GENIUS Act Implementation Tracker: Every Rule, Agency and Deadline Before 18 January 2027

The GENIUS Act takes effect on 18 January 2027. Section 20 of Public Law 119-27 sets the effective date as the earlier of 18 months after enactment (the Act was approved on 18 July 2025) or 120 days after the primary federal payment stablecoin regulators "issue any final regulations implementing this Act." As of 2 October 2026, none of those four regulators (the OCC, the FDIC, the Federal Reserve and the NCUA) had issued one, and any final rule issued from now on starts a 120-day clock that ends after 18 January. Treasury calls 18 January 2027 "the expected effective date" and says that from that day "a person generally may not 'issue a payment stablecoin in the United States' unless the person has obtained an appropriate federal or state license" (Treasury, 17 August 2026).

Most of the rules that give the Act its operating detail are unlikely to be in force by then. By 2 October the agencies had published 13 proposed rules and one interim final rule. Three of the proposals were still open for comment, the Federal Reserve's two until 30 November, and FinCEN and OFAC propose that their anti-money-laundering rules take effect 12 months after the final rules are issued. This tracker lists every one by agency with its Federal Register citation, stage and comment deadline, separates what applies on 18 January from what waits for final text, and ends with a 15-week checklist for banks, payment and fintech firms, and crypto platforms. Everything is stated as of 2 October 2026. It is one of the living trackers in our financial services hub, and the changelog at the bottom records each revision.

The 18 January 2027 date is fixed because no primary regulator finalized a rule in time

Section 13(a) of the Act required each primary federal payment stablecoin regulator, Treasury and each state payment stablecoin regulator to "promulgate regulations to carry out this Act through appropriate notice and comment rulemaking" by 18 July 2026, one year after enactment. That date passed with no final rule from the OCC, FDIC, Fed or NCUA, and the Fed only published its proposals on 29 September.

For the 120-day route to land before 18 January 2027, one of the four would have had to issue final regulations before 20 September 2026. None did. The only final action on the record is Treasury's interim final rule of 30 September 2026, and it does not start the clock: Treasury is not a primary federal payment stablecoin regulator under section 2(25), and the rule itself says the effective date "is expected to be January 18, 2027."

The OCC has named a target for its final rule. Comptroller Jonathan Gould said on 19 August, "We will have a final rule out by November" (OCC News Release 2026-69). A November final rule puts its 120-day mark in March 2027, so it changes nothing about the effective date, though it will tell OCC applicants what they are building to. One operational footnote: 18 January 2027 is a Monday and a federal holiday, the Birthday of Martin Luther King, Jr., on OPM's 2027 schedule, so plan issuance, listing and screening cutovers for the week before.

The questions bank compliance staff ask about the Act this year are practical ones: whether to act now or in six months, and how to verify they are actually compliant when most rules are still proposals. On timing, the statute settles it. Work that depends on the statute's own text starts now; work that depends on rule text should be scoped now and finished when the text is final.

The Act reaches four kinds of issuer and the firms that sell, trade and hold their coins

Section 2(23) defines a permitted payment stablecoin issuer (PPSI, in the agencies' shorthand) as a person formed in the United States that is one of three types. A fourth, the foreign issuer, sits outside that definition but inside the Act through sections 3, 8 and 18. Find your row before reading anything else:

Three boundary notes. A state qualified issuer that crosses $10 billion outstanding must move to the federal framework within 360 days or stop issuing new coins, unless its federal regulator grants a waiver (section 4(d)). The DASP definition excludes distributed ledger protocols, developers of protocols and self-custodial software, validators and liquidity-pool participants (section 2(7)(B)). And issuing on "an open, public, or decentralized network" is not "a valid ground for denial" of an application (section 5(d)(2)(A)(ii)).

Banks that only bank, custody or distribute stablecoins are still in scope

Reserve deposits. Issuers may hold reserves as demand deposits at insured depository institutions, "subject to limitations established by the Corporation and the National Credit Union Administration" (section 4(a)(1)(A)(ii)). The FDIC's April proposal would insure those deposits to the issuer as corporate deposits, aggregated with its other deposits at the same bank up to the standard maximum, and not to coin holders on a pass-through basis. All four primary regulators propose that "timely" redemption means no later than two business days after the request, so reserve outflows can be fast. The OCC's proposal would also limit an issuer's reserves at any one eligible financial institution to 40 percent, as a condition of a safe harbor (Option A) or as a hard limit (Option B).

