Negotiating the Scope of the Stablecoin Customer ID Rule

It's been a month since the end of the comment period on the interagency proposed rulemaking that implements a facet of the Guiding and Establishing National and Innovation for U.S. Stablecoins, or Genius, Act ended on Aug. 21. 

A review of the comments reveals in full color just how this proposed regulation is perceived by the industry. The organizations that made comments generally agree with regulation of stablecoins to some extent; however, that extent varies among commentators.

This proposal is just the latest action in the overarching regulatory framework that will regulate stablecoins. Thus far, the major impact of the proposal is that it would require identification of customers, which negates — or at least waters down — the pseudonymous nature of a stablecoin. Industry players have accepted this fact and understand the importance of mitigating the risks posed by stablecoins.

Implementing the Genius Act's Customer Identification Requirements

The proposal was jointly issued by Financial Crimes Enforcement Network, U.S. Department of the Treasury's Office of the Comptroller of the Currency, Federal Reserve Board, Federal Deposit Insurance Corp., and National Credit Union Administration in June. It would implement the Genius Act provision requiring permitted payment stablecoin issuers, or PPSIs, to comply with customer identification program, or CIP, regulations.

In this respect, the Genius Act expands the Bank Secrecy Act's definition of a financial institution to include PPSIs. Since finalization of the CIP rule in 2003, the financial services industry has evolved, and with it, so have the risks posed by illicit actors. Stablecoins and stablecoin issuers are by no means immune to these risks.

At a high level, the crux of the CIP rule is to obtain information on a customer that holds an account with a financial institution. As drafted, the proposal adopts very similar definitions to the current definitions of "customer" and "account," with more nuanced exemptions specific to PPSIs.

Overall, and more generally, the proposal will operate just as the existing CIP rule and will require PPSIs to obtain customer information and perform the necessary verification of the information. PPSIs must incorporate a CIP program into their overall Bank Secrecy Act/anti-money-laundering programs.

In the comments submitted on the proposal, several common themes are immediately apparent. Commentators highlighted the need for regulatory parity between traditional financial institutions and PPSIs. PPSI commentators urged the agencies to limit the proposal's application to primary market participants.

A contingent of commenters conversely highlighted that by limiting application to only the primary market, the risks of illicit activity remain and urged the agencies to apply the rule to both primary and secondary market activity.

Primary and Secondary Market Activity

The proposal describes primary and secondary market activity as they relate to PPSIs. Primary market activity is essentially any activity where a PPSI would directly interact with a user or holder of a stablecoin, as well as any custodial services.[1]

Secondary market activity is any activity that does not involve the PPSI as a party to the transaction other than via a smart contract. The proposal provides the following examples of secondary market activity: 

• An individual purchasing payment stablecoins from intermediaries;
• An individual sending a payment stablecoin from a self-hosted wallet to a vendor to purchase goods;
• An individual exchanging payment stablecoins for another digital asset via a digital asset exchange; or
• Person-to-person transactions in payment stablecoins.[2]

Scope of the Proposed Rulemaking

Whether the proposal applies to primary or secondary activity hinges on the key definitions of "customer" and "account." As proposed, the definition of a customer is any person who opens a new account.[3] Like the current definition, a customer does not include a person who has an existing account with a PPSI and the PPSI has a reasonable belief that they know the true identity of the person.[4]

Importantly, the proposal also exempts "a person acquiring or redeeming a payment stablecoin from a means other than directly from or directly to the PPSI."[5] This exemption is meant to promote the agency's view that a person is not a customer of a PPSI where they transfer stablecoins on the secondary market.[6]

The proposal adopts the current definition of an account as a formal banking relationship between a customer and a PPSI, including the issuing or redeeming of stablecoins, purchasing, selling, and holding reserve assets or providing custodial services for reserve assets, or providing services of a digital asset service provider.[7]

Comments from the PPSI industry unanimously encourage the agencies to limit the scope of the proposal to the primary market. Application to the secondary market may prove difficult for PPSIs as the issuer may lack necessary information on the participant, thus undermining the intent of the CIP program.

Because the Genius Act requires the same CIP obligations as any other financial institution, the exemptions from the definition of a customer are consistent with the existing CIP rule and focuses on the person opening a new account. During the CIP rulemaking process, the regulators construed the statute to ensure CIP programs only required financial institutions to identify customers that opened accounts.

The Patriot Act defined an account as a formal banking or business relationship established to provide ongoing services, dealings, or other financial transactions, but also did not require the Treasury to use the definition for purposes of finalizing the CIP rule.[8]

The intent of the CIP rule wasn't to look further down the road and require the financial institution to obtain information upon an ownership change of a financial product where no account is established, but that is likely because traditional banking products do not necessarily operate in that manner.

For example, a borrower that assumes a loan is the financial institution's customer for purposes of the existing account, but the customer does not have the ability to unilaterally transfer their mortgage to a new holder.

Notwithstanding the potential difficulties in finding common ground on the proposal's scoping of a customer, the application of AML requirements to stablecoins is important to mitigate the risks of illicit activity posed. The proposal briefly highlights the preference of illicit actors for using stablecoins, given their stability and liquidity.

Overall, the comments seem to generally agree with regulation of stablecoins to mitigate the risks of illicit activity. Several commentors, although against the proposal's scope to the secondary market, recognize the risks posed by the secondary market and support separate rulemaking activities specific to secondary market actors.

The proposal allows the federal functional regulators, along with the Treasury Department, to exempt certain PPSIs or certain types of accounts from CIP requirements so long as the exemption is consistent with the purposes of the Bank Secrecy Act, safety and soundness, in the public interest, and satisfies any other appropriate factors. The proposal utilizes this authority in carving out certain PPSI activities.

On the other hand, the Treasury Department's 2026 National Money Laundering Risk Assessment suggests that there is an increased use in illicit actors using stablecoins to perpetuate fraud, sanctions evasions, terrorist financing, proliferation financing and other crimes, including storing illicit proceeds.

Armed with the assertions that stablecoins are used and have been used in illicit activity, the agencies have a big task in wrestling with the scope of the final rule, taking into account the comments provided and the risks that remain.

Kaley N. Schafer is an associate at Ballard Spahr LLP.

Marjorie J. Peerce is senior counsel, a founding leader of the blockchain technology and cryptocurrency team, and a co-leader of the distressed digital assets team at the firm.

The opinions expressed are those of the author(s) and do not necessarily reflect the views of their employer, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.

Reprinted with permission from Law360, September 25, 2026. All rights reserved.