Stablecoin issuers are quietly being turned into banks

I’ve been watching the GENIUS Act rulemaking grind forward, and one piece landed last month that I think builders should actually read, not just skim the headline of.

On June 18, 2026, FinCEN — jointly with the OCC, the Federal Reserve, the FDIC, and the NCUA — issued a notice of proposed rulemaking (opens in new tab) that would require permitted payment stablecoin issuers to run a Customer Identification Program. The comment period runs to August 21, 2026. The framing in the statute is blunt: a stablecoin issuer is “treated as a financial institution for purposes of the Bank Secrecy Act.” In plainer terms — an issuer would have to collect and verify a name, a date of birth or formation date, an address, and an identification number before opening an account, and form a reasonable belief it knows who the customer actually is. That’s the same CIP muscle a bank has been building for decades.

This is happening on a clock. The GENIUS Act was enacted in July 2025, and the implementing regulations are due by July 18, 2026 — one year out, which is next week as I write this. So the regulators are sprinting, and this CIP proposal is one of a cluster of rules landing at once.

Now, “stablecoin issuers must do KYC” is a headline you could have written in your sleep. It’s not the interesting part. The interesting part is where the rule draws the boundary. The CIP obligation, as proposed, attaches only to primary-market activity — the issuer’s direct interactions: minting, redeeming, custody. It does not reach secondary-market transactions, the person-to-person transfers of an already-issued token flying around on-chain.

Sit with that line for a second, because it’s a genuine architectural decision dressed up as a compliance rule.

A stablecoin is, underneath, a liability ledger. The issuer owes a dollar to whoever holds the token. Where double-entry ledgers I’ve written about have a named account on both sides of every entry, a token on a public chain has an address on one side and, often, nobody the issuer has ever met on the other. The regulators clearly saw this. So they anchored the identity requirement at the two moments the issuer does control — the mint and the burn, the edges where value enters and leaves their book — and let the middle stay pseudonymous.

That’s the trade-off, and it’s a reasonable one. You can’t KYC a mempool. Forcing identity onto every hop would either kill the fungibility that makes a stablecoin useful or push the whole thing offshore. Anchoring at the edges is the design that a payments engineer would have reached for too: control the boundaries of the system, accept that you can’t police its interior.

Here’s my honest take on what it means for builders. If you’re issuing, this is the wall going up around your primary market — treat onboarding at mint and redemption as a bank-grade problem, not a crypto afterthought. But if you’re building on top of stablecoins — a wallet, a payout rail, a treasury product — don’t misread “no secondary-market CIP” as “no obligation.” It just means the identity gravity now sits at the on- and off-ramps. That’s exactly where your reconciliation and dedupe logic already has to be airtight, because a mint or a redemption is a real money movement and, like every money movement, it will get retried, and duplicates are your problem to make harmless, not the chain’s.

The thing I keep coming back to: this rule is regulators reasoning about a distributed ledger in the same terms engineers do — boundaries, primary vs. secondary, where you can enforce an invariant and where you can’t. It’s the same move the ISO 20022 migration was about, from the other direction: the rails are being asked to carry not just value, but who and what for. Stablecoins spent years pretending that question didn’t apply to them. It always did. Now it’s a deadline.

Archie