The OCC's Final GENIUS Act Rules: What Stablecoin Issuers Need to Know

The Office of the Comptroller of the Currency (OCC) has finalized its rulebook for payment stablecoin issuers under the GENIUS Act. The rules take effect on January 18, 2027, the same day the GENIUS Act itself takes effect. Any issuer that wants to be in the U.S. market on day one has less than three months to get its house in order.

This is the first final rule from any federal stablecoin regulator, so it sets the template for the U.S. market. It answers the questions issuers have been asking since the Act was signed in July 2025: what can go into reserves, how fast you must redeem, how much capital you need, what you must publish every month, and what the OCC will look at when it examines you.

The headline takeaways:

• It's final, and it's effective with the Act. New 12 CFR part 15 takes effect January 18, 2027. There is no phase-in for the core requirements.
• Reserves got more flexible, but not loose. The OCC dropped several proposed constraints, including the 10% insured-deposit floor, the weekly liquidity bucket and a weighted-average-maturity cap. It kept a 5% on-demand cash minimum and a 40% single-counterparty limit, and added explicit monetization and stress-testing duties.
• Two-day redemption is the hard line. Redemption may not take more than two business days. The proposed automatic extension during heavy outflows is gone; the OCC must now approve any extension.
• The yield ban stands, but the rebuttable presumption is gone. Issuers still may not pay interest or yield to holders. The OCC dropped the proposed presumption that affiliate and third-party rewards are prohibited yield. It kept its anti-evasion authority and declined to grandfather existing rewards programs.
• Capital is simpler. A $5 million floor, plus an operational backstop of liquid assets equal to 12 months of total expenses, up to half of which can be funded with qualifying subordinated debt.
• Smart contracts are in scope. The IT and security program must validate that key systems, "including smart contracts," operate as intended, with periodic independent testing.

Below, we walk through what the rulebook is, who it covers, what each part requires, and what issuers should be doing now.

What the Rulebook Is

The GENIUS Act (12 U.S.C. 5901 et seq.) set the statutory framework for payment stablecoins, but left much of the detail — capital, liquidity, operational risk, reporting — to the "primary Federal payment stablecoin regulators." For national banks, federal savings associations, federal branches of foreign banks and federally licensed nonbank issuers, that regulator is the OCC.

The OCC proposed its rules on March 2, 2026 (91 FR 10202) and received roughly 328 comments from crypto firms, banks, trade groups, academics and individuals. The final rule (Docket OCC-2025-0372) creates a new 12 CFR part 15, "Payment Stablecoins," and makes conforming changes to part 3 (capital), part 6 (prompt corrective action), part 8 (assessments) and part 19 (enforcement procedure).

Part 15 has five subparts:

Effective Date

The rule is effective January 18, 2027. Under the Act, the statute takes effect on the earlier of 18 months after enactment or 120 days after the regulators issue final rules. Because this is the first final rule and 120 days after its issuance would fall after January 18, 2027, the 18-month date controls.

What Changed from the Proposal

The OCC kept the architecture of the proposal but made it more workable for issuers in several places:

• Reserves: chose a slimmed-down version of the proposal's "Option B." The on-demand cash minimum fell from 10% to 5%. The weekly liquidity requirement, the per-institution concentration test, the weighted-average-maturity limit and the minimum insured-deposit requirement were all dropped. Excess reserves can be withdrawn at any time after due diligence, not once a month.
• New permitted activities: holding small amounts of non-stablecoin digital assets for gas and network fees, setting up trust or security-interest structures over reserves for holders' benefit, and FX hedging for non-USD coins.
• Redemption: removed the automatic extension of the redemption deadline during large outflows.
• Yield: eliminated the rebuttable presumption covering affiliate and third-party payments.
• SPV structures: "outstanding issuance value" no longer includes the word "consolidated," so each special-purpose issuer only reserves against its own coins.
• Capital: replaced the bank-style CET1 / additional tier 1 framework with GAAP equity less deductions, and spelled out how subordinated debt can fund half of the backstop.
• Exams: shortened the extended cycle for small issuers from 18–36 months to 18–24 months.

The OCC says it expects to revisit the rule in coming years as business models evolve, and that it will issue guidance alongside it.

Who It Applies to

Part 15 applies to issuers and custodians within the OCC's jurisdiction, and only to them. The OCC rejected calls to sweep in blockchain infrastructure, tech vendors or other service providers by activity: if an entity is not one of the types below, part 15 does not reach it (though issuers must flow requirements down to their vendors by contract, discussed later).

