What a Federal Stablecoin Issuer Actually Has to Run

You hear "1:1 backed" and picture a simple operation: issue a token, park dollars in Treasuries, redeem on demand. A stablecoin issuer is a token plus a bank account, maybe a compliance officer.

The OCC published its final rule implementing the GENIUS Act on October 21. The rule is 12 CFR Part 15, hundreds of pages of regulatory text that the OCC received approximately 328 comments on. It takes effect January 18, 2027, the same day as the Act itself.

What Part 15 describes is closer to running a narrow bank with an automatic liquidation trigger than parking dollars in T-bills. The issuer has to manage a reserve portfolio with concentration limits and a monthly examined report, a two-business-day redemption clock, a 12-month operating-expense backstop held entirely separate from reserves, private-key controls with breach notification requirements, and a shutdown path that fires automatically if reserves stay short for 15 business days. And the BSA/AML rules, the chapter that tells you how to screen customers and report suspicious activity, haven't been finalized yet.

The reserve book

Your reserves must be at least equal to every coin in circulation, at all times, measured by fair value net of liabilities. But the OCC goes further than saying "hold dollars," specifying exactly what you can hold and how much of each.

Eligible assets are cash at the Federal Reserve, demand deposits, Treasury securities with 93 days or less remaining maturity, overnight repo backed by T-bills under 93 days, overnight reverse repo with creditworthy counterparties, government money market funds investing only in those assets, and tokenized forms of any of the above. That's the full list. If an asset isn't on it, you need specific OCC approval.

At least 5% of reserves must be in demand deposits or Fed balances, available immediately. No single counterparty can hold more than 40% of your reserves, excluding the US government, qualifying custodians, and cleared repo. If you have $10 billion in reserves, no more than $4 billion can sit at any one bank.

By noon on the last day of every month, you file a 17-line composition report showing what you hold, where it's custodied, and the remaining tenor of each position. A PCAOB-registered firm examines it, you publish it, and your CEO and CFO personally certify it to the OCC.

The final rule dropped some constraints from the March proposal. The minimum insured-deposit requirement is gone. The liquidity floor dropped from 10% to 5%. The concentration limit moved from per-institution to per-counterparty. Surplus reserves above 1:1 can be withdrawn at any time instead of monthly.

But the constraint that shapes everything else stayed: reserves must be at least 1:1 at all times, with a buffer "to the extent necessary." The OCC is telling you to hold more than dollar-for-dollar and to demonstrate you can liquidate quickly if you need to.

The two-day clock

When a holder requests redemption, you have two business days to initiate the outbound transfer. The clock starts when onboarding is complete, which the OCC says cannot be "unduly delayed." You must redeem down to a single coin.

If redemptions exceed 10% of a brand's outstanding supply within 24 hours, you notify the OCC within 24 hours and can request a time extension. The March proposal had an automatic extension to seven calendar days past that threshold. The final rule dropped the automatic extension and made it discretionary.

You must disclose to every holder that stablecoins are not deposits and are not FDIC-insured. Fee changes require seven days' notice. The OCC won't force a redemption that would violate another law, such as a sanctions freeze.

Two business days is tight if you're holding overnight repo and 93-day Treasuries. You need a reserve portfolio liquid enough that you can convert to cash and initiate a transfer within that window even during a run. That's the operational reason for the 5% demand-deposit floor and the 93-day maturity limit. The reserve book has to unwind fast.

The backstop

Separate from reserves, the issuer must hold 12 months of total operating expenses. This is the operational backstop, capital set aside so the issuer can keep running even if it stops issuing new coins and the reserve book is fully committed to redemptions.

Eligible backstop assets are cash, fully insured deposits, or Treasuries with 93 days or less remaining. Up to 50% can be five-year subordinated debt, as long as it isn't funded by an affiliate. The backstop is measured at all times, and a breach triggers a 24-hour notification requirement.

If you're short on the backstop at a quarter-end, you can't issue new stablecoins starting the following month. Short at two consecutive quarter-ends and the OCC starts the liquidation and redemption process.

The capital floor is $5 million in GAAP equity minus goodwill, intangibles, deferred tax assets, and the equity-funded portion of the backstop. New issuers hold whatever the OCC sets as a licensing condition for 36 months. National trust banks that issue stablecoins can elect into Part 15 capital rules instead of Part 3, which is the trust bank capital election we covered previously.