Custody and agency. Section 10 lets only supervised firms hold reserves, collateral coins or issuers' private keys, requires segregation and gives customers priority over the custodian's creditors. Section 16(c) bars the banking agencies and the SEC from requiring a bank to book custodied digital assets it does not own as a liability on its balance sheet, or to hold capital against them beyond what operational risk requires. Section 16(b) authorizes regulated institutions to act "as a principal or agent with respect to any payment stablecoin," and the Fed's proposal would amend parts 208, 211 and 225 of its rules to say so.

Tokenized deposits and capital. A deposit, "including a deposit recorded using distributed ledger technology," is not a payment stablecoin (section 2(22)(B)(ii)), and the FDIC proposal would confirm that tokenized deposits meeting the statutory definition of a deposit are treated like any other deposit. Section 4(a)(4)(C)(iii) caps the consolidated capital a parent holds for an issuing subsidiary at the subsidiary's own requirement; the Fed proposes to amend Regulation Q accordingly and says it does not believe a holding company has "any obligation" to serve as a source of strength to a subsidiary issuer.

Community banks. In my view most community banks will meet the Act as a depository for an issuer or as the bank of a DASP, not as an issuer, so the work sits in deposit concentration, liquidity planning and customer due diligence. Credit unions have one extra line: the NCUA's February proposal would limit federally insured credit unions to investing in NCUA-licensed issuers.

The tracker lists every GENIUS Act rulemaking published by 2 October 2026

Stages use the labels in our regulatory lifecycle stages entry. Consultation means the agency was still taking comments on 2 October 2026 (the US notice-and-comment counterpart of a consultation paper), Proposal means comments have closed and no final rule exists, Adopted means final but not yet effective, and In force means effective. Dates are Federal Register publication dates; announcements often came a few days earlier and are noted under each agency.

Agency notes: where each regulator stands

Treasury and the Stablecoin Certification Review Committee. Treasury opened with a section 9 request for comment on methods for detecting illicit activity (closed 17 October 2025) and an advance notice of proposed rulemaking whose comment period was extended to 4 November 2025. Its April proposal, announced on 1 April 2026, treats reserve rules and AML and sanctions programs as "uniform requirements" every state must match and gives states room on capital as "State-calibrated requirements." The 30 September interim final rule was issued on behalf of the committee (Treasury chairs it, with the Fed Chair or Vice Chair for Supervision and the FDIC Chairman). Under it, a state meets its one-year deadline by filing any form of certification, even a conditional one, by 18 January 2028, but filings open only after the forms clear Paperwork Reduction Act approval. Two items the Act gave one-year deadlines had not appeared in the Federal Register by 2 October: the committee's interpretive rule on non-financial public companies (section 4(a)(12)(D)) and a Treasury rule on how foreign comparability determinations will be made (section 18(b)(6)). No comparability determination has been published either.

FinCEN and OFAC. The April proposal would define permitted issuers as BSA financial institutions, carve them out of the money services business definition and impose an AML/CFT program that FinCEN says "largely mirrors its proposed programs for banks." SARs would not be required on secondary market transactions, but the block, freeze and reject capability and lawful-order compliance would reach secondary market activity. OFAC's proposed part 502 would require a sanctions compliance program with five elements: senior management and organizational commitment, risk assessment, internal controls, testing and auditing, and training. The June CIP proposal came from FinCEN with all four banking agencies. On the same desk, though not GENIUS rules, sit FinCEN's AML/CFT program reform proposal and the matching bank proposals from the OCC, FDIC and NCUA and the Fed.

OCC. The main proposal was announced on 25 February 2026 and covers everything except BSA, AML and OFAC requirements. It would extend the two-business-day redemption limit to seven calendar days when requests exceed 10 percent of outstanding issuance in 24 hours, with notice to the OCC within 24 hours. Its reserve safe harbor asks, on each business day, for at least 10 percent in demand deposits or Fed balances, at least 30 percent available within five business days, no more than 40 percent at one institution and a weighted average maturity of 20 days or less. Capital would be set issuer by issuer at licensing, with a de novo period of generally three years. The June BSA proposal lists the enforcement actions it covers (cease-and-desist order, written agreement, consent order, memorandum of understanding, civil money penalty) and says an issuer with a properly established, effective program would not face one except for a "significant or systemic failure." Information collection notices show weekly and quarterly reporting forms and new application forms.