A few scoping points matter in practice:

• The activity list is exclusive. A permitted issuer "may not engage in any activity other than" those listed in § 15.10(a). Banks keep their existing powers, and issuers may still conduct digital-asset service activities the Act authorizes under section 4(a)(7)(B).
• State preemption is self-executing. The Act makes the OCC the exclusive licensor and supervisor of Federal qualified issuers and preempts State licensing for them and for OCC-regulated bank subsidiaries. State consumer protection laws are not preempted. The OCC wrote no rule text on this and will take questions case by case.
• Outstanding issuance value is per issuer. It counts only coins the issuer is obligated to redeem. Minted coins held in treasury, repurchased coins sitting in inventory and burned coins are excluded; frozen coins are included. Unconsolidated affiliates are generally not counted, which supports multi-SPV structures, but the OCC warns it will look through structures used to stay under the $10 billion State threshold.
• "United States customer" means an individual residing in the U.S., an entity organized under U.S. or State law, or one with its principal place of business here, judged at onboarding. This drives the foreign-issuer reserve test.

Part 1: Getting Licensed (§§ 15.30–15.33)

No domestic entity under OCC jurisdiction may issue a payment stablecoin without prior OCC approval. Bank-affiliated issuers apply for their subsidiary; nonbanks, uninsured national banks and uninsured federal branches apply to become Federal qualified issuers.

What Goes in the Application

• The OCC application form (posted on occ.gov), plus an Interagency Biographical and Financial Report or Corporate Background and Financial Report for every director, executive officer and 10%+ shareholder. The OCC may collect fingerprints for FBI background checks.
• A certification that the filing contains no material misrepresentations or omissions. False statements can bring criminal penalties under 18 U.S.C. 1001.
• A certification of whether section 4(a)(12) of the Act applies — the provision covering public companies not predominantly engaged in financial activities.

The Clock

1. Day 30: the OCC tells you whether the application is "substantially complete," or what is missing. It has another 30 days to respond each time you supplement.
2. Abandonment: an application still incomplete 60 days after the OCC's deficiency notice is returned without decision.
3. Day 120: a substantially complete application is deemed approved unless the OCC denies it first. A material change in circumstances can restart the clock.
4. Denial: within 30 days the OCC must give a written explanation, with findings and "actionable recommendations." You can appeal within 30 days, on the written record or with oral argument, and the Comptroller reviews anew. You can also simply refile.

What the OCC Weighs

The five review factors are: (1) financial condition and resources to meet subpart B; (2) any officer or director convicted of a felony involving insider trading, embezzlement, cybercrime, money laundering, terrorist financing or financial fraud; (3) the competence, experience, integrity and compliance record of officers, directors and principal shareholders, including at parents and subsidiaries; (4) whether the redemption policy meets § 15.12; and — new in the final rule — (5) whether the proposed structure adequately addresses run risk and ensures the ability to redeem.

Safe Harbor for Day-one Applicants

An entity with a substantially complete application pending on or before January 18, 2027 can ask the OCC to waive the Act and part 15 for up to 12 months. The OCC may grant it if it is in the public interest or extraordinary circumstances justify it, and can still deny the underlying application. In practice, this makes a complete filing before the effective date the single most important near-term milestone.

Foreign Issuers

A foreign issuer can serve U.S. customers only if the Treasury has found its home regime comparable to the GENIUS Act, its home country is not under comprehensive U.S. sanctions or a primary money laundering concern, and it registers with the OCC. Registration is deemed approved on day 30 unless rejected. Conditions include consent to U.S. jurisdiction, English-language access to books and records, and a monthly report of coins held by U.S. customers and the reserves behind them.

The key test is U.S.-held reserves. A foreign issuer must hold enough reserves at U.S.-organized eligible institutions to meet U.S. customers' liquidity demands, and the rule gives four ways to show it: attest that under 50% of issuance is U.S.-held and keep at least 50% of reserves onshore; keep substantially all reserves onshore; demonstrate ongoing sufficiency under normal and stressed conditions; or get an OCC-approved bespoke plan. Foreign issuers are also bound by the yield ban.

Losing a License

The OCC may revoke a domestic approval if the issuer fails to file its AML and sanctions certification (see Part 4), and may rescind a foreign registration for insufficient reserves, illicit finance risk or financial stability risk, in consultation with Treasury.

