Treasury's GENIUS Act rule would make exchanges vet foreign stablecoin issuers

The US Treasury has proposed rules requiring crypto exchanges to run due diligence on foreign stablecoin issuers before listing their tokens. The notice of proposed rulemaking published on 18 August 2026 implements section 3 of the GENIUS Act. Comments close on 19 October 2026, and the first prohibition bites from the Act's expected effective date in January 2027.

• Treasury proposes a new 12 CFR part 1523 implementing section 3 of the GENIUS Act, covering who may issue, offer or sell payment stablecoins in the United States.
• A digital asset service provider may rely on an issuer's representation that it can obey a lawful order only after conducting reasonable due diligence on that issuer.
• The prohibition covering foreign stablecoin issuers applies from the expected effective date of 18 January 2027, not from the later 2028 deadline.
• A provider that knowingly lists a stablecoin subject to a trading prohibition faces a civil penalty of up to 100,000 dollars per violation per day under 12 U.S.C. 5907(b)(4).
• Treasury has not yet found any foreign regime comparable, and each determination needs a recommendation from both the Federal Reserve and FDIC chairs.

What did Treasury actually propose?

Treasury proposed a rule implementing section 3 of the GENIUS Act, the statute governing who may issue, offer or sell payment stablecoins in the United States. The proposal appeared in the Federal Register on Tuesday 18 August 2026 at Volume 91, Number 158, under docket TREAS-DO-2026-0496. Comments are due by 19 October 2026.

The GENIUS Act became law on 18 July 2025 as Public Law 119-27, codified at 12 U.S.C. 5901 and following. Section 3 makes it unlawful for anyone other than a permitted payment stablecoin issuer to issue a payment stablecoin in the United States. Treasury's proposal would add a new part 1523 to title 12 of the Code of Federal Regulations, defining the terms the statute left open: what it means to issue a stablecoin "in the United States", what counts as an offer or sale, and who is located in the country.

Announcing the proposal, Treasury Secretary Scott Bessent said the department is "moving quickly to implement that framework". The practical weight sits in the sections dealing with foreign stablecoin issuers, because those duties fall on the exchanges and custodians that list the tokens rather than on the issuers alone.

How would the offer and sale prohibitions phase in?

Two prohibitions run on two clocks. The one aimed at foreign stablecoin issuers arrives on the Act's effective date, expected to be 18 January 2027. The broader prohibition on offering any unlicensed payment stablecoin to US persons does not arrive until 18 July 2028.

Two statutory terms carry the weight here, and both sit in 12 U.S.C. 5901. A digital asset service provider, at 5901(7), is a person that for compensation engages in the business of exchanging digital assets, transferring them to a third party, acting as a custodian, or participating in financial services relating to digital asset issuance. Subparagraph (B) expressly excludes distributed ledger protocols, self-custodial software interfaces, validators and liquidity pool participants, so a DeFi front end sits outside the definition. A lawful order, at 5901(16), is an order requiring a person to seize, freeze, burn or prevent the transfer of stablecoins they issued. It must also identify the stablecoins or accounts with reasonable particularity and be subject to judicial or administrative review.

The effective date matters more than it looks. Section 20 of the Act sets it as the earlier of 18 months after enactment or 120 days after the primary Federal payment stablecoin regulators issue final rules. Those regulators are the banking agencies, not Treasury, so this proposal becoming final would not move the date. With no such rules issued, 18 January 2027 is effectively locked, and it could only ever have moved earlier.

The two routes into the US market are not equivalent. A domestic permitted issuer clears a federal or state licensing process. A foreign issuer instead has to satisfy four cumulative conditions in 12 U.S.C. 5916(a), and one of them is outside its own control.

What changes for your compliance obligations?

The duty this rule creates is counterparty diligence on a business, not identity checks on a retail user. For foreign stablecoin issuers, the checking party is the venue. Before listing a foreign-issued token, a provider must satisfy itself that the issuer can freeze or seize on a lawful order. That is a know your business problem.

Four points deserve planning. First, reliance on an issuer's written representation is permitted only where the provider has conducted reasonable due diligence, so the representation alone is not a defence. Treasury states that a provider "should consider all reasonably available sources of information" about the issuer, a broader inquiry than reading a certificate.

Second, screening scope widens. Section 8 of the Act lets the Secretary designate a foreign issuer as noncompliant, publish that designation in the Federal Register, and then notify a prohibition on secondary trading. Treasury expects diligence to include confirming no such prohibition is in force. That is a new published list to ingest alongside sanctions and PEP screening, on three consecutive 30 day cycles: designate, cure, then the prohibition bites.

Third, the standard of knowledge reaches past actual knowledge. A provider may not rely on a representation where it "knows, has reason to know, or should know" that it is false. Constructive knowledge is proved from records, so evidence of what was checked, and when, becomes the operative control. Enhanced due diligence files on higher risk issuers should carry the rigour of any high risk customer file.

