The GENIUS Act: OCC Finalizes Its Payment Stablecoin Framework

Client Alert | November 9, 2026

This update examines the principal implications for market participants. The accompanying appendix provides a detailed Section-by-Section overview of the Final Rule, including key requirements and practical considerations.

Introductory Overview

On October 21, 2026, the Office of the Comptroller of the Currency (OCC) issued its final rule (Final Rule or the Rule) implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act or the Act), establishing detailed requirements for payment stablecoin activities within its jurisdiction. As discussed in our July 2025 client alert, The GENIUS Act: A New Era of Stablecoin Regulation, the Act establishes a Federal framework while preserving specified State regulatory pathways. The Final Rule implements the OCC’s portion of that framework through new 12 C.F.R. part 15 and related amendments to parts 3, 6, 8, and 19, effective January 18, 2027.

The Final Rule makes clear that reserve backing is only one component of a permitted payment stablecoin issuer’s (PPSI) financial obligations: capital and operational backstop funding are required in addition to reserves. Moreover, the Final Rule establishes reserve liquidity, concentration, and redemption standards that are largely principles-based; addresses permissible activities and the treatment of PPSIs; maintains scrutiny of yield and rewards arrangements, but on a case-by-case basis with no presumptions; and prescribes application, reporting, custody, and supervisory requirements. These provisions warrant careful consideration in structuring an issuance program. The Final Rule also extends beyond issuers: its custody requirements apply to national banks and Federal branches that hold reserves or issuance keys, and its capital amendments change how a parent bank accounts for an issuing subsidiary.

The Final Rule is an OCC-specific implementation, and not a uniform final framework governing every PPSI under every regulatory pathway. This client alert examines the principal implications for market participants. The accompanying appendix provides a detailed Section-by-Section overview of the Final Rule, including key requirements and practical considerations.

Important Timing Note: A Short Window to File Before January 18, 2027 Effective Date

Beginning on January 18, 2027, a person generally must be approved as a PPSI to issue a payment stablecoin in the U.S. (the Prior Approval Requirement), and issuing without that approval becomes unlawful and carries criminal penalties. Similarly, digital asset service providers cannot deal in foreign-issued payment stablecoins unless the relevant issuer has the technological capability to comply, and will comply, with any lawful order and any reciprocal arrangement under Section 18 of the GENIUS Act.

Section 5(f) of the Act permits the OCC to waive the Act’s requirements for up to 12 months for an insured depository institution (IDI) subsidiary or Federal qualified payment stablecoin issuer applicant with an application pending on the January 18, 2027 effective date. Section 15.30(g) of the Final Rule implements this safe harbor for an application that is substantially complete and pending on or before January 18, 2027. Any waiver runs for no more than 12 months beginning on that date. The OCC may grant a waiver only if doing so is in the public interest or extraordinary circumstances justify it, and it may still deny the underlying application.

The OCC generally expects to grant requests for waivers from the Prior Approval Requirement for existing issuers currently operating in the U.S. unless its review identifies more compelling reasons to deny the request. Beyond the Prior Approval Requirement, however, the OCC has not identified compelling, generally applicable reasons to grant a waiver, so prospective issuers that are not yet operating should not plan on one. For those applicants, the 120-day deemed-approval period will not begin to run until the later of January 18, 2027, and the date the application is substantially complete, meaning the earliest possible deemed approval is May 18, 2027.

The OCC will begin accepting applications and waiver requests only after Office of Management and Budget (OMB) approves the application forms (comments on which are due November 23, 2026), so the window to file before January 18, 2027, may be only a few weeks long and will fall over the holidays. Because an application is treated as substantially complete as of the date the OCC receives the required information, the OCC’s 30-day completeness review need not conclude by January 18; information supplied after that date to cure a deficiency, however, likely would not support a waiver.

As noted below, PPSI approval is distinct from charter approval. As a result, an uninsured national trust bank must still obtain OCC approval under 12 C.F.R. 15.30(a)(2) to issue payment stablecoins as a Federal qualified payment stablecoin issuer, even if its business plan contemplates solely issuance; a national trust bank charter does not by itself confer that authority. Recent national trust bank charter applicants for stablecoin issuance must remain mindful of the separate PPSI approval requirement.

Key Questions and Answers

What payment stablecoins and entities are covered by the final rule?

The Final Rule adopts the Act’s definition of “payment stablecoin,” which is defined as any digital asset that:

is, or is designed to be, used as a means of payment or settlement; and
the issuer of which:
1. is obligated to convert, redeem, or repurchase for a fixed amount of monetary value, not including a digital asset denominated in a fixed amount of monetary value; and
2. represents that such issuer will maintain, or creates the reasonable expectation that it will maintain, a stable value tied to a fixed amount of monetary value.

National currency, deposits (including deposits recorded using distributed ledger technology), and securities remain excluded from the “payment stablecoin” definition.

The Final Rule broadly applies to the payment stablecoin activities of:

National banks, Federal savings associations, Federal branches, and their subsidiaries;
Foreign payment stablecoin issuers;
Nonbank entities that seek to be or are approved as Federal qualified payment stablecoin issuers; and
State qualified payment stablecoin issuers subject to OCC regulatory or enforcement authority.

An entity does not have to be engaged in issuance to be subject to the Final Rule. The Final Rule’s custody requirements apply separately to “covered custodians” (i.e., national banks, Federal savings associations, Federal branches, and PPSIs, to the extent they custody reserves, issuance keys, or payment stablecoins known to be used as collateral). As such, these entities can be subject to the Final Rule due to issuance or custody activities. For a more detailed discussion on the custody requirements under the Final Rule, see “What requirements apply to custody, self-custody, and decentralized arrangements?” further below.

Who can issue payment stablecoins, and how does an applicant obtain OCC approval?

The Act generally prohibits any person other than a PPSI from issuing a payment stablecoin in the U.S. Under the Final Rule, (1) insured national banks, Federal savings associations, or insured Federal branches (to issue payment stablecoins through a subsidiary) and (2) nonbank entities, uninsured national banks (including national trust banks), and uninsured Federal branches may apply to the OCC for prior approval to issue payment stablecoins. The substantive standards are the same for both groups. Applicants must submit the following:

The OCC’s application form (occ.gov) [1];
Biographical and financial reports for each director, executive officer, and principal shareholder (with a Corporate Background and Financial Report for any principal shareholder that is a company);
A certification of accuracy; and
A new certification as to whether the GENIUS Act’s restrictions on non-financial public companies apply.

Upon receipt of the application, the OCC evaluates the GENIUS Act’s factors in deciding whether to grant PPSI status: financial resources, felony convictions, management competence and integrity, and the redemption policy all contribute to the OCC’s determination. The Final Rule adds a fifth factor for the OCC’s consideration: whether the applicant can operate safely and soundly, including whether its structure addresses run risk.

Within 30 days of receipt, the OCC must state whether the application is substantially complete. An incomplete application is returned without decision 60 days after the OCC provides a notice of deficiency. After 120 days, a substantially complete application is deemed approved unless denied first. The OCC may approve, conditionally approve, or deny the application. The OCC may only deny a substantially complete application based on safety and soundness concerns. The OCC must explain a denial in writing within 30 days and offer a hearing on appeal. The OCC is also empowered to nullify an approval that rested on a material misrepresentation or error.

Of note, PPSI approval is distinct from charter approval. For example, an uninsured national trust bank PPSI must still obtain approval under 12 C.F.R. 15.30(a)(2) to issue payment stablecoins as a Federal qualified payment stablecoin issuer. A national trust bank’s activities as a PPSI, including issuance, must also remain within the permissible operations of a trust company and activities related thereto under 12 U.S.C. 27(a). An uninsured national trust bank, whether or not it issues payment stablecoins, may also elect, with prior OCC approval, to follow the Final Rule’s capital and operational backstop requirements instead of 12 C.F.R. part 3; the OCC will act on a complete request within 60 days, and any OCC order or other supervisory document specifying a different minimum capital requirement continues to control.

What activities may PPSIs conduct?

Permissible activities for PPSIs under the Act include the following:

Issuing and redeeming payment stablecoins, managing reserves, and providing custody or safekeeping of payment stablecoins, required reserves, and private keys; and
Assessing fees for purchases and redemptions, acting as principal or agent with respect to payment stablecoins, and paying fees to facilitate customer transactions.

The Final Rule adds the following permissible activities for PPSIs in addition to those enumerated in the Act:

Holding other digital assets as principal, in reasonably foreseeable amounts, to pay fees or conduct testing;
Establishing reserve trust arrangements solely for holders’ benefit; and
Managing foreign exchange risk without speculating.

Section 4(a)(7)(A)(v) of the Act also contains a catch-all for all other activities that directly support the above activities and the Final Rule clarifies that hiring third parties is included by the catch-all. The authorities derived from other laws are expressly preserved; the Final Rule does not limit the powers of depository institutions, national banks, or trust companies. Conversely, approval to issue payment stablecoins does not, by itself, authorize a PPSI to conduct every type of digital asset business. A national trust bank that is a PPSI may therefore continue providing otherwise-authorized fiduciary and custody services but remains subject to the Act’s restrictions, including the yield prohibition. For example, authority to buy and sell payment stablecoins for customers does not automatically extend to trading or holding other digital assets for them; those services require a separate legal basis.

