Sullivan & Cromwell Discusses FinCEN, OFAC Proposed Rule on Anti-Money Laundering and Sanctions-Compliance Requirements

Key Takeaways

• Primary‑market PPSIs face full BSA AML obligations; secondary‑market duties are limited
• PPSIs must block, freeze, and reject illicit transactions on both markets
• Sanctions‑compliance program required for all U.S.‑person stablecoin issuers
• Violations can trigger civil penalties up to $100,000 per day
• FinCEN seeks comments on secondary‑market risk assessment by June 9, 2026

Pulse Analysis

The joint FinCEN‑OFAC proposal marks the most detailed regulatory guidance yet for payment stablecoin issuers, a sector that has grown rapidly since the GENIUS Act’s enactment in July 2025. By formally classifying PPSIs as "financial institutions" under the Bank Secrecy Act, the NPR extends traditional AML expectations—customer due diligence, beneficial‑owner reporting, and suspicious‑activity reporting—to the primary‑market functions of issuing, redeeming, and converting stablecoins. This alignment aims to close the compliance gap between legacy banks and emerging crypto‑native entities, ensuring that stablecoin transactions are subject to the same risk‑based scrutiny that regulators apply to conventional money‑transmitters.

A distinctive feature of the proposal is its treatment of secondary‑market activity. While PPSIs will not be required to file SARs or conduct full CDD for peer‑to‑peer trades, they must retain the technical capability to block, freeze, and reject transactions that involve sanctioned parties or violate lawful orders. The rule acknowledges that most illicit stablecoin flows occur off‑chain, through secondary exchanges, and therefore extends the enforcement reach of OFAC sanctions to smart‑contract interactions. This creates a compliance imperative for issuers to embed real‑time monitoring tools and address the challenge of identifying sanctioned wallets that may not appear on public SDN lists.

For the industry, the NPR balances regulatory rigor with operational flexibility. By adopting the risk‑based approach outlined in FinCEN’s concurrent Program Rule, issuers can prioritize high‑risk customers while avoiding burdensome “check‑the‑box” requirements. The mandated sanctions‑compliance program, built on five OFAC‑derived pillars, provides a scalable framework that can be tailored to an issuer’s size and complexity. Companies that proactively adapt to these expectations will likely mitigate enforcement risk and position themselves as trustworthy participants in the evolving U.S. stablecoin market.