Stablecoin Regulation Is a Stack, Not One Rule

The most common mistake institutions make about stablecoin regulation is treating it as a single law they need to comply with. As of 2026, a dollar-backed stablecoin in the United States sits inside a stack of obligations from at least four bodies: the GENIUS Act sets reserve and disclosure rules for issuers, FinCEN pulls issuers into Bank Secrecy Act reporting, OFAC binds anyone touching the token to sanctions law, and federal bank regulators set the terms under which a bank can hold or issue one. Miss any one layer and the token is non-compliant even if the other three are perfect.

According to Allium's dataset, total tracked onchain stablecoin circulating supply stands at $334B as of September 3, 2026, with USDT at $192.9B and USDC at $77.9B. That is the collateral base this regulatory stack is being built to govern, which is why the rulemaking moved fast once real money was involved.

Key takeaways

• US stablecoin regulation is layered. No single agency owns it, and compliance means satisfying reserve, AML, sanctions, and custody rules from four separate authorities.
• The GENIUS Act, signed in July 2025, is the federal framework for payment stablecoin issuers. It mandates one-to-one reserves in cash and short-dated Treasuries, monthly reserve disclosures, and a licensing path.
• FinCEN and OFAC obligations existed before GENIUS and still apply. A licensed issuer still runs a Bank Secrecy Act program and still screens against sanctions lists.
• Bank regulators (OCC, Federal Reserve, FDIC) govern whether and how a supervised bank can custody reserves or issue a token, adding a custody and safety-and-soundness layer.
• Onchain supply is concentrated. According to Allium's dataset, USDT and USDC together account for roughly $270.8B of the $334B tracked.

Why the rulebook hardened in 2025

For years, dollar stablecoins operated under a patchwork of state money-transmitter licenses and no dedicated federal statute. That changed when the GENIUS Act passed and was signed into law in July 2025, creating the first federal regime for what it calls payment stablecoins. The trigger was scale. When onchain dollar supply crosses hundreds of billions and enters Treasury markets and payment rails, regulators stop treating it as a niche.

The named players make the stakes concrete. Circle, the issuer of USDC, published its reserve composition and pursued regulatory alignment ahead of the statute, per its own transparency disclosures. Tether, issuer of USDT, holds the largest onchain supply by a wide margin. Payment networks moved too, building public views of stablecoin settlement activity. None of that changes the law, but it explains why the law arrived when it did.

The four layers, and who each one binds

The single most useful thing to understand is that these rules bind different parties. A reserve rule binds the issuer. A sanctions rule binds everyone. A custody rule binds the bank. Conflating them is how compliance gaps open.

The reserve requirement is the headline, but the layer most institutions underestimate is OFAC. It binds the broadest set of parties. A wallet, an exchange, or a corporate treasury moving a compliant token still owns the obligation to avoid sanctioned counterparties. The token being GENIUS-compliant does not discharge that duty.

How a compliant stablecoin actually moves through the stack

Walking one transaction through the layers shows where each rule attaches.

1. Issuance. A licensed issuer accepts $100 and mints 100 tokens. Under GENIUS, that $100 must sit in permitted reserves (cash or short-dated Treasuries), one-to-one, and be disclosed in a monthly report. This is where the reserve and disclosure layer binds.
2. Onboarding. Before the issuer serves a customer, its FinCEN/BSA program applies: identity verification, sanctions screening, and monitoring. The AML layer binds here regardless of how clean the token itself is.
3. Transfer. The token moves onchain from wallet to wallet. Every US person in that chain of custody carries the OFAC obligation to screen the counterparty. The sanctions layer binds continuously, not just at issuance.
4. Custody. If a supervised bank holds the reserves or offers custody, the bank-regulator layer binds it separately on safety-and-soundness and custody terms.
5. Redemption. The holder returns 100 tokens and receives $100. The issuer burns the tokens and adjusts reserves, and the disclosure layer captures the change.

Four layers, one transaction, four different parties responsible. For a fuller institutional read of how this fits with the broader market-structure push, the pillar walkthrough on the CLARITY Act for institutions covers the legislative context in depth.

