GENIUS Act Foreign Issuers: A Due Diligence Checklist

Updated November 2026 6 min read

Quick answer. Treasury's proposed 12 CFR 1523.3(c) would let an exchange rely on a foreign issuer's lawful order representation only after reasonable due diligence. The onchain check has six steps: deployments, live functions, roles, upgrades, bypass paths and evidence.

Watch: GENIUS Act Foreign Issuers: A Due Diligence Checklist 1:42

Video transcript

From January 18, 2027, a US exchange can only offer a foreign issuer's stablecoin if that issuer can comply with lawful orders. A representation letter alone does not prove it.

Treasury's proposal lets providers rely on the issuer's representation, but only after reasonable due diligence. The floor is confirming that no section 8 secondary trading ban is in effect.

Treasury's Question 52 asks whether diligence should include checking seize, freeze and burn functions in code. Treasury has not answered, but public chain state is about as reasonably available as information gets.

The check has six steps. Enumerate every deployment, confirm the live implementation, map roles, check upgradeability, test bypass paths, and record evidence.

Disclosure: Guardian has audited USDT0. Function names differ across deployments, so never search for just one. And Ethereum USDT blocks a blacklisted sender, not the recipient.

Roles differ by chain. On November 4, 2026, USDT's owner was a three of six multisig on Ethereum, and two of three on Tron.

Then test bypass paths. Vaults, bridges and pools can each escape or widen a freeze, so run fork tests against live state.

The answer goes stale. Alert on role and upgrade events, and poll values that emit none, like Ethereum USDT's owner.

Read the full checklist, or talk to Guardian about verifying a stablecoin before you list it.

GENIUS Act foreign issuers face their first US market test on January 18, 2027. That is the date Treasury and the OCC give for the Act's effective date.

From then, section 3(b)(2) makes it unlawful for a digital asset service provider to offer, sell or otherwise make available in the US a foreign issuer's stablecoin.

The exception is an issuer that "has the technological capability to comply, and will comply, with the terms of any lawful order."

Treasury's August 18, 2026 proposal would let providers rely on the issuer's representation, but only after reasonable due diligence.

This checklist covers the onchain half of the file, the part a representation letter cannot prove on its own.

This article explains the technical and security side of section 3(b)(2) of the GENIUS Act and Treasury's proposed 12 CFR 1523.3. It is not legal advice; confirm how it applies to you with counsel.

What the Proposal Asks

Proposed 1523.3(c) says a provider may rely on the issuer's representation that it can and will comply with lawful orders. Two limits apply.

It may not rely on the representation "unless it conducts reasonable due diligence regarding the representation"; and
it may not rely on it if it "knows, has reason to know, or should know" the representation is false or the issuer cannot or will not comply.

In all cases, Treasury expects that diligence to include confirming that no section 8 prohibition on secondary trading is in effect.

Providers should also "consider all reasonably available sources of information regarding the foreign payment stablecoin issuer."

Question 52 then asks whether providers should be required "to audit or examine smart contracts relating to a payment stablecoin" and to verify functions such as seize, freeze and burn.

Circle argued that providers should rely on official status: the OCC's public list of registered foreign issuers and Treasury's section 8 notices.

Providers "may audit smart-contract code or independently verify a particular seize, freeze, or burn function," Circle wrote. But "that is not the manner in which the Act was designed to verify compliance."

Comments closed October 19, 2026; there is no final rule yet.

Whatever the final text says, public chain state is about as "reasonably available" as information gets.

What the Representation Should Cover

The proposal does not prescribe its form, but a reviewer will want these points covered.

Scope: every token and deployment, by chain and address, including any the issuer does not control.
Actions: the capability to seize, freeze, burn and prevent the transfer of coins.
Secondary market reach: coins held by third parties in wallets the issuer does not control.
Reissuance: FinCEN says federal court orders "with some regularity" require issuers to burn and reissue coins to a government-controlled wallet.
Change notice: new chains, upgrades and role changes, and how often the representation is refreshed.

The Onchain Checklist

Disclosure: Guardian has audited USDT0, the omnichain deployment of USDT, and verified its deployments.

The USDT, USDT0 and USDC examples below are read from public chain state and verified source; they are not a view on any issuer's legal status.

Step 1: Enumerate every deployment

Start from the issuer's list. Tether's integration page lists native USDT on Ethereum, Tron, Solana and ten other chains.
Add omnichain versions. USDT0, a LayerZero OFT deployment of USDT, runs on more than 25 chains with its own contracts.
Add bridged versions. Under Circle's Bridged USDC Standard, a third-party team holds the roles until both sides agree to hand them to Circle.
Record each deployment's chain, address, standard, issuer control and supply.

