The Problem: Ensuring Operational Resilience
Your stablecoin issuer's attestation shows full reserves at month-end. But can you process 10,000 redemption requests tomorrow morning? Can you identify the wallet owner behind a $2 million mint? Can you operate if your primary banking partner goes offline for 48 hours?
Reserve transparency was the first test. Operational resilience is the second. Under the GENIUS Act, permitted payment stablecoin issuers are treated as financial institutions for purposes of the Bank Secrecy Act. The OCC's proposed framework includes confidential weekly reporting for each payment stablecoin issued, along with quarterly financial-condition reports. This isn't just a disclosure exercise. It's continuous supervisory oversight of your entire operation.
If you're building or operating a permitted payment stablecoin, you need a compliance program that covers liquidity management, governance controls, AML/sanctions screening, operational continuity, and third-party risk monitoring. This playbook walks you through the implementation.
What You Need Before Starting
Organizational Prerequisites
- Executive sponsor with authority to allocate budget and enforce cross-functional accountability.
- Documented organizational chart showing who controls reserve management, compliance, technology, and redemption operations.
- Access to all systems that touch stablecoin issuance, redemption, reserve custody, and transaction data.
- Legal authority to implement wallet monitoring and transaction surveillance.
Technical Prerequisites
- Direct API access to blockchain nodes for each network where your stablecoin operates.
- Read access to banking and custodial systems holding reserve assets.
- Administrative rights to configure transaction monitoring and name screening tools.
- Data warehouse or reconciliation platform capable of joining on-chain activity with customer records.
Regulatory Prerequisites
- Confirmed registration status under the Bank Secrecy Act.
- Written AML/CFT program approved by the board.
- Designated BSA officer with authority to file SARs and escalate issues.
- Customer Identification Program that meets proposed requirements for permitted issuers.
Step-by-Step Implementation
Phase 1: Map Your Liquidity and Redemption Process (Weeks 1-2)
Start by documenting every step between a redemption request and final settlement.
Action 1.1: Create a process map showing:
- Where redemption requests originate (wallet interface, API, exchange partner).
- Who verifies the request (automated system, compliance review, manual approval).
- How reserve assets convert to settlement currency (same-day liquidity, T+1 settlement, asset sale required).
- Which banking or custody partners execute the transfer.
- What happens if any step fails or delays.
Action 1.2: Identify concentration risk. List every institution holding reserve assets and calculate what percentage of total reserves each holds. If a single bank holds more than 25% of your reserves, document your contingency funding plan.
Action 1.3: Test redemption capacity under stress. Model three scenarios:
- 10% of outstanding stablecoins redeemed within 24 hours.
- Your largest banking partner becomes unavailable for 72 hours.
- A reserve asset declines 5% in value during a redemption surge.
For each scenario, document whether you can meet redemptions without delays, fees, or operational failures.
Phase 2: Build Governance Controls (Weeks 3-4)
Regulators will examine who makes decisions and whether those decisions follow documented standards.
Action 2.1: Draft a reserve management policy that defines:
- Permitted reserve asset types and concentration limits.
- Who approves changes to reserve composition.
- Escalation procedures when reserves fall below required thresholds.
- Frequency of reserve reconciliation (daily minimum).
Action 2.2: Establish a compliance committee with representatives from legal, risk, finance, and technology. Document:
- Meeting frequency (monthly minimum).
- Escalation triggers (material compliance issues, technology incidents, regulatory inquiries).
- Decision-making authority for wallet restrictions, redemption delays, and regulatory filings.
Action 2.3: Implement a policy change log. Every modification to reserve strategy, redemption terms, or compliance procedures must be documented with:
- Date and description of change.
- Business justification.
- Approval authority.
- Implementation date.
Phase 3: Implement Financial Crime Controls (Weeks 5-8)
You're a financial institution under the Bank Secrecy Act. Your AML/CFT framework must connect on-chain activity with customer identity.
Action 3.1: Deploy transaction monitoring rules tailored to stablecoin activity:
- Rapid minting and redemption by the same customer within 24 hours.
- Transfers to or from wallets associated with sanctioned entities (integrate OFAC SDN list).
- Unusually large single transactions relative to customer profile.
- Cross-chain transfers to high-risk protocols or mixers.
Action 3.2: Configure name screening at two points:
- Customer onboarding (before first mint or redemption).
