Five Federal Regulators Propose Joint Rule Requiring Stablecoin Issuers to Verify Customer Identities Under the GENIUS Act

Since the GENIUS Act became law in July 2025, regulators have been racing to finalize its implementing rules before a hard statutory deadline. This week's proposed rule is the latest concrete output from that effort.

On June 18, FinCEN announced that five federal agencies — FinCEN itself, the Federal Reserve, the FDIC, the OCC, and the NCUA — issued a joint notice of proposed rulemaking requiring all permitted payment stablecoin issuers, referred to as PPSIs, to maintain written customer identification programs, or CIPs. The FDIC's own notice confirms the same action.

What the Rule Would Actually Require

According to the Bitcoin Magazine report by Micah Zimmerman, PPSIs would be required to collect a legal name, date of birth or date of formation for entities, physical address, and a government-issued identification number from each customer before an account is opened or a direct token redemption is processed. That's the same baseline banks, broker-dealers, mutual funds, and futures commission merchants have operated under for more than 20 years.

The FDIC's notice adds operational detail: PPSIs that are subsidiaries of federally insured depository institutions can coordinate with their parent bank's existing CIP program rather than building one from scratch, so long as the combined program adequately addresses the distinct risks of each entity. A PPSI can also rely on another federally regulated institution's CIP procedures if three conditions are met: the reliance is reasonable, the other institution has an AML/CFT program with CIP requirements, and it is regulated by a federal functional regulator.

This avoids imposing duplicative compliance costs on bank-affiliated stablecoin operations. Whether it creates a gap that non-bank stablecoin issuers can exploit is a legitimate open question.

The Statutory Clock

The GENIUS Act becomes effective on the earlier of January 18, 2027, or 120 days after primary federal regulators finalize their implementing rules, according to the Bitcoin Magazine account. FinCEN notes that this CIP proposal runs alongside a separate rulemaking covering the Act's broader anti-money laundering obligations for PPSIs. Both tracks need to close before the 120-day countdown can start. With 60 days of public comment now open, the timeline is tight.

One Voice of Caution from Within the Fed

Federal Reserve Governor Michael Barr has emerged as the most vocal voice of caution within the regulatory apparatus. Speaking in March at a Federalist Society conference in Washington, Barr warned that stablecoins face material risks around reserve asset quality, regulatory arbitrage, anti-money laundering gaps, and financial stability — concerns he argued the GENIUS Act's primary text does not resolve on its own. "While some digital asset service providers are subject to anti-money laundering and anti-terrorist financing requirements in their home jurisdiction, it is far too easy for bad actors to evade these restrictions and operate without detection when transacting in digital assets," Barr said in a statement Thursday.

The rule as proposed does NOT directly address reserve requirements or run-risk backstops. Those obligations already exist under the core GENIUS Act text. This rulemaking is specifically and narrowly about knowing who your customers are, not about capital adequacy. Critics who worry that CIP requirements alone are insufficient to prevent systemic risk are raising a real point, and this proposal doesn't purport to resolve it.

Why This Matters

The GENIUS Act was framed as pro-innovation legislation. Requiring 100% liquid-asset reserve backing and Bank Secrecy Act compliance is not a light touch. Bringing stablecoin issuers under the same AML discipline as banks closes a genuine gap that law enforcement has flagged for years: crypto transactions that move value across borders with limited customer-identity traceability.

For stablecoin issuers operating outside the banking system, this is new compliance territory. For bank-affiliated PPSIs, the parent-reliance provision in the FDIC notice significantly reduces the operational burden. Large bank-backed issuers may have an advantage over independent crypto-native competitors.

No charges or enforcement actions are connected to this rulemaking. It is a proposed rule, and nothing in these sources indicates that any PPSI is currently under investigation for CIP failures.

The Open Question

FinCEN says the final CIP rule, once issued, will trigger a 120-day clock before the full GENIUS Act regime kicks in. The unresolved question is whether regulators can close both the CIP rulemaking and the separate AML rulemaking in time to give issuers a workable implementation window before January 18, 2027. According to Bitcoin Magazine, final CIP rules are not expected before 2027, which means the statute could take effect before its customer identification architecture is fully in place. That scheduling pressure is the next thing to watch.