OCC GENIUS Act Final Rule: The Stablecoin Controls That Must Work by January 18

TL;DR

• The OCC GENIUS Act final rule takes effect January 18, 2027, covering reserves, redemption, capital, custody, risk management, reporting, applications, and supervision.
• The final reserve rule requires at least 5% in immediately available balances and generally caps exposure to one counterparty at 40%; it drops the proposal’s 30% weekly-liquidity test and large-issuer insured-deposit minimum.
• Redemptions remain subject to a two-business-day ceiling. A 10% redemption surge triggers notice to the OCC and permits an extension request, but no automatic extension.
• Existing issuers should build one evidence-backed gap register now. A pending application does not itself create relief: the issuer needs a substantially complete filing and a separate OCC waiver.

The OCC just replaced stablecoin planning assumptions with an operating deadline.

On October 21, the agency issued its final rule implementing the GENIUS Act. It becomes effective January 18, 2027. That leaves less than three months for an OCC-supervised issuer to prove that reserves can be monetized under stress, redemptions can clear inside two business days, reports reconcile, and the application record is substantially complete.

The interesting part is not that the OCC kept 1:1 reserves. Everyone expected that. The useful practitioner question is what changed between proposal and final rule—and which controls now need executable evidence rather than another policy draft.

What the OCC GENIUS Act final rule actually covers

The rule creates a new 12 CFR Part 15. It applies to OCC-supervised permitted payment stablecoin issuers, including relevant national-bank and federal-savings-association subsidiaries, federal qualified nonbank issuers, certain state-qualified issuers under OCC authority, and foreign payment stablecoin issuers within the agency’s jurisdiction. It also reaches specified custody activity performed by OCC-supervised entities.

The OCC’s release lists the operating perimeter:

• permitted activities;
• reserve assets and redemption;
• risk management, audits, reports, and supervision;
• transition from state to federal supervision;
• reserve and private-key custody;
• applications and registrations;
• foreign-issuer examination;
• approval revocation; and
• capital and the operational backstop.

One important exclusion: this final rule does not finish the Bank Secrecy Act, anti-money-laundering, or OFAC sanctions framework. Treasury and the OCC say that work will arrive separately. Compliance teams should keep that as a distinct dependency instead of marking “GENIUS implementation” complete when Part 15 is mapped.

Four final-rule changes that break the old project plan

The proposal described two reserve options. The final rule chose neither option unchanged. That means any requirements matrix copied from the NPRM is already stale.

The 5% number should not be read as permission to run the entire reserve program to a 5% liquidity target. Section 15.11 requires the portfolio to remain capable of supporting timely redemption under normal and adverse conditions. It expressly allows the OCC to expect reserves beyond the quantitative floor based on the issuer’s business model and risk profile.

That distinction will matter in examination. A dashboard can show “5.2%—green” while the issuer still cannot monetize enough assets inside its actual redemption window. The test is operational capability, not a colored cell.

Reserve compliance now needs three reconciliations

The final rule PDF requires reserve assets to be identifiable, segregated, uncommingled, and at least equal to outstanding issuance value at all times. Eligible assets include U.S. currency and Federal Reserve balances, qualifying on-demand deposits, Treasury securities with 93 days or less remaining maturity, specified overnight repo and reverse-repo positions, qualifying government money market funds, approved similar federal assets, and certain tokenized forms of eligible reserves.

A defensible reserve control is not one reconciliation. It is three:

1. Token liability to reserve value. Reconcile outstanding issuance by chain and contract to reserve fair value. Investigate mint, burn, bridge, and valuation breaks before the report is certified.
2. Reserve ledger to custodian evidence. Match each reserve position to bank statements, custody records, repo confirmations, maturity data, and legal ownership. A general-ledger balance without custodian evidence does not establish access.
3. Reported reserve to public disclosure. Reperform the monthly composition table and trace every published category, tenor, and custody geography back to the controlled data set.

The rule requires the monthly reserve-composition report on the issuer’s website by noon on the last day of each month, using prior-month-end data. The practical failure mode is predictable: Treasury closes one data set, Finance certifies another, and Communications posts a manually edited table. Put all three functions on one production calendar with named preparer, reviewer, approver, source-system timestamp, and exception log.

The OCC also kept weekly supervisory reporting and quarterly condition-and-income reporting. Bulletin 2026-52 links the proposed PS-01 and PS-02 forms and instructions. Even while the information collection proceeds through OMB, those forms are a useful data-dictionary test: if the organization cannot source a field reliably today, log the gap now.

The two-day redemption promise needs a stress test, not a procedure

Section 15.12 says timely redemption may not exceed two business days. The obligation begins after the issuer receives the order and completes legally necessary onboarding under procedures designed not to create undue delay.

The surge trigger is equally concrete. If one stablecoin brand receives redemption requests above 10% of outstanding issuance during a 24-hour period, the issuer must notify the OCC within 24 hours. It may ask for more time, but the OCC decides whether to grant it.