- Ongoing monitoring (daily batch screening of existing customers against updated sanctions lists).
Use a screening tool that supports fuzzy matching and can handle non-Latin scripts. Document your match review process, including who investigates potential hits and what evidence supports a clearance decision.
Action 3.3: Establish SAR escalation procedures. Define thresholds for escalating alerts to your BSA officer:
- Any confirmed sanctions match.
- Transactions linked to wallets flagged by law enforcement.
- Patterns consistent with structuring or layering.
- Customer refuses to provide source of funds for large mints.
Document each escalation with the alert ID, investigation summary, and disposition.
Phase 4: Build Operational Resilience (Weeks 9-12)
Your stablecoin depends on smart contracts, blockchain infrastructure, banking partners, and custody providers. Any single failure can disrupt redemptions.
Action 4.1: Document critical dependencies:
- List every third party required to issue, transfer, or redeem your stablecoin.
- Identify single points of failure (one bank, one custodian, one cloud provider).
- Establish service-level agreements with maximum acceptable downtime.
Action 4.2: Create an incident response playbook covering:
- Smart contract vulnerability discovered.
- Banking partner becomes unavailable.
- Blockchain network experiences congestion or outage.
- Administrative key compromise suspected.
For each scenario, document immediate actions, communication protocols, and recovery steps.
Action 4.3: Test your disaster recovery plan. Schedule a tabletop exercise simulating a 48-hour outage of your primary banking partner. Participants should include representatives from treasury, compliance, technology, and customer support. Document gaps identified during the exercise and assign remediation owners.
Phase 5: Prepare Regulatory Reporting (Weeks 13-16)
Weekly confidential reporting and quarterly financial-condition reports require clean data and reliable reconciliation.
Action 5.1: Build a weekly reporting template covering:
- Total stablecoins outstanding by blockchain network.
- Reserve assets by type and institution.
- Minting and redemption volume for the reporting period.
- Any discrepancies between on-chain issuance and reserve balances.
Action 5.2: Automate reconciliation between on-chain data and reserve records. Schedule daily jobs that:
- Query blockchain nodes for total token supply.
- Pull reserve balances from banking and custody APIs.
- Flag discrepancies exceeding 0.1% of total issuance.
- Generate exception reports for manual review.
Action 5.3: Document your data governance process:
- Who is responsible for investigating reconciliation breaks.
- How discrepancies are researched and resolved.
- Where supporting documentation is retained.
- How corrections are reflected in regulatory filings.
Validation: How to Verify It Works
Liquidity Test: Execute a test redemption representing 1% of outstanding issuance. Measure time from request to settlement. If it exceeds 24 hours, identify the bottleneck.
Governance Audit: Review the last three months of compliance committee minutes. Verify that material issues were escalated within defined timeframes and that decisions were documented with supporting rationale.
Transaction Monitoring Validation: Pull a sample of 100 transactions from the past month. Manually review them against your monitoring rules. If the automated system missed obvious red flags, recalibrate your rule thresholds.
Reconciliation Accuracy: Compare your weekly reserve report to actual blockchain data and bank statements. Discrepancies should be identified and resolved within 48 hours.
Incident Response Drill: Conduct quarterly tabletop exercises simulating operational disruptions. Measure whether your team can execute the playbook without referencing external documentation.
Maintenance: Ongoing Tasks
Daily:
- Reconcile on-chain issuance with reserve balances.
- Review transaction monitoring alerts and escalate suspicious activity.
- Screen new customers against sanctions lists.
Weekly:
- Prepare confidential regulatory reports.
- Review redemption processing times and identify delays.
- Monitor reserve asset liquidity and concentration.
Monthly:
- Hold compliance committee meeting and document decisions.
- Review third-party service provider performance.
- Update risk assessments for high-volume customers.
Quarterly:
- Submit financial-condition reports.
- Conduct governance policy review and update as needed.
- Test disaster recovery and incident response procedures.
- Re-evaluate reserve asset allocation and liquidity capacity.
Annually:
- Independent audit of reserve holdings.
- Comprehensive review of AML/CFT program effectiveness.
- Stress testing of redemption capacity under adverse scenarios.
- Board-level review of operational resilience and compliance posture.
Stablecoin oversight isn't about proving you have reserves anymore. It's about proving you can operate safely when those reserves are tested.
