OCC GENIUS Act Final Rule: What Changed for IT and Keys

By the Guardian team Updated November 2026 6 min read

Quick answer. The OCC's final rule, effective January 18, 2027, keeps the proposed IT program: smart contract validation, independent testing, key management and breach notice. It adds dual controls and a key definition covering shares, and drops automatic redemption extensions.

Watch: OCC GENIUS Act Final Rule: What Changed for IT and Keys 1:45

Video transcript

The OCC's final GENIUS Act rule takes effect January 18, 2027. It keeps the proposed security program, names dual controls, covers key shares, and drops automatic redemption extensions.

Segregation of duties now adds dual controls. Private keys can be held whole or in shares. A qualified individual replaces a named officer, and customer means direct counterparties only.

Beyond security, automatic seven day redemption extensions are gone. When requests top 10 percent of issuance in a day, issuers notify the OCC within 24 hours and may ask for an extension.

The program sets outcomes, not methods. No smart contract audit is named, but it requires board approval, a full inventory, contracts that operate as intended, independent testing, incident response and resilience.

MPC key shares now count as private keys, so back them up and test recovery. In Guardian's view, a signing quorum on mint, burn, freeze, upgrade and reserve movements is the most direct evidence of dual controls.

Vendor oversight means due diligence at selection, contracts requiring part 15 and GENIUS Act measures, and monitoring their audits and test results.

In Guardian's reading, readiness means an inventory of every key share, a dated key recovery, bytecode matched to reviewed code, independent tests, and a key compromise plan.

Read the full article for every change and deadline, or talk to Guardian about evidencing your OCC security program.

The OCC issued its final GENIUS Act rule on October 21, 2026, and published it on October 23 (91 FR 67000). It takes effect January 18, 2027, the same day as the Act.

It covers OCC-supervised issuers, from national bank subsidiaries to federal qualified issuers, and foreign issuers that register with the OCC.

This post covers the security sections in 12 CFR 15.13. Every other date is in our GENIUS Act implementation timeline.

This article explains the technical and security side of the OCC's final rule, 12 CFR part 15. It is not legal advice; confirm how it applies to you with counsel.

What Changed From the Proposal

The OCC received about 328 comments on its March 2, 2026 proposal. It kept the security sections principles-based and technology-neutral, with targeted edits.

Provision	Proposal	Final rule
15.13(a)(1)(i)	Segregation of duties	Segregation of duties and dual controls
15.2, private key	A unique alphanumeric string	Material held whole, in shares, or reconstructed ephemerally
15.13(b)(2)	A qualified Information Technology and Security Officer	A qualified individual responsible for the program
15.13(b)(4)	Nonpublic personal information	Adds sensitive customer information
15.13(b)(6)	Monitor, evaluate and adjust	Monitor, then evaluate and adjust from that monitoring
15.2, customer	Anyone buying another person's products or services	Only those who buy from, or redeem with, the issuer directly
15.13(b)(8)	"Testing of vulnerabilities," "in the face of disruptions"	"Testing for vulnerabilities"
15.13(a)(7)(ii)	Vendors meet part 15	Vendors meet part 15 and the GENIUS Act
15.13(a)(9)	None	New: reserve monetization and stress testing

The written program in (b)(1), the required elements in (b)(3) and safe handling of digital assets in (b)(5) are final as proposed. Breach notice in (b)(7) got only clarifying edits.

What the OCC declined to add

Detailed smart contract controls for minting, burning and freezing.
Real-time monitoring of smart contract or ledger activity.
More named roles, such as a Chief Risk Officer.
An external audit mandate in 15.13 (15.14's audit rules still apply).
Private insurance requirements.
Interoperability standards, for now.

Bigger changes beyond 15.13

The proposal extended redemption to seven days automatically once requests topped 10% of issuance in 24 hours. That is gone.

Issuers still notify the OCC within 24 hours of such a day, and may now ask it for an extension.

Reserve rules gained flexibility and capital was simplified. The $5 million capital floor now runs past the de novo period, and the 12-month expense backstop stays.

The IT and Security Program

Section 15.13(b) sets outcomes, not methods. The right-hand column is Guardian's reading, not rule text.

Requirement	What to build (Guardian's reading)
(b)(2) Board approval	Board sign-off, a named owner, regular reports
(b)(3)(i) Inventory	Every contract, key, process and data set, per chain
(b)(3)(iii) Operating as intended	Deployed contracts matched to reviewed code and configuration
(b)(3)(iv) Independent testing	Periodic tests of contracts, keys, APIs and cloud
(b)(3)(v) Incident response	Alerts on mint, burn, role and upgrade events; a rehearsed plan
(b)(6) Monitor and adjust	Threat and change tracking that updates the program
(b)(8) Resilience	Continuity drills with providers, including a failed mint or burn

The Federal Reserve's September 29 proposal still names an Information Technology and Security Officer. Its Question 126 asks whether to add the OCC's notice, adjustment and resilience provisions.

