The OCC's Stablecoin Rule Is Final. The Compliance Work Starts Now.

Insights

Lana Schwartzman

VP, Global Regulatory & Compliance Strategy

October 29, 2026

A final rule, three months before go-live

On October 21, 2026, the Office of the Comptroller of the Currency (OCC) announced its final rule implementing the GENIUS Act for the stablecoin issuers it supervises. The rule, new 12 CFR part 15, takes effect January 18, 2027, the same day the GENIUS Act does.

Part 15 covers subsidiaries of national banks and federal savings associations, Federal qualified payment stablecoin issuers, certain nonbank State issuers, and foreign issuers registering with the OCC. It sets the rules for reserves, redemption, capital, risk management, licensing and supervision. For issuers, and for the exchanges, custodians and payment firms connected to them, the rule settles a lot.

Importantly, the financial crime rules, along with BSA/AML and the Travel Rule, are in separate rulemakings from Treasury that are still in progress.

"…those related to the Bank Secrecy Act, anti-money laundering, and Office of Foreign Assets Control sanctions, which will be addressed in a separate rulemaking in coordination with the Department of the Treasury."

However, as part of the current application process, applicants still need to:

"… ensure that submissions are fully responsive to the questions and documentation requirements included in the relevant application form. This includes providing sufficient details on the proposed … Bank Secrecy Act/Anti-Money Laundering/Office of Foreign Assets Control; third-party risk management; enterprise risk management; compliance risk management; and audit functions." (OCC Bulletin 2026-51)

What changed from the March proposal

The OCC dropped two of the fixed rules it had proposed and will now review them on a case-by-case basis instead.

Topic	March 2 proposal	Final rule
Yield	Presumed a violation when an issuer paid an affiliate or related third party who then paid holders	Presumption dropped. The statutory ban on interest or yield paid solely for holding, use or retention stays (§ 15.10(c)(4))
Redemption	Two business days, with an automatic seven-day extension under stress	Two business days stays. The automatic extension is gone. Issuers notify the OCC within 24 hours if redemptions pass 10% of a brand's outstanding issuance in a day, and request an extension (§ 15.12(d))
Applications	Standard licensing factors	Adds an explicit safety and soundness factor, including run risk and ability to redeem (§ 15.30(d)(5))
Foreign issuers	Registration framework	Requires a Treasury comparability determination, OCC registration, enough US-held reserves, and no domicile in a comprehensively sanctioned or primary money laundering concern jurisdiction (§ 15.31)

On yield, the OCC kept things pretty open-ended. It didn't define what counts as "interest" or "yield," and it said no to every carve-out people asked for (small payments, existing rewards programs, staking, white-label partners). Rewards tied to transactions aren't automatically banned, but they can't be used to pay people for holding the coin. And if Congress changes the law, the OCC said it will take another look.

Applications, waivers and reporting

The OCC isn't taking applications yet. It will start once the Office of Management and Budget approves the application forms, and will announce the date in a press release (Bulletin 2026-51).

Waivers: Issuers already operating in the US need a substantially complete application on file by January 18, 2027 to request a waiver. The OCC expects to grant waivers from the prior approval requirement, but sees no general reason to waive anything else. Issuing without approval after January 18 carries criminal penalties.
What applications must cover: The OCC lists BSA, AML and OFAC compliance and third-party risk management among the required topics, next to reserves, redemption, capital and audit. So AML readiness gets reviewed at licensing, before the AML rules are final.
Timing: The OCC will say within 30 days whether an application is substantially complete, and decide within 120 days after that.
Reporting: Revised weekly and quarterly reporting forms are out for comment. Pending OMB approval, weekly reports start with the January 25, 2027 report date and quarterly reports with March 31, 2027 (Bulletin 2026-52).

The Travel Rule lives in a different rulemaking

Part 15 does not set AML, sanctions or Travel Rule obligations. In the OCC's own words, the final rule covers everything it must issue under the GENIUS Act "other than those related to the Bank Secrecy Act, anti-money laundering, and Office of Foreign Assets Control sanctions, which will be addressed in a separate rulemaking in coordination with the Department of the Treasury." The OCC sent every comment on those topics to its separate AML/CFT proposal, and that proposal cross-references FinCEN and OFAC rules for the substance. As of October 22, none of the three is final.

