KYC and Customer Identification Requirements
Published 6/22/2026, 1:43:26 PM
The GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins), enacted on July 18, 2025, does not eliminate stablecoin privacy but formalizes a two-tiered ecosystem. While it mandates bank-level surveillance for centralized intermediaries, it includes explicit "safe harbor" protections for self-custody and peer-to-peer (P2P) transactions. The primary privacy risk introduced is the federal requirement for issuers to maintain "freeze and burn" capabilities, which allows for state-level intervention on-chain.
KYC and Customer Identification Requirements
Under the Act, Permitted Payment Stablecoin Issuers (PPSIs) are classified as "financial institutions" under the Bank Secrecy Act (BSA) [Source: https://www.sullcrom.com/SullivanCromwell/_Assets/PDFs/Memos/GENIUS-Act-Enacted.pdf]. This classification triggers several mandatory requirements for users interacting with regulated entities:
- Customer Identification Programs (CIP): Issuers must collect full identity data, including Name, Address, SSN/TIN, and Government ID [Source: https://home.treasury.gov/news/press-releases/sb0435].
- Travel Rule Compliance: Intermediaries must transmit originator and beneficiary information for transfers, mirroring traditional wire transfer standards.
- Freeze and Burn Mandate: Section 4 requires issuers to maintain the technical capability to freeze, burn, or block tokens in response to lawful orders [Source: https://www.sullcrom.com/SullivanCromwell/_Assets/PDFs/Memos/GENIUS-Act-Enacted.pdf].
Privacy Protections and Exemptions
The Act contains specific exclusions to preserve the decentralized nature of blockchain for individual users:
- Self-Custody Safe Harbor: The legislation explicitly does not regulate transactions made via software or hardware wallets where the individual maintains their own custody [Source: https://www.congress.gov/bill/119th-congress/senate-bill/1582].
- P2P Exemption: Direct transfers between two individuals acting on their own behalf for lawful purposes are exempt from these regulatory requirements [Source: https://www.congress.gov/bill/119th-congress/senate-bill/1582].
- Infrastructure Providers: Developers of protocols, validators, and self-custodial interfaces are excluded from the definition of "digital asset service providers," shielding them from KYC obligations.
Privacy Trade-offs and Risks
The GENIUS Act creates a "regulated perimeter" where privacy is traded for institutional access.
| Feature | Privacy Status under GENIUS Act | Impact on User |
|---|---|---|
| Self-Custody Wallets | ✅ Protected | No KYC required for private wallet use. |
| P2P Transfers | ✅ Protected | Direct individual-to-individual transfers remain private. |
| Issuer Redemptions | ❌ Reduced | Full identity verification required to mint/redeem. |
| Exchange Trading | ❌ Reduced | Subject to BSA/AML and Travel Rule reporting. |
| On-Chain Control | ⚠️ At Risk | Issuers can freeze/burn tokens via lawful order. |
Implementation Timeline
The regulatory framework is currently moving through its rulemaking phase, with full enforcement expected by early 2027.
- June 18, 2026: Deadline for agencies to issue joint proposed rules for Customer Identification Programs (CIP).
- January 18, 2027: Final effective date for the Act's primary provisions (18 months after enactment) [Source: https://www.paulhastings.com/insights/crypto-policy-tracker/].
In summary, the GENIUS Act preserves privacy for those operating entirely within the self-custody ecosystem but effectively ends pseudonymity for any user who interacts with the regulated "on-ramps" or "off-ramps" of the U.S. financial system.