Federal: AFC Response to FDIC Genius Act BSA Rulemaking

Jennifer M. Jones
Deputy Executive Secretary
Federal Deposit Insurance Corporation
550 17th Street NW
Washington, DC 20429

Re: Response to Notice of Proposed Rulemaking Regarding Bank Secrecy Act and Sanctions Compliance Standards for FDIC-Supervised Permitted Payment Stablecoin Issuers

Dear Ms. Jones,

On behalf of the American Fintech Council (AFC),  I appreciate the opportunity to submit this comment letter in response to the Federal Deposit Insurance Corporation’s (FDIC) Notice of Proposed Rulemaking regarding Bank Secrecy Act (BSA) and sanctions compliance standards for FDIC-supervised permitted payment stablecoin issuers (PPSI’s) pursuant to the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act) (Proposed Rulemaking).

AFC is a standards-based organization and the largest and most diverse trade association representing financial technology companies and innovative banks. On behalf of more than 150 member companies and partners, AFC promotes a transparent, inclusive, and customer-centric financial system by supporting responsible innovation and encouraging sound public policy. AFC’s membership includes banks, payments companies, digital asset firms, compliance and infrastructure providers, and other participants operating throughout the modern financial services ecosystem. This breadth provides AFC with a practical understanding of the governance, technology, and supervisory considerations that will shape implementation of the GENIUS Act.

The Proposed Rulemaking addresses a particularly consequential component of the federal payment stablecoin framework. Effective supervision must protect the financial system against illicit finance while also providing regulated entities with sufficiently clear standards to design, implement, and continuously improve sophisticated compliance programs. That objective is best served by a cohesive federal framework that respects the respective roles of the FDIC, the Financial Crimes Enforcement Network (FinCEN), and the Office of Foreign Assets Control (OFAC), evaluates compliance according to risk and program effectiveness, and preserves the confidentiality and legal protections essential to candid supervisory engagement.

AFC therefore recommends that the FDIC finalize a framework that: first, harmonizes its supervisory expectations with applicable Treasury requirements and permits PPSIs to rely on effective enterprise compliance infrastructure; second, clearly distinguishes material or systemic program failures from isolated, remediable deficiencies; third, establishes a disciplined FinCEN consultation process that improves consistency without delaying examinations or enforcement decisions; and fourth, protects privileged and confidential supervisory information through narrow, secure, and legally durable information-sharing procedures.

I. AFC Supports a Coordinated Federal Compliance Framework that Promotes Consistent Supervision and Efficient Risk Management

The final rule should define the FDIC’s role as prudential supervisor in a manner that complements, rather than duplicates, the substantive BSA and sanctions requirements administered by FinCEN and OFAC. Where a PPSI satisfies the applicable federal Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) and sanctions requirements, the FDIC should treat that compliance as satisfying corresponding obligations under its supervisory framework unless the GENIUS Act expressly requires an additional prudential standard. A clear statement to this effect would reduce the risk that substantially identical legal requirements develop divergent documentation, governance, or examination expectations across federal agencies.

Regulatory alignment is especially important because the GENIUS Act assigns distinct but interdependent responsibilities to Treasury and the primary federal payment stablecoin regulators. The FDIC should not recreate Treasury’s substantive compliance rules through examination guidance, nor should supervised entities be required to maintain parallel programs that address the same underlying risks. Instead, the final rule should focus the FDIC’s review on whether a PPSI has integrated applicable requirements into an effective governance and risk management framework, whether accountability is clearly assigned, and whether material risks are identified and remediated in a timely manner.

The framework should also expressly permit a PPSI that is affiliated with an insured depository institution to leverage existing enterprise systems where those systems achieve the applicable regulatory objective. Mature transaction monitoring, suspicious activity reporting, sanctions screening, customer due diligence, independent testing, escalation, and board reporting functions should not be replicated solely because stablecoin issuance occurs through a separately organized subsidiary. The PPSI should remain accountable for compliance, but accountability does not require unnecessary operational isolation. A functional approach that evaluates the adequacy of controls will produce stronger outcomes than a structural mandate that rewards duplication.

