OFAC's GENIUS Act Sanctions Program for Stablecoin Issuers

Video transcript

Under OFAC's GENIUS Act proposal, stablecoin issuers would need a five-element sanctions program, with controls reaching every trade in their coin, even on the secondary market.

Proposed on April 10, 2026, the rule was not final as of November 6. It would take effect 12 months after the final rule.

OFAC calls five elements a necessary floor: management commitment, risk assessments, internal controls, testing and auditing, and training. Controls are where the engineering lives.

Issuers are generally not party to transfers, yet controls cover all activity in their coin. Block coins where a blocked person has an interest. Reject and report prohibited jurisdiction trades.

A material program violation could cost up to one hundred thousand dollars a day, more if knowing. And OFAC can penalize sanctions violations even without knowledge.

Screening should catch SDN-listed addresses and adjust rapidly to new designations. Guardian recommends a pipeline: ingest each update, parse addresses by chain, expand the list, freeze on every deployment, and log the time to freeze.

OFAC has seen apparent violations from software improperly configured, deactivated or modified over time. Freeze paths can drift too, so fork-test every chain and re-test after upgrades.

Guardian maps every role that can freeze or upgrade your contracts, and Managed Security watches them on every block. Read the full article, or talk to Guardian.

The GENIUS Act requires permitted payment stablecoin issuers to maintain "an effective sanctions compliance program, including verification of sanctions lists".

OFAC calls it the first time federal law has explicitly required a particular US person to have such a program.

On April 10, 2026, OFAC and FinCEN proposed what it must contain. OFAC's half is a new part 502, built around section 502.201.

It turns the five elements of OFAC's 2019 compliance framework into minimum requirements. And it reaches all activity in the issuer's coin, not just trades with its own customers.

This article explains the technical and security side of OFAC's proposed 31 CFR part 502 and FinCEN's companion 31 CFR 1033.240. It is not legal advice; confirm how it applies to you with counsel.

Where the Rule Stands

The same proposal adds FinCEN's 31 CFR 1033.240: the technical capability to block, freeze and reject transactions, and to comply with lawful orders.

Our post on the GENIUS freeze mandate and the SEC's central party test covers that side.

The Five Required Elements

Section 502.201(b) says the program "shall include, at a minimum" five elements. OFAC calls them "a necessary floor".

1. Management commitment. Senior management shall review and approve the program, resource it, and give compliance sufficient authority.
2. Risk assessments. Each issuer shall assess sanctions risk holistically, at appropriate intervals. Assessments should cover customers, products and foreign contacts.
3. Internal controls. Each issuer shall keep technical capabilities and written procedures that identify, block or reject, report and retain records.
4. Testing and auditing. Each issuer shall keep an independent testing or audit function, accountable to senior management.
5. Training. Each issuer shall train relevant staff at least annually, tailored to each role.

The program must also "routinely" give senior management risk updates, including testing results.

Element three is where the engineering lives.

Blocking on the Secondary Market

The controls apply to all payment stablecoin-related activity, "whether on the primary or secondary market".

Proposed 502.303 defines that activity from issuance until the coin's "removal from circulation". Trading, holding and transferring are all in.

Issuers are generally not a party to transfers, other than issuing and redeeming. OFAC says the GENIUS Act obliges them to block and reject impermissible transactions in their coin anyway, "including on the secondary market".

What the issuer must do depends on the sanction:

• A blocked person has an interest: block the coins. Letting a blocked person trade through the issuer's smart contract is a prohibited service.
• A prohibited jurisdiction, no blockable interest: reject the transaction and report it to OFAC. OFAC's example is persons in Iran.

Strict liability raises the stakes. OFAC may impose civil penalties even when an issuer did not know, or have reason to know, it was in a prohibited transaction.

FinCEN puts the reach this way: issuers need capabilities to block coins traded by blocked persons "when PPSIs exercise possession or control of such stablecoins, including through smart contracts."

The Technical Controls

Neither agency prescribes a design. OFAC "does not require PPSIs to use any specific tool or software", and FinCEN does not say how to build the capability.

The lists below are our recommended baseline, not rule text.

In the contracts

• A freeze or blocklist function on every deployment, on every chain.
• Screening at mint and redemption, where the issuer is a direct party.
• No escape paths from a frozen address: allowances, permits, bridges, wrappers or redemption.
• A freezer role reachable at any hour, narrower than burn, mint or upgrade.
• An event on every freeze and unfreeze, so the record writes itself.

Our comparison of stablecoin freeze requirements sets out one role design and the bypass paths to test.