What reserve assets must a PPSI maintain?

A PPSI’s reserve assets must be identifiable, segregated from, and not commingled with its other assets, and either held directly by the issuer or in the custody of an “eligible financial institution.” At all times, the issuer’s “reserve asset value” must equal or exceed its “outstanding issuance value.” Reserve asset value is the fair value of reserve assets net of associated liabilities (with U.S. coins and currency counted at face value), while outstanding issuance value is the total par value of all payment stablecoins the issuer has issued.

The PPSI must also demonstrate the operational capability to access and monetize its reserves under both normal and adverse economic, liquidity, market, and interest rate conditions, ensure that the portfolio can support timely redemptions under similar stresses, and, to the extent necessary, hold a buffer of reserve assets above outstanding issuance value.

Reserves in excess of the outstanding issuance value may be withdrawn only after due diligence confirming that the withdrawal will not cause reserve asset value to fall below outstanding issuance value as of the time of withdrawal. The withdrawal limit does not apply to income earned on reserve assets. The Final Rule also limits eligible reserve assets to eight categories, as summarized in the chart set forth below. A PPSI must also hold at least 5% of its reserve assets as demand deposits, on-demand share accounts, or Federal Reserve Bank balances. A PPSI may not have more than 40% of its reserve assets exposed to any one counterparty; exposures to the U.S. Government, assets held by an “appropriate custodian,” reserves held directly by the PPSI, and centrally cleared repurchase and reverse repurchase agreements are excluded from the 40% limit.

Asset Type	Conditions and Limits
U.S. coins and currency; Federal Reserve Bank balances	Coins and currency valued at face value. Federal Reserve Bank balances count toward the 5% minimum but remain subject to the 40% counterparty limit.
Demand deposits (or other deposits withdrawable on request at any time) or insured shares at an IDI (including its foreign branches, agents, correspondents)	Subject to any Federal Deposit Insurance Corporation (FDIC)/National Credit Union Administration (NCUA) limitation under GENIUS Act § 4(a)(1)(A)(ii). Accounts with notice periods or withdrawal-count limits do not qualify. Reserves may be placed through deposit placement networks, but not to the extent that a network’s withdrawal limits would keep the PPSI from meeting its redemptions on time. Counts toward 5% minimum; subject to the 40% limit.
Treasury bills, notes, or bonds with remaining maturity of 93 days or less	93-day period runs from settlement date of purchase. Treasury Floating Rate Notes, Treasury Inflation-Protected Securities, and Separate Trading of Registered Interest and Principal of Securities qualify if ≤ 93 days remaining. Exposure to U.S. Government excepted from 40% limit.
Money received under repurchase agreements	The PPSI must be acting as the seller. Maturity cannot be longer than overnight. Must be backed by Treasury bills with maturity ≤ 93 days. Not eligible in tokenized form.
Reverse repurchase agreements	The PPSI must be acting as the purchaser, the securities must be collateralized by Treasury bills, Treasury notes, or Treasury bonds, and the PPSI must receive collateral worth more than the cash it provides, in line with standard market terms. Agreements must be tri-party, centrally cleared through a Securities and Exchange Commission-registered clearing agency, or bilateral with creditworthy counterparty. Maturity no longer than overnight. Centrally cleared exposures excepted from 40% limit. Not eligible in tokenized form.
Fund securities	Must be issued by registered investment company or other registered government money market fund. Must be invested solely in U.S. coins/currency, demand deposits or insured shares, Federal Reserve balances, money received under repurchase agreements, reverse repurchase agreements, and Treasury securities with a remaining maturity of ≤ 93 days. Registered exchange-traded funds investing solely in these assets qualify. Excludes funds invested in other funds. Fund exposure is a counterparty exposure subject to the 40% limit.
Any other similarly liquid Federal Government-issued asset approved by the OCC, in consultation with the State regulator if applicable	OCC may impose conditions (e.g., maturity). OCC will consider four non-exclusive factors: liquidity characteristics comparable to foregoing permitted reserve assets, operational capability of monetizing asset to meet redemptions, comparable risk level to foregoing assets, and additional risks that are difficult for PPSIs to manage.
Tokenized forms of the currency, deposit, Treasury, fund, and OCC-approved categories.	Must comply with all applicable law; “tokenized form” requires distributed ledger technology authoritative record and identical legal rights. Must be separately listed in monthly report.

What are the diversification, liquidity, custody, and reporting requirements for a PPSI’s reserves?

The Final Rule supplements the GENIUS Act’s 1:1 reserve requirement with standards governing diversification, liquidity, custody, and reporting. These requirements give PPSIs flexibility in managing reserves while requiring them to demonstrate that their portfolios can support timely redemption under both normal and stressed conditions.

Diversification and liquidity. PPSIs must diversify reserves and manage concentration risks; maintain at least 5% of reserves in qualifying demand deposits, on-demand share accounts, or Federal Reserve Bank balances; and limit exposure to a single counterparty to 40% of reserves.
Restrictions on reserve use. Required reserves generally may not be pledged, rehypothecated, or reused, subject to limited exceptions for permitted margin obligations, standard custodial services, and transactions that provide liquidity for redemptions. The OCC confirmed, however, that an IDI at which a PPSI holds reserves as deposits (rather than in custody) may deploy or invest those deposits, unless it holds them in a fiduciary capacity, and that a national bank or Federal savings association holding reserve deposits or custodying reserve assets is not obligated to ensure 1:1 backing unless it agrees to do so by contract. The Final Rule provides advance OCC approval for qualifying redemption-related repurchase agreements involving Treasury bills with maturities of 93 days or less.
Reporting and accountability. PPSIs must publish monthly reserve composition reports, accompanied by an examination report from a registered public accounting firm, and submit CEO and CFO certifications to the OCC. Additional reporting applies where different brands have separate reserve pools or are issued through separate entities.
Reserve shortfalls. A PPSI that falls below the required reserve level must notify the OCC and generally cease new issuance immediately. A shortfall lasting 15 consecutive business days requires liquidation of reserves and redemption without fees, unless the OCC extends that period. The OCC may also require a remediation plan or order redemption where timely compliance is sufficiently doubtful.

Compared with the OCC’s original proposal, the Final Rule reduces the contemplated daily liquidity minimum from 10% to 5%, omits several proposed quantitative tests, and permits more flexible withdrawals of excess reserves. These changes are balanced by express requirements to demonstrate the ability to monetize reserves and maintain sufficient liquidity under stress. Accordingly, compliance with the numerical thresholds alone may not satisfy a PPSI’s obligations.

What capital and operational backstop must a PPSI maintain?

The Final Rule imposes two separate funding requirements on PPSIs in addition to its reserves.

Minimum Capital

A de novo PPSI, meaning one that received OCC approval to issue payment stablecoins within the prior three years, or certain State qualified payment stablecoin issuers that transitioned to the Federal framework within the prior three years, must hold the greater of $5 million or the amount specified in its OCC licensing or chartering conditions, generally for 36 months (a period the OCC may shorten or lengthen).

On an ongoing basis, every PPSI must maintain capital commensurate with all of its risks (including off-balance-sheet activities), maintain a process for assessing its overall capital adequacy and a strategy for sustaining it, and in all events hold at least $5 million. The OCC may also impose an additional individualized capital or backstop requirement after written notice, a 30-day response period (or another period the OCC determines appropriate), and a written decision.

Operational Backstop

A PPSI must maintain assets equal to 12 months of total expenses, measured from the four most recent quarterly reports once the PPSI has filed quarterly reports for at least one year; otherwise, from actual expenses for quarters in operation or reasonably determined (including annualized) expenses. One-time expenses wholly unrelated to continuing operations may be excluded only with prior written OCC approval. An acquirer must add an acquired PPSI’s historical expenses to its own.

Eligible backstop assets consist of U.S. coins and currency or Federal Reserve Bank balances; demand deposits or share accounts payable on demand at a U.S. insured depository institution, the balances of which are fully insured by the FDIC or NCUA; and Treasuries with a remaining or original maturity of 93 days or less. Eligible backstop assets must be separately identified from reserve assets and other assets in the PPSI’s reports. Up to 50% of the backstop requirement may be funded with “operational backstop debt,” which is subject to stringent standards, including being unsecured, subordinated to payment stablecoin holders and general creditors, having at least a five-year maturity, and being callable only after five years with prior written OCC approval (and only if the PPSI replaces it with qualifying debt or demonstrates sufficient capital).

