Federal: AFC Response to OCC GENIUS Act AMLCFT and Sanctions Rulemaking

The Honorable Jonathan V. Gould
Comptroller of the Currency
Office of the Comptroller of the Currency
Attn: Bank Appeals Process
400 7th St., SW
Washington, DC 20219

Re: Response to Notice of Proposed Rulemaking Regarding Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism and Sanctions Compliance Risk Management

Dear Comptroller Gould,

On behalf of the American Fintech Council (AFC),  I appreciate the opportunity to submit this comment letter in response to the Office of the Comptroller of the Currency’s (OCC) Notice of Proposed Rulemaking regarding Permitted Payment Stablecoin Issuer (PPSI) Anti-Money Laundering, Countering the Financing of Terrorism (AML/CFT), and Sanctions Compliance Risk Management (Proposed Rulemaking).

AFC is a standards-based organization and the largest and most diverse trade association representing financial technology companies and innovative banks. On behalf of more than 150 member companies and partners, AFC promotes a transparent, inclusive, and customer-centric financial system by supporting responsible innovation and encouraging sound public policy. AFC’s membership includes banks, payments companies, digital asset firms, financial technology companies, infrastructure providers, and other participants operating throughout the modern financial services ecosystem.

AFC supports the OCC’s efforts to implement the AML/CFT and sanctions provisions of the GENIUS Act through a supervisory framework that strengthens protections against illicit finance while providing clear and consistent regulatory expectations for permitted payment stablecoin issuers. As the OCC finalizes the proposal, the resulting framework should remain risk-based, operationally practicable, and technology neutral while avoiding duplicative compliance obligations and remaining closely aligned with existing Bank Secrecy Act (BSA), the Financial Crimes Enforcement Network (FinCEN), and Office of Foreign Assets Control (OFAC) requirements. Such an approach would strengthen the integrity of the financial system while supporting continued responsible innovation throughout the payment stablecoin ecosystem. Accordingly, AFC respectfully offers the following recommendations

I. AFC Supports a Coordinated Federal Supervisory Framework that Promotes Regulatory Consistency and Effective AML/CFT Compliance

The proposed rulemaking represents an important step toward implementing the GENIUS Act through a cohesive federal supervisory framework that appropriately integrates the respective responsibilities of the OCC, FinCEN, and OFAC. AFC strongly supports the OCC’s objective of ensuring that PPSI’s maintain effective AML/CFT and sanctions compliance programs while avoiding the creation of an entirely separate regulatory regime that unnecessarily overlaps with existing federal requirements. As the payment stablecoin market continues to mature, regulatory consistency across the federal banking agencies and the Department of the Treasury will be essential to promoting both effective supervision and responsible innovation.

By incorporating the substantive AML/CFT and sanctions requirements administered by FinCEN and OFAC into the OCC’s supervisory framework, the proposed rulemaking would appropriately advance a more coordinated federal approach to regulating PPSI’s. This approach would promote greater consistency across the federal regulatory landscape, reduce unnecessary operational complexity, and enable regulated entities to build upon mature compliance programs that already satisfy longstanding BSA obligations. AFC strongly supports this coordinated approach and encourages the OCC to continue harmonizing its supervisory framework with Treasury’s implementing regulations wherever practicable.

To further promote regulatory consistency, the OCC should expressly provide that compliance with applicable FinCEN and OFAC regulations satisfies the corresponding AML/CFT and sanctions obligations established under the proposed rulemaking, except where the GENIUS Act expressly requires additional standards unique to PPSI’s. Such clarification would provide greater certainty regarding the relationship between the OCC’s supervisory framework and Treasury’s implementing regulations while reducing the potential for overlapping examination expectations or inconsistent compliance interpretations. Institutions operating across multiple federal regulatory regimes should not be required to reconcile duplicative supervisory requirements addressing substantially similar risks through different documentation standards, governance structures, or examination processes. Instead, the final rule should reinforce a unified federal framework that promotes consistency across agencies while preserving clear supervisory accountability.