FDIC. The board approved the application proposal on 16 December 2025, extended its comment period by 90 days and approved the standards proposal on 7 April 2026. One difference worth logging already: when redemption requests pass 10 percent in 24 hours, the FDIC wants immediate notice and would let the issuer ask for approval to extend past two business days, where the OCC and NCUA proposals extend automatically. A group with issuing subsidiaries under both a national bank and a state nonmember bank would face both versions. Comments on the FDIC's own reporting forms closed on 18 September.

Federal Reserve. The Board announced both proposals on 24 September 2026. The first would require full backing with permissible reserve assets and "establish standardized capital requirements to address certain credit and operational risks," and would set the tying rule that applies to every permitted issuer regardless of regulator. The second would set the application process for state member banks.

NCUA. The NCUA announced its licensing proposal on 11 February and its issuance standards on 15 May, when Chairman Kyle Hauptman said the agency had worked "to align the standards for NCUA-licensed PPSIs with the standards that are proposed for bank subsidiaries."

State regulators. Section 13(a) also directs every state payment stablecoin regulator to write rules. This edition does not track individual state rulemakings; if you rely on a state license, add your state regulator's rulemaking page to your register.

Disclosure: RegWatch, my company, builds software for keeping a table like this one accurate. A watchlist pointed at the Federal Register, the OCC, the Fed, the FDIC, FinCEN, Treasury and the state regulators you choose runs on the schedule you set, and triage scores each finding against your company profile and writes why it matters, citing the source clause. Each item carries a lifecycle stage, and a change from Proposal to Adopted is recorded with its date.

On 18 January 2027 the statute's own prohibitions apply, with or without final rules

Section 20 says "This Act, and the amendments made by this Act, shall take effect" on that date. Both the OCC and the Fed proposals list provisions they treat as self-executing and do not propose text for.

Applies on 18 January 2027 from the statute alone:

• Issuance is limited to permitted issuers (section 3(a)). Knowingly participating in a violation carries a fine of up to $1,000,000 per violation and up to five years in prison (section 3(f)), and issuing a dollar payment stablecoin in violation of section 3 carries a civil penalty of up to $100,000 a day (section 6(b)(5)(A)). The relief valve is section 5(f): regulators may waive the Act's requirements for up to 12 months for bank subsidiaries and federal qualified applicants with an application pending on the effective date. The OCC proposes a written request and a finding that the waiver is in the public interest or justified by extraordinary circumstances.
• DASPs may not offer foreign coins that cannot obey lawful orders. Section 3(b)(2) bars offering, selling or making available a foreign issuer's coin unless the issuer "has the technological capability to comply, and will comply, with the terms of any lawful order," and Treasury's section 3 proposal confirms this applies from the effective date. Under section 8, Treasury can designate a foreign issuer noncompliant; a ban on secondary trading takes effect 30 days after the Federal Register notice, and a DASP that knowingly breaks it faces up to $100,000 per violation per day.
• Marketing and naming rules. It becomes unlawful to "market a product in the United States as a payment stablecoin unless the product is issued pursuant to this Act" (section 4(e)(3), up to $500,000 per violation), to represent payment stablecoins as government-backed or federally insured (section 4(e)(2)), and for an issuer to use "United States" or "USG" in a coin's name, though abbreviations such as "USD" remain allowed (section 4(a)(9)).
• No interest or yield from issuers. Neither a permitted nor a foreign issuer may pay holders interest or yield "solely in connection with the holding, use, or retention" of the coin (section 4(a)(11)).
• Felony bar. No one convicted of a felony involving insider trading, embezzlement, cybercrime, money laundering, terrorist financing or financial fraud may serve as an officer or director of a payment stablecoin issuer (section 4(f)).
• Securities status, insolvency priority and custody. Coins issued by permitted issuers leave the definitions of security and commodity (section 17); the SEC wrote in March that they "categorically will not be securities by operation of statute after the effective date," while other stablecoins "may meet the definition of 'security' depending on the facts and circumstances" (91 FR 13714). Holders get first priority over required reserves in an issuer's insolvency (section 11), and section 10's custody rules start.
• BSA status. A permitted issuer "shall be treated as a financial institution for purposes of the Bank Secrecy Act" (section 4(a)(5)(A)), and within 180 days of approval and annually after that it must certify to its regulator that its AML and sanctions programs are reasonably designed, with false certifications punishable under 18 U.S.C. 1001 (section 5(i)).

