2026 Crypto Compliance Roadmap: Preparing for the GENIUS Act and CLARITY Act

TL;DR:

• Two major crypto bills, one already law: the GENIUS Act was signed July 18, 2025; the CLARITY Act passed the House in July 2025 but remains stalled in the Senate as of April 2026
• GENIUS Act compliance deadline: January 18, 2027 at the latest — likely November 2026 if federal regulators finalize rules by July 2026 as planned
• California’s DFAL adds a state deadline on top: license application or active license required by July 1, 2026
• The CLARITY Act’s SEC/CFTC framework could transform how every crypto exchange and broker is regulated — even if it doesn’t pass in 2026, the classification logic is already influencing enforcement posture

Two years ago, compliance officers at crypto companies dealt with ambiguity. No federal framework. Regulatory guidance by enforcement action. Every business model lived in a gray zone.

2025 closed that era. Congress passed the GENIUS Act. Regulators started implementing it. The CLARITY Act passed the House with a 294-134 bipartisan vote and is grinding through Senate negotiations. California added its own state-level licensing regime. The patchwork of no-rules has been replaced by a patchwork of new rules — and the compliance calendar is filling up fast.

This is the roadmap. Two laws, one year, multiple state requirements, and a set of deadlines that are closer than most crypto compliance teams realize.

The Framework: What’s Already Law vs. What’s Still Pending

First, the ground-floor distinction: the GENIUS Act is signed law. The CLARITY Act is pending.

That matters for prioritization. If your business involves stablecoin issuance, GENIUS Act compliance is mandatory and your clock is already running. If your business is a crypto exchange, broker, or tokenized asset platform without stablecoin components, CLARITY Act is the framework you need to monitor — but you’re not yet legally required to comply with it.

The GENIUS Act: What You Need to Build Before January 2027

The GENIUS Act creates the first federal framework for payment stablecoins. It defines “permitted payment stablecoin issuers” (PPSIs), establishes licensing requirements through OCC (for federally chartered entities), FDIC (for state bank subsidiaries), and the Federal Reserve, and imposes a specific set of operational requirements on anyone who qualifies.

Who Is a PPSI?

Under the GENIUS Act, a PPSI is any entity that issues a payment stablecoin to the public. That includes:

• Federally chartered banks and their subsidiaries issuing stablecoins
• State bank subsidiaries with FDIC approval
• State-chartered stablecoin issuers meeting federal standards
• Non-bank stablecoin issuers with OCC licensing

If you issue a token that maintains a stable value relative to a fiat currency and you market it for payments — you’re likely a PPSI. The framing matters: tokens sold as investments or securities are out of scope for GENIUS Act (that’s CLARITY Act territory).

Core Compliance Requirements

Reserves: 1:1 backing in high-quality liquid assets — U.S. Treasury securities, FDIC-insured deposits, Federal Reserve accounts, or equivalents. Monthly public disclosure of reserve composition is mandatory.

Redemption: Stablecoins must be redeemable within two business days. If redemption requests exceed 10% of outstanding issuance within 24 hours, you must immediately notify your primary regulator (OCC, FDIC, or Fed) and may request a redemption period extension.

Disclosures: Plain-language fee disclosure to consumers. Any fee change requires at least 7 days’ advance notice.

Yield prohibition: Payment stablecoins cannot pay yield or interest to holders. This is the provision that’s generated the most lobbying heat — Coinbase CEO Brian Armstrong publicly withdrew support from the Senate CLARITY Act over a similar provision, and it remains one of the main sticking points in Senate negotiations.

Technical controls: PPSIs must maintain the technical capability to block, freeze, and burn stablecoins in response to lawful orders. This means having wallet-level control infrastructure before the effective date — not a trivial lift for some issuers.

Bankruptcy protection: The GENIUS Act amends Section 541 of the Bankruptcy Code to exclude stablecoin reserves from the bankruptcy estate. Redemption distributions to holders must begin within 14 days of a bankruptcy court lifting stays.

The Regulatory Timeline

Here’s where it gets real. The GENIUS Act set a July 18, 2026 deadline for regulators to finalize implementing rules. Both the OCC and FDIC are on track:

Banking industry groups filed for a comment period extension on April 23, 2026 — which could push final rule timing slightly. But the statutory July 2026 deadline for regulators to issue rules creates structural pressure.

