GENIUS Act Compliance Map

Why it matters: Three agencies — OCC, Treasury, FDIC — are writing the implementing rules right now. The compliance architecture for the entire stablecoin industry is being decided in a 12-month window.

What this page does: Maps where each GENIUS provision fires in the actual transaction architecture — not a legal summary, but the compliance cartography.

Reading the Stage Map

How it works: Each row is a GENIUS section. Each column is an STP stage. A lit cell means that provision creates compliance obligations at that stage.

What stands out:

• §6 AML/BSA concentrates at Stages 2–5 — the identity and routing phases
• §4 Reserves fires at Stages 4, 6, and 7 — where money is committed and moved
• §8 Foreign Issuers lights up at Stages 1, 2, and 5 — intent, identity, and transport — the cross-border exposure points

The Rulemaking Window

The big picture: Three parallel rulemakings, one deadline.

• OCC — PPSI licensing and reserve attestation
• Treasury — State oversight framework and foreign issuer registration (the extraterritorial provisions)
• FDIC — Insured depository institutions entering the stablecoin market

Key dates:

• June 2, 2026 — All three comment periods close
• July 18, 2026 — Final rules due (one year after signing)
• January 18, 2027 — Full enforcement begins

The bottom line: The window between now and final rules is when the compliance architecture is being decided. Every issuer, custodian, and infrastructure provider integrating stablecoins should be tracking these NPRMs.

Where GENIUS Reaches

Near-universal: §3 (Definitions) and §6 (AML/BSA) fire on virtually every path.

Broad but selective: §4 (Reserves) is lighter on DeFi paths where issuers aren't directly in the loop. §8 (Foreign Issuers) concentrates on cross-border paths — CCTP, remittance corridors, wholesale FX, and RWA cross-chain.

What's missing matters: Pure DeFi paths (Uniswap, Aave, Lido) show minimal GENIUS exposure — §3 and §6 only. This doesn't mean unregulated. It means the GENIUS Act's PPSI framework doesn't directly address permissionless protocol interactions. Separate frameworks (SEC, CFTC) apply there.

Go deeper: Hover any cell in the surface to see the specific provision-to-path mapping and enforcement mode.