Waits for final rules or later dates:

• The operating detail. Reserve diversification, capital, liquidity, risk management, the meaning of "timely" redemption, report formats and application procedures are all still proposals.
• The PPSI-specific AML/CFT, CIP and sanctions program rules. As proposed, they take effect 12 months after the final rules are issued. FinCEN notes that stablecoin issuers are regulated today as money transmitters; until its carve-out is final, plan on the money transmitter obligations you already carry.
• The state route. State regimes need committee approval, filings open after Paperwork Reduction Act approval, and the deadline for initial certifications is 18 January 2028.
• The foreign route under section 18. It needs a Treasury comparability determination (none published), OCC registration (rules proposed) and reserves held in a US financial institution.
• The general DASP ban. From 18 July 2028, DASPs may not offer or sell a payment stablecoin to a person in the United States unless a permitted issuer issued it, subject to section 18 and Treasury's safe harbors (section 3(b)(1)).

Have counsel confirm each line against your own facts. How the day-one prohibitions apply to issuers licensed in states whose regimes are not yet certified is one of the questions Treasury's open section 3 proposal puts to commenters, including whether to offer safe harbors where a state's certification is late or denied.

The 15-week checklist gives each team an owner, a deadline and evidence

There are 108 days, about 15 weeks, between 2 October 2026 and 18 January 2027. The rows below are written for that window; the dates are my suggested internal deadlines, set so the work lands before the week of 18 January. Every row should become an entry in your obligations register with an owner, a date and a trigger to reassess when the relevant rule is final. Our obligations register template has the columns.

Banks, including community banks

Payment and fintech firms

Crypto platforms

Most of the value sits in the evidence column. An examiner samples artifacts (minutes, inventories, memos, logs), and the practical test for each row is whether you could produce that artifact within 48 hours. When a proposal turns final, run the change through a regulatory change impact assessment; our impact assessment template gives the sections to fill in.

The calendar runs past January to July 2028

The FinCEN item matters to BSA officers. Section 9(d) requires public guidance and a notice-and-comment rule by July 2028 on standards for issuers to identify and report illicit activity and to monitor transactions on blockchains and mixing services, and on tailored risk management standards for financial institutions that interact with decentralized finance protocols.

Multinationals should run GENIUS and MiCA as separate rows in one register

A group that issues or distributes a dollar stablecoin in the United States and an e-money token in the EU faces two regimes with similar goals and different mechanics. Our MiCA compliance checklist covers the EU side now that the MiCA transitional period for crypto-asset service providers ended on 1 July 2026 (Article 143(3) of Regulation (EU) 2023/1114). The differences that change controls:

Section 18 is where the two regimes could meet, and on 2 October 2026 no link between them exists yet: no comparability determination has been made, and the Act's target date for reciprocal arrangements is 18 July 2027. Until then, keep one register with a jurisdiction column and separate rows per regime, even where one operations team serves both, because the evidence differs. A redemption row under GENIUS needs a timing log against your published policy and the proposed two-business-day limit; the MiCA row needs proof of at-par redemption with no fee.

A tracker stays current when each row is re-dated the day its rule moves

Three habits keep a GENIUS tracker honest through 2027. Record two dates per row, publication and effect, because FinCEN's proposed 12-month delay means a rule finalized in January would not bind until the following January. Log differences between agencies' versions of the same requirement, such as the FDIC and OCC approaches to redemption spikes, because groups with more than one charter will live under both. And source every row to the Federal Register document or the agency's release, never to coverage of it. Our regulatory change tracker spreadsheet has those columns, and how compliance teams track regulatory changes compares the methods. A visible regulatory change log, like the one below and the one on our US state privacy laws tracker, lets a reader check what changed and when.

This is the workflow RegWatch, my company, runs for banks and payment firms. Each development on a watchlist is tagged with its lifecycle stage, so a final rule arrives as Adopted or In force, and an accepted alert converts into an obligation with an owner, a deadline and evidence. Decisions land in a tamper-evident, append-only audit log you can show an examiner, and board-ready reports cover where each rule stands. Plans start from $799 per month, and Private VPC runs it in your own cloud. To see it on your own regulators, book a demo and we will run the session on them.

Changelog

---

This article is general information, not legal advice.