The Office of Foreign Assets Control (“OFAC”) recently issued a proposed rule that will require the implementation and maintenance of a sanctions compliance program (“SCP”) for permitted payment stablecoin issuers (“PPSIs”). 

The proposed rule, which directs that PPSIs put in place a SCP that includes at least five specific elements, deserves immediate attention from the stablecoin industry because, even if the rule is not ultimately adopted, it describes the compliance measures OFAC currently expects from issuers of payment stablecoins. More generally, this proposal is the first time that OFAC was directed by Congress to adopt rules for a mandatory SCP. OFAC responded to that direction by drafting a rule describing the required SCP with some precision. The resulting proposed rule impacts PPSIs directly, but also represents an opportunity for all businesses that face sanctions risk to evaluate their compliance efforts against OFAC’s detailed SCP expectations.

Background

The proposed rule is a product of the Guiding and Establishing National Innovation for U.S. Stablecoins Act (“GENIUS Act”), which was passed by Congress and signed into law by President Trump in July 2025. The GENIUS Act provides a framework for the regulation of payment stablecoins and directs that PPSIs “be treated as a financial institution for purposes of the Bank Secrecy Act, and as such, shall be subject to all Federal laws applicable to a financial institution located in the United States relating to economic sanctions, prevention of money laundering, customer identification, and due diligence.” 12 U.S.C. § 5903(a)(5)(A). The GENIUS Act also requires PPSIs to maintain “an effective economic sanctions compliance program, including verification of sanctions lists, consistent with Federal law,” and instructs the Secretary of the Treasury to adopt rules to implement this requirement. 12 U.S.C. § 5903(a)(5)(A)(vi). The Secretary delegated the rule-writing to OFAC and to Treasury’s Financial Crimes Enforcement Network (“FinCEN”), which proposed additional anti-money laundering obligations for PPSIs as part of the same rulemaking. (Separately, as described here, FinCEN and other bank regulators have issued a joint proposed rule that would implement the GENIUS Act’s requirement that PPSIs maintain an effective customer identification program.) Comments on the OFAC proposal were due earlier this month; there is no timeline as to when the rules will be finalized and adopted through the issuance of new federal regulations. Under the proposal, the SCP rule will become effective twelve months after the final regulations are issued

While the Bank Secrecy Act and its implementing regulations require financial institutions to maintain an anti-money laundering program, no U.S. persons, including financial institutions, are currently required by federal law to maintain a SCP. As OFAC notes, the “GENIUS Act’s requirement that PPSIs maintain an effective sanctions compliance program is a novel legal requirement that currently does not apply to other U.S. persons.” 91 Fed. Reg. 18638 (April 10, 2026). When the proposed rule is adopted, it will be the first instance in which a specific sector is legally obligated to implement and maintain a SCP. And OFAC’s proposed rule is the first time that the agency has dictated the required elements for a SCP. The detailed specifications for a SCP issued by OFAC may be a result of OFAC’s specific concerns regarding virtual currency. In 2021, OFAC issued a brochure, “Sanctions Compliance Guidance for the Virtual Currency Industry,” (“OFAC’s 2021 Guidance Brochure”) that stated: “In many cases, OFAC has observed that members of the virtual currency industry implement OFAC sanctions policies and procedures months, or even years, after commencing operations.”

Upon adoption of the rule, a PPSI will be subject to penalties of up to $100,000 for each day that it fails to implement and maintain the SCP required by the rule. These penalties will apply even if there are no underlying sanctions violations or any sanctions violations are de minimis. Because no other industry is required to maintain a SCP, no other industry faces penalties merely for having an inadequate SCP.

The Current Need for a Sanctions Compliance Program

While not required by law, financial institutions and other businesses have adopted SCPs because it was a prudent risk control. OFAC imposes substantial civil penalties for sanctions violations based on a strict liability standard. That is, an organization need not be aware that it is dealing with a sanctioned person to be liable for engaging in or processing a transaction for that sanctioned person. As a result, financial institutions and other businesses facing sanctions risks voluntarily enact compliance policies to avoid dealing with sanctioned persons.