Step 2: Confirm the functions in the live implementation

Resolve proxies, then match deployed bytecode to verified source. Circle publishes a bytecode verification guide for USDC.
Never search for one function name. Even one issuer's names differ by deployment.

Implementation	Freeze	Remove a frozen balance	Mint or reissue	Pause
USDT on Ethereum and Tron (`TetherToken`)	`addBlackList`	`destroyBlackFunds`	`issue`	`pause`
USDT0 on Arbitrum (`ArbitrumExtensionV2`)	`addToBlockedList`	`destroyBlockedFunds`	`mint`, callable only by the OFT contract	None in this implementation
USDC (`FiatTokenV2_2`)	`blacklist`	None; minters burn only their own balance	`configureMinter` and `mint`	`pause`
Solana, classic SPL Token mint	`FreezeAccount` by the freeze authority	None for the authority; burning is an account owner action	`MintTo` by the mint authority	None

Check what the freeze blocks. A blacklisted USDC address cannot send or receive. Ethereum USDT checks only the sender, so a blacklisted address can still receive.
Confirm the check also covers permit and EIP-3009 transferWithAuthorization.

Step 3: Map who holds each role

Classify each holder: single key, multisig, timelock or governance contract.
Expect differences. Read on November 4, 2026, USDT's owner was a 3 of 6 multisig on Ethereum and a 2 of 3 multisig on Tron.
Its Solana mint and freeze authority was a 2 of 3 SPL multisig.
On Arbitrum, the USDT0 token owner and its proxy admin's owner were the same 3 of 5 multisig. The details are in Is USDT GENIUS Act Compliant?
Chain state shows how many signers there are, not who they are. Ask the issuer to attest who controls the signing keys.

Step 4: Check upgradeability

Find every path that can change the code, such as a proxy admin or USDT's deprecate, which forwards calls to a new contract.
On Arbitrum, the USDT0 owner sets the OFT contract that mints and burns; map it too.
Write down who could remove the freeze or burn functions, and with how much notice. With no timelock, the answer is none.

Step 5: Test bypass paths

Vaults: freezing a depositor's address does not by itself stop vault shares moving; freezing the vault freezes every depositor.
Bridges: a freeze on one chain does not follow a holder to another. Confirm the process covers coins in flight and lockbox balances.
Pools: blacklisting a pool's address freezes every provider's share of that asset.
Fork tests: on a fork of live state, impersonate the role holder, freeze a test address, try each transfer path, then burn and reissue.

Step 6: Record evidence and alert on changes

Keep a dated record per deployment: block number, addresses, implementation, role holders, thresholds and test results.
Alert on events that change the answer, such as USDC's Blacklisted, Pause, AdminChanged and Upgraded.
In USDT's source: AddedBlackList, DestroyedBlackFunds, Deprecate and Issue.
Poll what does not emit. Ethereum USDT's transferOwnership emits no event, so read owner().

When to Recheck

Any upgrade, proxy admin change or role transfer, on any deployment.
A new chain, bridge route or retired deployment.
A section 8 designation. The trading ban takes effect 30 days after Treasury's Federal Register notice.
A comparability determination or its rescission, which gives providers 90 days under section 18(b)(4)(B).
OCC registration or rescission of a foreign issuer, under 12 CFR 15.31 to 15.33.
The final Treasury rule, and July 18, 2028, when section 3(b)(1) also applies.

For the chain-by-chain method, see Multi-Chain Stablecoin Deployment: How to Verify Every Chain Matches.

How Guardian Helps

Guardian's audits and deployment verification cover the same ground.

For USDT0, Guardian has matched deployed proxies, implementations and admins byte-exact against the audited source, across more than forty-five engagements since February 2025.

For USAT, Guardian ran a 62-test fork suite over blocklist, permit, mint and redeem paths. The USDT0 case study has the detail.

Risk monitoring then surfaces new implementations and proxy changes as they land.

Frequently Asked Questions

Does Treasury require exchanges to audit a foreign stablecoin's smart contracts?

Not in the proposal. Question 52 asks whether diligence should include examining smart contracts; comments closed October 19, 2026, and there is no final rule yet.

Who are GENIUS Act foreign issuers?

Section 2(12) covers an issuer of a payment stablecoin that is not a permitted issuer. It must be organized under the laws of, or domiciled in, a foreign country or a listed US territory.

Is a representation letter from the issuer enough?

Under the proposal, only with reasonable due diligence, and only if nothing the provider knows or should know contradicts it. The final rule may settle this.

Sources

Verify a stablecoin before you list it

Guardian reads every deployment, role and upgrade path of the token you plan to list and gives your listing file evidence it can date and trace.

Talk to Guardian Explore audits