Once final rules issue, the 120-day clock starts. If OCC and FDIC finalize rules by July 18, 2026, the effective compliance date would be approximately November 15, 2026 — well before the January 2027 backstop.

Compliance teams planning on a January 2027 effective date may be surprised.

What to Build Now

If you’re a stablecoin issuer or are building stablecoin capabilities:

Q2 2026 (Now through June):

• Map your existing reserve assets against GENIUS Act permissible reserves; identify gaps
• Assess your technical capability to block, freeze, and burn wallets
• Begin OCC or FDIC pre-licensing discussions; determine your licensing pathway
• Review your redemption infrastructure against the 2-business-day standard

Q3 2026 (July–September):

• Submit license applications to your primary regulator
• Build monthly reserve disclosure process and public disclosure template
• Update consumer disclosures with 7-day fee change notice mechanism
• Verify that yield payment features are disabled or redesigned

Q4 2026 (October–December):

• Complete compliance program documentation (policies, procedures, controls)
• Run a tabletop exercise against a 10%-in-24-hours redemption scenario
• Document BSA/AML program under FinCEN’s stablecoin-specific proposed rule
• Finalize bankruptcy reserve segregation with legal counsel

The CLARITY Act: What to Know Before It’s Law

The Digital Asset Market Clarity Act creates a three-bucket classification system for all digital assets. This matters enormously because it determines which regulator owns you — and which compliance regime applies.

The Three Buckets

Investment Contract Assets (SEC jurisdiction): Digital assets offered and sold as part of an investment contract where buyers expect returns from the managerial efforts of a centralized entity. Think tokens associated with projects where a core team controls development, fund allocation, and direction. The SEC’s existing securities regulations apply.

Digital Commodities (CFTC jurisdiction): Digital assets on “mature blockchain systems” — blockchains that are sufficiently decentralized such that no single person or group controls them. Bitcoin and Ethereum are the obvious examples that the bill’s drafters had in mind. The CFTC gets exclusive jurisdiction over digital commodity spot markets.

Payment Stablecoins: Covered by the GENIUS Act, not the CLARITY Act. The classification framework defers to the GENIUS Act’s licensing regime.

The CLARITY Act creates three new CFTC registration categories: Digital Commodity Exchanges (spot trading platforms), Digital Commodity Brokers, and Digital Commodity Dealers. It also creates a new SEC disclosure regime tailored to digital assets, replacing the securities registration process for qualifying tokens.

What’s Blocking Senate Passage

As of April 2026, three issues remain unresolved in Senate negotiations:

1. Stablecoin yield restrictions: Bank lobbyists have drawn enough Senate support to block provisions they argue would allow stablecoin rewards programs to compete unfairly with bank deposits. Negotiations are trending toward banning pure passive yield while allowing limited activity-based incentives.

2. Tokenized stocks: How to treat digital tokens that represent traditional equity securities remains contested between the SEC and CFTC, with different committee jurisdictions staking out positions.

3. Ethics provisions: Restrictions on government officials’ crypto holdings — a provision added to address conflicts of interest given cryptocurrency holdings by senior White House officials — has created political friction.

Senator Cynthia Lummis warned on April 11, 2026, that if the Senate Banking Committee didn’t mark up the bill by April 25, the window could close until 2030. Galaxy Research pegged passage odds at roughly 50-50 or lower.

That doesn’t mean you ignore it. Even if CLARITY doesn’t pass in 2026, the SEC and CFTC are both using the classification logic in their enforcement posture — the “mature blockchain” vs. “centralized control” distinction is appearing in SEC enforcement decisions right now.

What CLARITY Passage Would Require of Crypto Exchanges

If the bill becomes law, crypto exchanges trading non-stablecoin digital assets would need to:

• Determine which assets they list qualify as digital commodities (CFTC) vs. investment contract assets (SEC)
• Register as a Digital Commodity Exchange if primarily trading commodities
• Comply with new SEC disclosure regime for any investment contract assets listed
• Implement new resale restrictions for project insider tokens
• Satisfy reporting requirements for both CFTC and SEC depending on asset mix

The transition period would likely be 12–18 months from enactment, similar to the GENIUS Act structure.

The State Layer: California DFAL and MTL Patchwork

Federal legislation doesn’t eliminate state compliance obligations. Two state-level requirements are live right now:

California Digital Financial Assets Law (DFAL)

The DFPI began accepting applications on March 9, 2026. The deadline: any entity engaging in covered digital financial asset business in California must either hold a DFAL license or have submitted a completed application by July 1, 2026.