PPSIs must comply with both the minimum capital and operational backstop requirements at all times. An issuer must notify the OCC within 24 hours of any failure during a quarter and must publicly report quarterly whether it complied. An issuer that is noncompliant at quarter-end may not issue new payment stablecoins from the first day of the following month until it regains compliance (other than ledger-to-ledger transfers that do not increase net issuance). An issuer that is noncompliant at two consecutive quarter-ends must begin liquidating reserves and redeeming payment stablecoins without fees and cease issuance. The OCC may accelerate the issuance restriction before quarter-end. It may also permit continued operation if the issuer drew on backstop assets to address a temporary disruption and, within seven days, delivers a plan to restore compliance within 90 days that the OCC deems viable.

How quickly must a PPSI redeem payment stablecoins, and who must have access to redemption?

Redemption

Redemption may not exceed two business days following the date of the requested redemption. Redemption is deemed to occur when the PPSI has fully processed and initiated the outgoing transfer of monetary value to the customer or the customer’s financial institution as the customer directs, or, if the customer requests, credited monetary value to the customer’s account with the PPSI. The OCC explains that this measures what is within the PPSI’s control, so the time for funds to arrive at a customer’s bank falls outside the window and no longer timeline is available for cross-border redemptions.

Redemption Policy

A PPSI’s redemption policy must provide clear and conspicuous procedures for timely redemption and must state that timely redemption may not exceed two business days following the date of the requested redemption, though issuers may redeem sooner. An issuer must redeem payment stablecoins once it has received a redemption order from a customer and, if the issuer has onboarding procedures, once the customer has been successfully onboarded and all other legal conditions for a compliant redemption are met. Such onboarding procedures must be reasonably designed not to unduly delay onboarding of retail or other customers (including in times of stress). Onboarding deficiencies may not be used as a pretext to extend the redemption timeline.

If a PPSI receives redemption requests exceeding 10% of the outstanding issuance value of any brand of its payment stablecoins in a single 24-hour period, it must notify the OCC through its supervisory office within 24 hours and may request an extension of the timely redemption period. The OCC may grant or deny the request or impose discretionary limits in accordance with Section 4(a)(1)(B)(i) of the Act.

All holders of at least one payment stablecoin must be able to redeem directly with the PPSI. A PPSI may set a minimum redemption amount (which may be a fraction of one payment stablecoin), but it must redeem any number of payment stablecoins greater than or equal to one, subject to appropriate customer screening and onboarding. An issuer must have the legal obligation to redeem from any holder, retail or institutional, and it may not eliminate that obligation by limiting its customer base to one or a few intermediaries since an issuer serving a single institution could otherwise lose the obligation if that institution failed. Although an issuer need not build a retail-focused business, it must be able to onboard holders who come to it directly, particularly under stressed conditions.

Required Redemption Disclosures

The PPSI must publicly disclose its redemption policy. This policy must include its own redemption timeframe and the regulatory two-day limit, a statement that discretionary limits on timely redemption may be imposed only by the OCC (or, for a State qualified payment stablecoin issuer, by the OCC, the Federal Reserve, or the State regulator), the scenarios in which the period may be extended, clear instructions and a link to where holders can redeem, and any minimum redemption amount.

Separately, the PPSI must publicly, clearly, and conspicuously disclose, in plain language and segregated from other information, the name of the issuer, that the issuer is the entity obligated to redeem for a fixed amount of monetary value, the webpage linking to the monthly reserve report, all purchase and redemption fees, and that the payment stablecoin is not legal tender or government-issued or guaranteed and is not a deposit, not backed by the full faith and credit of the U.S., and not FDIC- or NCUA-insured. These disclosures must appear on the PPSI’s website and in any customer agreements. Fee changes require at least seven calendar days’ prior notice, including delivery to current customers. Fees are otherwise permitted.

Can PPSIs, affiliates, or distributors offer interest or rewards?

The GENIUS Act prohibits PPSIs from paying holders “any form of interest or yield (whether in cash, tokens, or other consideration) solely in connection with the holding, use, or retention” of the payment stablecoin.

Under the Final Rule, PPSIs remain subject to the GENIUS Act’s prohibition on paying interest or yield to payment stablecoin holders. However, there may still be room for affiliates, distributors, and other third parties to offer rewards. The Final Rule removed a proposed presumption against payment arrangements involving affiliates, distributors, and other third parties, but it did not replace it with a safe harbor. Instead, it adopted an approach in which the OCC will evaluate the facts and circumstances of each arrangement to determine whether the payment is attributable to the issuer. The OCC’s commentary signals the limits of that approach. Payments made by an agent on the issuer’s behalf fall within the prohibition; an issuer that pays another entity to make a payment the issuer could not make directly would be engaged in evasion; and the OCC declined to adopt safe harbors for white-label arrangements, de minimis payments, or preexisting rewards programs. Absent other facts, however, payments for bona fide services “generally would not be prohibited.”

How does the Final Rule affect State qualified payment stablecoin issuers?

The Final Rule leaves the GENIUS Act’s framework for State qualified payment stablecoin issuers in place but adds procedures, deadlines, and interpretations regarding how an issuer moves between State and Federal supervision. Under the Act, a nonbank PPSI with $10 billion or less in outstanding payment stablecoins may elect to be regulated under a State regime instead of the Federal framework, so long as the State regime is substantially similar to the Federal framework.

When a State qualified payment stablecoin issuer exceeds the $10 billion threshold, it can either: (1) transition to the Federal framework within 360 days; or (2) stop issuing new payment stablecoins on a net basis until it falls back below $10 billion. Once an issuer passes the $10 billion threshold, the OCC supervises it jointly with the State regulator. An issuer that falls back below $10 billion can return to sole State supervision once the OCC makes that determination.

Under the Final Rule, a State qualified payment stablecoin issuer must notify the OCC within five calendar days of crossing $10 billion (measured at a point in time, not a rolling average). If the State qualified payment stablecoin issuer transitions, it must submit a capital analysis within 270 days and meet the OCC’s capital requirement before its transition date. The transition itself must be complete no later than 360 days after the issuer crosses the $10 billion threshold, and the OCC confirmed that it cannot extend this statutory deadline. Transition does not necessarily require a national bank charter. A transitioning issuer becomes subject to the rules for Federal qualified payment stablecoin issuers, which are nonbank entities.

The Final Rule also allows a State qualified payment stablecoin issuer to request a waiver to stay under State supervision. The waiver must be submitted within 240 days of crossing the threshold. The OCC may use discretion in issuing a waiver, reviewing the issuer’s capital, history, the State regulator’s experience, and the State’s supervisory framework. The OCC will approve a waiver if the State regulator had established a prudential regime for digital assets or payment stablecoins as of April 19, 2025, that regime has since been certified, and the State regulator has approved at least one issuer, unless the OCC finds by “clear and convincing evidence” that the waiver criteria are not substantially met or that the issuer poses significant safety and soundness risks to the financial system of the U.S. Because no State regime has yet been certified (initial State certifications are not due until January 18, 2028), the presumption is not yet available in practice, although the OCC may still grant a waiver on the four criteria above.

Finally, the OCC has emergency authority over State qualified payment stablecoin issuers in “unusual and exigent circumstances,” subject to 48 hours’ notice to the State regulator. The OCC determines whether unusual or exigent circumstances exist by examining immediate risks to the issuer, the State regulator’s response, redemption failures, and significant swings in the payment stablecoin’s market price.

The U.S. Department of the Treasury (Treasury) has proposed, but not finalized, its standards for whether a State regime is substantially similar to the Federal framework. Treasury has recently, on behalf of the Stablecoin Certification Review Committee, issued an interim final-rule-setting procedures for certifying State regimes.

How may foreign payment stablecoin issuers access the U.S. market?

A foreign payment stablecoin issuer can enter the U.S. market in one of two ways: (i) it can establish a U.S. entity and seek approval as a PPSI, subject to the same requirements as any domestic issuer; or (ii) it can remain a foreign payment stablecoin issuer and register with the OCC under the GENIUS Act’s exemption for foreign payment stablecoin issuers.

To qualify for the exemption, a foreign payment stablecoin issuer must meet several conditions:

Treasury must have determined the issuer’s home regime is comparable to the GENIUS Act;[2]
The issuer must be registered with the OCC;
The issuer must hold reserves in a U.S. financial institution sufficient to meet the liquidity demands of U.S. customers, unless a reciprocal arrangement provides otherwise; and
Its home country cannot be subject to comprehensive U.S. sanctions or designated a primary money laundering concern.

The GENIUS Act also restricts digital asset service providers from offering or selling certain foreign-issued payment stablecoins in the U.S. unless the statutory conditions concerning lawful order compliance and reciprocal arrangements are satisfied.

A foreign payment stablecoin issuer must also hold enough reserves at U.S.-organized institutions to meet U.S. customers’ liquidity demands. The Final Rule offers four ways to satisfy this requirement. The foreign payment stablecoin issuer can:

Attest that less than 50% of its outstanding issuance value is held by U.S.-located holders, and hold reserves at eligible U.S. financial institutions equal to at least 50% of its outstanding issuance value;
Hold substantially all of its reserves in the U.S.;
Maintain U.S. reserves sufficient for stressed redemptions; or
Obtain OCC approval of its own approach. A foreign payment stablecoin issuer may also be relieved of this requirement altogether if a Treasury reciprocal arrangement with its home jurisdiction provides otherwise.