Part 2: What You Can Do, What You Must Hold, and How Fast You Must Pay (§§ 15.10–15.12)

Permitted Activities and Hard Prohibitions

An issuer may issue and redeem; manage reserves; custody stablecoins, reserves and private keys; charge purchase and redemption fees; act as principal or agent; pay fees to facilitate customer transactions; and do anything that directly supports those activities, including hiring third parties. The final rule adds three activities:

• Holding non-stablecoin digital assets as principal — only as much as is reasonably needed to pay customer and network fees or to test on distributed-ledger platforms.
• Trust or security-interest structures over reserves, if the security interest is solely for holders, does not impair normal-course redemption, creates no competing claims in insolvency, and does not block a receiver from moving or liquidating reserves to pay holders.
• FX hedging for non-USD stablecoins, with prior OCC approval (see Part 3).

The prohibitions:

• No names using "United States," "United States Government" or "USG" ("USD" is fine), and no marketing that suggests legal tender, U.S. issuance or a government guarantee.
• No claims of full faith and credit, government guarantee, or FDIC or NCUA insurance.
• No interest or yield to holders, in cash, tokens or other consideration, solely for holding, using or retaining the coin.
• No pledging, rehypothecating or reusing required reserves, except for margin on repo and reverse repo, standard custody obligations, or repo of Treasury bills of 93 days or less to meet expected redemptions. The OCC gave blanket approval to such repos, so they no longer need to be centrally cleared.
• No activity the OCC determines is an evasion of section 4 of the Act.

On yield, the final rule is notable for what it removed. The proposal presumed that affiliate or "related third party" payments to holders were prohibited yield unless rebutted. That presumption is gone, and the OCC declined to publish lists of permitted or prohibited arrangements. But it did not create safe harbors either: there is no de minimis exemption, no cure period, no retail/institutional distinction, and pre-existing rewards programs get no grandfathering. The OCC will judge each arrangement on its facts and expressly retains anti-evasion authority. It also noted that pending market-structure legislation may change the picture. Issuers and their distribution partners should treat every rewards program as something they may need to defend.

Reserves (§ 15.11)

Reserves must be identifiable, segregated, held by the issuer or an eligible financial institution, and at all times worth at least 100% of outstanding issuance value. Beyond the 1:1 floor, the issuer must show it can actually turn reserves into cash in normal and adverse conditions, taking into account market access, financing channels, haircuts and operational readiness, and hold a buffer above 1:1 "to the extent necessary." Excess reserves may be withdrawn at any time after confirming the withdrawal will not breach 1:1; reserve income can be withdrawn without that diligence step.

Eligible reserve assets are limited to:

Two numerical limits apply on top of a principles-based diversification duty:

• At least 5% of reserves in on-demand deposits, credit union share accounts or Fed balances.
• No more than 40% of reserves exposed to any single counterparty. U.S. government exposures, centrally cleared repo and reverse repo, and assets held at an "appropriate custodian" are excluded. To qualify, the issuer must identify itself to the custodian as a stablecoin issuer, get the custodian's commitment to section 10 of the Act, and monitor the arrangement.

The OCC stresses that meeting the numbers may not be enough: depending on business model, an issuer may need a portfolio more conservative than the minimums and a reserve balance above 1:1.

Monthly Transparency (§ 15.11(e)–(f))

By noon on the last day of each month, the issuer must publish on its website the composition of reserves as of noon on the last day of the prior month, using the OCC template. The template shows outstanding coins; reserves by category, split into insured and uninsured deposits, tokenized holdings and repo liabilities; average tenor; and geographic location of custody. A separate report is required for each brand backed by a distinct pool, and for each SPV issuer.

At the same time, the issuer must publish a registered public accounting firm's examination report on that composition, and the CEO and CFO must certify its accuracy to the OCC every month.

When Reserves Fall Short (§ 15.11(g))

The consequences escalate quickly:

1. Same day: notify the OCC on any day reserves dip below 1:1, and stop issuing new coins immediately, except for cross-chain transfers that do not increase net supply.
2. 15 consecutive business days short (extendable by the OCC): begin liquidating reserves and redeeming all outstanding coins, with no redemption fees.
3. At any time, the OCC can demand a remediation plan, or order full redemption if it sees significant risk the issuer cannot get back into compliance.

Redemption (§ 15.12)

Redemption must be completed within two business days of the request. The obligation starts once the issuer has the order and, if its onboarding procedures are designed not to unduly delay customers (including in times of stress), once the customer is onboarded. It is complete when the issuer has initiated the outgoing transfer or credited the customer's account.

