GENIUS Act: Interagency Customer Identification Program Proposed Rule
Customer identification program requirements for permitted payment stablecoin issuers
KPMG Regulatory Insights
- New Category of Financial Institution: PPSIs would be treated as financial institutions under the Bank Secrecy Act (separate from money service businesses) and required to maintain effective customer identification programs; the proposed requirements are intended to be comparable to those for other financial institutions (e.g., banks, broker-dealers).
- Element of a Larger Effort: Rules for PPSIs would align with FinCEN’s AML/CFT proposals/reforms for U.S. financial institutions more broadly, emphasizing program effectiveness, risk-based assessments, and the allocation of resources to higher-risk areas.
- Primary vs. Secondary Market: Under the proposal, CIP obligations would apply to direct relationships between a PPSI and a customer (i.e., primary market activity) but not extend to activity where the PPSI is not a party to the transaction other than via a smart contract (i.e., secondary market activity).
- Seeking Balance: The agencies propose to balance innovation and scalability with strong AML/CFT controls for PPSIs of all sizes and relationships (e.g., standalone or bank subsidiary) to protect against regulatory gaps that could create new entry points for illicit finance.
The Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN), together with the Federal Deposit Insurance Corporation (FDIC), Federal Reserve Board (FRB), National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) (collectively, Agencies), has issued a joint proposed rule to implement certain requirements of the GENIUS Act (i.e., the Guiding and Establishing National Innovation for U.S. Stablecoins Act). In particular, the proposal would treat permitted payment stablecoin issuers (PPSIs) as financial institutions under the Bank Secrecy Act (BSA) and require them to maintain an effective customer identification program (CIP). The proposal would also apply to PPSIs that opt for state supervision under the GENIUS Act. Comments on the proposal are due to FinCEN and the Agencies on or before August 21, 2026.
The proposed rule would address requirements including:
- Minimum requirements, such as a written CIP.
- Identity verification procedures, including customer information collection, verification methods, and procedures for customers whose identities cannot be verified.
- Other CIP procedures, concerning recordkeeping, government-list screening, customer notice, and reliance or coordination arrangements.
Minimum Requirements
PPSIs would be treated as financial institutions under the BSA and be required to maintain an effective written CIP. Threshold requirements and program standards would include:
|
|
|---|---|
BSA treatment | PPSIs would be treated as financial institutions under the BSA. |
Scope of CIP obligation | CIP obligations would apply to direct relationships between a PPSI and a customer, including primary-market activity, and would not extend solely to secondary-market transfers or interactions with a PPSI’s smart contract. |
Minimum requirements | Each PPSI would be required to establish and maintain a written CIP appropriate for the PPSI’s size and business, the types of accounts it has, how those accounts are opened, and the identifying information available. The CIP must include:
|
AML/CFT integration | The CIP would be part of the PPSI’s AML/CFT program. |
Parent institution coordination | For certain PPSIs that are subsidiaries of insured depository institutions (IDIs), the PPSI and parent IDI would generally be allowed to operate under a single comprehensive AML/CFT program, provided the program is reasonably designed to identify and mitigate risks and satisfies applicable requirements of each entity. |
Risk-based procedures | The CIP would include risk-based procedures for verifying the identity of each customer to the extent it is reasonable and practicable. The procedures would be based on the PPSI’s assessment of relevant risks and would need to enable the PPSI to form a reasonable belief that it knows the identity of each customer. |
Identity Verification Procedures
Identity verification procedures would address customer information collection, verification methods, customers that are not individuals, and customers whose identities cannot be verified. CIP procedures would include:
|
|
|---|---|
Customer information before account opening | A PPSI would be required to obtain identifying information from each customer before opening an account, including:
|
Customer verification | The CIP would include procedures for verifying the identity of each new customer within a reasonable period before or after the customer’s account is opened. The procedures would be required to describe when the PPSI would use:
|
Lack of verification | The CIP would be required to include procedures for circumstances in which the PPSI cannot form a reasonable belief that it knows the true identity of a customer. The procedures should describe:
|
Other Procedures
CIP procedures would also address recordkeeping, government-list screening, customer notice, and reliance on another federally regulated financial institution. Required procedures and conditions include:
|
|
|---|---|
Recordkeeping | The CIP would be required to include procedures for making and maintaining records of information obtained under the CIP, including:
Records would be required to be retained for a period of five years. |
Government-list screening | The CIP would be required to include procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by a federal government agency and designated by Treasury in consultation with the federal functional regulators. |
Customer notice | The CIP would be required to include procedures for providing customers with “adequate” notice, before the account is opened, that the PPSI is requesting information to verify their identities. |
Reliance on another financial institution | A PPSI would be permitted but not required to include procedures specifying when it may rely on another financial institution’s performance of PPSI’s CIP procedures for the PPSI’s customer, provided that:
|
Note: FinCEN previously issued a proposed rule to implement the GENIUS Act's directive to apply BSA (anti-money laundering/combatting the financing of terrorism) obligations to PPSIs (see KPMG Regulatory Alert here). This current proposal builds on and references that rule proposal.
Separately, FinCEN issued a proposal to “fundamentally reform” financial institutions’ AML/CFT programs under the BSA. The proposal is a part of what Treasury describes as its “broader efforts to modernize” the U.S. AML/CFT regulatory and supervisory framework while also implementing statutory changes made to the BSA by the Anti-Money Laundering Act of 2020 (AML Act). That proposal was followed by related releases from the federal banking agencies that would amend each agency’s BSA compliance program requirements to align with FinCEN’s proposal – with a notable exception in the FRB proposal. (See KPMG Regulatory Alert here.)
Dive into our thinking:
GENIUS Act: Interagency Customer Identification Program Proposed Rule
Customer identification program requirements for permitted payment stablecoin issuers
Download PDFExplore more
Subscribe to receive regulatory and compliance transformation insights
By registering you will periodically receive additional compliance-related communications from KPMG.
Meet our team
