US stablecoin regulation: what the GENIUS Act requires

US stablecoin regulation stopped being a policy debate on 18 July 2025, when the Guiding and Establishing National Innovation for U.S. Stablecoins Act (P.L. 119-27) was signed into law. Its licensing and reserve rules take effect on 18 January 2027, or 120 days after the final implementing regulations, whichever comes first. The OCC issued its final rules on 21 October 2026, and 120 days from that date falls on 18 February, so the January date governs. Prudential banking regulators now hold primary federal authority. The SEC and CFTC do not.

Two tokens, USDT and USDC, carry 96% of volume across the whole category, so a federal rule that decides which issuers are permitted sets the terms for almost every stablecoin an American can hold.

2026 is the runway. Agencies are publishing the proposed and final rules that build the machinery for the January transition. The prohibited-without-license rules are not operative yet, but the reserve, audit and redemption duties sit in the statute already, and state regulators are fining businesses that ignore the licensing side.

Key takeaways

• The GENIUS Act is law. Signed 18 July 2025, it creates the first federal licensing regime for payment stablecoin issuers, with rules taking effect 18 January 2027.
• The OCC leads federal oversight. The SEC and CFTC lose direct jurisdiction over permitted payment stablecoins.
• Reserves must be 1:1. Eligible assets are narrowly defined, held apart from operating funds, and published every month.
• State licensing still applies. Federal authorization replaces neither a state money-transmitter licence nor New York's BitLicense.
• Holders gain checkable protections. Monthly certified reserve reports and a two-business-day redemption rule replace marketing claims.

What the GENIUS Act actually does

The Act creates a federal licensing regime for permitted payment stablecoin issuers and makes it unlawful for anyone outside that definition to issue a payment stablecoin in the United States once the operative date arrives. The law defines a payment stablecoin as a digital asset designed to hold a stable value against a fiat currency, issued by a permitted issuer, and backed 1:1 by eligible reserves. That is narrower than the way most people use the word.

What the law leaves out

Algorithmic stablecoins hold their peg with code rather than fiat reserves, so they cannot meet the statute's redemption and reserve requirements. A token with no licensed issuer obliged to redeem it at par falls outside the permitted category. Partially backed stablecoins fail the same test, because the Act requires full backing rather than fractional coverage. The Federal Reserve has placed algorithmic stablecoins among the other stablecoins that sit outside the framework.

The three authorization routes

The first route is a federally licensed nonbank path supervised by the OCC. The second is a subsidiary or affiliate of an insured depository institution, supervised by its banking regulator. The third is a state-qualified issuer operating under a state regime that federal regulators have certified as equivalent. Foreign issuers face extra restrictions and cannot use the same pathways as domestic entities.

Which federal agencies have authority now

Before the Act, the SEC and CFTC each staked overlapping claims over stablecoins under general securities and commodities law. The Act classifies permitted payment stablecoins as neither securities nor commodities, which moves primary federal supervision to prudential banking regulators.

• OCC. Primary federal licensor and examiner for federally approved nonbank issuers.
• Federal Reserve. Supervises state-member-bank stablecoin subsidiaries, covering reserves, capital, redemption, custody, risk management and reporting.
• FDIC. Safety-and-soundness oversight of insured depository institutions, and the clarification that deposit insurance does not cover digital assets.
• FinCEN and Treasury. AML, CFT, sanctions and Bank Secrecy Act compliance, with every permitted issuer treated as a financial institution.
• SEC and CFTC. No primary role for permitted stablecoins, and continuing jurisdiction over tokens that do not qualify.

FinCEN's 2026 proposed rules treat permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act. They add transaction monitoring, customer identification programs and a sanctions-compliance framework covering management oversight, risk assessment, internal controls, independent testing and staff training. The OCC's final rules, published on 21 October, match reserves to coins outstanding, hold redemption to two business days and keep the ban on paying yield.

What issuers must actually do to comply

The Act and the OCC rules rest on four pillars: reserve adequacy, monthly disclosure and audit, redemption mechanics, and custody segregation.

Reserve requirements

Issuers must hold identifiable assets equal to at least 1:1 with outstanding tokens at all times. Under section 5903 of title 12, the eligible assets are:

• US currency and Federal Reserve balances.
• Demand deposits at insured institutions.
• Treasury securities with no more than 93 days to maturity, and qualifying repurchase and reverse-repurchase agreements collateralized by them.
• Government money-market funds invested solely in those same categories.

A fund holding longer-dated Treasuries or anything outside that list does not qualify. Reserve assets sit apart from the issuer's operating funds, and the issuer publishes them every month. The list also points reserve money at short-dated Treasury bills and almost nowhere else. Stablecoin issuers already rank among the top-20 holders of US government debt, and the statute narrows what else they may hold.

Audits, financial statements and redemption

Reserve reports must be certified monthly by the issuer's CEO and CFO and examined by a registered public accounting firm. Issuers with more than $50bn in outstanding stablecoins must also prepare annual GAAP financial statements audited to PCAOB standards. On redemption, issuers must publish clear procedures including any fees, and process redemptions within two business days as a general rule. They must notify the OCC when redemption requests inside 24 hours exceed 10% of outstanding issuance value.

