Subscribe free
fincenoccstablecoincipkycamlfintech

Who Has to Know the Customer? Banks Used the Stablecoin CIP Comment File to Go After the Exchange KYC Gap

How BPI and TCH used the FinCEN/OCC/Fed/FDIC/NCUA stablecoin CIP proposal (91 FR 37234, RIN 1506-AB74) to push CIP duties onto digital asset service providers.

By Lex, LexRegPulse Analyst · ·10 min read
Primary-source research · AI-drafted · human-reviewed. Methodology

The comment period on the joint FinCEN/OCC/Federal Reserve/FDIC/NCUA customer identification program proposal for permitted payment stablecoin issuers closed August 21, 2026. The obvious read on the docket — banks versus crypto, banks wanting more KYC — is wrong, and the filings are what make it wrong. The Bank Policy Institute and The Clearing House Association told the agencies they are "generally supportive of the proposed CIP framework." Their substantive ask points elsewhere: that the agencies state, "whether through this rulemaking, a separate rulemaking, or additional guidance," that digital asset service providers establishing account relationships with customers carry CIP obligations of their own.

That is not a comment on stablecoin issuers. It is an attempt to use an issuer rulemaking to close a chartered-bank-versus-money-transmitter onboarding gap that predates stablecoins — and the agencies handed the trades the premise themselves, in the proposal's background section: "In contrast, money transmitters do not have a CIP obligation, but they are required to, for certain activity, verify an individual's identity" (91 FR 37236).

Where the perimeter sits

The proposal — 91 FR 37234, June 22, 2026, RIN 1506-AB74, docket FINCEN-2026-0101 — adds three definitions to a new 31 CFR part 1033: "account," "customer," and "digital asset service provider." The perimeter is narrow and deliberate.

An "account" is a formal relationship between a PPSI and a customer established to provide or engage in services, dealings, or other financial transactions — issuance and redemption, reserve management, custody of stablecoins or private keys, authorized DASP services. It excludes stablecoin activity that does not involve the PPSI as a party other than via a smart contract, and provides that ownership of a PPSI's stablecoins alone, without other indicators of a formal relationship, is not an account. "Customer" tracks the bank rule's exclusions and adds a fourth with no analogue at 31 CFR 1020.100(b)(2): any "person acquiring or redeeming a payment stablecoin from a means other than directly from or directly to the PPSI." The agencies' reason for stopping there is blunt: doing otherwise "would essentially impose on PPSIs a global obligation to collect and verify identifying information of individual users," which they assess "would be nearly impossible for PPSIs to implement and could potentially cripple the industry."

What makes this live rather than settled is that the agencies asked. Question 1 asks whether any CIP requirement should extend to secondary market activity; Question 4 asks whether the rule should be clarified where a customer's only desired relationship with a PPSI is redemption. And the impact analysis concedes what is left outside: "Almost all (approximately 99 percent) of stablecoin transaction activity takes place on the secondary market" (91 FR 37259).

The bank bloc's real ask

BPI and TCH built their letter around FinCEN's own assessment, made in the April PPSI AML/CFT and sanctions proposal issued jointly by FinCEN and OFAC, that "the majority of illicit activity involving stablecoins occurs on the secondary market" (91 FR 18601). Their Recommendation 2 is the competitive core: DASPs "generally are regulated as MSBs," MSBs "are financial institutions under the BSA but are not subject to formal CIP requirements, creating a regulatory gap between banks and MSBs," and FinCEN should close it "regardless of whether they operate as state-licensed money transmitters" — citing "same activity, same risk, same regulation" and pointing to 31 U.S.C. 5312(a)(2)(Y) as the authority.

This is not one trade group freelancing. The American Bankers Association filed the same argument and went further, urging the agencies to eliminate the "formal relationship" requirement altogether as a 2003 bank-CIP concept that "could exclude significant primary market activity the rule should capture." SIFMA expressly supported "BPI's and TCH's request that the Agencies exercise existing authorities to engage in a separate rulemaking to impose CIP requirements on secondary market actors." Four bank and capital-markets trade groups, one structural complaint, one docket, one deadline.

To be fair to the crypto side, the authority objection is real, and BPI effectively concedes it by offering three procedural routes. This rulemaking is scoped to part 1033 and to PPSIs; the joint issuance mechanism runs through the BSA's direction that CIP standards for institutions engaged in Bank Holding Company Act section 4(k) activity be prescribed jointly by Treasury and the appropriate federal functional regulator. A final rule imposing CIP on state-licensed money transmitters would not be a logical outgrowth of a proposal about stablecoin issuers, and would draw a procedural challenge the agencies would probably lose. The realistic outcome is a line in the preamble, or an ANPRM, starting the clock on an MSB CIP rule Treasury never wrote in the twenty-plus years since it wrote them for banks, broker-dealers, mutual funds, and futures commission merchants.