Once registered, a foreign payment stablecoin issuer is subject to the same reporting requirements as domestic PPSIs unless a reciprocal arrangement provides otherwise. It must also file a monthly report on its U.S. holdings and reserves. The OCC will examine its U.S. activity and charge cost-based fees. The OCC, in consultation with Treasury, may rescind a registration for noncompliance.

What requirements apply to custody, self-custody, and decentralized arrangements?

A national bank, Federal savings association, Federal branch, or PPSI subject to OCC supervision is a “covered custodian” under the Final Rule when it provides custodial or safekeeping services for “covered assets.” Covered assets relate to payment stablecoins offered, sold, or otherwise made available to persons in the U.S. and include payment stablecoin reserves, payment stablecoins used as collateral where a covered custodian has actual knowledge of that use, private keys used to issue payment stablecoins, and cash and other property received while providing custodial or safekeeping services.

A covered custodian must separately record and account for the covered assets of each “covered customer,” or any person for whom a covered custodian receives, acquires, or holds covered assets. It must also maintain possession or control of the covered assets of a covered customer that it directly holds and treat such assets as customer property. The covered custodian must take appropriate measures—including through written custody agreements and policies, procedures, and internal controls—to protect such covered assets from claims of the creditors of the covered custodian or any sub-custodian.

A covered custodian may use a sub-custodian to maintain control of the covered assets of a covered customer if the covered custodian maintains sufficient oversight over the sub-custodian. A covered custodian or sub-custodian may meet the control standard for payment stablecoins, tokenized reserve assets, and private keys used to issue payment stablecoins if they can demonstrate that no third party, including the covered customer, is able to transfer the relevant payment stablecoin or tokenized asset without the consent of the covered custodian or sub-custodian.

Although a covered custodian must segregate its own assets from those of covered customers, one or more omnibus accounts are permitted, provided the covered custodian maintains adequate safeguards and controls, including appropriate recordkeeping, and the arrangement is fully disclosed in any applicable custody agreement. Notwithstanding the foregoing, a covered custodian may share an omnibus account with covered assets of covered customers at a sub-custodian if the sub-custodian maintains sufficient safeguards to keep its own assets separate from customer assets.

Of note, the custody rules under the Final Rule expressly carve out any entity that may otherwise be deemed a covered custodian if such national bank, Federal savings association, Federal branch, or PPSI solely provides hardware or software facilitating a person’s self-custody of their covered assets. However, this exclusion only applies if the entity does not control or hold itself out as controlling the relevant private keys or as providing custody or safekeeping services. The Final Rule is distinct from the GENIUS Act. The Act’s exclusions from the definition of “digital asset service provider” address certain protocols, self-custodial interfaces, validation activities, and liquidity pool participation. However, neither exclusion establishes a blanket exemption for a business that is purportedly decentralized. Instead, the analysis turns on the activities performed, the assets involved, and who exercises control.

What ongoing governance, reporting, and compliance obligations apply?

The Final Rule requires PPSIs subject to OCC supervision to establish and maintain effective risk management, governance, and compliance arrangements proportionate to their size, complexity, and activities. Such arrangements must include internal controls, organizational structures, and procedures that provide an internal audit system, manage interest rate exposure and liquidity and concentration risk, monitor growth and earnings, address insider and affiliate transaction risks, and ensure timely and accurate reporting. A PPSI must conduct appropriate due diligence on and monitor any service provider it engages, including by reviewing audits, test result summaries, or other equivalent evaluations of such service providers.

Additionally, a PPSI must regularly stress test its reserve asset portfolio to ensure that it will continue to at least equal the outstanding issuance value under stressed conditions, including scenarios involving significant positive interest rates. A PPSI must be able to demonstrate to the OCC that it is able to reliably access and monetize its reserve assets necessary to meet any redemption requests under both normal and stressed conditions, accounting for market access, financing channels, haircut assumptions, and operational readiness.

Each PPSI must implement a comprehensive written information security risk and control framework, which must include an information technology and information security risks program. The board of directors or a committee thereof must both approve the program and appoint a qualified individual to oversee the program. Among other things, the technology and security program is required to inventory and classify assets and processes; assess the sensitivity of data; implement controls to safeguard sensitive information; include processes to ensure that key systems and controls, including smart contracts, are operating appropriately; undergo periodic independent testing; and include incident identification, assessment, and response processes that provide for required notification to affected or potentially affected customers and the OCC. In addition, a PPSI must have appropriate procedures to ensure the proper handling of digital assets, including private key management, backup, and recovery. The Final Rule requires a PPSI to monitor relevant changes, both internally and externally, that may impact its security risk and control program, and to adjust as appropriate in response to any such changes.

The Final Rule also establishes distinct reporting and certification obligations for PPSIs, as summarized in the chart set forth below.

Frequency	Requirement	Responsibility
Weekly	Submit confidential activity and reserve information to the OCC.	PPSI.
Monthly	Publish the monthly reserve composition report, as of noon on the last day of the previous month, on its website by noon on the last day of each month, together with the accounting firm’s examination report.	A registered public accounting firm must examine the report. Chief Executive Officer and Chief Financial Officer (or equivalent officers) must submit a certification to the OCC of the accuracy of this report.
Quarterly	Submit a quarterly financial condition report that includes an income statement, expenses, balance sheet, reserves, changes in equity, investments, capital, outstanding issuance value, and assets under custody. Must be submitted within 30 days of the end of the prior quarter.	Chief Financial Officer (or equivalent officer) must provide a declaration, and directors and senior management other than the Chief Financial Officer (or equivalent) must attest by signature after examining the report, that it is true and correct to the best of their knowledge.
Within 180 Days Following Approval and Annually Thereafter	Certification of the implementation of anti-money laundering and economic sanctions compliance programs.	Board of directors to provide initial certification. Bank Secrecy Act officer, the board of directors, or an appropriate committee thereof, may provide subsequent certifications.
Annually for Specified Large PPSIs	PPSIs with more than $50 billion in consolidated outstanding issuance value that are not subject to the Securities Exchange Act of 1934 (Exchange Act) § 13(a) or § 15(d) reporting must obtain a Public Company Accounting Oversight Board-standard audit of GAAP financial statements disclosing related party transactions, file them with the OCC within 120 days after fiscal year-end, and make the audited financial statements publicly available on their website.	Registered public accounting firm must perform audit.

Examinations

The Final Rule requires the OCC to conduct a full scope examination of each PPSI subject to its supervision at least once every 12 months. However, the OCC may extend the full scope examination cycle to once every 18 to 24 months for PPSIs that satisfy all of the following requirements:

the PPSI is not subject to a formal enforcement proceeding or order;
there was no change of control of the PPSI during the otherwise applicable 12-month examination period;
the PPSI has an outstanding issuance value of less than $1 billion, inclusive of any affiliated PPSIs; and
the PPSI is following all reserve and reporting requirements.

Notwithstanding the foregoing, the OCC retains the authority to examine any PPSI as frequently as it deems necessary.

Recordkeeping

The Final Rule also prescribes certain recordkeeping requirements for PPSIs, including the requirement to establish and maintain a records retention policy that enables a PPSI to demonstrate compliance with applicable law, and to maintain a complete set of its records in English.

Change of Control

Under the Final Rule, an acquisition that would result in the change of control of a PPSI is subject to the requirements set forth in 12 C.F.R. 5.50 as though the PPSI were a national bank, unless the acquisition is subject to specified alternative filing requirements. The framework generally requires 60 days’ prior written notice and can reach minority investments and persons acting in concert, not only majority acquisitions.

Do Federal qualified payment stablecoin issuers benefit from preemption of State licensing laws?

As discussed in our prior client alert, the GENIUS Act provides preemption from certain State licensing laws. The GENIUS Act reserves visitorial powers with respect to Federal qualified payment stablecoin issuers to the OCC, which generally limits overlapping supervision by other regulators. This is intended to avoid inconsistent, duplicative, and unduly burdensome regulation. The GENIUS Act governs how State law applies to a Federal qualified payment stablecoin issuer or a subsidiary of an OCC-regulated IDI approved to be a PPSI. However, neither the GENIUS Act nor the Final Rule preempts State consumer protection laws.

The OCC noted that because the preemption provisions of the GENIUS Act are self-executing, it neither proposed nor adopted any implementing regulations and instead chose to retain flexibility to address questions as they arise.

Are State consumer protection laws preempted?

As discussed in our prior client alert, State consumer protection laws are not broadly preempted by the GENIUS Act, and the Final Rule reiterates this point. The OCC generally distinguishes licensing provisions like Sections 4(b)(1) and 5(h), which designate the OCC as the sole licensing authority and regulator and expressly preempt State licensing laws for Federal qualified payment stablecoin issuers, from Section 7(f)(4), which provides that nothing in the GENIUS Act preempts State consumer protection laws.