Do state laws still apply, and which ones matter

Federal licensing does not preempt state requirements in most situations. A company operating nationally faces a jurisdiction-by-jurisdiction map rather than a single national clearance. Many states treat fiat-backed, redeemable stablecoins as monetary value or stored value, which triggers money-transmitter licensing in every state where the issuer operates or serves customers.

Six states have gone further, with digital-asset statutes that modify or replace standard money-transmitter licensing: California, Colorado, Delaware, New York, Texas and Vermont. Delaware is the newest. Governor Matt Meyer signed SB 19 on 6 July 2026 alongside two companion banking bills, and the framework is written to be certified as substantially similar to the federal regime. Its substantive provisions become operative a year after signing, or sooner if the State Bank Commissioner publishes notice that final implementing regulations have been adopted.

New York adds a layer on top. A BitLicense, or a qualifying NYDFS charter, covers any business that issues, custodies, transmits or exchanges virtual currency involving New York residents, and an issuer needs written NYDFS approval before launching a product. A platform that both issues a stablecoin and transmits fiat in New York may need the BitLicense, a separate money-transmitter authorization, and FinCEN registration as a money-services business.

Where regulators have already drawn the line

Three cases set the clearest precedents for US stablecoin businesses heading into 2027. In August 2025 NYDFS fined Paxos $26.5m and required a further $22m of compliance investment, $48.5m in total, over AML, transaction monitoring and due-diligence failures tied to its Binance relationship. Paxos had leaned on Binance's written policies and outside-auditor materials instead of testing whether Binance's controls worked.

“Regulated entities must maintain appropriate risk management frameworks that correspond to their business risks, which includes relationships with business partners and third-party vendors.”

— Adrienne Harris, Superintendent of NYDFS, 7 August 2025, https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20250806

NYDFS pointed to no customer loss and fined Paxos anyway.

The CFTC's October 2021 order against Tether remains the leading federal precedent on reserve accuracy. Tether paid $41m over misleading claims about what stood behind USDT. The order still matters because the CFTC keeps jurisdiction over stablecoins that do not qualify under the GENIUS Act.

In February 2026 Texas went after a platform rather than an issuer. Banking Commissioner Charles Cooper signed consent order 2026-001 on 24 February, finding that CoinFlip sold stablecoins to Texas customers without a money transmission licence, first through CF Preferred, an unlicensed affiliate that merged into the company in October 2024, then through its own Order Desk. The selling ran from 13 February 2024 until the department found it in October 2025, twenty months, and the penalty came to $40,839, roughly $2,000 for each of those months. Texas needed no new statute: Finance Code section 152.003 already counts a fully backed, redeemable stablecoin as monetary value.

What the new rules mean if you hold USDC or USDT

Holders gain from the shift. A permitted stablecoin must be 1:1 backed by eligible, segregated assets, examined by a public accounting firm, and redeemable within two business days, where before 2025 the adequacy of those reserves was whatever the issuer said it was.

The transition still carries risk. The January 2027 date means the prohibited-without-license framework is not in force yet. Issuers based outside US jurisdiction answer to no US supervisor in the meantime. Algorithmic stablecoins the Act does not cover operate without the same oversight, and smart-contract custody risk exists whatever the regulatory status. You can check today whether the token in your wallet comes from an issuer heading for permitted status, and the MiCA treatment of USDC in Europe shows how far two jurisdictions diverge on one token.

The bottom line on stablecoin regulation in the US

Compliance runs on three layers: the GENIUS Act, its implementation by the OCC, FinCEN, the Federal Reserve and the FDIC, and the licensing regimes of the states. No single license clears all three, and regulators in New York and Texas have already fined companies that read the overlap as optional.

For issuers the to-do list is concrete. Pick an authorization route, build reserve management and monthly disclosure, document an AML and sanctions program, and work through the states before January 2027. Paxos paid $48.5m for the gap in its program, and CoinFlip lost the right to transact in Texas at all. We follow each OCC release, FinCEN proposal and state enforcement action as it lands, and the longer arc of crypto licensing history sits in a separate piece.

Frequently asked questions

When do the GENIUS Act licensing and reserve rules take effect?

On 18 January 2027, or 120 days after the final implementing regulations, whichever comes first. The OCC published its final rules on 21 October 2026, which puts the 120-day alternative at 18 February 2027, so the January date governs.

How can I tell whether a stablecoin comes from a permitted issuer?

Check whether the issuer holds federal authorization under one of the three routes and whether eligible, segregated reserves back the token 1:1. Monthly certified reserve reports and disclosures examined by a registered public accounting firm come with that status.

Does deposit insurance cover balances held in stablecoins?

No. The FDIC keeps safety-and-soundness oversight of insured depository institutions, and the statute states plainly that deposit insurance does not extend to digital assets.

Are foreign stablecoin issuers treated the same as US issuers?

No. Foreign issuers face extra restrictions and cannot use the same authorization pathways, which is why an issuer outside US jurisdiction stays a separate risk for holders through the transition.

Reference material, not legal or investment advice. Dates and figures come from the statute, agency press releases and state orders linked above, checked on 28 October 2026. The 18 February calculation, the Delaware operative-date detail and the arithmetic on the CoinFlip penalty are ours.