OFAC has issued regulations and guidance that further encourage the adoption of compliance policies. Under OFAC’s current Enforcement Guidelines, “the existence, nature and adequacy” of a SCP will be considered in determining the appropriate administrative action in response to an apparent violation. In addition, the amount of civil penalty imposed by OFAC is heavily influenced by whether the case is deemed “egregious,” for purposes of the base penalty calculation. In its 2019 Framework for OFAC Compliance Commitments (“OFAC’s 2019 Framework”), OFAC stated that it may consider “the existence of an effective SCP at the time of an apparent violation as a factor in its analysis as to whether a case is deemed ‘egregious.’”

Because of their role in facilitating transactions, banks are particularly vulnerable to committing sanctions violations and likely to be treated relatively harshly by OFAC if they are involved in systemic violations. The GENIUS Act and the proposed rule seek to treat PPSIs similar to banks. Through the proposed rule, OFAC has signaled high expectations for PPSIs with respect to sanctions compliance.

Even though only a proposal and not a final regulation, a PPSI should understand that the rule reflects OFAC’s current expectations. OFAC acknowledges this point in its discussion of the impact of the proposed rule by stating, “OFAC expects PPSIs’ obligations under this proposed rule, if finalized, would be comparable to existing obligations stemming from their status as U.S. persons subject to U.S. sanctions laws.” 91 Fed. Reg. 18625 (emphasis added). Failure to implement the rule’s sanctions compliance directives exposes a PPSI to greater risk of significant penalties if OFAC becomes aware that the PPSI has violated sanctions. 

The Proposed Rule

The compliance program requirements in the proposed rule track closely with OFAC’s 2019 Framework, which OFAC described as its “perspective on the essential components of a sanctions compliance program.” as well as the best practices included in OFAC’s 2021 Guidance Brochure. These documents and the proposed rule all indicate that a SCP should include, at a minimum, five essential elements: (1) Senior management and organizational commitment; (2) Risk assessments; (3) Internal Controls; (4) Testing and Auditing; and, (5) Training. The proposed rule also provides additional directions as to what is expected regarding each element.

OFAC’s approach is specific but flexible, intended to provide PPSIs “discretion to make risk-based judgments in light of, among other factors, their size and complexity.” 91 Fed. Reg. 18614. By mandating five elements as a minimum, “the proposed rule intentionally sets a necessary floor” for an effective SCP “while leaving space for PPSIs to take additional or refined compliance measures that account for the specific circumstances of individual PPSIs.” 91 Fed. Reg. 18615. The proposal contemplates that compliance controls will evolve alongside products and services in this growing sector.

The proposed rule does include several details that have not been mentioned previously. Among other things, the rule indicates that senior management should ensure that the SCP is “fully integrated into the PPSI’s ongoing stablecoin-related operations” and “[r]outinely provides risk updates, including testing results, to senior management and other appropriate stakeholders within the organization.” 91 Fed. Reg. 18660. The rule requires that testing and auditing results are used to identify and implement any needed enhancements to the SCP and that PPSIs maintain and provide to OFAC upon request records of any such testing and auditing results and enhancements. Id. More generally, OFAC’s commentary accompanying the proposed rule provides additional helpful information regarding OFAC’s expectations relating to SCPs, including addressing how “senior management” should be defined, updating of risk assessments, and frequency of training. See 91 Fed. Reg. 18615-18619.

Conclusion

Federal rulemaking is a complicated task and it may take some time before the proposed rule is finalized. But even before the rule is adopted, stablecoin issuers should understand that it describes the SCP elements that OFAC expects PPSIs to have in effect. Having spelled them out with some specificity, OFAC may now expect more robust SCPs and may consider program gaps more critically if it has occasion to pursue an enforcement action for an apparent violation of sanctions.