The Final Rule also does not address the related question of the extent to which State consumer protection laws apply to State qualified payment stablecoin issuers licensed in other States. As we noted in our prior client alert, the GENIUS Act provides that State law applies to State qualified payment stablecoin issuers chartered or licensed in another State only to the extent that such laws would apply to a Federal qualified payment stablecoin issuer. The OCC, however, recognizes that Federal preemption continues to depend on the type of license (e.g., bank vs. nonbank) and the application of preexisting Federal law, like the National Bank Act or the Home Owners’ Loan Act, which can preempt State consumer protection laws. Because the Final Rule does not address Federal preemption of State consumer protection laws directly, the application of State law to State qualified payment stablecoin issuers operating across State lines continues to vary based on facts and circumstances.

As a result, other substantive PPSI activity, like redemption disclosures, practices, and fees, as well as activity by distributors, should be assessed across applicable State laws.

What remains for Treasury and other regulators to address?

The OCC is the first primary Federal payment stablecoin regulator to finalize its rules under the Act, though other rules have been proposed. Appendix A reflects the status, as of publication, of the required rulemakings. Key outstanding subjects include:

Federal payment stablecoin regulatory frameworks. The Federal Reserve, FDIC and NCUA’s proposals all remain pending.
Anti-money laundering (AML)/sanctions. The Final Rule does not address Bank Secrecy Act (BSA) obligations or sanctions requirements. The OCC proposed its own BSA and sanctions compliance standards for OCC-supervised PPSIs on June 24, 2026, after the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) jointly proposed a rule that would treat PPSIs as “financial institutions” under the BSA on April 10, 2026. These are statutorily required rulemakings.
State regime certification. Treasury is obligated under Section 4 of the GENIUS Act to establish broad-based principles for assessing whether a State-level regulatory regime is substantially similar to the GENIUS Act’s Federal framework Treasury proposed such principles in April 2026, but the proposal has not yet been finalized. In September 2026, Treasury, on behalf of the Stablecoin Certification Review Committee (SCRC), also issued an interim final rule implementing interim procedures for the SCRC’s certification of State payment stablecoin regulatory regimes.
Foreign comparability/reciprocity. Treasury has not yet identified comparable regulatory and supervisory regimes that would permit OCC registration of a foreign payment stablecoin issuer. Treasury previously proposed, but has not yet finalized, rules implementing Section 3 of the GENIUS Act that would require foreign payment stablecoin issuers to establish a U.S. nexus for issuance but also limit exposure for PPSIs and digital asset service providers in certain circumstances.
Nonfinancial company restrictions. Under Section 4(a)(12) of the GENIUS Act, a public company not predominantly engaged in financial activities may issue a payment stablecoin only if the SCRC unanimously finds, among other things, that the issuance will not pose a material risk to the safety and soundness of the banking system or U.S. financial stability. The SCRC has not yet proposed a statutorily mandated interpretive rule clarifying the provision’s application. Nonetheless, the Final Rule requires each applicant to certify whether Section 4(a)(12) of the Act applies to it.
Other Discretionary Rulemakings. Other permissive rules—including a de minimis safe harbor under Section 3(c), reciprocal arrangements under Section 18(d), commingling rules under Section 10(c), and interoperability standards under Section 12 of the GENIUS Act—are still forthcoming. Still other outstanding items are studies and reports rather than rules, such as the insolvency study under Section 11(h), the non-payment stablecoin study under Section 14, and the annual reports under Section 15 of the Act.

Key Dates

Date	Event	Nature
Nov. 30, 2026	Comments due on Federal Reserve proposals and SCRC interim final rule	Rulemaking
TBD (post-OMB approval)	OCC begins accepting applications and waiver requests	OCC announcement
Jan. 18, 2027	Act and OCC rule effective; Prior Approval Requirement; restriction on digital asset service providers dealing in noncompliant foreign-issued payment stablecoins; deadline for a pending substantially complete application to support a waiver	Statutory / regulatory
Monthly, from effective date	Reserve composition published by noon on the last day of each month	Recurring obligation
Within 180 days of approval, then annually	AML/sanctions program certification	Statutory
July 18, 2027	Statutory target for completing Treasury Section 18 reciprocal arrangements	Statutory (Treasury)
Jan. 18, 2028	Latest end of any Section 5(f) waiver; deadline for initial State certifications	Statutory / SCRC rule
July 18, 2028	Prohibition on digital asset service providers offering non-permitted payment stablecoins; FinCEN AML-innovation guidance and rulemaking due	Statutory

APPENDIX A — UPDATED RULEMAKING CHART

As of October 28, 2026, the OCC is the only primary Federal payment stablecoin regulator to have finalized its GENIUS Act rules; the SCRC has adopted interim procedures, and nearly every other implementing rulemaking remains at the proposal stage.

This Appendix A updates the overview of rulemakings, reports, and studies in our July 2025 client alert. It lists, newest first, each implementing action taken to date, with the GENIUS Act provisions it implements, its Federal Register citation, and its comment and effective dates. Provisions on which no action has yet been taken are omitted. Section 13 of the Act directed most rulemakings to be completed by July 18, 2026; the Act takes effect on January 18, 2027.

Implementing Actions

Date	Agency	Type	Action	Citation	Key dates
Oct. 23, 2026	OCC	Final Rule	Implementing the GENIUS Act for OCC-supervised PPSIs (12 C.F.R. part 15), including capital and operational backstop, unusual and exigent circumstances (§ 15.16), omnibus accounts (§ 15.22), applications and § 15.30(g) waivers, and foreign payment stablecoin issuer registration (§§ 15.31–15.32).	91 FR 67000	Effective Jan. 18, 2027
Oct. 23, 2026	OCC	Notice	Application forms submitted for OMB review	91 FR 66939	Comments due Nov. 23, 2026
Oct. 23, 2026	OCC	Notice	Weekly and quarterly reporting forms submitted for OMB review	91 FR 66916	Comments due Nov. 23, 2026
Oct. 21, 2026	OCC	Guidance	Bulletin 2026-51: waiver and application submission guidance	OCC Bulletin 2026-51	—
Sept. 30, 2026	SCRC (issued by Treasury)	Interim final rule	Forms and procedures for SCRC review of State certifications; certifications accepted only after Paperwork Reduction Act approval	91 FR 61688	Effective Sept. 30, 2026; comments due Nov. 30, 2026
Sept. 29, 2026	Federal Reserve	Proposed rule	Requirements for Federal Reserve-supervised PPSIs; tying prohibition for all issuers; unusual and exigent circumstances (proposed § 247.50). Approved Sept. 24, 2026.	91 FR 61580	Comments due Nov. 30, 2026
Sept. 29, 2026	Federal Reserve	Proposed rule	Application procedures for Federal Reserve-supervised IDIs seeking approval for a subsidiary to issue	91 FR 61346	Comments due Nov. 30, 2026
Aug. 18, 2026	Treasury	Proposed rule	Issuance, offer, and sale rules (proposed 31 C.F.R. part 1523), including the unusual-and-exigent safe harbor; no de minimis safe harbor proposed	91 FR 53368	Comments closed Oct. 19, 2026
July 27, 2026	OCC	Notice	Application forms, initial notice	91 FR 47032	Comments closed Sept. 25, 2026
July 20, 2026	FDIC	Notice	Reporting forms for FDIC-supervised PPSIs	91 FR 45274	Comments closed Sept. 18, 2026
June 24, 2026	OCC	Proposed rule	BSA/AML and sanctions compliance risk management standards	91 FR 37840	Comments closed July 24, 2026
June 22, 2026	FinCEN, OCC, Federal Reserve, FDIC, NCUA	Proposed rule	Customer identification program	91 FR 37234	Comments closed Aug. 21, 2026
June 12, 2026	OCC	Notice	Weekly and quarterly reporting forms, initial notice	91 FR 35795	Comments closed Aug. 11, 2026
June 5, 2026	FDIC	Proposed rule	BSA and sanctions compliance standards	91 FR 34171	Comments closed Aug. 4, 2026
May 18, 2026	NCUA	Proposed rule	Supplemental proposal on issuance and related activities, share insurance, and tokenized shares	91 FR 28956	Comments closed July 17, 2026
Apr. 10, 2026	FinCEN, OFAC	Proposed rule	AML/countering the financing of terrorism and sanctions compliance program requirements (proposed effective 12 months after final rule)	91 FR 18582	Comments closed June 9, 2026
Apr. 10, 2026	FDIC	Proposed rule	Requirements and standards for FDIC-supervised PPSIs and IDIs. Approved Apr. 7, 2026.	91 FR 18534	Comments closed June 9, 2026
Apr. 3, 2026	Treasury	Proposed rule	Broad-based principles for whether a State regime is substantially similar (proposed 31 C.F.R. part 1521). Issued Apr. 1, 2026.	91 FR 16844	Comments closed June 2, 2026
Mar. 6, 2026	Treasury	Report	Report to Congress on innovative methods to detect illicit finance involving digital assets (statutory target Jan. 14, 2026)	Treasury report	—
Mar. 2, 2026	OCC	Proposed rule	Proposed rule implementing the GENIUS Act (finalized Oct. 23, 2026, above)	91 FR 10202	Comments closed May 1, 2026
Feb. 12, 2026	NCUA	Proposed rule	Investments in and licensing of PPSIs	91 FR 6531	Comments closed Apr. 13, 2026
Feb. 11, 2026	FDIC	Notice	Comment period extended on December 2025 application proposal	91 FR 6138	Comments closed May 18, 2026
Dec. 19, 2025	FDIC	Proposed rule	Approval requirements for subsidiaries of FDIC-supervised IDIs	90 FR 59409	Originally due Feb. 17, 2026; extended (above)
Oct. 1, 2025	Treasury	Notice	Advance notice of proposed rulemaking (ANPRM) comment period extended	90 FR 47251	Comments closed Nov. 4, 2025
Sept. 19, 2025	Treasury	Proposed rule	ANPRM on GENIUS Act implementation (issuance, BSA/sanctions, State oversight, foreign comparability, tax)	90 FR 45159	Originally due Oct. 20, 2025; extended (above)
Aug. 18, 2025	Treasury	Notice	Request for comment on innovative methods to detect illicit activity involving digital assets	90 FR 40148	Comments closed Oct. 17, 2025

