Digital cash just became a financial institution

On July 18, 2025, the GENIUS Act made stablecoins legitimate. In April 2026, Treasury made them regulated. FinCEN and OFAC jointly proposed rules treating permitted payment stablecoin issuers — PPSIs — as “financial institutions” under the Bank Secrecy Act, for the first time. The comment window closed June 9, and the statute’s own clock runs to full enforcement no later than January 18, 2027.

For a decade, stablecoins lived in a regulatory gray zone: a patchwork of state money-transmitter licenses and informal, voluntary monitoring. That era is over. A stablecoin issuer is now, by law, a financial institution — carrying the same core duties as a bank: an effective AML program, customer identification and due diligence, suspicious-activity reporting, recordkeeping, and independent testing. And, for the first time ever mandated by law for a category of U.S. persons, an effective sanctions compliance program.

The obligation doesn’t end at issuance

This is more than bank rules copied over. A stablecoin is a bearer instrument — digital cash that keeps moving after it leaves the issuer’s hands. So the rules reach into territory a bank never had to police: the secondary market, where FinCEN has assessed that the majority of illicit stablecoin activity occurs.

The proposal expects issuers to retain technical control over their own tokens after issuance — the ability to block, freeze, and reject transactions, and even to burn and reissue tokens to make fraud victims whole or to execute a lawful order. Monitoring and suspending a token becomes an ongoing obligation, not a one-time check at onboarding.

This is the effectiveness standard, extended

None of this is happening in isolation. The stablecoin rules were published in the same Federal Register edition as FinCEN’s overhaul of bank AML programs, and they share one philosophy: effectiveness over box-checking. A PPSI’s program is judged not by whether the forms were filed, but by whether it actually works — and the proposal explicitly rewards issuers who demonstrate results through advanced tools, including artificial intelligence and other advanced monitoring. The same outcomes-based regime now governs a community bank in Ohio and a stablecoin issuer on Ethereum.

Who has to build, and who has to adapt

For crypto-native issuers, this is a build-from-scratch moment. Many have operated on state money-transmitter licenses with lean compliance teams; they now need bank-grade AML and sanctions programs stood up against a January 2027 clock. The gap between the large issuers with existing banking relationships and the smaller entrants is wide, and it is measured in months of infrastructure they do not yet have.

For banks and established institutions, stablecoins are now counterparties and rails you have to account for. If your customers touch regulated stablecoins — for payments, treasury, or cross-border settlement — then those issuers’ controls, and their freezes, are now part of your risk picture too.

It comes down to data and real-time screening

Strip away the novelty and the requirements resolve to a familiar core — executed in a faster, on-chain context:

1. Identity you can trust. Customer identification and due diligence on account holders — know who is minting and redeeming your stablecoin, and the real humans and entities behind them.
2. Sanctions screening that never sleeps. An effective, now-mandated sanctions program means real-time screening of parties and, where you exercise control, wallet-level exposure — against lists that change by the day.
3. Risk profiles that read on-chain and off. Blend blockchain signals — secondary-market exposure, addresses tied to illicit actors — with off-chain entity intelligence to build a customer risk picture that reflects real risk.
4. Monitoring across the token’s life. Not a snapshot at onboarding, but continuous monitoring and the technical capability to act — block, freeze, burn — when a lawful order or a risk event demands it.
5. Effectiveness you can show. Under this regime you must demonstrate the program works: provenance on the data, an audit trail behind every decision, and a rationale an examiner can follow.

Compliance is now core stablecoin infrastructure

The stablecoin economy will be built by the issuers who treat AML and sanctions not as a bolt-on to satisfy an examiner, but as core infrastructure that earns the trust of banks, institutional partners, and regulators. That trust runs on data — and the data layer is exactly where a program is won or lost.