GENIUS Act Security Requirements for Stablecoin Issuers

Video transcript

From January 18, 2027, issuing a payment stablecoin in the US without approval carries criminal penalties, the OCC says. But the Act leaves most security controls to your regulator.

Four provisions carry the security load: IT standards from regulators, the capability to comply with lawful orders, blocking unlawful transactions, and supervised custody of issuing keys.

Only the OCC's rule is final. The Federal Reserve, FDIC and NCUA texts are proposals, and state rules must be substantially similar.

The OCC, Federal Reserve and NCUA texts share a core: inventory, safeguards, smart contracts operating as intended, independent testing, incident response and key management. Guardian suggests building to the OCC text plus FDIC code change controls.

Audit requirements usually mean reserve reports, not code review. A registered accounting firm examines reserves monthly. Above 50 billion dollars, annual audited financials apply.

No text requires a smart contract audit. Code evidence comes from the operating as intended and independent testing elements.

Reserves below the minimum mean notifying the OCC and halting issuance. In Guardian's reading, an unauthorized mint could open that gap the moment it lands.

A stablecoin audit checks mint authority, freeze and seize paths for lawful orders, invariants that supply never exceeds backing, and each new chain deployment.

Read the full article for the requirement to evidence checklist, or talk to Guardian about testing your controls.

The GENIUS Act and the OCC's final rule take effect on January 18, 2027. From that day, issuing a payment stablecoin in the US without approval carries criminal penalties, the OCC says.

The Act sets few security controls itself. Regulators write them, so your IT standard depends on who supervises you.

The OCC rule's section detail is in our OCC final rule breakdown.

This article explains the technical and security side of the GENIUS Act and its implementing rules. It is not legal advice; confirm how it applies to you with counsel.

Key Dates

The GENIUS Act compliance date is January 18, 2027. Status is as of November 10, 2026; the full calendar is in our implementation timeline.

What the Act Itself Requires

Four statutory provisions carry the security load.

• IT standards (4(a)(4)(A)(iv)): regulators "shall" issue principles-based operational, compliance and IT risk standards.
• Lawful orders (4(a)(6)(B)): an issuer may issue only if it "has the technological capability to comply, and will comply."
• Blocking (4(a)(5)(A)(iv)): "technical capabilities, policies, and procedures to block, freeze, and reject" unlawful transactions.
• Key custody (10(a)): only supervised firms may provide custody of reserves or "the private keys used to issue permitted payment stablecoins."

Section 2(16) defines a lawful order as one requiring an issuer to "seize, freeze, burn, or prevent the transfer" of its coins.

Which Regulator Sets Your Standard

So far, the GENIUS Act OCC final rule is the only IT standard adopted.

The shared core

The OCC, Federal Reserve and NCUA texts list the same five program elements:

1. An inventory of assets, processes and data.
2. Safeguards for sensitive information.
3. Checks that systems, "including smart contracts, are operating as intended."
4. "Periodic independent testing."
5. Incident identification and response.

All four texts add "private key management, backup, and recovery." The Fed's version is in our post on its proposal.

Where they differ

• Code changes. Only the FDIC proposal adds controls for "testing, storage, and deployment of the code base, including the smart contract code."
• Change management. Asked to stress it, the OCC added nothing, but "will consider" guidance on change management and information security.
• Vendor evidence. Under the OCC rule, issuers "must review audits, summaries of test results" of providers. The FDIC proposal says "should."

Most of 15.13 is adapted, the OCC says, from the bank guidelines in 12 CFR part 30. It names no framework or certification; NIST CSF or SOC 2 can organize evidence but is not required.

In Guardian's reading, build to the OCC text plus the FDIC's code change controls, and confirm any gaps with counsel.

State issuers

Treasury's proposed 12 CFR 1521.4(g) would require state standards with outcomes "at least as stringent and protective" as the federal ones.

Their minimum topics include internal controls, information security, information systems, internal audit and service providers. Treasury expects states to look to "the OCC's rules."

Above $10 billion, a state issuer must move to federal oversight within 360 days or stop issuing new coins, unless its federal regulator grants a waiver (section 4(d)).

What "Audit Requirements" Means

"GENIUS Act audit requirements" usually means the reserve reports. That is accounting work, not code review.

A knowingly false certification is a crime under section 4(a)(3)(C). Issuers already reporting to the SEC are exempt from the annual audit.

No text requires a smart contract audit, though the NCUA's proposal asks whether it should (Question 199).

Asked to require independent audits, the OCC said 15.13 "does not mandate the use of an external audit, but such an audit may be appropriate for some" issuers.

Code evidence comes from the "operating as intended" and independent testing elements. Our post on audits, attestations and assurance compares the reports.

Where the two meet

Under 15.11(g), an issuer must notify the OCC on any day its reserves fall below the minimum. It may not issue new coins until reserves are restored, except to move coins between ledgers or as the OCC permits.