APPENDIX B — DETAILED SECTION BY SECTION SUMMARY OF THE OCC FINAL RULE

This Appendix B summarizes the Office of the Comptroller of the Currency’s final regulations implementing the Guiding and Establishing National Innovation for U.S. Stablecoins Act (the “GENIUS Act” or the Act). The discussion follows the Sections of new 12 C.F.R. Part 15, with additional headings highlighting significant requirements and interpretive issues.

Subpart A. Purpose, Scope, Definitions, Severability, and Reservation of Authority

Section 15.1. Purpose and Scope

Part 15 implements the GENIUS Act for entities over which the OCC has regulatory or enforcement authority. It applies to relevant payment stablecoin and custody activities of national banks and their subsidiaries; Federal savings associations and their subsidiaries; Federal branches and their subsidiaries; foreign payment stablecoin issuers; nonbank entities seeking or holding approval as Federal qualified payment stablecoin issuers; and State qualified payment stablecoin issuers over which the OCC has authority under §§ 15.15 or 15.16.

Section 15.2. Definitions

The Rule generally follows the definitions as used in the GENIUS Act. The Rule does, however, have certain deviations:

Money

Under the Rule, “money” is defined as “(1) Monetary value; and (2) Any other medium of exchange that the OCC has determined is currently authorized or adopted by a domestic or foreign government, including a monetary unit of account established by an intergovernmental organization or by agreement between two or more countries.” Unlike the GENIUS Act’s definition, which does not expressly require an agency determination, the Rule requires an OCC determination for a medium of exchange other than “monetary value.” The OCC explains that this mechanism provides clarity concerning instruments whose status may change following governmental action and states that it intends to publish its determinations.

PPSI

The Rule defines a “PPSI” as “a person formed in the U.S. that is a—(1) Subsidiary of an insured national bank or Federal savings association that has been approved to issue payment stablecoins under § 15.30; (2) Federal qualified payment stablecoin issuer; or (3) State qualified payment stablecoin issuer subject to the OCC’s regulatory or enforcement authority under Section 4 of the GENIUS Act (12 U.S.C. 5903).”

Payment stablecoin

The Rule’s definition of “payment stablecoin” excludes a digital asset that is a “[s]ecurity, as defined in Section 2 of the Securities Act of 1933 (15 U.S.C. 77b), Section 3 of the Exchange Act (15 U.S.C. 78c), or Section 2 of the Investment Company Act of 1940 (15 U.S.C. 80a–2).” Although the Act contains the same exclusion, it adds a clarification that a bond, note, evidence of indebtedness, or investment contract issued by a PPSI does not qualify as a security solely because it satisfies the affirmative elements of the payment-stablecoin definition. The Rule omits that clarification. The OCC explains that repeating it is unnecessary because § 17 of the Act amends the relevant securities statutes.

Section 15.3. Severability

The provisions of Part 15 are severable. If one provision is stayed or invalidated, the OCC intends the remaining provisions to continue in effect.

Section 15.4. Reservation of Authority

The OCC reserves authority to waive or modify Part 15 requirements or use different procedures as necessary to carry out the GENIUS Act.

Subpart B. PPSIs and State Qualified Payment Stablecoin Issuers

Section 15.10. Activities

Permitted Activities

A PPSI generally may engage only in issuing and redeeming payment stablecoins, managing reserves, providing specified custody services, and activities directly supporting those functions. Expressly permitted activities include:

Charging purchase and redemption fees;
Acting as principal or agent with respect to payment stablecoins;
Paying fees to facilitate customer transactions;
Holding limited quantities of other digital assets needed for network fees, customer fees, or necessary testing;
Establishing qualifying trust arrangements for reserves;
Managing foreign-exchange risk subject to 15.13; and
Hiring third parties to support permitted functions.

The Rule preserves otherwise applicable activity authority of depository institutions, national banks, and trust companies.

Interest and Yield

PPSIs may not pay holders interest or yield, in cash, tokens, or other consideration, solely in connection with holding, using, or retaining a payment stablecoin. The Rule removes the proposed rebuttable presumption concerning certain affiliate and third-party arrangements.

Removal of the presumption does not establish a safe harbor for indirect payments. The OCC explains that payments made by an agent on the PPSI’s behalf can fall within the prohibition and that paying another entity to make a prohibited payment can constitute evasion. The OCC declines categorical safe harbors for white-label arrangements, de minimis payments, or preexisting rewards programs and will evaluate arrangements based on their facts.

Marketing and Reserve Reuse

PPSIs may not use deceptive government-related names or suggest that their payment stablecoins are legal tender, government-issued, government-guaranteed, federally insured, or backed by the U.S.’s full faith and credit. Currency abbreviations such as “USD” are permitted.

Required reserves generally may not be pledged, rehypothecated, or reused, directly or indirectly. Exceptions address specified repo-related margin obligations, ordinary custody obligations, and qualifying repos used to meet expected redemptions.

Section 15.11. Reserve Assets

Reserve Coverage and Segregation

PPSIs must maintain identifiable reserves, segregated from other assets, with reserve asset value at least equal to outstanding issuance value at all times. Reserves may be held directly or with an eligible financial institution. Reserve asset value generally reflects fair value net of associated liabilities, with U.S. coins and currency measured at face value.

A PPSI must demonstrate that it can access and monetize reserves under normal and adverse conditions. It must maintain additional reserves where necessary to preserve coverage and timely redemption, and may withdraw excess reserves only after confirming that the withdrawal will not cause a shortfall. Thus, a nominal 1:1 portfolio may be insufficient if valuation or liquidity risks require a buffer.

Eligible Reserve Assets

Permitted reserves consist exclusively of:

U.S. coins and currency and Federal Reserve account balances;
Qualifying demand or immediately withdrawable deposits and insured shares;
Treasury bills, notes, or bonds with remaining maturities of 93 days or less;
Proceeds from qualifying overnight repurchase agreements;
Qualifying overnight reverse repurchase agreements;
Qualifying registered investment company or government money market fund securities invested solely in permitted underlying assets;
Other similarly liquid Federal Government-issued assets approved by the OCC; and
Specified eligible assets in tokenized form.

Diversification and Concentration

The Rule imposes both qualitative requirements and quantitative minimum standards:

At least 5% of reserves must consist of qualifying immediately available deposits, payable on demand share account funds, or Federal Reserve
Exposure to a single counterparty generally may not exceed 40% of reserves, excluding exposures to the U.S. Government, qualifying custody exposures, and centrally cleared repos and reverse repos.

To obtain the custody exposure exception, a PPSI must identify itself to the custodian as such, secure the custodian’s commitment to applicable statutory custody requirements, and conduct due diligence and ongoing monitoring. Compliance with the numerical limits does not eliminate the obligation to maintain a sufficiently diversified and liquid portfolio.

Monthly Disclosures and Certifications

By noon on the last day of each month, PPSIs must publish reserve information measured as of noon on the preceding month’s last day. Disclosures include outstanding payment stablecoins, reserve composition, average tenor, and geographic custody locations, using a substantially similar version of the Rule’s template. The template addresses separate brands, distinct reserve pools, and separate PPSIs.

A registered public accounting firm must examine the monthly information, and its examination report must be published with the PPSI’s report. The chief executive officer and chief financial officer, or their equivalents, must certify the monthly report’s accuracy to the OCC.

Reserve Shortfalls

A PPSI must notify the OCC on any day it falls below the minimum reserve amount and immediately stop new issuance, subject to limited exceptions for transfers between ledgers without increased net issuance and other OCC permission. If the shortfall continues for 15 consecutive business days, subject to OCC extension, the issuer must begin liquidating reserves and redeeming payment stablecoins without redemption fees. The OCC may also require remediation plans or order redemption where timely compliance is unlikely.

