The OCC's final rule implementing the GENIUS Act raises a critical question: should stablecoins be included in your deposit-taking compliance framework, or do they require a separate approach?
This decision isn't just theoretical. It impacts which BSA officer manages the risk, how you set up transaction monitoring, and whether your existing Customer Due Diligence processes can scale to handle tokenized value transfers.
The Question at Hand
The GENIUS Act establishes a federal framework for U.S. stablecoin regulation under the OCC's oversight. For payments compliance teams, the key issue is whether to extend your current AML/CFT framework to cover stablecoin transactions or to develop parallel controls.
Some argue that stablecoins are similar to electronic deposits: they represent dollar claims, move through payment systems, and pose similar money laundering risks. Others point to differences in custody models, redemption mechanics, and blockchain transparency that necessitate specialized compliance infrastructure.
Both views have merit. Your decision depends on your institution's role in the stablecoin ecosystem.
The Case for Extending Existing Controls
If you're a national bank issuing stablecoins or holding reserves, treating them like deposits can be operationally efficient.
Your BSA E-Filing System already processes Currency Transaction Reports and FinCEN SARs for deposit accounts. Your name screening engine checks against the same OFAC lists, whether the asset is a checking account balance or a tokenized dollar. Your Customer Risk Rating methodology already considers payment velocity, cross-border exposure, and beneficial owner complexity.
Adding stablecoins to existing transaction monitoring rules allows you to use years of tuning. You know your false positive rates and have calibrated thresholds for detecting structuring. Your MLRO escalation procedures are established.
This approach also supports regulatory consistency. If the OCC oversees both your deposit-taking and stablecoin issuance, maintaining separate compliance programs increases documentation burden and the risk of gaps. Examiners expect consistent risk assessment across product lines.
The practical advantage: speed to market. Extending your current Customer Due Diligence process to stablecoin customers means you're not building new workflows, training new teams, or negotiating new vendor contracts. You're applying proven controls to a new asset class.
The Case for Separate Infrastructure
Stablecoins present challenges your deposit compliance program wasn't designed to manage.
Consider redemption monitoring. Traditional deposits move through ACH, wires, or checks with clear counterparties. Stablecoins transfer peer-to-peer on public blockchains. Your transaction monitoring rules for rapid account movement don't apply cleanly when the "account" is a self-custodied wallet and the "movement" is a smart contract interaction.
Then there's custody. When a customer holds stablecoins in their own wallet, you don't control the asset like a deposit. This affects your ability to freeze assets quickly for targeted financial sanctions. If OFAC designates a person and they control their private keys, your compliance response differs from blocking a checking account.
Ongoing due diligence is another challenge. For deposits, periodic reviews typically examine transaction patterns within your institution. For stablecoins, meaningful risk assessment requires blockchain analytics: tracking on-chain behavior, identifying mixer interactions, and tracing funds to high-risk addresses. Your current review cadence and tools may not support this.
Blockchain transparency creates new obligations. You need to monitor customer addresses after issuance, detect suspicious activity in decentralized finance protocols, and potentially file continuing activity SARs based on on-chain intelligence your deposit monitoring never captured.
Building separate controls lets you address these differences without compromising your deposit compliance program's integrity.
Where Practitioners Actually Land
Most institutions we've observed adopt a hybrid model.
They apply existing Customer Due Diligence at onboarding: same KYC documentation, same beneficial owner identification requirements, same customer risk profile methodology. The GENIUS Act doesn't introduce new identity verification standards, so your current CDD procedures likely meet the rule.
Where they diverge is in transaction monitoring and ongoing due diligence. They're adding blockchain analytics platforms that feed risk signals into their existing case management systems but operate as a distinct monitoring layer. This preserves your FinCEN Suspicious Activity Report workflow while capturing stablecoin-specific typologies like smurfing across multiple wallet addresses or layering through decentralized exchanges.
The key operational decision is ownership. Some institutions assign stablecoin compliance to their existing BSA officer. Others create a digital assets compliance function that coordinates with BSA but maintains separate procedures. The choice often depends on transaction volume and whether you're issuing stablecoins or just facilitating customer transactions.
Our Take
Treat stablecoins like deposits for customer onboarding and sanctions compliance. Build separate infrastructure for transaction monitoring and ongoing due diligence.
Here's why: the GENIUS Act subjects stablecoins to the same BSA obligations as deposits. You're filing the same FinCEN SARs, screening against the same designated persons and entities, and answering to the same examiners. Fragmenting your CDD process creates compliance risk without corresponding benefit.
But transaction behavior on blockchains doesn't map to deposit activity. Trying to force stablecoin transfers into deposit monitoring rules will either generate unmanageable false positives or miss material risk. You need monitoring logic that understands smart contract interactions, decentralized exchange flows, and cross-chain bridges.
The practical path: expand your existing CDD and sanctions screening to cover stablecoin customers, then add blockchain analytics as a new monitoring capability that integrates with your current SAR decisioning process. This approach satisfies the OCC's expectation of consistent risk management while acknowledging the operational reality that stablecoins require specialized surveillance.
If you're still deciding, ask yourself: can your current transaction monitoring rules detect layering through a liquidity pool? If not, you need purpose-built controls regardless of how you classify the underlying asset.