Technology providers, blockchain analytics firms, and specialized compliance vendors will likewise perform important functions across the stablecoin ecosystem. The FDIC should confirm that PPSIs may allocate operational responsibilities to qualified third parties, subject to appropriate due diligence, contractual controls, ongoing monitoring, and ultimate institutional accountability. Supervisory expectations should remain technology neutral and performance based so that PPSIs may adopt improved tools for wallet screening, transaction tracing, anomaly detection, and sanctions risk management as those capabilities evolve. Novel technologies can materially improve visibility, precision, and responsiveness, and the final framework should encourage their responsible use rather than embed assumptions tied to current systems or methodologies.

II. AFC Supports Risk-Based Supervisory and Enforcement Standards that Focus Remedial Action on Material Program Weaknesses

A PPSI that has established and maintains an effective AML/CFT program should not face a significant supervisory action or enforcement action based solely on an isolated control failure, a discrete processing error, or an immaterial deficiency that does not undermine the program’s overall effectiveness. The final rule should make this principle explicit and should direct examiners to evaluate the nature, duration, frequency, and consequences of a deficiency, the institution’s prior knowledge of the issue, and the timeliness and adequacy of remediation. This approach would preserve accountability while ensuring that supervisory outcomes remain proportionate to actual risk.

The proposed definitions of “AML/CFT enforcement action” and “significant AML/CFT supervisory action” should be refined to provide greater certainty regarding the threshold for consultation and the consequences that follow. A significant supervisory action should require a written determination involving a material, programmatic weakness that necessitates substantial remediation, rather than any communication that happens to request a meaningful operational change. The definition should continue to exclude examiner observations, suggestions, and other informal comments, and the final rule should clarify that routine matters requiring attention do not become significant merely because remediation requires time or resources.

The FDIC should also establish clear procedures for suspension or revocation proceedings that arise, in whole or in part, from alleged AML/CFT deficiencies. Such proceedings are among the most consequential actions available to the agency and should be subject to the same consultation, evidentiary, and procedural safeguards applicable to other material enforcement decisions. The final rule should require written notice identifying the statutory and factual basis for the contemplated action, a meaningful opportunity for the PPSI to respond, and a reasoned explanation of how the identified deficiency satisfies the applicable legal threshold.

Consistent treatment across examination teams will require more than regulatory text. The FDIC should issue examiner guidance and training materials that explain how to distinguish isolated deficiencies from systemic program failures, how to assess technology-enabled controls, and how to evaluate remediation undertaken during an examination. Supervisory policy established at the agency level can lose coherence if examination teams apply differing assumptions in practice. Clear implementation materials, calibrated review procedures, and escalation mechanisms for novel interpretive questions will help ensure that the final rule produces predictable and defensible outcomes.

III. AFC Supports a Disciplined FinCEN Consultation Process that Enhances Consistency Without Delaying Supervisory Outcomes

Consultation with FinCEN can improve legal consistency and reduce the risk that the FDIC and Treasury reach materially different conclusions regarding the effectiveness of the same AML/CFT program. The process should therefore apply to all contemplated AML/CFT enforcement actions and significant AML/CFT supervisory actions, without an asset or outstanding issuance threshold. The legal and operational significance of a supervisory action does not depend solely on issuer size, and a threshold could produce inconsistent treatment of substantively similar deficiencies. A uniform trigger will also be easier for examiners and supervised entities to administer.

A PPSI should not bear responsibility for determining when consultation is appropriate, although the final rule may permit an institution to request consultation when it reasonably believes a contemplated action presents a material interpretive conflict. The mandatory process should remain an agency obligation. Making consultation primarily elective would create uncertainty, place institutions in the difficult position of requesting review from a second regulator during an active examination, and risk disparate outcomes based on an issuer’s willingness or ability to invoke the process.

Furthermore, the final rule should establish firm procedural deadlines. The FDIC should transmit a complete consultation package to FinCEN promptly after determining that a qualifying action is under consideration, and FinCEN should ordinarily provide its views within a defined period that does not extend the issuance of an examination report. The agencies should conduct consultation concurrently with the FDIC’s internal review rather than sequentially after examination work is complete. Where urgent circumstances justify a shorter period, the FDIC should document the basis for acceleration and preserve an opportunity for subsequent coordination.