Rulemaking	Reference	Published	Comments closed	What it covers
FinCEN/OFAC PPSI AML/CFT and sanctions program	FR Doc. 2026-06963	April 10, 2026 (91 FR 18582)	June 9, 2026	Program requirements, including Travel Rule obligations for issuers
OCC PPSI AML/CFT and sanctions risk management	OCC-2026-0463	June 24, 2026 (91 FR 37840)	July 24, 2026	Adopts the FinCEN and OFAC rules by reference, plus OCC supervision and FinCEN consultation
Joint PPSI Customer Identification Program	FINCEN-2026-0101	June 22, 2026 (91 FR 37234)	August 21, 2026	Who counts as a customer, verification, reliance

The GENIUS Act gave regulators until July 18, 2026 to finalize their rules (section 13), and that date has come and gone. FinCEN has also proposed giving issuers 12 months to comply once its rule is final. So the new AML rules written for stablecoin issuers probably won't kick in until after the GENIUS Act itself takes effect.

That doesn't mean issuers get a break in the meantime. The OCC is clear that existing FinCEN and OFAC rules still apply. Most stablecoin issuers today are registered money transmitters, which means the Travel Rule already applies to them.

What issuers and their counterparties should do now

Every stablecoin payment raises two questions: who is behind the address on the other side, and how value settles once both parties are known. Here are five parts of the final rule that touch on both.

Vendor oversight is now a rule requirement: Section 15.13(a)(7) requires issuers to run due diligence on service providers, write Part 15 and GENIUS Act compliance into their contracts, and review the providers' audits or test results. Issuers should map every provider touching redemption, screening and transfer data before January.
Information security flows down: Section 15.13(b) requires breach notification to customers and the OCC, and resilience testing with critical service providers. Expect these terms in vendor contracts.
Self-hosted wallets stay allowed: Issuers using them still have to meet the lawful order capability requirement and their AML and sanctions obligations. Knowing who sits behind an unhosted address, before value moves, is part of meeting both.
Redemption speed now depends on onboarding speed: The OCC kept the two-business-day deadline partly to avoid conflict with BSA and sanctions duties, and expects issuers to screen and onboard new customers promptly, even under stress. A slow screening queue becomes a redemption problem.
Travel Rule data and privacy rules don't collide: The OCC clarified Part 15's privacy provisions don't change BSA obligations.

One more point for banks entering the market: the OCC set no interoperability standards. It is assessing the question under section 12 of the GENIUS Act with NIST and other standard setters. Open standards for exchanging identity and authorization data between institutions have room to shape where this lands.

Where the next decisions get made

The rules still open will decide how the Travel Rule works for payment stablecoins. Notabene has commented on each of them: the FinCEN/OFAC program rule, the OCC AML/CFT proposal, and the joint CIP proposal.

Our position across all of them is the same. Once a stablecoin transfer goes through on the blockchain, it can't be undone. So the checks have to happen before the money moves. That means the two institutions share who is sending and who is receiving, check both against sanctions lists, and confirm the recipient is who they say they are, all before the transfer goes out.

We've asked regulators to recognize pre-transaction controls, and reliance on specialized compliance infrastructure, as evidence of an effective AML program. We've also asked for one rulebook per issuer and consistent requirements across the OCC, FDIC and Federal Reserve.

Part 15 is the prudential foundation. The financial crime layer comes next, and January 18 is fixed regardless.

Sources

Notabene is the trust layer for global crypto money movement.

Notabene Flow — the first open stablecoin payments platform for businesses—and Notabene Transact—the world's largest Travel Rule-compliant transaction authorization platform for regulated institutions—are built on the Transaction Authorization Protocol (TAP), an open messaging standard that enables verified entities to transact securely.

The Notabene Network connects thousands of trusted counterparties, facilitating over $1.3T in transaction volume over the past 12 months across over 110 jurisdictions.