Hook
The OCC, FDIC, and NCUA collectively missed the GENIUS Act’s first rulemaking deadline. No final customer identification standards. No BSA compliance framework. No reserve disclosure templates. The law was signed. The clock is ticking. But the playbook is blank.
This is not a delay in the traditional sense — it is a structural failure of regulatory execution. The United States now has a federal stablecoin statute that exists as a legal abstraction, unmoored from the operational guidelines necessary for any issuer to comply. Code does not lie, but it often omits the context. Here, the omission is the entire rulebook.
Context
The Guiding and Establishing National Innovation for US Stablecoins (GENIUS) Act was signed into law in early 2025. It establishes a federal framework for “payment stablecoins” — digital assets pegged to a fiat currency and used primarily for transactions, not investment. The Act mandates that issuers must:
- Maintain 1:1 reserves composed of specified assets (cash, Treasuries, etc.)
- Honor redemption requests within one business day
- Publish monthly reserve attestations from a registered public accounting firm
- Implement customer identification programs (CIP) and comply with the Bank Secrecy Act (BSA)
- Accept oversight by either the OCC (for national bank issuers) or state regulators under certain conditions
The Act itself came with a built-in timeline: within 180 days of enactment, the OCC, FDIC, and NCUA were required to publish joint rules clarifying compliance standards. That deadline has passed. No rules have been issued. The Treasury’s Financial Crimes Enforcement Network (FinCEN) also failed to complete its proposal for tailored BSA requirements.
Based on my audit experience — both of smart contracts and of compliance frameworks — this is precisely the kind of gap that creates systemic risk. You can have the most elegant mathematical proof of solvency, but if the regulatory inputs are undefined, the outputs are meaningless.
Core: The Anatomy of the Vacuum
Let me break down exactly what is missing and why it matters at the code-and-risk level.
1. Customer Identification Rules (CIP)
Under GENIUS, all issuers must verify the identity of anyone creating a wallet or transacting above a certain threshold. But the Act delegates the specifics to the banking agencies. Without final CIP standards, an issuer cannot determine:
- The minimum data fields required (name, address, government ID? Or just wallet address?)
- Acceptable verification methods (third-party KYC providers, blockchain-native identity, or both?)
- Thresholds for “occasional” versus “regular” users
Risk implication: Issuers who implement KYC now may find their systems incompatible with the final rule. Those who wait risk being unprepared when enforcement begins. This is a prisoner’s dilemma for the entire stablecoin ecosystem.
2. BSA Compliance Framework
FinCEN was tasked with proposing a new rule for how stablecoin issuers should file Suspicious Activity Reports (SARs) and conduct ongoing monitoring. The deadline passed without a proposal.
This is not merely a paperwork delay. The absence of a framework means issuers have no legal safe harbor. If they over-report, they waste resources. If they under-report, they expose themselves to criminal liability. The uncertainty is asymmetric — the downside is far larger than the upside.
3. OCC, FDIC, NCUA Joint Regulations
These three agencies were supposed to harmonize standards for how reserves are held, how custody works, and how failure resolution proceeds. Without this, a stablecoin issuer operating under a state trust charter may face different reserve requirements than one under an OCC national bank charter. That fragmentation is a design flaw masquerading as flexibility.
In my 2024 ZK-rollup optimization research, I learned that inefficiencies in a circuit’s constraint system can cascade into 15% higher gas costs. The same principle applies here: every regulatory inconsistency introduces friction. Friction drives capital elsewhere.
4. The Effective Date Paradox
GENIUS states that its core provisions take effect 18 months after enactment — unless the agencies issue rules earlier, in which case compliance kicks in sooner. The law does not push back the effective date if rules are late. So issuers are now in a “blind flight” window: the law is active, but the guidance is absent.
This is a textbook case of operational risk amplified by regulatory inaction.
Contrarian: The Delay Is Not Purely Negative
Conventional wisdom says regulatory vacuum is bad for everyone. I disagree — at least for a subset of market participants.
Who benefits?
- Already-compliant issuers: Circle (USDC) and PayPal (PYUSD) have been operating well above minimum standards for years. They publish monthly attestations. They maintain audited reserves. The delay exposes them to no new risk — instead, it highlights their discipline. They can now market themselves as “verifiably ahead of a vague law.”
- Tether (USDT): Regulatory ambiguity is Tether’s natural habitat. The longer the US framework remains unclear, the longer Tether can operate outside of it without losing market share. The delay is a tacit gift to the largest stablecoin by volume.
- State-level regulators: New York’s DFS, Texas, and others have been building their own stablecoin regimes. Federal delay entrenches state power. Issuers may prefer a state charter with clear rules over a federal one with none.
Who loses?
- New entrants: Any bank or fintech planning to launch a stablecoin under GENIUS now faces a go/no-go decision without data. Capital expenditures for compliance systems cannot be justified against an unknown standard. Innovation freezes.
- DeFi protocols: DAI, FRAX, and others that rely on stablecoin liquidity for collateral now face the risk that their primary reserve assets might be legally in limbo. If a major issuer is forced to restructure later, DeFi positions can unwind catastrophically.
The hidden opportunity: This delay may accelerate the adoption of on-chain proof-of-reserves technology. Issuers who cannot wait for regulators might deploy Merkle-tree-based attestations as a de facto standard. If enough players adopt it, the regulators may simply endorse it retroactively. Technology can outrun bureaucracy — but only if the industry has the discipline to move first.
Takeaway: What to Watch Next
The GENIUS Act is not dead. But its implementation is bleeding trust. The next 90 days will determine whether the US can still lead in stablecoin innovation or whether capital will permanently migrate to EU MiCA and Asian jurisdictions.
Three signals to track:
- Agency action: If the OCC and FinCEN issue proposals within the next quarter, trust can be rebuilt. If they miss a second deadline, the law will be effectively hollow.
- Issuer behavior: Watch whether a major bank like JPMorgan or Goldman Sachs delays its stablecoin launch. That will be the market’s vote of no confidence.
- Migration patterns: Developer activity on chains like Solana and Ethereum is already shifting toward projects domiciled in Switzerland and Singapore. If the trend accelerates, the regulatory vacuum will be the cause.
Code does not lie, but it often omits the context. Here, the missing code is the rulebook. Without it, even the best-engineered stablecoin lives in a state of legal beta. And beta, in regulation, is where crashes happen.