Run a tabletop that forces the process across its messy handoffs:

• Operations validates the order and starts the clock.
• BSA/AML and sanctions teams resolve screening holds without turning onboarding into an undeclared redemption delay.
• Treasury sells or accesses reserves and documents haircuts, settlement timing, and failed-trade contingencies.
• Finance updates issuance and reserve balances after the burn.
• Legal and Regulatory Affairs prepare the OCC notice if the 10% threshold is crossed.
• Customer Operations uses the published policy and approved fee disclosures, including the required seven-calendar-day advance notice for a fee change.

Evidence should include the timestamped test script, transaction extracts, funding confirmations, exception tickets, decision log, and after-action remediation. “We tested redemption” is not enough when nobody can establish when the regulatory clock began.

Capital and the backstop are separate pools

The final rule sets a $5 million minimum capital floor. De novo issuers must maintain at least the greater of $5 million or the amount in their OCC licensing conditions, and all issuers remain subject to an ongoing $5 million floor plus risk-based expectations.

The operational backstop is different. It must equal 12 months of total expenses and consist of specified highly liquid assets. It must be separately identified from Part 15 reserve assets. An issuer that counts the same cash as token backing, capital, and operational runway has not built three safeguards; it has counted one dollar three times.

Finance should produce a backstop memo with:

• the trailing-quarter expense inputs and general-ledger mapping;
• treatment of one-time expenses, including any OCC approval to exclude them;
• asset eligibility and insurance evidence;
• funding source, including any debt component;
• separate balance-sheet and regulatory-report presentation; and
• a quarterly sign-off by the CFO and CRO.

Falling below either minimum triggers notice to the OCC within 24 hours. Continuing noncompliance can stop new issuance, and noncompliance at two consecutive quarter-ends can force liquidation of reserves and redemption without customer fees. That consequence makes capital and backstop monitoring a daily control, not a quarter-end certification exercise.

The waiver window is narrower than “application pending”

OCC Bulletin 2026-51 is the document existing issuers should read first. Beginning January 18, issuing a U.S. payment stablecoin without the required approval can carry criminal penalties. The statute did not create a blanket transition period for current operators.

An issuer may request a waiver lasting no more than 12 months if it has a substantially complete application pending with the OCC by January 18. The filing and the waiver request are separate artifacts. The OCC also says it will not begin accepting them until OMB approves the application-form information collection; the agency will announce that opening separately.

That produces a sequencing risk no project manager can solve by adding a later due date. Build the submission binder now, but track OMB approval and the OCC opening announcement as external dependencies. The licensing lead should maintain a completeness index showing the owner, final version, approval date, and source evidence for every required exhibit.

A 30/60/90-day implementation plan

Days 1–30: freeze the rule interpretation

• Legal creates a proposal-to-final change log, with each Part 15 citation mapped to policy, procedure, system, report, contract, and evidence owner.
• Compliance separates completed Part 15 work from pending BSA/AML/OFAC rulemaking.
• Treasury recalculates reserve liquidity and counterparty concentration using the final 5% and 40% requirements.
• PMO opens issues for every missing control or artifact. Each issue gets severity, root cause, owner, due date, dependency, and closure evidence.

Days 31–60: run the controls

• Operations and Treasury execute a two-business-day redemption stress test and a 10% surge tabletop.
• Finance dry-runs the monthly public composition report, weekly PS-01 data, quarterly PS-02 data, capital floor, and 12-month backstop calculation.
• Third-Party Risk obtains evidence from custodians, banking partners, repo counterparties, cloud providers, and key-management vendors.
• Internal Audit or independent validation samples source-to-report lineage and challenges any manually adjusted field.

Days 61–90: close gaps and assemble the filing record

• Licensing counsel finishes the application completeness index and draft waiver request.
• CCO and CRO review open high-risk issues and document any item that cannot close before January 18.
• Board or designated committee approves the final risk acceptance and receives the readiness dashboard.
• Internal Audit validates closure using the actual evidence—not the action owner’s statement that work is done.

The human part of this will get messy around ownership. Treasury owns reserves, Product owns rewards, Operations owns redemption, Finance owns reports, and Legal owns the filing. Nobody naturally owns the seams. Give the CRO or CCO authority to reject a closure package when those seams remain untested.

So what should be on Monday’s dashboard?

Put five indicators in front of the implementation steering group:

1. percentage of final-rule requirements mapped to a control owner;
2. unresolved data fields in monthly, weekly, and quarterly reports;
3. reserve assets immediately available and largest counterparty exposure;
4. tested redemption completion time and unresolved exceptions; and
5. application exhibits complete, approved, and supported by evidence.

Calibrate status thresholds to the January 18 deadline and the organization’s own remediation throughput. Do not let teams close gaps by lowering severity or splitting one overdue requirement into several “in progress” tasks. Reconcile every closure to the rule citation and retained artifact.

If that register is still living across legal redlines, Slack threads, and a launch spreadsheet, the Issues Management Tracker & Template gives the CCO one place to assign owners, track deadlines, preserve evidence, and validate closure before January 18.

Related reading:

• Federal Reserve Stablecoin Rules: The Capital Math and Application Binder Banks Need Now
• Stablecoin Issuers and the Proposed Customer Identification Mandate