Fourth, this is a continuing obligation, not an onboarding gate. The test asks whether an issuer "will comply", which is forward looking, so a listing decision made in January 2027 does not stay valid by default. None of this displaces Bank Secrecy Act duties: transaction monitoring, Suspicious Activity Report filing and sanctions obligations continue unchanged.

What is still uncertain about the foreign stablecoin issuers regime?

Several things in this proposal are unresolved, and the largest is that no foreign regime has yet been found comparable. 12 U.S.C. 5916(b) makes a published Federal Register justification a precondition of any determination taking effect, and none has appeared for any jurisdiction. Without one, the section 18(a) route is theoretical while the section 3(b)(2) prohibition still binds.

The comparability process is a bottleneck by design, and no jurisdiction has cleared it, the EU, the UK, Singapore, Japan and the UAE included. The Secretary may act only on a recommendation from each other member of the Stablecoin Certification Review Committee, which the statute defines as the Federal Reserve chair, or the vice chair for supervision, and the FDIC chair. Either can stall a jurisdiction. A request does start a clock, since the Secretary must decide within 210 days of a substantially complete request, but that clock cannot meaningfully run before the framework is effective, so the earliest realistic determinations land well into 2027.

The diligence standard is also undefined. Treasury concedes a provider "can never know with certainty" whether an issuer will comply in future, and asks the industry, in question 52 of the proposal, what diligence should be required and whether the rule should prescribe the form of the representation. Firms building controls now are building against a moving target, and the final rule may be more prescriptive.

Two further risks matter. The proposal includes a severability clause stating that provisions are separate and severable, language drafters use when they expect litigation. And the location tests lean on mechanisms that are easy to defeat: proposed section 1523.3(d) treats advising purchasers on how to evade IP address checkers as an offer, which concedes that geofencing alone is weak evidence of where a customer sits. Firms relying on IP based controls to prove they did not offer a token to a US person may find that record thin under examination.

How does this differ from the earlier stablecoin proposals?

This is not the first US stablecoin rulemaking of 2026, and it addresses a different question from the earlier one. The June 2026 FinCEN proposal dealt with customer identification duties owed to end users, which we covered at the time. This one governs market access.

Europe took the opposite route. The EU's Markets in Crypto-Assets Regulation, MiCA or Regulation (EU) 2023/1114, requires an issuer to be authorised inside the bloc and then passports that authorisation across member states, putting the licensing burden on the issuer. That regime's transitional period closed on 1 July 2026. The GENIUS Act takes a different route for foreign stablecoin issuers by placing an ongoing verification duty on the venue. An exchange in the American model is the enforcement point, and the party exposed to penalties when the check is inadequate.

How should compliance teams respond?

Start with an inventory. List every token you support from foreign stablecoin issuers, name the issuing entity, its jurisdiction of incorporation and its regulator, and record whether that jurisdiction is under comprehensive US sanctions or designated a primary money laundering concern. That last test can be answered today and removes some names immediately.

Next, build the issuer file. It should hold the registered entity and its incorporation record, the ownership and control chain, the named regulator and licence reference, the written representation on lawful order capability, and the independent checks supporting it. Add section 8 designations to your screening feeds, and note that they arrive as Federal Register notices rather than a delimited file, so ingesting them needs a human trigger rather than an overnight job. Set a dated review cadence, and file a comment before 19 October 2026 if the diligence standard would be unworkable at your scale, because Treasury has asked for exactly that input.

Zyphe handles the verification half of this problem. Our KYB verification resolves ownership and control against 240+ corporate registries worldwide, sanctions screening covers the list checks, and every check leaves an exportable audit trail, with no central store of identity records to breach. If you are scoping issuer diligence before January 2027, book a demo.

The bottom line

This proposal moves the burden of policing foreign stablecoin issuers onto the venues that list their tokens, and it does so on a timeline starting well before the headline 2028 deadline. Teams running KYC and AML programmes at exchanges and custodians should treat it as a business verification problem with a screening component attached.

The diligence standard is still open, the comparability determinations that would make the qualifying route usable have not been made, and the knowledge test will be judged on records written long before anyone asks to see them. Building the issuer file now is cheaper than reconstructing it later.

Cited sources

• Treasury NPRM: GENIUS Act Regulations on Payment Stablecoin Issuance, Offer, and Sale (91 FR 53368)
• Full text of the proposed rule, Federal Register PDF
• Treasury press release: Treasury Seeks Public Comment on GENIUS Act Proposed Rulemaking
• 12 U.S.C. 5916: Exception for foreign payment stablecoin issuers
• 12 U.S.C. 5907: Anti-money laundering protections
• 12 U.S.C. 5901: Definitions, including digital asset service provider
• FinCEN NPRM, June 2026: Permitted Payment Stablecoin Issuer Customer Identification Program
• Regulation (EU) 2023/1114 (MiCA), consolidated text on EUR-Lex
• Public Law 119-27, the GENIUS Act, enacted 18 July 2025