In tandem, consultation should also be confined to the issues necessary to evaluate the proposed action. The FDIC should provide a concise statement of the alleged deficiency, the governing legal requirements, the material factual findings, the institution’s response, and the proposed remedial or enforcement outcome. Requiring wholesale transfer of examination files would impose needless burden, complicate privilege review, and invite duplicative reexamination of matters outside FinCEN’s statutory role. A focused record, supported by secure channels and designated agency points of contact, would promote meaningful review while preserving examination efficiency.

Importantly, the final rule should explain how the FDIC will address a material disagreement with FinCEN. The FDIC should retain its statutory authority, but the decisional record should reflect that FinCEN’s views were considered and should identify the basis for any departure on a question concerning BSA program effectiveness or Treasury-administered requirements. This modest discipline would improve accountability, enhance interagency consistency, and create a more reliable foundation for subsequent supervisory or judicial review.

IV. AFC Supports Narrow Information-Sharing Safeguards that Preserve Privilege and Promote Candid Supervisory Engagement

The consultation process should not erode attorney-client privilege, attorney work product protection, or the statutory safeguards applicable to confidential supervisory information. Institutions must be able to obtain legal advice, investigate potential deficiencies, and communicate candidly with supervisors without creating uncertainty as to whether compelled or voluntary production will later be characterized as a waiver. The final rule should therefore adopt the information-sharing option that most clearly preserves existing privileges and protections under 12 U.S.C. § 1821(t), while also limiting disclosure to information reasonably necessary for FinCEN’s consultation.

Additionally, the FDIC should generally avoid sharing privileged legal advice, attorney work product, internal communications with counsel, or board materials that reflect legal analysis. If FinCEN requires information related to those materials, the FDIC should first determine whether the same issue can be addressed through nonprivileged factual information. When potentially privileged material may need to be shared, the institution should receive notice and an opportunity to identify protected content. Any disclosure should occur under a written protocol confirming that the information remains confidential, that sharing does not waive applicable legal protections, and that access is limited to personnel directly involved in the consultation.

To further bolster this level of security, the FDIC should also require secure methods for transferring and storing consultation materials, limit how long those materials may be retained, and establish procedures for addressing inadvertent disclosures. Information that is unnecessary or outside the scope of the consultation should be promptly returned or destroyed. The final rule should further clarify that consultation materials will not be publicly disclosed or used for unrelated supervisory or enforcement purposes without an independent legal basis. These safeguards are essential to preserving candid communication between supervised institutions and their regulators.

A carefully bounded information-sharing regime will allow FinCEN to provide informed views without creating collateral legal risk or discouraging institutions from documenting concerns and remediation efforts. The strongest supervisory system is one in which regulated entities can identify weaknesses early, seek advice, and engage openly with examiners. Preserving privilege and confidentiality directly advances that objective and should remain a central element of the final rule.

* * *

AFC appreciates the FDIC’s efforts to implement the GENIUS Act through a supervisory framework that protects the financial system while supporting responsible payment innovation. A final rule grounded in regulatory coordination, proportional supervision, efficient consultation, and durable confidentiality protections will strengthen AML/CFT outcomes and provide PPSIs with the clarity necessary to build effective compliance programs.

AFC welcomes continued dialogue with the FDIC and would be pleased to provide any additional information that may assist the agency as it finalizes and implements the rule.

Sincerely,

Ian P. Moloney
Chief Policy Officer
American Fintech Council

[1] American Fintech Council’s (AFC) membership spans EWA providers, BNPL and other lenders, banks, payments providers, loan servicers, credit bureaus, and personal financial management companies.
[2] Federal Deposit Insurance Corporation, “Bank Secrecy Act and Sanctions Compliance Standards for FDIC-Supervised Permitted Payment Stablecoin Issuers,” Federal Register 91, no. 108 (June 5, 2026): 34171–34178, https://www.federalregister.gov/documents/2026/06/05/2026-11342/bank-secrecy-act-and-sanctions-compliance-standards-for-fdic-supervised-permitted-payment-stablecoin.

‍