Private keys and breach response

The risk management and IT requirements read like a bank examination manual adapted for cryptographic operations. Board-approved IT and cybersecurity program, segregation of duties and dual controls, asset inventory, and internal audit.

But three requirements are specific to stablecoin operations. The OCC requires documented validation of the smart contracts used to issue, transfer, and redeem stablecoins. It requires private key management with backup and recovery procedures. And it requires breach notification that covers customers and the OCC, including key compromise specifically.

Stress testing is required, including against "significant positive interest rate scenarios." That language targets the risk that rising rates make your reserve assets lose value at the exact moment when redemption demand spikes, the scenario that hit Silicon Valley Bank but applied to a stablecoin reserve book.

The OCC also requires a business impact analysis and resilience testing with critical vendors. If your key management vendor goes down, what happens to your ability to process redemptions within two business days?

The shutdown path

If your reserves drop below 1:1, you report the shortfall the same day and stop issuing new coins immediately.

If the shortfall persists for 15 consecutive business days, you begin liquidating and redeeming all outstanding stablecoins at par, fee-free. The shutdown is automatic once the 15-day clock runs out. There is no negotiation with the OCC about whether to wind down.

The supervision regime around this is dense. Full-scope examination every 12 months, extended to 18-24 months if total assets including affiliates are under $1 billion. Confidential weekly reports to the OCC. Quarterly financials within 30 days. If you exceed $50 billion and aren't an SEC reporting company, your annual financial statement needs a PCAOB audit within 120 days of year-end.

State-supervised issuers face their own trigger. At $10 billion in issuance, you notify the OCC within five days. Within 360 days, you either move to federal supervision or stop net issuance. The OCC allows a waiver application, due within 240 days, but the presumption is that large issuers come under federal oversight.

The missing chapter

The OCC's press release says the final rule "addresses all of the regulations the OCC is required to promulgate under the GENIUS Act other than those related to the Bank Secrecy Act, anti-money laundering, and Office of Foreign Assets Control sanctions, which will be addressed in a separate rulemaking in coordination with the Department of Treasury."

That matters because the final rule requires new issuers to certify AML compliance within 180 days of receiving approval. The AML rules they'd be certifying against are still proposals. The OCC published its BSA NPRM in June 2026. FinCEN and OFAC published a joint AML/sanctions proposal in April 2026. A joint customer identification program proposal came out the same month. None are finalized.

The application window for new issuers isn't open either. The OCC is waiting on OMB form approval before it starts accepting applications. Existing issuers can apply for a waiver of up to 12 months if they file a substantially complete application by January 18, 2027. But the criminal penalties for unlicensed issuance under the GENIUS Act start on the same date.

Other agencies are further behind. The FDIC published its GENIUS NPRM in April 2026. The Federal Reserve proposed Regulation UU in September 2026, with a comment period extending into late November. The Fed's capital approach diverges from the OCC's: the Fed proposes, according to Sullivan & Cromwell's analysis, a standardized 2% charge on uninsured deposits plus an operational charge of 1-2% of issuance and 25% of revenue, while the OCC takes an individualized approach based on GAAP equity. An issuer's choice of federal regulator could meaningfully affect its capital costs.

The yield question is also unresolved. The GENIUS Act bans interest or yield "solely in connection with the holding, use, or retention" of a stablecoin. The OCC's March proposal included a rebuttable presumption that would have treated affiliate and third-party rewards as issuer yield. The final rule dropped that presumption and will review arrangements case by case. The Bank Policy Institute noted the final rule "leaves room for ambiguity on yield." Rewards programs like those at PayPal, Coinbase, and Kraken operate in that ambiguity until the OCC issues guidance or enforcement.

Building against an incomplete rulebook

The OCC moved first, and the final rule is substantive. An issuer that builds to Part 15 will have reserve management, redemption operations, capital and backstop requirements, key management infrastructure, and a supervision relationship with the OCC.

But it will also be certifying AML compliance against rules that are still proposals, applying through a window that hasn't opened, and operating in a yield regime that the OCC explicitly left for case-by-case review. The rule and the Act take effect January 18, 2027. The pieces around them are still being assembled.

For issuers building now, the operational spec is clear enough to start: the reserve book, the redemption clock, the backstop, the key controls, and the shutdown path. The regulatory spec is clear enough to plan around: file by January 18, request a waiver, and build the AML program against the proposals while waiting for the final rules. Being wrong on the operational side means liquidation, while being wrong on the regulatory side means a criminal penalty for unlicensed issuance under a statute whose implementing regulations are, as of today, incomplete.