The published redemption policy must state the two-day deadline and the timeframe the issuer actually targets; that only regulators can impose discretionary limits; when extensions may apply; clear step-by-step instructions with a link to the redemption site; and any minimum redemption amount. Any minimum must allow redemption of as little as one coin, subject to screening and onboarding.

If requests in any 24-hour period exceed 10% of a brand's outstanding issuance value, the issuer must notify the OCC within 24 hours and may ask for more time. The proposal's automatic extension is gone; the OCC decides. The OCC will not require a redemption that would make the issuer break other laws, such as sanctions.

Required Disclosures (§ 15.12(e))

In plain language, segregated from other content, on the website and in every customer agreement, the issuer must disclose:

• the issuer's name, and that it is the entity obligated to redeem;
• where to find the monthly reserve report;
• all purchase and redemption fees, with seven calendar days' notice to holders before any change;
• that the coin is not legal tender, not issued, guaranteed or approved by the United States; and
• that it is not a deposit, not backed by the full faith and credit of the U.S., and not FDIC- or NCUA-insured.

Part 3: Capital, Liquidity and the Operational Backstop (§§ 15.13(a)(8)–(10), 15.40–15.42)

Reserves protect holders' claims. Capital and the backstop protect the issuer's ability to keep operating — and to wind down in an orderly way — if something goes wrong.

Minimum Capital

Capital is measured simply: GAAP equity minus goodwill and other intangibles, net deferred tax assets, and the portion of the operational backstop funded by equity. The requirements:

• De novo issuers (approved within the past three years, or State issuers that transitioned within three years without a waiver): the greater of $5 million or the amount set in the OCC's licensing conditions, held for 36 months unless the OCC sets a different period.
• All issuers, ongoing: at least $5 million, plus capital "commensurate with the level and nature of all risks," including off-balance-sheet risk. Issuers need an internal capital adequacy assessment process and a written strategy for sustaining capital.
• Individual add-ons (§ 15.42): the OCC can impose higher capital or backstop requirements for reasons such as weak risk management, volatile issuance and redemption, significant off-balance-sheet activity, or exposure to troubled affiliates. Issuers get written notice and 30 days to respond.

Operational Backstop

Separately from reserves, every issuer must hold liquid assets equal to 12 months of total expenses, in cash, Fed balances, fully insured on-demand deposits, or Treasuries of 93 days or less. These assets must be shown separately from reserves on regulatory reports. Expenses are based on the trailing four quarterly reports; new issuers use actual or reasonably projected expenses. One-time expenses unrelated to ongoing operations can be excluded with OCC approval, and an acquirer must add the target's historical expenses.

Up to 50% of the backstop can be funded with subordinated debt if it is paid in, unsecured, subordinated to holders and general creditors, has at least five years' maturity, carries no acceleration or credit-sensitive features, is callable only after five years with OCC approval, and is not funded by an affiliate. Eligibility amortizes 20% a year over the final five years.

A simple illustration: an issuer with $20 million in annual expenses needs a$20 million backstop. If it funds $10 million with qualifying sub debt, the other$10 million of equity-funded backstop assets is deducted from capital. It therefore needs at least $15 million of GAAP equity (net of intangibles and DTAs) to clear the$5 million floor.

When Capital or the Backstop Falls Short

• Notify the OCC within 24 hours of any breach during a quarter, and disclose publicly on the quarterly report whether the requirements were met.
• Still short at quarter-end: no new issuance from the first day of the following month until cured. The OCC can impose this earlier.
• Short at the end of two consecutive quarters: begin liquidating reserves and redeeming all coins, with no fees and no new issuance.
• If the backstop was drawn down to handle a temporary disruption, the OCC may let the issuer keep operating if it files a plan within seven days to restore the backstop within 90 days.

Liquidity, Stress Testing and FX

The final rule replaces several hard-coded liquidity tests from the proposal with explicit risk management duties in § 15.13:

• Monitor and validate compliance with the reserve rules, and manage liquidity and concentration risk for your business model.
• Show the OCC that the portfolio supports timely redemption across a range of redemption scenarios, and that you can reliably monetize reserves under stress, considering market access, financing channels, haircuts and operational readiness.
• Stress test the reserve portfolio regularly to confirm it stays at or above 1:1, including under significant rising-rate scenarios.
• Non-USD issuers must hedge residual FX risk down to "minimal" levels, with no speculative or anticipatory positions. They need policies covering margin, counterparty and basis risk, and prior OCC approval before hedging.

