Rain
FinCEN Advisory Change Map — May 9, 2026

Implements the GENIUS Act’s BSA provisions. A “permitted payment stablecoin issuer” is a U.S.-formed entity that is either a subsidiary of an insured depository institution approved for stablecoin issuance, a federal qualified PPSI, or a state qualified PPSI. The rule moves these entities from MSB classification into a dedicated BSA framework under proposed Part 1033. Mandatory program elements: an “effective” AML/CFT program with risk-based internal policies, procedures, and controls; independent testing with explicit recordkeeping of results and program enhancements; a designated AML/CFT officer; ongoing employee training; customer due diligence; an “effective sanctions compliance program” (the novel piece — the first-ever federal-statute requirement for U.S. persons to maintain such a program, per the joint FinCEN/OFAC framing); technical capability to block, freeze, or reject impermissible secondary-market transactions; sanctions-compliance recordkeeping that extends beyond current U.S. person obligations. Comment period closes 2026-06-09. Implementation attaches to the GENIUS Act’s three-year timeline.

A separate but parallel rule, issued the same week, modernizing the AML/CFT program standard for all BSA-covered institutions under the Anti-Money Laundering Act of 2020. Key shifts: risk assessment becomes a formal, codified program component (currently a supervisory expectation but not explicitly required by rule); risk assessments must review and, where appropriate, incorporate Treasury’s AML/CFT Priorities; for the first time, financial institutions are expressly permitted — and effectively required — to direct resources toward higher-risk activity and away from lower-risk areas, grounded in the documented risk assessment; a new “in all material respects” implementation standard, intended to separate criticism of program design from criticism of day-to-day execution. Comment period closes 2026-06-09. Implementation runs 12 months after the final rule publishes. The coordinated bank-regulator companion NPRMs from OCC, the Federal Reserve, the FDIC, and NCUA mirror the FinCEN proposal for their respective supervised institutions, meaning a card-issuing partner bank’s BSA program will be reshaped on the same timeline.

Stablecoins held by customers and routed through the platform’s settlement flow are issued by entities that will be reclassified under Part 1033. Those issuers will be required to extend “effective sanctions compliance programs” downstream, and the technical block/freeze/reject obligation only works if the platform can honor freeze requests in near-real-time. Expect counterparty agreements to be reopened, sanctions-screening attestations to become formal, and the platform’s transaction-monitoring stack to need to produce an audit trail acceptable not just to internal counsel but to a PPSI’s independent testing engagement.

A money services business operating as a card-issuance and stablecoin-settlement infrastructure layer is a BSA-covered financial institution. The risk-assessment codification, the AML/CFT Priorities incorporation, and the risk-based resource allocation provisions apply directly. The “in all material respects” implementation standard means a program that looks complete on paper but isn’t running on a cadence the regulator can re-test will fail the standard on examination, regardless of design quality.

The card-issuing bank’s own BSA program will be reshaped by the parallel banking-regulator NPRM. The TPRM cycle the partner bank runs against fintech partners — quarterly evidence reviews, control-testing log requests, sanctions-screening attestations — will tighten the moment the bank’s own examiner expectations recalibrate. The platform receives the cascade through the partner-bank relationship before the regulatory floor finalizes.