Covered activities: exchange, transfer, storage, custody, and stablecoin issuance for California residents. Minimum surety bond: $500,000. Capital requirements set by DFPI on a case-by-case basis. Kiosk operators face a daily transaction cap of $1,000 per customer and a fee limit of 15% or $5, whichever is lower.

This is not a federal preemption situation — the GENIUS Act preserves state consumer protection and licensing laws. You need both the federal license and the California license if you serve California residents.

State Money Transmitter Licensing

If you haven’t completed your state money transmitter licensing build-out, that clock has been running for years. Most states require MTL for crypto exchange and transfer activities. The patchwork of 50 state regimes remains the largest operational compliance burden for crypto businesses at scale.

The Integrated Compliance Calendar

Here’s the full 2026–2027 compliance calendar with hard deadlines and monitoring triggers:

So What: Where to Focus Now

The biggest mistake compliance teams make is waiting for legislative certainty before building. The GENIUS Act is already law. California DFAL has a July 2026 deadline. The CLARITY Act framework, even if it doesn’t pass this session, is shaping how the SEC and CFTC approach enforcement right now.

If you issue stablecoins: You have three concrete deadlines — OCC/FDIC final rules expected July 2026, California DFAL application by July 1, and effective compliance required by Q4 2026. Build now.

If you run a crypto exchange or broker: Monitor CLARITY Act Senate progress weekly. Begin a preliminary asset classification exercise using the mature/centralized blockchain test. This work is useful regardless of whether the bill passes — it shapes your risk disclosures and any SEC/CFTC inquiry responses.

If you’re a consumer-facing crypto platform in California: File your DFAL application through NMLS. Don’t wait until June — DFPI processing times are uncertain for a new application category.

The compliance window is narrowing on multiple fronts simultaneously. Unlike the prior era of regulatory ambiguity, the obligations are now defined. The risk is not regulatory uncertainty — it’s operational unreadiness.

For the control self-assessment work that maps your current controls against GENIUS Act and CLARITY Act requirements, the RCSA template gives you a structured framework to identify gaps and prioritize remediation before the effective dates hit.

FAQ

Does the GENIUS Act apply to stablecoin issuers outside the US serving US customers?

The GENIUS Act regulates “payment stablecoin issuers” based on the stablecoins being offered to US persons, not just where the issuer is domiciled. Foreign issuers marketing stablecoins to US residents face GENIUS Act obligations. The specific licensing pathway for foreign-headquartered issuers will depend on final OCC implementing rules, but international location is not a compliance exemption.

What happens to existing stablecoin issuers that don’t get licensed by the effective date?

Criminal penalties for unauthorized stablecoin issuance under the GENIUS Act include fines up to $1,000,000 per violation and imprisonment up to five years. Civil penalties and regulatory enforcement apply to ongoing noncompliance. There is expected to be a grace period for issuers in the application process — but that protection applies only if you’ve submitted a substantially complete application.

Does passing CLARITY Act change GENIUS Act obligations?

No. The CLARITY Act explicitly defers to the GENIUS Act for payment stablecoins. GENIUS Act compliance requirements for PPSIs remain unchanged regardless of CLARITY Act passage or failure. The two frameworks are designed to operate in parallel — GENIUS covers the stable-value payments layer, CLARITY covers the broader digital asset ecosystem.

If the CLARITY Act doesn’t pass in 2026, what’s the fallback framework for crypto exchanges?

The SEC continues applying the Howey test under existing securities law, and the CFTC continues asserting jurisdiction over digital commodity derivatives and spot markets under the CEA. SEC enforcement actions against crypto exchanges and token issuers continue under existing authorities. Failure of the CLARITY Act doesn’t create a deregulatory outcome — it extends the current regulatory-by-enforcement environment.

What’s the relationship between the GENIUS Act AML rules and FinCEN’s broader proposed rule?

The GENIUS Act requires PPSIs to comply with the Bank Secrecy Act. FinCEN’s separate proposed rule — issued under the GENIUS Act’s mandate — specifies the SAR filing threshold ($5,000, same as banks), CDD requirements, and AML program elements. The AML implementation post covers this in detail. The GENIUS Act consumer protection requirements and the FinCEN AML requirements operate as parallel compliance tracks.