ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
GENIUS Act compliance requirements live in one place: section 4 of Public Law 119-27. It is the longest section of the Act by a wide margin, and it is where a permitted payment stablecoin issuer finds every standing duty it will be examined against, from the reserve floor to the felony bar on its directors. Sections 5 and 6 add the application and the supervision; section 4 is the substance.
This is a walkthrough of the GENIUS Act compliance requirements in section 4(a) as enacted, in the order the statute puts it, with the paragraphs that bind an issuer separated from the ones that instruct a regulator. It assumes you already know the Act takes effect on 18 January 2027 and that none of the implementing rules was final when this was written. The enrolled text is on govinfo.
Section 4(a) has fourteen numbered paragraphs, and they are the GENIUS Act compliance requirements an examiner will work from. Eleven impose requirements directly, ten on the issuer and one on a non-financial public company that wants to become one. Two, paragraphs (13) and (14), are rules of construction. One, paragraph (4), is an instruction to the regulators to write rules, though it binds the issuer the moment those rules exist. The table is the map; the rest of this guide fills in the rows that need it.
| Paragraph | Requirement | Binds |
|---|---|---|
| (1)(A) | Reserves at least 1 to 1 in eight eligible asset classes | Issuer |
| (1)(B) | Public redemption policy; plain-language fee disclosure; 7 days’ notice of fee changes | Issuer |
| (1)(C) | Monthly reserve composition report on the website | Issuer |
| (2) | No pledging, rehypothecation or reuse of reserves, with three exceptions | Issuer |
| (3) | Monthly examination by a registered public accounting firm; CEO and CFO certification | Issuer |
| (4) | Capital, liquidity, diversification, interest-rate and operational risk standards | Regulators write; issuer complies |
| (5) | Bank Secrecy Act financial institution status; six enumerated AML and sanctions elements | Issuer |
| (6) | Technological capability to comply with lawful orders | Issuer (and Treasury coordination) |
| (7) | Only five permitted activities; others need authorisation | Issuer |
| (8) | No tying | Issuer |
| (9) | No Government terms in the name; no legal-tender or Government-backing impression | Issuer |
| (10) | Annual audited GAAP financial statements above $50 billion | Issuer, above the threshold |
| (11) | No interest or yield to holders | Issuer and foreign issuer |
| (12) | Non-financial public companies need a unanimous SCRC vote | Non-financial public company |
Paragraph (1)(A) is the reserve floor: identifiable reserves of at least 1 to 1 against outstanding stablecoins, comprising only cash, Federal Reserve balances, demand deposits, Treasuries of 93 days or less, overnight repo and reverse repo, government money market funds, regulator-approved Federal Government assets, and tokenised forms of most of those. The reserve requirements have their own guide because each clause carries a condition.
Paragraph (1)(B) carries the GENIUS Act compliance requirements for redemption, and it has two halves. The issuer must publicly disclose a redemption policy with clear and conspicuous procedures for timely redemption, and any discretionary limitation on timely redemption may be imposed only by a State regulator, the FDIC, the Comptroller or the Federal Reserve Board, not by the issuer. And the issuer must disclose all purchase and redemption fees in plain language, changeable only on not less than 7 days’ prior notice to consumers. Section 5(c)(4) makes whether the redemption policy meets these standards a factor in approving the application, so the policy is written before the application, not after.
Paragraph (1)(C) requires the monthly composition of reserves on the issuer’s website, including the total outstanding, the amount and composition, and the average tenor and geographic location of custody of each category. Paragraph (3) has that report examined monthly by a PCAOB-registered firm and certified monthly by the chief executive and chief financial officers, with 18 U.S.C. 1350(c) penalties for a knowingly false certification.
Paragraph (4)(A) tells the primary Federal payment stablecoin regulators, or the State regulator for a State qualified issuer, to issue four sets of standards: capital requirements, the liquidity standard, reserve diversification including deposit concentration and interest-rate risk, and principles-based operational, compliance and information-technology risk standards including Bank Secrecy Act and sanctions compliance. Every one must be tailored to the issuer’s business model and risk profile and go no further than ensuring ongoing operations.
The statute sets no numbers. The OCC’s proposed rule did, and so did the FDIC’s, but proposals are not GENIUS Act compliance requirements until they are final. The defensible position between now and then is a board-set interim standard on each of the four, documented with its rationale, and a mechanism to adopt the final figure and keep the interim one where it is stricter. Paragraph (4)(C) adds a group point: a parent bank or holding company holds no more regulatory capital for the issuer than the issuer’s own requirement, and section 171 of the Financial Stability Act is disapplied.