In our reading, an unauthorized mint could open that gap the moment it lands. The accountant checks month-end; the contracts decide every block in between.

Freeze and Seize Capability

The lawful order duty is statutory and applies from January 18, 2027. The detailed rules are still proposals.

• The OCC's final rule does not use "freeze" or "seize." Its separate BSA/AML and sanctions rule is still proposed.
• Proposed 31 CFR 1033.240 reaches coins "held by a third party," including "in an account not with or controlled by" the issuer.
• That April 10, 2026 FinCEN and OFAC proposal also reaches transactions that interact with the issuer's smart contract. Comments closed June 9.

In our reading, that points to a freeze and burn path in the token contract on every chain. Our post on GENIUS freeze mandates and the SEC's central party test covers the SEC side.

Requirement to Evidence Checklist

Sections are 12 CFR part 15 unless marked. The control and evidence columns are Guardian's reading, not rule text.

For other regulations, see Guardian's evidence workbook, a downloadable control and evidence map.

Where Guardian Testing Fits

Rows 3, 5, 10 and 11, and the contract side of row 4, are what a stablecoin audit checks.

• Mint authority and limits, and "minting only against assets actually received."
• Freeze and seize paths, and whether "transfers, permits or bridges can route around them."
• An invariant suite fuzzing "supply never exceeds backing."
• Deployment verification for each new chain, as its own engagement.

In Guardian's USDT0 Polygon review, a migration playbook would have sent migrated USDT to a multisig, not the adapter (Info, USDT0 Polygon Deployment).

That would have left more USDT0 circulating than USDT to redeem it. It was fixed before the transactions ran (case study).

Rows 6 to 9 fall under Guardian's Regulatory & Compliance work, which reviews keys and custody, incident response, business continuity and critical third-party dependencies.

Row 11's accountant report is not security work: statutory financial audits "require the appropriate appointed providers."

Frequently Asked Questions

Can a waiver delay the GENIUS Act security requirements?

Not as a rule. Bulletin 2026-51 says the OCC generally expects to waive prior approval for existing US issuers with substantially complete applications. Otherwise, it has "not identified compelling, generally applicable reasons," since issuers "have had 18 months" to prepare.

Who can perform the monthly reserve examination?

Only a registered public accounting firm: under section 2 of the Sarbanes-Oxley Act, a firm registered with the PCAOB. The OCC rule requires the firm's examination report on the issuer's website, published with the month-end reserve report.

What will OCC examiners ask to see?

For most issuers, the OCC runs a full-scope examination at least yearly. On request, issuers must report on systems "for monitoring and controlling financial and operational risks," and keep records that let them "demonstrate compliance" (15.14(g), (j)).

Sources

• GovInfo: Public Law 119-27, the GENIUS Act (July 18, 2025)
• Federal Register (GovInfo): OCC, Implementing the GENIUS Act for Entities Subject to the Jurisdiction of the OCC, final rule, 91 FR 67000 (October 23, 2026)
• OCC: Bulletin 2026-50, GENIUS Act Regulations: Final Rule (October 21, 2026)
• OCC: Bulletin 2026-51, GENIUS Act Waivers and Application Submission Guidance (October 21, 2026)
• OCC: GENIUS Act landing page (read November 10, 2026)
• Federal Register (GovInfo): Federal Reserve, Implementing the Board's Responsibilities Under the GENIUS Act, proposed rule, 91 FR 61580 (September 29, 2026)
• Federal Register (GovInfo): FDIC, GENIUS Act Requirements and Standards for FDIC-Supervised Permitted Payment Stablecoin Issuers, proposed rule, 91 FR 18534 (April 10, 2026)
• Federal Register (GovInfo): NCUA, Implementing the GENIUS Act for Entities Subject to the Jurisdiction of the NCUA, proposed rule, 91 FR 28956 (May 18, 2026)
• Federal Register (GovInfo): Treasury, GENIUS Act Broad-Based Principles for Determining Whether a State-Level Regulatory Regime Is Substantially Similar, proposed rule, 91 FR 16844 (April 3, 2026)
• Federal Register (GovInfo): Treasury, Forms and Procedures for Review of State Certifications by the Stablecoin Certification Review Committee, interim final rule, 91 FR 61688 (September 30, 2026)
• Federal Register (GovInfo): FinCEN and OFAC, Permitted Payment Stablecoin Issuer AML/CFT Program and Sanctions Compliance Program Requirements, proposed rule, 91 FR 18582 (April 10, 2026)
• Cornell LII: 15 U.S.C. 7201, Sarbanes-Oxley Act section 2, definitions
• Guardian: USDT0 Polygon Deployment and Peer Verification report (August 7, 2025)
• Guardian: USDT0 Deployment and Configuration Verification case study
• Guardian: Stablecoin Security Audit
• Guardian: Regulatory & Compliance