The OCC should also expressly recognize that institutions may leverage existing enterprise AML/CFT infrastructure to satisfy the supervisory expectations established under the proposed rulemaking where those systems already achieve the underlying regulatory objective. Financial institutions should be permitted to rely upon existing transaction monitoring programs, suspicious activity reporting processes, sanctions screening systems, governance structures, and enterprise risk management controls rather than developing duplicative compliance infrastructure that provides little additional supervisory value. Accordingly, supervisory evaluations should focus on whether an institution maintains a reasonably designed and effective compliance program capable of identifying, assessing, and mitigating material illicit finance risks, rather than whether substantially similar compliance functions are maintained through multiple parallel regulatory frameworks.

The OCC should also avoid imposing duplicative compliance obligations where comprehensive federal requirements already govern the same operational or information governance activities. This is particularly important with respect to existing obligations under the Gramm-Leach-Bliley Act and other federal compliance frameworks that address privacy, information security, and related operational controls. Clarifying the relationship between the final rule and these existing requirements would promote regulatory certainty while reducing unnecessary compliance burdens.

II. AFC Supports Supervisory Standards that Promote Effective Risk Management, Regulatory Certainty, and Continuous Compliance

Establishing clear supervisory expectations will be essential to the successful implementation of the proposed rulemaking. Institutions should understand not only the substantive compliance obligations applicable to PPSI’s, but also the supervisory principles that will guide examinations, remediation efforts, and enforcement decisions. Clear supervisory standards would effectively encourage earlier investment in governance, strengthen risk management, and provide institutions with greater confidence to develop innovative payment products within a well-defined regulatory framework.

Accordingly, the OCC should continue emphasizing the effectiveness of an institution’s overall AML/CFT and sanctions compliance program rather than isolated operational deficiencies that do not materially impair its ability to identify, assess, or mitigate illicit finance risks. No compliance program can reasonably eliminate every operational error or prevent every instance of suspicious activity. Supervisory evaluations should therefore distinguish between isolated deficiencies that are promptly identified and remediated and broader weaknesses that reflect systemic failures in governance, internal controls, or enterprise risk management. Preserving this distinction will better align supervisory outcomes with the underlying objectives of the Anti-Money Laundering Act of 2020 while encouraging institutions to continuously improve their compliance programs through proactive risk management.

To facilitate effective implementation of the final rule, the OCC should provide institutions with greater clarity regarding its supervisory expectations. In particular, the final rule or accompanying supervisory guidance should articulate clear expectations regarding governance structures, board and senior management oversight, independent testing, escalation procedures, documentation standards, and remediation practices. Additional supervisory guidance in these areas would promote greater consistency across examinations, reduce implementation uncertainty, and enable institutions to allocate compliance resources more effectively in support of robust AML/CFT and sanctions compliance programs.

The OCC should also provide a clear and administrable standard for determining when a person has established an “account” with a PPSI for purposes of the customer identification program requirements. This question is particularly important where a person acquires a permitted payment stablecoin through a secondary market transaction or another process that does not involve a direct relationship with the issuer. The final rule should specify the facts or activities that create an account relationship and distinguish those circumstances from the mere acquisition or possession of a PPSI-issued stablecoin. Such standards should be sufficiently definitive to avoid inconsistent interpretations among issuers, service providers, and examination teams. To the extent that additional operational questions arise following implementation, AFC encourages the OCC to coordinate with FinCEN and the other appropriate federal agencies to issue interagency frequently asked questions or comparable guidance.

Additionally, there should be effort given in the final rulemaking towards preserving sufficient flexibility for each PPSI to develop identity verification procedures that are reasonably designed to address the risks associated with its customers, products, services, distribution channels, and transaction activity. A risk-based approach should permit a PPSI to select verification methods that are appropriate for its particular operating model, provided that those methods satisfy applicable customer identification requirements and effectively address relevant illicit finance risks. The OCC should, however, provide additional explanation regarding how a PPSI’s size and geographic location are expected to affect its identity verification procedures. Without further clarification, references to these factors may create uncertainty regarding whether similarly situated PPSIs are expected to apply different verification standards based primarily on organizational characteristics rather than identifiable customer or transaction risks.