In monitoring

OFAC's preamble sets a minimum for screening. It "should include tools sufficient to identify and block transactions associated with digital currency addresses included on OFAC's SDN List."

Controls should also be "capable of adjusting rapidly to new OFAC designations". That is a pipeline from designation to enforced freeze:

1. Ingest every SDN List update as it is published.
2. Parse each listed address by chain. OFAC uses identifiers like "Digital Currency Address - ETH".
3. Expand the list. OFAC warns its address listings are "not likely to be exhaustive".
4. Freeze on every deployment, then confirm the state onchain.
5. Alert on any transfer that touches a listed or linked address.
6. Log the time from designation to enforced freeze, per chain.

For the expansion step, OFAC notes the industry reports using blockchain analysis, open-source intelligence, geolocation and media monitoring tools.

Records and reports

Proposed 502.102 applies OFAC's existing part 501 rules, and adds one:

• Report blocked property and rejected transactions to OFAC within 10 business days.
• File the annual report of blocked property by September 30.
• Keep records for at least 10 years.
• On request, give OFAC the sanctions certifications you filed with your regulator (proposed 502.102(b)).

OFAC notes it has penalized firms "not solely because prohibited transactions occurred", but for missing records or late reports.

Testing the Program

Proposed 502.201(b)(4) would require an independent testing or audit function. It can be internal or external.

OFAC adds that internal audits can lack independence, while external audits "often provide more effective and comprehensive assessments".

It has seen apparent violations caused by compliance, testing or audit software "improperly configured, deactivated, or modified over time". An onchain freeze path can drift the same way.

• Fork-test a freeze on every chain against live state.
• Confirm the freezer role's signers are current and reachable.
• Re-test after every upgrade, new chain or role change.
• Run a drill: a test designation through to a confirmed freeze, timed.
• Keep the results and fixes. Under the proposal, OFAC can ask for them.

Checklist Before the Rule Is Final

1. Inventory every deployment, chain and privileged role of your coin.
2. Write the sanctions risk assessment, covering secondary market holders.
3. Map each control to 502.201(b)(3): identify, block or reject, report, retain.
4. Automate SDN ingestion and measure designation to freeze.
5. Close every path that lets a frozen address move value.
6. Stand up independent testing that covers the contracts, not just the screening vendor.
7. Plan the build against the proposed 12-month window after the final rule.

Exchanges listing foreign coins face a parallel check. See our foreign stablecoin due diligence checklist.

How Guardian Helps

Guardian's regulatory and compliance work maps every role that can move value, upgrade, pause, freeze or change parameters, read from the deployed contracts.

Its deployment verification matches deployed bytecode to the audited commit, and checks live configuration against what was reviewed.

Managed Security monitors your contracts on every block: privileged calls, role and ownership changes, upgrades, multisig transactions and large fund movements.

Guardian's security operations team reviews every multisig transaction before it is signed. When a detection fires, a Guardian engineer responds.

Frequently Asked Questions

Is 31 CFR 502.201 in force?

No. It is a proposed rule, published April 10, 2026. Comments closed June 9, 2026, and no final rule was published by November 6, 2026. OFAC proposes it take effect 12 months after the final rule.

Must a stablecoin issuer screen secondary market transfers?

The proposed internal controls apply to all payment stablecoin-related activity, "whether on the primary or secondary market." At a minimum, OFAC says, screening should identify and block transactions with digital currency addresses on the SDN List.

What are the penalties under proposed part 502?

Proposed 502.401 sets a civil penalty of up to $100,000 for each day a material violation of the program requirement continues. A knowing violation adds up to another $100,000 a day.

Does the proposal require a specific freeze function?

No. Neither OFAC nor FinCEN prescribes a contract design or a tool. The controls would have to identify and block or reject prohibited activity, and FinCEN's companion rule would require the technical capability to block, freeze and reject transactions.

Sources

• Federal Register: FinCEN and OFAC, Permitted Payment Stablecoin Issuer AML/CFT Program and Sanctions Compliance Program Requirements, proposed rule, 91 FR 18582 (April 10, 2026)
• Federal Register: full text of FR Doc. 2026-06963, including proposed 31 CFR part 502 (April 10, 2026)
• OFAC: Questions on Virtual Currency, FAQs 562, 563 and 646
• Guardian: Is USDC Centralized or Decentralized? GENIUS vs SEC FAQ 1.5
• Guardian: Stablecoin Freeze Requirements: MAS, HKMA and the GENIUS Act
• Guardian: GENIUS Act Foreign Issuers: A Due Diligence Checklist