The GENIUS Act is law: what permitted stablecoin issuers should prepare for

The GENIUS Act established a federal framework for payment stablecoins in the United States. For issuers, the significance is structural rather than rhetorical: issuance moves from an unlicensed activity conducted under general law to a permitted activity conducted under supervision, with defined reserve, redemption and disclosure requirements and an examination relationship attached.

The structure

The framework centers on permitted payment stablecoin issuers, with pathways at federal level and, for issuers below the applicable threshold, at state level under regimes certified as substantially similar. Reserves must back outstanding tokens on a one-to-one basis in specified high-quality assets, redemption terms must be published and honored, and issuers become subject to ongoing supervision, reporting and examination by the relevant regulator.

The operational consequences

A licensing regime converts operating practice into evidence. Four obligations dominate the work. First, an information security risk and control framework approved at board level, covering the systems that mint, burn, custody and reconcile. Second, third-party due diligence and ongoing monitoring for the providers an issuer depends on, including custodians, chain infrastructure, monitoring vendors and reserve administrators. Third, incident records that show detection, classification, notification and remediation with times and named owners. Fourth, reserve and issuance reporting that ties the attested reserve position to the token supply observable on chain.

What to build now

Mint and burn controls should be enforced by a policy engine rather than by convention: quorum requirements, value thresholds, destination allow-lists and time windows evaluated before a transaction is signed, with every policy decision logged. Privileged actions on the contract, including role grants, pause-state changes, configuration flags and proxy upgrades, should raise a critical event in the security operations center and be correlated against an approved change record. Reconciliation should run continuously between the reserve ledger, the issuance ledger and observed on-chain supply, with a documented break process. Evidence should be packaged as it is generated, in the formats an examiner asks for, so that a request produces a file rather than a project.

Implementing rules followed

The statute set the perimeter; the rules set the detail. Federal banking agencies issued proposals in 2026 addressing capital, liquidity, reserve composition and risk management for permitted issuers, and Treasury advanced anti-money-laundering rulemaking touching the same population. Issuers that treated 2025 as the year to build controls entered the comment period with an operating record. Issuers that waited for final text are now building under a clock.

The pattern is familiar from every other regulated payment rail. The license is the beginning of the obligation, not the end of it. What distinguishes a prepared issuer is that the operating record already exists on the day the examiner asks.