Section 15.12. Redemption

Timing and Access

Redemption generally must occur within two business days following the requested redemption date. The obligation begins upon receipt of a redemption order and satisfaction of the applicable onboarding and legal conditions. Reliance on onboarding requires procedures reasonably designed not to unduly delay retail or other customers, including during stress.

Redemption occurs when the PPSI has fully processed and initiated the outgoing monetary transfer, or, at the customer’s request, credited the customer’s account with the issuer. The Rule requires redemption of any amount equal to or greater than one payment stablecoin, subject to appropriate screening and onboarding. This requirement materially limits the ability to restrict direct redemption to large institutional customers.

Stress Period Redemptions

If redemption requests exceed 10% of a brand’s outstanding issuance value during a single 24-hour period, the PPSI must notify the OCC within 24 hours. It may request an extended redemption period, but an extension is discretionary. The threshold does not automatically suspend redemption or authorize the issuer to impose its own discretionary limitation.

Policies, Fees, and Disclosures

PPSIs must publish redemption policies describing timing, procedures, applicable limitations, and circumstances permitting extensions. Separate disclosures must identify the actual issuer and its redemption obligation, link to reserve disclosures, describe purchase and redemption fees, and explain the absence of government backing and deposit or share insurance. These disclosures must appear on the issuer’s website and in customer agreements. Fee changes require at least seven calendar days’ advance notice, including delivery to customers with current relationships.

The requirement to identify the PPSI is especially significant for white-label programs: branding does not substitute for disclosure of the entity legally responsible for redemption.

Section 15.13. Risk Management

Operational and Managerial Standards

PPSIs must maintain controls and information systems proportionate to their size, complexity, and activities. Requirements address clear authority, segregation of duties, risk assessment, accurate reporting, asset protection, compliance, and independent internal audit or appropriate independent reviews. Growth must remain commensurate with operational capacity, staffing, and risk-management capability.

Affiliates and Service Providers

Affiliate and insider transactions are subject to documentation, review, and transaction term requirements. PPSIs must exercise due diligence in selecting service providers, contractually require appropriate measures to meet applicable requirements, and monitor performance, including through audit or testing information where appropriate. Outsourcing operational functions therefore does not transfer the issuer’s compliance responsibilities.

Liquidity, Stress Testing, and Foreign Exchange

PPSIs must monitor reserve compliance and test their ability to monetize reserves and meet redemption demands under normal and stressed conditions, including significant positive interest-rate scenarios. Issuers of non-dollar payment stablecoins must hedge identified residual foreign-exchange risk, retain no more than minimal exposure, avoid speculative positions, and obtain OCC approval before engaging in the prescribed foreign-exchange risk management.

Information Security and Resilience

A comprehensive written information-technology and security program requires board or appropriate committee approval and oversight. Required elements include asset and data inventories, safeguards, smart-contract and system validation, independent testing, incident response, private-key management and recovery, and continuity planning.

Upon unauthorized access to sensitive customer information, a PPSI must investigate the likelihood of misuse. If misuse has occurred or is reasonably possible, it must notify affected or potentially affected customers and the OCC as soon as possible, subject to the specified law enforcement delay. If affected individuals cannot be identified within a compromised group, notice must reach the entire group where misuse is reasonably possible.

Section 15.14. Audits, Reports, and Supervision

Examination Frequency

The OCC will conduct full-scope examinations at least annually, except the OCC may use an 18- to 24-month cycle for qualifying PPSIs with less than $1 billion in outstanding issuance together with affiliated PPSIs, no relevant recent control acquisition, no formal enforcement proceeding or order, and compliance with reserve and reporting requirements.

Records and Reports

PPSIs must maintain complete books and records and a retention policy supporting demonstration of compliance. Issuers must submit confidential weekly reports and quarterly financial condition reports within 30 days after quarter-end, with officer declarations and prescribed director and senior management attestations.

Compliance Certifications and Audits

Within 180 days after approval, and annually thereafter, PPSIs must certify implementation of reasonably designed anti-money laundering and sanctions-compliance programs. The initial certification must come from the board; later certifications may come from the BSA officer, board, or appropriate board committee.

PPSIs with more than $50 billion in total consolidated outstanding issuance that are not already subject to reporting requirements under Section 13(a) or 15(d) of the Exchange Act must prepare annual audited GAAP financial statements, including related-party disclosures. The statements must be audited by a registered public accounting firm and made publicly available and submitted to the OCC within 120 days after fiscal year-end.

Changes in Control

Persons seeking to acquire control must comply with 12 C.F.R. § 5.50 as though the PPSI were a national bank, unless the transaction is already subject to the identified Part 5 or § 15.30 procedures. Acquirers should therefore assess the specific control and filing standards incorporated from § 5.50.

Section 15.15. State Qualified Payment Stablecoin Issuers

Transition to Federal Oversight

A nonbank State qualified payment stablecoin issuer exceeding $10 billion in total consolidated outstanding issuance generally must transition to the Federal framework within 360 days after reaching such threshold, or cease net new issuance from the threshold date until it falls below the threshold. It must notify the OCC within five calendar days after crossing the threshold.

Transitioning State qualified payment stablecoin issuers generally must submit a capital analysis within 270 days, satisfy the OCC’s capital requirement before transition, and provide a compliance notice to the OCC or identify deficiencies and a remediation plan.

An initial OCC examination must occur upon OCC request or no later than six months after the specified notice.

Waivers and Return to State Supervision

A State qualified payment stablecoin issuer seeking to remain solely State-supervised must request a waiver within 240 days after crossing the threshold. The OCC evaluates capital, operating and examination history, the State regulator’s experience, and the State supervisory framework. A statutory presumption favors qualifying State regimes established by April 19, 2025, subject to the specified clear-and-convincing-evidence exception.

A State qualified payment stablecoin issuer that has transitioned generally ceases OCC supervision under this framework when the OCC determines that its consolidated outstanding issuance no longer exceeds $ 0 billion. The reduction in issuance does not itself substitute for the OCC’s determination.

Section 15.16. Unusual and Exigent Circumstances

The OCC may impose emergency restrictions on a nonbank State qualified payment stablecoin issuer where unusual and exigent circumstances exist and continued activity or inaction presents a serious risk to the issuer’s financial safety, soundness, or stability. Restrictions may address redemptions, affiliate transactions, and activities exposing the issuer to holding-company or affiliate liabilities.

Relevant considerations for determining unusual and exigent circumstances include immediate risks, the State regulator’s response, holder risks, secondary market price fluctuations, redemption failures, and significant unanticipated losses.

Subpart C. Custody

Section 15.20. Definitions

Covered Assets

The Rule defines “covered assets” to include reserves, payment stablecoins used as collateral where the custodian has actual knowledge of that use, private keys used to issue payment stablecoins, and related cash or property received during custody services.

Covered Custodian

The Rule defines “covered custodian” to mean a national bank, Federal savings association, Federal branch, or PPSI to the extent of such person’s provision of custodial or safekeeping services for covered assets.

Section 15.21. Covered Asset Custodial Property Requirements

Covered custodians must separately account for covered assets, treat them as customer property, and take appropriate steps to protect them from claims of custodian and sub-custodian creditors. Written agreements and proportionate policies, procedures, and controls are required.

A covered custodian generally must maintain possession or control, although qualified sub-custody arrangements are permitted with adequate oversight. For specified digital assets, control requires a reasonable demonstration that no other person, including the customer, can transfer the asset without the custodian’s or sub-custodian’s consent. The rule permits authorized withdrawals for settlement and lawful charges and permits cash to be held as a deposit liability where consistent with Federal law.

Section 15.22. Use of Omnibus Accounts

Customer assets generally must remain segregated from the custodian’s assets. A covered custodian may commingle the covered assets of multiple customers in one or more omnibus accounts to the extent that recordkeeping, safeguards, applicable law, and custody agreement disclosures support that treatment. The Rule also permits specified omnibus arrangements at sub-custodians, provided customer assets remain segregated from the sub-custodian’s own property.

Section 15.23. Self-Custody Hardware and Software Exclusion

Subpart C does not apply solely because an entity provides hardware or software facilitating self-custody of covered assets. To qualify, the provider must neither control nor hold itself out as controlling the relevant private keys, and must not provide or hold itself out as providing custody or safekeeping. The exclusion reflects a distinction between software functionality and custody responsibility, but is not a general exemption from other GENIUS Act provisions.

Subpart D. Applications and Registrations

Section 15.30. Approval of PPSIs

Insured national banks, Federal savings associations, and insured Federal branches must obtain approval before subsidiaries issue payment stablecoins. Nonbank entities, uninsured national banks, and uninsured Federal branches seeking Federal qualified payment stablecoin issuer status also must obtain approval. Applications include prescribed information, background and financial submissions for specified principals, and certifications concerning accuracy and applicability of the Act’s restrictions on certain publicly traded nonfinancial companies.

Completeness and Review

The OCC must notify applicants within 30 days whether an application is substantially complete and identify missing information. Substantial completeness generally persists unless a material change causes treatment as a new application. An application remaining incomplete 60 days after the specified deficiency notice is returned without decision. A substantially complete application is deemed approved on the 120th day after receipt unless denied before then.