Paragraph (5)(A) makes a permitted issuer a financial institution for the purposes of the Bank Secrecy Act and subjects it to all Federal law applicable to a financial institution in the United States on sanctions, money laundering, customer identification and due diligence. It then enumerates six elements that “including” makes non-negotiable: an effective AML program with risk assessments and a designated officer; record retention; suspicious transaction monitoring and reporting; technical capabilities to block, freeze and reject impermissible transactions; a customer identification program covering account holders, high-value transactions and enhanced due diligence; and an effective sanctions compliance program with list verification. The six elements are a guide of their own.
Paragraph (6)(B) is the condition most easily missed in a checklist. A permitted issuer may issue payment stablecoins only if it has the technological capability to comply, and will comply, with the terms of any lawful order. Section 2(16) defines a lawful order as one requiring the issuer to seize, freeze, burn, or prevent the transfer of its stablecoins. A token contract that can freeze but cannot burn does not satisfy the condition, and the capability has to exist on every chain the stablecoin is issued on.
The GENIUS Act compliance requirements on conduct start with paragraph (7)(A), which confines the issuer to five activities: issuing, redeeming, managing reserves, custodying stablecoins, reserves or private keys, and activities that directly support those. Anything else needs the regulator’s authorisation under (7)(B), and even then only if holders’ claims rank senior to any other creditor’s on the reserve assets. Paragraph (8) prohibits conditioning a service on the customer buying another paid product or agreeing not to deal with a competitor.
Paragraph (9) governs the name and the marketing: no combination of terms relating to the United States Government in the stablecoin’s name, and nothing that would lead a reasonable person to think it legal tender, issued by the United States, or guaranteed or approved by the Government. “USD” is expressly permitted because it abbreviates the pegged currency. Section 4(e) reinforces this from the other side: payment stablecoins are not FDIC or NCUA insured and not backed by the full faith and credit of the United States, and representing otherwise is unlawful.
Paragraph (11) is the shortest of the GENIUS Act compliance requirements and admits no exception: no permitted or foreign issuer shall pay a holder any form of interest or yield, in cash, tokens or other consideration, solely in connection with holding, using or retaining the stablecoin. A rewards program measured by balance is yield by another name.
Three GENIUS Act compliance requirements sit outside section 4(a) but belong on the same list. Section 4(f) bars any individual convicted of a felony involving insider trading, embezzlement, cybercrime, money laundering, terrorism financing or financial fraud from serving as an officer or director, with a criminal penalty for knowing participation. Section 5(i) requires a certification to the regulator, within 180 days of approval and annually thereafter, that the issuer has implemented AML and sanctions programs reasonably designed to prevent it from facilitating money laundering, naming cartels and foreign terrorist organisations expressly; failure to submit can revoke approval. And section 6(a)(2) requires reports on request in four areas: financial condition, risk-control systems, compliance with the Act, and BSA and sanctions compliance.
Which of the three issuer types an entity is changes which regulator supervises it, and for a State qualified issuer below $10 billion, whether section 6 applies at all. It does not change section 4.
Yes. Section 20 fixes the effective date at 18 January 2027 regardless of the rules, and section 4(a) contains the requirements in statutory form. The rules add detail, particularly under paragraph (4); they do not create the duties.
Not a number. Paragraph (4)(A)(i) requires the regulators to set tailored capital requirements that do not exceed what ongoing operations need, and allows tailored buffers. The figures in the OCC’s and FDIC’s proposals were proposals when this was written.
Not one paid to holders solely for holding, using or retaining the stablecoin. Paragraph (11) prohibits interest or yield in any form. A referral payment for introducing a customer, unconnected to balance or holding period, is a different thing, and the line should be drawn by counsel in writing.
The primary Federal payment stablecoin regulator under section 6 for Federal qualified issuers and bank subsidiaries, with cease-and-desist, removal and civil money penalty powers borrowed from the Federal Deposit Insurance Act. A State regulator under section 7 for a State qualified issuer below $10 billion, with the Federal Reserve Board or the Comptroller able to step in only in unusual and exigent circumstances.
Fourteen paragraphs of GENIUS Act compliance requirements read quickly; operating them does not. Each one needs a policy, a procedure and a record, and section 6(a)(3) tells the examiner to assess the systems that control the risks, not the documents that describe them. Our GENIUS Act Toolkit maps every operative provision of the Act to one of 126 editable templates, organised on section 4’s own structure, with every proposed rule tracked and none stated as binding.
September 13, 2026
September 13, 2026
September 13, 2026
September 13, 2026
September 13, 2026