The final rule should also recognize that PPSI’s frequently rely on third-party service providers to support various aspects of their AML/CFT and sanctions compliance programs. Technology providers, compliance vendors, blockchain analytics firms, and other service providers increasingly assist with transaction monitoring, sanctions screening, customer due diligence, and related compliance functions throughout the payment stablecoin ecosystem. Accordingly, the OCC should clarify that institutions retain flexibility to allocate these operational responsibilities among qualified third-party service providers, provided that the PPSI maintain appropriate oversight and ultimate accountability for compliance with applicable regulatory requirements. Clear supervisory expectations regarding third-party risk management would create much potential to augment governance, reduce operational uncertainty, and enable institutions to leverage specialized expertise while preserving robust compliance controls.

In addition, AFC encourages the OCC to reinforce supervisory practices that promote timely remediation and constructive engagement between regulated institutions and their supervisory teams. Institutions should be encouraged to identify emerging compliance risks, communicate potential concerns to supervisors, and implement corrective actions before those issues develop into material supervisory findings or enforcement matters. A supervisory framework that encourages ongoing dialogue and continuous improvement would generally produce stronger compliance outcomes than one that relies primarily upon retrospective enforcement following the identification of deficiencies. Supporting proactive engagement between regulators and supervised institutions would ultimately strengthen the effectiveness of AML/CFT compliance while fostering a culture of continuous risk management.

III. AFC Supports Technology Neutral and Risk Based Compliance Standards that Encourage Continued Innovation

As payment stablecoin technologies continue to evolve, the final rule should remain sufficiently flexible to accommodate future developments in compliance capabilities, operational models, and blockchain infrastructure. A supervisory framework that is tied to particular technologies or prescriptive compliance methodologies may quickly become outdated as the payment stablecoin ecosystem matures. Instead, the OCC should continue emphasizing principles-based standards that evaluate the effectiveness of an institution’s compliance program while allowing institutions to determine the technological solutions most appropriate for their individual business models and risk profiles.

Accordingly, the OCC should make clear that the final rule establishes performance-based compliance expectations rather than prescribing particular technologies or operational methodologies. Institutions should retain flexibility to implement the risk management tools and compliance technologies best suited to their business models, provided those solutions effectively satisfy applicable AML/CFT and sanctions requirements. A technology neutral framework will encourage continued investment in blockchain analytics, automated transaction monitoring, wallet screening capabilities, artificial intelligence, machine learning, and other innovative compliance technologies while ensuring that supervisory expectations remain focused on effective compliance outcomes rather than the specific technologies used to achieve them.

The final rule should also remain sufficiently adaptable to accommodate continued advancements in compliance capabilities and the broader payment stablecoin ecosystem. Emerging technologies increasingly enable institutions to improve transaction monitoring, enhance sanctions screening, strengthen investigative capabilities, and reduce false positives in ways that were not previously possible through more traditional compliance processes. The OCC should therefore avoid establishing supervisory expectations that become tied to current technological capabilities or operational models. A principles-based framework focused on effective compliance outcomes will better position the regulatory framework to evolve alongside future technological developments while preserving strong protections against illicit finance.

Finally, AFC encourages the OCC to continue engaging with industry participants as payment stablecoin technologies, compliance capabilities, and illicit finance risks continue to evolve. Ongoing dialogue between regulators and regulated entities will help ensure that supervisory expectations remain responsive to emerging risks while allowing responsible innovation to continue within a clear and predictable regulatory framework. Continued engagement will also provide the OCC with valuable operational insight as institutions deploy new compliance technologies and risk management practices that may inform future supervisory guidance. Maintaining this collaborative approach will strengthen the long-term effectiveness of the regulatory framework while supporting responsible innovation throughout the payment stablecoin ecosystem.

* * *

AFC appreciates the OCC’s efforts to implement the GENIUS Act through a supervisory framework that strengthens protections against illicit finance while supporting the continued development of the payment stablecoin ecosystem. As the OCC finalizes the proposed rulemaking, AFC believes the final rule will be most effective if it remains coordinated with existing federal regulatory requirements, provides clear supervisory expectations for regulated entities, and preserves sufficient flexibility to accommodate continued innovation in AML/CFT compliance.

A final rule grounded in these principles will provide regulated entities with greater regulatory certainty, encourage the development of robust compliance programs, and strengthen the long-term safety, integrity, and competitiveness of the United States payment stablecoin market.  AFC looks forward to continuing to work with the OCC as it finalizes and implements the GENIUS Act.

Sincerely,

Ian P. Moloney
Chief Policy Officer
American Fintech Council

‍