Review Factors and Appeals

The OCC considers financial resources, relevant felony convictions, management and ownership competence and integrity, redemption policy compliance, and safe and sound operation, including run risks and redemption capability. A denial must be followed within 30 days by an explanation identifying material shortcomings and actionable recommendations. Applicants may request a hearing within 30 days of receiving notice, with a final determination generally due within 60 days after the hearing.

Pending Application Relief and Nullification

Applicants with substantially complete applications pending on or before January 18, 2027, may request a waiver lasting up to 12 months beginning on that date. Relief requires an OCC determination of public interest or extraordinary circumstances and is not automatic. The OCC may nullify approvals obtained through material misrepresentations or omissions, contrary to law, or resulting from specified errors, subject to the notice procedures in the rule.

Section 15.31. Foreign Payment Stablecoin Issuers

Eligibility

A foreign payment stablecoin issuer qualifies for the specified exception from the Act’s Section 3 (Issuance and Treatment of Payment Stablecoins) prohibitions if it is subject to a Treasury-determined comparable foreign regime, registers with the OCC, maintains sufficient reserves at eligible U.S.-organized financial institutions unless a reciprocal arrangement permits otherwise, and satisfies the jurisdictional sanctions and money-laundering conditions.

U.S. Reserve Requirements

The Rule provides four alternative approaches to establishing sufficient U.S. reserves:

Attest that fewer than 50% of outstanding issuance is held by U.S.-located holders and maintain U.S. reserves at least equal to 50% of outstanding issuance;
Attest to, and maintain, substantially all reserves at eligible U.S.-organized institutions;
Demonstrate on an ongoing basis that the value and composition of U.S. reserves can support timely U.S.-customer redemptions under normal and adverse conditions, including necessary buffers; or
Obtain OCC approval of a detailed alternative proposal and comply with its conditions.

Withdrawals of excess U.S. reserves require confirmation that the applicable requirement remains satisfied. These alternatives address practical difficulties in measuring geographically dispersed payment stablecoin holdings. They do not, however, establish Treasury’s geographic standards for deciding whether an issuance, offer, or sale occurs in the U.S.

Supervision and Yield

Registered foreign payment stablecoin issuers are subject to OCC reporting, supervision, and examination. They generally must provide the reports required under § 15.14, although they may request exemptions. They are subject to the same statutory formulation of the interest-and-yield prohibition.

Section 15.32. Registration of Foreign Payment Stablecoin Issuers

Application and Review

A foreign payment stablecoin issuer that seeks to be registered with the OCC must file an application. Applications must include prescribed information, evidence of Treasury’s comparability determination, commitments to provide information, consent to U.S. jurisdiction, and required certifications. An application satisfying the specified information requirements is deemed approved on the 30th day after receipt unless the OCC rejects it in writing.

In evaluating an application under this Section, the OCC considers U.S. financial and managerial resources, information access, financial-stability and illicit-finance risks, and safe and sound operation, including redemption and run risks. Approval conditions require English-language information access, compliance with U.S. reserve requirements, monthly reports, prompt notice of reserve deficiencies, and compliance with applicable Treasury determinations and reciprocal arrangements.

Rejection, Appeal, and Nullification

The OCC may reject applications based on adverse review findings or inability to satisfy approval conditions. Foreign payment stablecoin issuers may request a hearing within 30 days of rejection; the OCC generally must issue its final decision within 60 days after the hearing. Approvals may be nullified for material misstatements or omissions, legal defects, or specified errors.

Section 15.33. Revocation or Rescission of Approval

The OCC may revoke a PPSI’s approval for failure to submit the required compliance certification. In consultation with Treasury, the OCC may rescind a foreign payment stablecoin issuer’s registration for noncompliance, including insufficient reserves, illicit-finance risk, or financial stability risk.

Notice and an opportunity for a hearing generally apply, with expedited procedures where necessary to protect the public interest. Foreign registration rescission generally becomes effective upon Federal Register publication, unless otherwise specified.

Subpart E. Capital and Operational Backstop

Section 15.40. Capital

Qualifying Capital

Capital consists of GAAP equity accounts less specified deductions for goodwill, other intangible assets, deferred tax assets net of valuation allowances, and the equity-funded portion of required operational-backstop assets. This last deduction prevents the same equity from satisfying both minimum capital and the separately funded backstop.

Operational Backstop Debt

Qualifying debt may fund no more than 50% of the operational backstop requirement. It must be paid in, unsecured, subordinated to payment stablecoin holders and general creditors, and have a minimum five-year maturity. Additional restrictions address declining recognition as maturity approaches, early calls, acceleration, credit-sensitive features, and affiliate funding. Operational backstop debt does not replace the minimum equity-capital requirement.

Section 15.41. Minimum Capital and Operational Backstop

Minimum Capital

De novo PPSIs must hold the greater of $5 million or the amount established in OCC licensing or chartering conditions. De novo status includes issuers approved within the prior three years and specified State qualified payment stablecoin issuers that recently transitioned. The initial requirement generally applies for 36 months, subject to OCC adjustment. Thereafter, capital must remain proportionate to all relevant risks and may not fall below $5 million.

Operational Backstop

PPSIs must separately maintain eligible assets equal to 12 months of total expenses, generally measured using the current and preceding three quarterly reports.

Eligible backstop assets are narrower than eligible payment stablecoin reserves, and may consist of:

S. currency or Federal Reserve balances;
Fully insured qualifying demand deposits or share accounts; and
Specified short-term Treasuries with a remaining maturity of 93 days or less.

Backstop assets must be separately identified from reserves and other assets in regulatory reports.

Deficiencies

PPSIs must notify the OCC within 24 hours of a capital or backstop deficiency. An unresolved quarter-end deficiency triggers an issuance restriction beginning on the first day of the following month until the issuer satisfies its minimum capital and backstop requirements. Deficiencies at two consecutive quarter-ends require liquidation of reserves, fee-free redemptions, and cessation of new issuance. The OCC may impose restrictions earlier.

The OCC may permit continued operation after backstop assets are used to address a temporary disruption or operational event if the PPSI provides a viable restoration plan within seven days, targeting compliance within 90 days.

Uninsured National Trust Banks

An uninsured national trust bank may elect, with prior OCC approval, to comply with the Rule’s capital and operational backstop provisions instead of Part 3, whether or not it issues payment stablecoins. The OCC must approve or deny a complete request within 60 days. The election does not supersede institution-specific capital requirements imposed through an OCC order or other specified supervisory document.

Section 15.42. Individual Additional Capital or Operational Backstop Requirement

The OCC may impose additional capital or backstop requirements based on a PPSI’s circumstances, including losses, inadequate risk assessment, operational or fiduciary exposures, significant issuance or redemption volatility, and off-balance-sheet activities.

The procedure varies in each case, but generally includes written notice, an opportunity to respond, and a written decision. The OCC may require a compliance plan. A PPSI may seek reconsideration after a material change in circumstances, but the existing decision remains effective pending reconsideration.

[1] The OCC has not posted the application form on www.occ.gov as of November 5, 2026.

[2] Treasury makes comparability determinations on the recommendation of the other members of the Stablecoin Certification Review Committee. As of the date of publishing, Treasury has not formally made any comparability determinations.

The following Gibson Dunn lawyers prepared this update: Jeffrey Steiner, Sara Weed, Jason Cabral, Rachel Jackson, Karin Thrasher Barry, Alexis Levine, Cana Cossin*, Madeline Mehra*, and Maykel Peña, and Paul Yu.

Gibson Dunn’s lawyers are available to assist with any questions you may have regarding these developments. To learn more, please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Financial Institutions, Fintech & Digital Assets, or Financial Regulatory practice groups:

Jeffrey L. Steiner – Washington, D.C. (+1 202.887.3632, jsteiner@gibsondunn.com)

Jason J. Cabral – New York (+1 212.351.6267, jcabral@gibsondunn.com)

Sara K. Weed – Washington, D.C. (+1 202.955.8507, sweed@gibsondunn.com)

Paul Yu – San Francisco (+1 415.393.8205, pyu@gibsondunn.com)

Akila S. Bhargava – Washington, D.C. (+1 202.887.3662, abhargava@gibsondunn.com)

Rachel Jackson – New York (212.351.6260, rjackson@gibsondunn.com)

Karin Thrasher Barry – Washington, D.C. (202.887.3712, kthrasher@gibsondunn.com)

Alexis Levine – Dallas (+1 214.698.3194, alevine@gibsondunn.com)

Simon Moskovitz – Washington, D.C. (+1 202.777.9532, smoskovitz@gibsondunn.com)

Alice Wang – Washington, D.C. (+1 202.777.9587, awang@gibsondunn.com)

*Recent law graduates in the Washington, D.C. office Cana Cossin and Madeline Mehra are not yet admitted to practice law.

The GENIUS Act: OCC Finalizes Its Payment Stablecoin Framework

Related Capabilities