tools it accepts, how it screens government lists, how it retains records and how staff handle exceptions.

The friction point is distribution. If a merchant signs up through a wallet partner rather than directly through the issuer, the issuer still needs confidence that the customer identification process satisfies the proposed rule if a direct issuer relationship exists. The proposal asks how often stablecoin issuers are likely to rely on another financial institution’s customer identification program instead of doing verification themselves.

That question matters because the rule is not final. Comments are due Aug. 21, and the proposed implementation period is 12 months after finalization.

The practical watch item is the final definition of “customer.” If regulators keep the formal-relationship test narrow, stablecoin issuers get a clearer boundary between direct issuer activity and secondary-market circulation. If they broaden it, direct redemption and partner distribution could carry heavier onboarding obligations.

Either way, FinCEN stablecoin KYC is moving from theory to operating manual. Issuers that want to be permitted payment stablecoin issuers will need to prove not just that their tokens work, but that their customer files do too.

Disclaimer: This XOOMAR analysis is for informational and educational purposes only. It is not financial, investment, legal, tax, or professional advice. It does not provide buy, sell, hold, price-target, portfolio, or personalized recommendations. Verify information independently and consult qualified professionals before making decisions.

Impact Analysis

• Stablecoin issuers would face bank-like customer identification duties when dealing directly with customers.
• The proposal could slow onboarding while strengthening compliance controls around digital-dollar products.
• The rule clarifies that secondary-market stablecoin transfers may be treated differently from direct issuer relationships.