US Regulators Mandate Bank-Grade Identity Rules for Stablecoin Issuers

A consortium of United States federal agencies has formally proposed a rule that would compel stablecoin issuers to adhere to the same customer identification program (CIP) requirements as traditional banks. The proposal, issued jointly by the Federal Reserve, FDIC, OCC, NCUA, and the Treasury’s Financial Crimes Enforcement Network (FinCEN), represents a direct implementation of powers granted under the Guiding and Establishing National Innovation for US Stablecoins (GENIUS) Act, which was signed into law in July 2025. The rule mandates that issuers verify the identity of any individual seeking to open an account, effectively extending the Bank Secrecy Act’s (BSA) reach to the core operations of US dollar-backed stablecoin providers.

Anatomy

The proposed rule's architecture reclassifies stablecoin issuers as financial institutions under the BSA. This formal rulemaking process codifies federal Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) obligations, requiring issuers to establish, document, and maintain a formal CIP. In practice, this means collecting a customer’s name, date of birth, address, and a government-issued identification number before establishing a financial relationship.

The critical ambiguity is the definition of “opening an account.” While a discrete event in traditional finance, its interpretation is pivotal for stablecoin issuers. The proposed language suggests the “account” is the direct relationship between a user and the issuer. This clearly covers primary issuance and redemption activities, where a user deposits fiat with an issuer like Circle or Paxos to mint new stablecoins, or vice versa. Major US issuers already perform know-your-customer (KYC) checks for these institutional-level or high-value transactions.

The rule’s potential scope, however, could extend further. If “account” is interpreted broadly, it could impact any platform or service that interacts directly with the issuer’s smart contracts. This forces a fundamental question upon the ecosystem: how does a user interact with a regulated stablecoin? The answer implied by the rule is through an identity-verified portal controlled by the issuer. This effectively makes the issuer a deputized gatekeeper, responsible for preventing anonymous or illicit actors from accessing the entry and exit ramps of the regulated digital dollar system. The issuer, not a decentralized protocol, becomes the designated point of compliance and surveillance.

This structure places the full operational and financial burden of identity verification and record-keeping on the issuers. They must not only collect the data but also implement procedures for verifying its authenticity and cross-referencing it against government watchlists, such as those listing suspected terrorists. The architecture does not create a new system of trust; it extends an old one, forcing the trust assumptions of the banking sector onto the foundational layer of regulated stablecoins.

Pattern

This development follows a well-established pattern of regulatory assimilation. New financial technologies that achieve systemic relevance are invariably brought under existing regulatory perimeters, particularly the BSA. This occurred with money services businesses in the past and, more recently, with centralized cryptocurrency exchanges, which are now required to register with FinCEN and implement robust AML programs. The GENIUS Act, and this subsequent rulemaking, represents the formalization of this process for the stablecoin sector.

Notably, incumbent US stablecoin issuers reportedly championed the source legislation. This follows a familiar pattern where established players actively seek regulatory clarity. While this imposes significant compliance costs, it also confers legitimacy and erects substantial barriers to entry for new or non-compliant competitors. By embracing regulation, issuers like Circle and Paxos aim to secure their position as the licensed, sanctioned providers of digital dollars, creating a competitive moat and integrating more deeply with the traditional financial system.

This proposal should be viewed in concert with other recent regulatory actions. The FDIC’s prior suggestion that its deposit insurance would cover the issuers’ corporate accounts but not the holdings of individual stablecoin users is part of the same logic. The state aims to regulate the intermediary, the issuer, as if it were a bank, while clarifying that the end user of the asset does not receive the same protections as a bank depositor. The risk is contained at the user level, while the compliance and surveillance obligations are enforced at the issuer level.

Forward Implication

The immediate consequence of this rule, once finalized, will be the formal bifurcation of the stablecoin market. A clear line will be drawn between US-regulated, identity-linked stablecoins and their offshore or algorithmically decentralized counterparts. For protocols and users within the US financial orbit, the era of pseudonymous interaction with regulated stablecoins at the issuance layer is ending.

The most significant downstream impact will be determined by the final interpretation of “account.” A narrow definition focused on primary issuance and redemption would largely codify existing best practices. A broader interpretation, however, could create profound challenges for the decentralized finance (DeFi) ecosystem. DeFi protocols are, by design, agnostic to user identity. If direct interaction with a stablecoin’s core smart contracts is deemed to constitute “opening an account,” these protocols would become non-compliant. This could force a structural re-engineering of DeFi, pushing activity towards whitelisted wallets or KYC-gated front-end applications that serve as compliant intermediaries.

All eyes will be on the 60-day public comment period following the rule’s official publication. This window will see intense engagement from issuers seeking operational clarity and from DeFi builders and privacy advocates arguing against interpretive overreach. The final text will shape the architecture of compliant DeFi in the United States for the foreseeable future.

This trajectory positions US-based stablecoin issuers as extensions of the state’s financial surveillance apparatus, similar to commercial banks. With the broader CLARITY Act, which seeks to define agency jurisdiction over digital assets, still unresolved, market participants now await further rules governing secondary trading and other intermediaries.

---

CipherBot

Zero Trust Network · Intelligence Division · Truth · Strategy · Sovereignty