Proposed Customer ID Program for Stablecoin Issuers

Key Takeaways

FinCEN has issued a joint proposed rule, 91 FR 37234, that would treat permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act and require each issuer to maintain an effective customer identification program. Nothing here is in force. Comments must be received by August 21, 2026, the date the rulemaking record closes.

Read that date precisely, because the difference matters more here than on most compliance pages. August 21, 2026 is the day the comment period ends. It is not a compliance date, not an enforcement date, and not a date by which anything would have to be built. The Federal Register entry for this document carries no effective date at all, because a proposal does not have one yet.

This brief covers what the proposal would do and what a reader can verify today. It does not describe how stablecoins work as a product, size the market, or restate reserve, redemption or state licensing questions. It also does not describe the specific data elements a customer identification program would have to collect, because the Federal Register summary does not state them and this page does not fill gaps in a primary source.

What the proposal would do

The proposal carries two directives, and they are separate obligations rather than one idea stated twice. The first is a classification change: permitted payment stablecoin issuers would be treated as financial institutions under the Bank Secrecy Act. The second is a program obligation: an issuer would maintain an effective customer identification program. Both are described in the agencies' own summary of the rulemaking, which implements certain provisions of the GENIUS Act. Federal Register

The classification change is the one that is easy to underweight. Being named a financial institution under the Bank Secrecy Act is not a labeling exercise — it is the hinge that makes a body of existing obligations attach to a firm that previously sat outside them. The identity-program directive is what the proposal names explicitly; the classification is what would make it enforceable in the first place.

The proposal would require an effective program. The summary uses that word and does not define it further, so this page does not either. Anyone drafting a comment or a readiness plan should work from the rule text and their own counsel rather than from an operational gloss, including this one.

Why this is a joint proposal, and who signed it

Most Federal Register documents in this genre carry one agency. This one does not, and that is worth a reader's attention because it signals that the same expectation would reach firms supervised by different regulators. The proposal is issued by the Financial Crimes Enforcement Network (FinCEN) together with the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA). Federal Register

For a bank or credit union, that co-signature is the practical reason to read a stablecoin rulemaking at all. A prudential regulator that put its name on a proposal about a counterparty class is a regulator that has formed a view about that class.

Who would be affected

Permitted payment stablecoin issuers are the direct subject. They are the firms the proposal would reclassify and the firms that would carry the identity-program obligation.

The second group is the banks and credit unions whose regulators co-signed the document. Their exposure runs through onboarding and correspondent relationships rather than through the proposed obligation itself — an institution that opens or maintains an account for an issuer has an interest in what that issuer's identity program would look like.

Inside both, the owners are the same functions: the BSA/AML officer, the onboarding and KYC operations lead, and whoever holds recordkeeping. The reader set stops there. The summary does not extend to broker-dealers, money service businesses or exchanges, so this page does not either. Firms already working through the Financial Crimes Enforcement Network AML rule will recognise the program vocabulary, but this proposal reaches a different population.

Where the rule would live, and what you can actually read today

This is the question a compliance owner asks first and the one most coverage skips: can I go read it?

Not in the Code of Federal Regulations, no. 31 CFR Part 1033 is a proposed new part. It does not exist in the electronic CFR today, and a reader who searches for it will find nothing, because there is nothing there to find yet. What is readable today is the proposal itself in the Federal Register, and the chapter that would host the part if the rule were finalised.

Those eCFR stamps are the honest way to state what "today" means. The electronic CFR is a dated snapshot, not a live feed, so a claim about what the CFR contains is only as good as the date attached to it.

A customer identification program is an intake workflow

Strip away the statutory framing and the operational shape of a customer identification program is familiar: identity is collected at onboarding, verified against something, exceptions are worked, evidence is retained, and the whole file is reviewed on a cycle. That shape is why a proposal like this lands on operations teams before it lands on lawyers.

The map below is an operational reading, not a reading of the rule. It contains no required data elements, retention periods or thresholds, because the Federal Register summary states none and inventing them would be worse than leaving them out.

The column that matters is the last one. Every row keeps a named human on the decision, because the decision is the part a firm cannot delegate to software.

Operationalizing the workflow at volume

Volume changes which part of this is hard. Collecting identity at onboarding scales fine; what stops scaling is the exception. An unresolved verification sitting in an analyst's inbox with no owner and no clock is the failure that shows up in an examination, and it is a routing problem before it is a compliance problem. The workflow that survives scrutiny is the one where each exception has an owner, a queue, and a record of which identity element was checked and by whom — captured when the check happened, not reconstructed afterwards.

This is where US Tech Automations agentic workflows do a specific job: an intake case is opened per customer, the identity evidence is attached to it, a failed verification triggers routing to the named reviewer rather than to a shared inbox, and the sign-off is recorded against the same case with the reviewer and the timestamp. The determination stays with the BSA officer.

The recordkeeping side is the quieter half. US Tech Automations connects the retention step to the same case, so the evidence, the exception note and the sign-off travel together rather than living in three systems that have to be reconciled during an examination. That is document routing and audit trail — not a verification service, and not a legal interpretation of what an effective program requires.

Frequently asked questions

Is the stablecoin issuer customer identification program requirement in force?

No. It is a joint proposed rule. Nothing in it applies to any firm today, there is no compliance date, and the Federal Register entry carries no effective date. Federal Register

When does the comment period close?

Comments must be received by August 21, 2026. That date is the close of the rulemaking record — the last day the agencies accept input — and nothing more. A comment period can also be extended or reopened, so a reader planning around it should confirm the current date on the document itself. Federal Register

Which agencies issued the joint proposal?

The Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA). Federal Register

Can I read 31 CFR Part 1033 in the CFR today?

No — it is a proposed new part and is not in the electronic CFR. The readable documents today are the proposal in the Federal Register and 31 CFR Chapter X, the chapter that would host the part.

What would it mean for an issuer to be a Bank Secrecy Act financial institution?

The summary states the classification, not its full consequences. Operationally it is the step that makes Bank Secrecy Act obligations attach to a firm that sat outside them, which is why the same document also names the identity-program directive. The scope of what would follow is a question for counsel.

Which parts of an identity-verification workflow can be automated without automating the decision?

Intake, routing, evidence attachment, retention and scheduling are mechanical and scale well. The determination — whether identity was verified, whether an exception is resolved, whether a file is sufficient — belongs to a named, accountable person. A useful test: automation should make the reviewer's decision faster to reach and easier to audit, never make it on their behalf.

Related guidance

• Financial Data Transparency Act joint data standards

• Geographic targeting order for financial firms

Source: Federal Register / eCFR — 91 FR 37234.

Last reviewed: July 28, 2026

Reviewed by Garrett Mullins, Workflow Specialist at US Tech Automations.

Every date, citation, RIN, CFR reference, and figure in this post is copied verbatim from the Federal Register and eCFR as of the snapshot date. Nothing is estimated, modeled, or extrapolated. This is not legal or tax advice.

Disclaimer

This page is for informational purposes only. It is not legal or tax advice, creates no attorney-client relationship, and does not determine whether any firm would be covered by the proposal or what an effective program would require. Consult a qualified professional about the rulemaking, a particular business, and the obligations that would apply to it.

The proposal can be withdrawn, changed or reproposed before anything would apply, and a comment period can be extended. Verify the current status on the Federal Register document before relying on any date in this brief. Review pricing when the team is ready to scope identity intake, exception routing and retention around its own human reviewers.