Stablecoin KYC and the Line at the Point of Issuance

The interesting part of this comment letter is not the objection. It is that the regulators wrote the objection first.

In the joint proposal, the agencies themselves acknowledged that applying customer identification to every transfer would create obligations that are "nearly impossible" and "global," and could "cripple the industry" ^[8]. The proposal then excludes secondary-market activity ^[9]. And then it asks whether the final rule should go further anyway ^[10]. That is a request for comment functioning as an open door, which is why a trade group that broadly supports the underlying rule ^[3] spent a letter defending a carve-out that already exists.

The mechanism argument is the load-bearing one, and it is about custody rather than ideology. Once tokens circulate, a sender signs and broadcasts, distributed validators confirm and a smart contract executes predetermined code ^[11]. The issuer in that sequence may hold no contract with either party, no custody of the tokens and no ability to run a real-time check ^[12], and generally cannot approve or block the transaction before settlement just because its contract is involved ^[13]. A rule that assigns a duty there does not create surveillance. It creates a duty nobody can discharge, which in practice is a duty to stop issuing.

The statutory hook is narrow, and the association leans on the wording. The GENIUS Act requires verification of "account holders with the permitted payment stablecoin issuer" ^[14], and the group reads that as not authorising regulators to make an issuer responsible for identifying everyone who later holds or moves its tokens ^[1]. The agencies' own definition of "account" already tracks the formal relationship between issuer and customer ^[6], applying checks at issuance, fiat conversion, reserve management and some redemptions ^[7]. Those are the points where operational control actually sits.

The rest of the letter is where operators should read closely, because it is about duplicated spend rather than principle. The association wants explicit exclusions for one-time redemption requests, redemptions handled through another regulated institution, data-processing and transmission services, vendor relationships and other commercial partnerships ^[15]. It wants firms that both issue stablecoins and run digital-asset services to keep their exchange, transfer and custody businesses out of the issuer rule, since those may already carry separate Bank Secrecy Act obligations ^[16]. That is a request to be regulated once per activity rather than once per label.

Two smaller asks carry real money. The group wants issuers that reasonably rely on identification performed by a federally regulated institution to be shielded from automatic liability when that institution falls short of its own obligations ^[17]. And it wants the effective date aligned with coming FinCEN and OFAC requirements on money laundering, terrorist financing and sanctions, on the grounds that staggered deadlines force issuers to rebuild the same compliance systems repeatedly ^[18]. Sequencing is a cost line. Every offset deadline is another integration project against controls that will be replaced before they are amortised.

The through-line the association is pressing is that obligation should follow control ^[19]. That test is doing more work than its plainness suggests: it decides whether a permitted issuer is a regulated financial institution with identified customers, or the guarantor of every wallet that ever touches its token.