What changes in practice, before and after GENIUS

• Reserve transparency: monthly instead of opaque. Before a federal standard, reserve disclosure quality varied by issuer and jurisdiction. Under GENIUS, a payment stablecoin issuer publishes reserve composition monthly, so a treasurer can verify backing on a fixed cadence rather than trusting a one-off attestation.
• Licensing: one federal path instead of fifty state ones. Before, an issuer stitched together state money-transmitter licenses. GENIUS creates a federal route (with a qualifying state option below a size threshold), so the compliance map is national rather than fragmented.
• Bank participation: permitted with rules instead of ambiguous. Before, whether a supervised bank could custody reserves or issue a token sat in a gray zone. The bank-regulator layer now sets explicit custody and approval terms, so a bank can plan a product instead of guessing at supervisory tolerance.
• Redemption: a legal claim instead of a policy promise. A one-to-one reserve mandate backed by disclosure turns a promise to redeem into a rule the issuer must meet and report against.

The data problem this stack creates

Each layer of the regime assumes someone can see the underlying activity in a consistent shape. A reserve auditor, a BSA analyst, and an OFAC screener are all asking questions about the same transfers, but they need different fields, and those fields have to mean the same thing across chains.

Here is where it gets hard. USDT alone circulates across many chains. To answer a single supervisory question, such as how much of a token moved between two counterparties last month, the same transfer on Ethereum, Solana, and Tron has to resolve to the same fields: asset, issuer, sender, recipient, amount, USD value, and transaction type. Raw chain data does not arrive that way. Each network encodes transfers differently, contract addresses differ per chain, and a naive count double-reports bridged supply. Allium ingests raw data from 150+ blockchains and standardizes it into a stablecoins vertical with those fields normalized, which is what makes an issuer's circulating supply or a screener's counterparty view comparable across networks rather than chain-by-chain guesswork. This is the layer that lets a $334B market be measured against a rulebook that assumes it can be measured.

Risks and open questions

• Foreign issuers. The largest onchain supply belongs to an issuer domiciled outside the US. How GENIUS treats non-US issuers offering tokens to US persons remains a live area, and enforcement posture will shape the market more than the statute's text alone.
• Yield and interest. GENIUS restricts payment stablecoins from paying interest to holders. That pushes yield-bearing designs into adjacent structures, and where those sit legally is not fully settled.
• State versus federal thresholds. The qualifying state path below a size threshold creates a boundary that issuers will test as they grow. Crossing it mid-life is an operational question the rules only partly answer.
• Sanctions on immutable code. OFAC obligations bind people, but tokens move through smart contracts that no one can pause on some designs. Reconciling continuous screening duties with permissionless transfer is an unresolved tension.
• DeFi exposure. Once a compliant token enters a lending pool or automated market maker, tracing counterparties for AML and sanctions purposes gets materially harder, and the rules were written with issuer-level controls in mind.

The regime will keep moving. Treating it as a stack, checking each layer against the party it binds, is the durable way to read it rather than waiting for a single tidy rule that is not coming.

Frequently asked questions

Is there a single US stablecoin law?

No. The GENIUS Act (signed July 2025) is the dedicated federal framework for payment stablecoin issuers, but it sits alongside FinCEN anti-money-laundering rules under the Bank Secrecy Act, OFAC sanctions obligations, and bank-regulator custody and issuance standards. Compliance means satisfying all of these layers, not just one.

What does the GENIUS Act require of issuers?

It requires payment stablecoin issuers to hold one-to-one reserves in permitted assets such as cash and short-dated Treasuries, publish monthly reserve composition disclosures, and obtain a federal license or qualify under a state path below a size threshold. It also restricts paying interest to token holders.

Does a GENIUS-compliant token remove sanctions risk for users?

No. OFAC sanctions obligations bind any US person or entity touching the token, independent of the issuer's status. A treasury or exchange moving even a fully compliant stablecoin still has to screen counterparties and addresses against sanctions lists and block prohibited transactions.

Which regulators govern banks that want to custody or issue stablecoins?

The OCC, the Federal Reserve, and the FDIC. They set the safety-and-soundness and custody standards, and in some cases supervisory approval, that a supervised bank must meet before holding stablecoin reserves or issuing a token. This is a separate layer from the issuer-level GENIUS rules.

How concentrated is the stablecoin market the rules govern?

Very. According to Allium's dataset, total tracked onchain stablecoin circulating supply was $334B as of September 3, 2026, with USDT at $192.9B and USDC at $77.9B, meaning the two largest tokens account for roughly $270.8B of the total.

Why is measuring stablecoin activity for compliance difficult?

The same token circulates across many blockchains that encode transfers differently, so a raw count can double-report bridged supply and fields do not line up across networks. Consistent measurement requires normalizing each transfer to shared fields (asset, issuer, sender, recipient, amount, USD value, transaction type) across chains before it can be checked against reserve, AML, or sanctions questions.