Uninsured national trust banks may, with OCC approval, elect to use the part 15 capital and backstop framework in place of the bank capital rules in 12 CFR part 3.

Part 4: Risk Management, Security, Custody and AML (§§ 15.13, 15.14(k), 15.20–15.23)

The Act requires these standards to be "principles-based," and the OCC kept them technology-neutral. Most are adapted from the OCC's safety-and-soundness standards for banks (12 CFR part 30) and scale with size and complexity. The OCC declined to mandate real-time on-chain monitoring or API reporting. Principles-based does not mean optional: examiners will test each element.

Governance and Internal Controls

• Internal controls and information systems with clear lines of authority, segregation of duties and dual controls. They must support effective risk assessment, timely and accurate regulatory reporting, and procedures to safeguard and monetize reserves.
• Internal audit, or for smaller issuers a system of independent reviews of key controls. It must be independent and staffed by qualified people, and must test controls, verify customer-facing published information and reserve calculations, and check regulatory filings. The audit committee or board reviews its effectiveness.
• Interest rate risk management with periodic reporting to management and the board.
• Prudent growth matched to risk management, operations and staffing, and an earnings monitoring system that supports required capital.
• Insider and affiliate transactions must, individually and in aggregate, be not quantitatively detrimental, not pose significant loss risk, be on market terms, and be documented and reviewed by the board.
• Service providers: due diligence in selection, contractual flow-down of part 15 and GENIUS Act requirements, and ongoing monitoring, including reviewing providers' audits and test results.

Information Technology and Security

This is the area most relevant to on-chain operations. Every issuer needs a comprehensive written information security program, approved and overseen by the board or a board committee, with a qualified individual in charge. The final rule dropped the proposal's required "IT and Security Officer" title. The program must include:

• an inventory and classification of assets, processes and data sensitivity;
• controls safeguarding sensitive information and processes;
• evaluation, validation and reporting processes showing that key systems and controls, "including smart contracts," operate as intended;
• periodic independent testing;
• an incident identification, assessment and response program;
• administrative, technical and physical safeguards for nonpublic personal information and "sensitive customer information." That term expressly includes a customer's public key combined with their private key;
• secure handling of digital assets, including private key management, backup and recovery, tailored to each asset and its underlying ledger, and updated for material developments on those ledgers;
• ongoing monitoring of threats, technology and business changes, with the program adjusted accordingly; and
• resilience: business impact analyses, vulnerability testing and testing with critical service providers to ensure continuity and recovery of critical functions.

Breach notification: on discovering unauthorized access to sensitive customer information, including private keys, the issuer must investigate promptly. If misuse has occurred or is reasonably possible, it must notify affected customers and the OCC as soon as possible. Notice can be delayed only at a law enforcement agency's written request. If the issuer cannot tell which customers in a group were affected, it must notify the whole group.

Custody (Subpart C)

Subpart C applies to any national bank, federal savings association, federal branch or permitted issuer that custodies covered assets: reserves, payment stablecoins it knows are being used as collateral, and private keys used to issue payment stablecoins, for coins offered in the U.S. Custodians must:

• record covered assets separately and treat them as the customer's property, protected from the custodian's and any sub-custodian's creditors, under written custody agreements, policies and controls;
• maintain possession or control. For tokens and issuing keys, "control" means being able to show that no other party, including the customer, can move the asset without the custodian's consent. The OCC confirmed that multi-signature, distributed key-control, multiparty computation (MPC) and shared-key architectures fit this standard;
• segregate customer assets from their own. Omnibus accounts are permitted with adequate recordkeeping and disclosure in the custody agreement, and sub-custodians may use omnibus accounts if the custodian oversees segregation.

Providers of self-custody hardware or software are excluded, as long as they neither control nor claim to control the keys.

AML and Sanctions

The Act treats issuers as financial institutions under the Bank Secrecy Act, with program rules coming from Treasury and FinCEN. Part 15 adds two OCC-specific obligations:

• Certification within 180 days of approval and annually after: the issuer certifies that its AML and sanctions programs are reasonably designed to prevent money laundering — particularly for cartels and designated foreign terrorist organizations — and terrorist financing. The board signs the first certification; later ones may come from the BSA officer, the board or a committee. Missing it is grounds for revoking the license.
• Reports on request: Federal qualified nonbank issuers must report to the OCC on BSA and sanctions compliance when asked. The OCC can review any issuer's BSA compliance in supervision.

Part 5: Supervision, Reporting and Enforcement (§§ 15.14–15.16)

Once licensed, an issuer is examined like a bank and reports more often than most banks do.