Redemption is where the money is

Everyone in the file agrees CIP should not follow a token into a self-hosted wallet. The genuine fight is over the one place a secondary-market holder can walk up to an issuer's front door: direct redemption. The proposal flags the scenario — an individual with no relationship acquires a stablecoin from an exchange and seeks to redeem it — and says "redemption could establish an account with the PPSI and make the individual a customer." Four positions, all irreconcilable:

Here is what most of the coverage has missed: the OCC has already largely answered this in a different docket. Its March 2, 2026 GENIUS Act proposal would require an issuer to redeem "any number greater than or equal to one payment stablecoin, subject to appropriate customer screening and onboarding" (91 FR 10291), while defining "timely" redemption as no later than two business days from the request (91 FR 10220). NYCUA notes the NCUA companion standards proposal carries the same condition. If that language survives, the answer to Question 4 is effectively pre-committed: onboarding attaches at direct redemption. Which is why BPI's Recommendation 3 — that redemption deadlines be tolled while CIP is completed — matters more than it looks. The real question is no longer whether a redeemer becomes a customer, but whether the two-day clock stops while the issuer verifies, and what happens during a stress event when the direct-redemption queue fills with holders nobody has onboarded.

Who this repricing favors

The agencies did the competitive analysis themselves and buried it in the Paperwork Reduction Act section. They estimate roughly 50 PPSIs in the first three years — about 30 subsidiaries of insured depository institutions and 20 non-IDI subsidiaries — and state plainly that "IDI-subsidiary PPSIs would have reduced CIP-related expenses due to their position within a parent's existing CIP program" (91 FR 37266). The preamble confirms an enterprise-wide CIP is permissible across a PPSI subsidiary and its depository parent, which NYCUA called the single most important provision in the proposal for credit unions.

Stack the reliance provision on top. Proposed § 1033.220(a)(6) permits reliance only on another federally regulated financial institution, subject to contract and annual certification — and the agencies acknowledge this "create[s] a disparity": a state qualified payment stablecoin issuer may rely on a bank-subsidiary PPSI's procedures, but not the reverse. A standalone state-chartered issuer sits on the wrong side of that asymmetry in both directions.

Then the sentence that quietly undoes the whole "reliance solves duplication" argument. The agencies observe that many exchanges collect customer information comparable to what issuers collect — but "exchanges rarely share this information with issuers" (91 FR 37259). Reliance is worth something only if the relied-upon institution will contract to perform your CIP and certify annually that it did, and exchanges have no commercial reason to sign that contract for an issuer competing with them for the customer. Absent a DASP CIP rule, the duplicated verification at redemption is not a drafting problem the final rule can fix; it is a market-structure problem.

The liability allocation is the other unresolved piece, and it is a genuine defect. The preamble states reliance "would not change a PPSI's CIP obligation, and the PPSI would remain responsible for its compliance." The 2003 bank CIP adopting release took the opposite tack: a bank "will not be held responsible for the failure of the other financial institution to adequately fulfill the bank's CIP responsibilities," provided reliance was reasonable and the requisite contracts and certifications were obtained (68 FR 25090, 25104). Blockchain Association flagged the mismatch; America's Credit Unions asked outright "which party is liable for compliance violations." Leave the preamble as written and the reliance provision is close to unusable, because the certification buys process comfort and no legal protection.

What to watch

The runway is twelve months from issuance of a final rule, and part 1033 cannot be finalized until FinCEN and OFAC finalize the April AML/CFT and sanctions proposal that creates the part. Treasury's issuance, offer, and sale proposal (91 FR 53368, August 18, 2026) is open through October 19, 2026 — see our August 18 brief. The OCC has publicly targeted November for its main GENIUS Act rule and expects to begin processing issuer applications early in 2027, per our August 20 brief. The statutory effective date is the earlier of eighteen months after the July 18, 2025 enactment — January 18, 2027 — or 120 days after the primary federal payment stablecoin regulators issue final regulations. Note the plural: an OCC final rule in November does not start the 120-day clock by itself, so January 18, 2027 governs. The prohibition on DASPs offering non-compliant payment stablecoins runs from July 18, 2028 under 12 U.S.C. 5902(b)(1).

Do the arithmetic. A CIP final rule issued in Q4 2026 carries a compliance date in Q4 2027 — nearly a year after licensed-issuer-only issuance begins. Institutions will be licensed and issuing under a CIP regime that is not yet binding, running whatever onboarding conditions their prudential regulator imposes. That gap is where examiner discretion will live for most of 2027.

Three things to build now. Model both redemption outcomes — full onboarding-before-redemption and a screening-only tier — because the difference is a product decision, and the OCC's screening-and-onboarding language makes the strict version more likely. If you plan to issue through a subsidiary, decide whether you are running an enterprise-wide CIP or a standalone one, and document how it satisfies each entity's obligations. And if you rely on anyone's CIP, paper the contract and annual certification against the bank standard while assuming you retain the liability the preamble says you retain.

Bottom line

This is not the largest open item in GENIUS implementation — Treasury's Section 3 proposal and the OCC's main rule are bigger. It is the most consequential unresolved question in stablecoin BSA compliance this quarter, and the one where the outcome still turns on an open record. The bank trades did not come to this docket to slow issuers down. They came to argue that an exchange holding a retail customer relationship should carry the same onboarding obligation a bank does, and they picked this rulemaking because it is where the agencies put the gap in writing. The agencies cannot grant that here. Whether they acknowledge it in the preamble is the tell.

Sources