See our post on the Fed proposal.

Keys, Custody and Breach Notice

Section 15.13(b)(5) requires measures for "secure handling of digital assets, including private key management, backup, and recovery."

Key shares count

Commenters said the proposed definition implied a single static key. The OCC changed it "to more expressly address sharding."

A private key is now cryptographic material "held in whole, in shares, or reconstructed ephemerally" that can authorize a transaction.

So MPC key shares sit inside the key program. Inventory them, back them up and test their recovery like any key.

Dual controls

Section 15.13(a)(1)(i) now names dual controls. In our view, a signing quorum on mint, burn, freeze, upgrade and reserve movements is the most direct evidence.

Custody of issuing keys

Subpart C covers custody of "private keys used to issue payment stablecoins." A custodian has control if it can reasonably demonstrate that no other party can move the asset without its consent (15.21(b)(2)(ii)).

Breach notice

Section 15.13(b)(7) covers unauthorized access to sensitive customer information, "including a customer's private key."

The issuer must investigate promptly. If misuse is reasonably possible, it must notify the customer and the OCC as soon as possible.

The narrower customer definition limits who is notified: direct counterparties, not holders who bought from a distributor and never dealt with the issuer.

Vendors and Independent Testing

Section 15.13(a)(7) sets three duties for overseeing service providers.

Due diligence when selecting them.
Contracts requiring measures that meet part 15 and the GENIUS Act.
Monitoring, including review of their "audits, summaries of test results, or other equivalent evaluations."

For a stablecoin, providers in scope likely include key custodians, signing services, node and RPC providers, bridges and monitoring vendors. Collect their latest test evidence on a schedule.

Internal audit must independently test "internal controls and information systems" (15.13(a)(2)(iv)). The OCC says its coverage includes payment system safeguards and third-party risks.

Section 15.13(b)(8) also requires testing with critical service providers. The OCC says issuers should have controls for operational issues that arise "with burning and minting new stablecoins."

It also expects due diligence "before supporting any new distributed ledger." For bridges where customers' assets are locked, custodians should understand the "mechanics, legal roles, code, contract terms."

A bank subsidiary may rely on its parent's framework to the extent it addresses the Act and part 15, and the subsidiary's management plays "a meaningful role" in it.

Deadlines and Readiness

January 18, 2027: the rule and the Act take effect.
Applications: the OCC opens them once OMB approves its forms.
Waivers: up to 12 months, with a substantially complete application pending by January 18, 2027.
Reporting: first weekly report date January 25, 2027, first quarterly March 31, 2027, both subject to OMB approval.
Examinations: a full-scope OCC examination at least every 12 months, unless an extended cycle applies.

Foreign issuers register with the OCC under 15.32. For what platforms must check, see our foreign stablecoin due diligence checklist.

Readiness checklist

Guardian's reading, not rule text:

Write the IT and security program, name its owner, and get board approval.
Inventory every contract, key, key share and privileged role on every chain.
Put dual controls on mint, burn, freeze, upgrade and reserve movements.
Perform and date a key recovery.
Match deployed bytecode and configuration to the reviewed versions.
Commission independent tests of contracts, keys, APIs and cloud, with retests.
Collect audits and test summaries from every critical vendor.
Add a key compromise branch, with customer and OCC notice, to the incident plan.
Test continuity with critical providers, including a failed mint or burn.

How Guardian Helps

Guardian's Regulatory & Compliance practice maps each control to the provision it answers, confirmed with your counsel.

Its evidence ledger maps audit reports, invariant suites and contract configuration drift checks to 12 CFR 15.13(b).

Guardian audits and pentests contracts and the offchain systems around them. Managed Security keeps signer inventories read from the chain, with key ceremony and recovery records.

For the controls in depth, see our stablecoin security guide.

Frequently Asked Questions

Is the OCC's GENIUS Act rule final?

Yes. The OCC issued it on October 21, 2026 and published it on October 23 (91 FR 67000). It takes effect with the Act on January 18, 2027.

Does the OCC final rule require a smart contract audit?

Not by name. It requires processes that ensure smart contracts operate as intended, plus periodic independent testing. In our view, an independent review of mint, burn and role logic is the most direct evidence of both.

How does the final rule treat MPC and key shares?

As private keys. The definition covers material "held in whole, in shares, or reconstructed ephemerally" that can authorize a transaction. Shares fall under the key management, backup and recovery duty.

What changed most from the OCC's proposal?

In the security sections, little: dual controls, a qualified individual instead of a named officer, sensitive customer information, and the key definition. The bigger changes were to reserves, redemption and capital.

Sources

Evidence your 15.13 program with Guardian

Guardian tests your contracts, keys and vendors against the OCC's final rule and maps every artifact to the provision it answers.

Talk to Guardian Explore regulatory compliance