Examinations

The OCC will conduct a full-scope examination every 12 months, onsite or remotely, and may examine more often. An extended 18- to 24-month cycle is available if the issuer is not under a formal enforcement action, has had no change in control in the past year, is fully compliant with reserve and reporting rules, and has outstanding issuance under $1 billion including affiliated issuers. On request, the OCC gets prompt and complete access to all officers, directors, employees, agents and records. The rule commits the OCC to rely on existing reports and avoid duplicative requests where it can.

Reporting calendar

Issuers must also keep complete books and records in English and adopt a records retention policy that can demonstrate compliance with the Act and part 15.

Changes in Control

Anyone seeking to acquire control of a permitted issuer must follow the OCC's change-in-control rules at 12 CFR 5.50, as if the issuer were a national bank. A change in control also removes eligibility for the extended exam cycle for a year.

Fees

The amendments to part 8 extend OCC assessments to stablecoin issuers. Nonbank Federal qualified issuers and transitioned State issuers pay semiannual assessments, due March 31 and September 30, based on total assets. For national banks and federal savings associations whose balance sheets include a subsidiary issuer's reserves, the assessment on those reserves is discounted by 35%, and by up to 55% as the OCC gains experience.

State Issuers Crossing $10 Billion

A nonbank State-qualified issuer that crosses $10 billion in total consolidated outstanding issuance value faces a fixed clock, counted from the day it crosses:

1. Day 5: written notice to the OCC, covering its State regulators, current issuance, the date it crossed, whether it has stopped net issuance, and whether it will seek a waiver.
2. Day 240: last day to request a waiver to stay solely State-supervised. The OCC must grant it if the State had a certified prudential stablecoin regime as of April 19, 2025 and has approved at least one issuer, unless it finds by clear and convincing evidence that the criteria are not met or the issuer poses significant safety and soundness risk.
3. Day 270: submit a capital analysis; the OCC will set a minimum capital requirement.
4. Day 360: transition to OCC oversight and comply with Federal qualified rules, or have stopped net new issuance until back under $10 billion. An issuer not fully compliant at transition must file a remediation plan.
5. Within six months of transition: initial OCC examination.

An issuer that later falls back under $10 billion can return to the State framework once the OCC so determines.

Emergency Powers and Enforcement

For any nonbank State-qualified issuer, regardless of size, the OCC can issue directives with the force of a final cease-and-desist order in "unusual and exigent circumstances." Factors include imminent failure to redeem, significant secondary-market price swings, unexpected losses and the State regulator's own response. Directives can limit redemptions, affiliate transactions and activities that expose the issuer to holding-company liabilities.

The part 19 amendments bring GENIUS Act enforcement — registration suspension or revocation, cease-and-desist orders, removal and prohibition, and civil money penalties — under the OCC's standard rules of practice and procedure. The OCC also says anyone responsible for material misstatements in filings faces enforcement action and potential criminal penalties.

How CertiK Can Help

The OCC's rulebook turns technical security from a best practice into a supervisory requirement. Examiners will expect issuers to show that their smart contracts work as intended, that their issuing keys are controlled, that their systems are independently tested, and that their vendors are held to the same standard. CertiK works with issuers on the parts of part 15 where code and keys meet compliance:

• Smart contract assurance — independent audits and formal verification of mint, burn, pause, freeze, blocklist and upgrade logic, supporting the § 15.13(b)(3) duties to validate systems "including smart contracts" and to test them periodically and independently.
• Key management and custody reviews — assessments of issuing-key generation, storage, multi-sig and MPC policies, backup and recovery against § 15.13(b)(5) and the subpart C "control" standard.
• Penetration testing and resilience — infrastructure, API and web application testing to support independent testing and vulnerability-testing expectations.
• Continuous on-chain monitoring — real-time monitoring of contracts, supply and privileged roles to feed incident detection, the 10% outflow trigger and reconciliation for monthly reserve reporting.
• Vendor and third-party diligence — security reviews of critical service providers to support § 15.13(a)(7) oversight.
• Exam readiness — gap assessments that map your program to part 15 and produce the documentation an OCC examiner will ask for.

The OCC has said it will keep refining this framework and issuing guidance, and other regulators' GENIUS Act rules are still to come. Issuers that build security and controls into their programs now will be better positioned both for day one and for whatever comes next. To discuss your readiness, contact the CertiK team.

This post summarizes the OCC's final rule for general information. It is not legal advice; issuers should consult counsel on their specific circumstances.