TRM Labs Comment on FinCEN and OFAC’s Proposed Rule Implementing the GENIUS Act
Introduction
The financial crime threat environment has changed fundamentally. AI-enabled scam activity rose 500 percent in the past year. North Korea has stolen more than USD 600 million in digital assets in the first months of 2026 alone. Pig butchering networks have stripped tens of billions from American families using AI tools to run industrial-scale fraud operations — synthetic identities, deepfake video calls, automated grooming scripts deployed at a speed and scale no human network could sustain.
The adversaries who threaten the integrity of the financial system have embraced AI as an offensive weapon. The question this rulemaking must answer is whether the compliance infrastructure protecting that system will do the same.
The answer TRM offers is affirmative: stablecoins are a compliance opportunity, and the technology now available to permitted payment stablecoin issuers gives this rulemaking a foundation no prior generation of financial regulation has had. Every transaction is permanently recorded on a public blockchain. We can now share actionable intelligence in real time. Freeze, burn, and reissue authority lets issuers act at the speed of the blockchain rather than the speed of a correspondent banking chain. AI-powered intelligence compresses weeks of manual investigative work into minutes and produces case-ready intelligence that law enforcement can act on before the laundering window closes. The tools exist. The data is there. The final rule should be designed to unlock them fully.
Our response
TRM Labs welcomes the opportunity to respond to FinCEN and OFAC's joint proposed rule implementing the AML/CFT and sanctions compliance provisions of the GENIUS Act for Permitted Payment Stablecoin Issuers.
The central premise of TRM's comment is affirmative: stablecoins are a compliance opportunity. The transparent, traceable, programmable properties of blockchain networks give PPSIs enforcement capabilities that no traditional financial institution holds — and that, when paired with the right legal framework, can produce enforcement outcomes that exceed anything the existing BSA architecture can achieve. The final rule should be designed to recognize and enable those capabilities while ensuring that lawful users are able to transact in a secure and private manner.
According to TRM's data, less than 0.5% of stablecoin transactions were tied to illicit activity in 2025, and sanctions-related activity in stablecoins fell 60% year-over-year as enforcement and compliance tools took hold. The compliance ecosystem is working. Where illicit activity occurs it is concentrated in identifiable, traceable networks that blockchain intelligence can target with precision. The final rule should be calibrated to that reality — accelerating what is working, closing the legal gaps that limit it, and building the framework around the technology that is already producing results.
The technology advantage: What makes PPSIs different
The NPRM correctly recognizes that stablecoin issuers hold technical capabilities with no analog in traditional finance. These capabilities are the foundation of an effective compliance architecture, and the final rule should be built around enabling them.
Every stablecoin transaction is permanently recorded on a public blockchain, creating an immutable audit trail that cash and wire transfers cannot match. Blockchain intelligence tools can trace illicit funds across thousands of wallets and multiple chains, identify the behavioral signatures of criminal networks, and surface connections between seemingly unrelated addresses invisible to manual analysis.
An investigator using TRM's AI-native platform can start from a single wallet address, SAR narrative, or sanctions target and automatically build a living network map of connected entities, wallets, transaction counterparties, and criminal infrastructure across chains and data sources — compressing days of manual work into minutes and generating case-ready intelligence that enables action before the laundering window closes.
Because stablecoin transactions are on-chain and visible as they occur, it is possible to build alert systems that fire the moment flagged funds touch a participating platform — giving law enforcement and financial institutions the opportunity to act before proceeds are laundered beyond recovery.
TRM's Beacon Network demonstrates this at scale, connecting about 100 verified law enforcement agencies worldwide with participating institutions covering approximately 85% of centralized cryptocurrency transaction volume. FATF cited Beacon Network in its November 2025 Asset Recovery Guidance as a leading model for public-private partnership in digital asset enforcement.
The most significant capability that distinguishes stablecoin issuers from every other type of financial institution is freeze, burn, and reissue authority. A bank can freeze an account but cannot destroy the underlying funds. A correspondent bank can block a wire but cannot act on another institution's ledger. A stablecoin issuer can freeze an address, burn the tokens in it, and reissue clean value — all on-chain, all verifiable, all without waiting for a court order to pass through an intermediary. This is a categorically superior enforcement capability, and the final rule should be built around enabling it fully.
Freeze, burn, and reissue: The case for explicit legal standards in the final rule and other key considerations
The freeze-burn-reissue pipeline deserves its own treatment in the final rule because it is the single most powerful enforcement tool the stablecoin ecosystem offers — and because the legal framework governing it remains incomplete in ways that limit its deployment.
A freeze stops movement of funds while leaving the tokens on the blockchain — the balance is visible but inoperable. A burn destroys the tokens entirely by sending them to an unrecoverable address, removing them from circulation permanently. Reissuance follows a burn: the stablecoin issuer mints an equivalent amount of new tokens and directs them to government-controlled wallets for asset recovery or to victims for restitution. Together, these steps achieve something a traditional bank hold cannot: permanent elimination of the illicit instrument and return of value to victims, without the months or years of court process that frozen bank accounts require.
The April 2026 freeze of USD 344.2 million in USDT linked to the Central Bank of Iran illustrates what issuer-level freeze authority looks like at scale: OFAC designated two wallets attributed to the Central Bank of Iran with linkages to the IRGC-Qods Force and Hizballah; Tether coordinated with OFAC and U.S. law enforcement and froze the funds on-chain immediately — no correspondent bank, no court order working through an intermediary, no delay. The freeze was immediate and verifiable on-chain.
The T3 Financial Crime Unit has operationalized this capability across 23 jurisdictions since September 2024, freezing USD 450 million in illicit assets with freezes executed within 24 hours of law enforcement requests.
The GENIUS Act gave this mechanism statutory grounding. Section 5(a)(2) authorizes the Secretary of the Treasury and the Attorney General, acting jointly, to direct the seizure or burning of stablecoins used in significant violations of sanctions law or federal criminal law.
The gap the final rule must address is reissuance. The operational capability to reissue clean value to victims after a burn exists today. The legal standards governing when and how reissuance occurs — what process triggers it, who directs it, what verification is required before clean tokens are directed to victims — are not yet defined in statute or regulation. That gap creates legal uncertainty that limits the full deployment of the pipeline and leaves victim restitution dependent on ad hoc coordination rather than established protocol.
Proposed 31 CFR 1033.240 should be expanded to include explicit standards for the full freeze-burn-reissue pipeline: legal standards for when a PPSI may execute a freeze at the request of, or in coordination with, law enforcement; conditions under which a PPSI may proceed to a burn and the role of law enforcement authorization in that determination; a framework for reissuance specifying the process by which clean value is minted and directed to recovery wallets or identified victims; and explicit safe harbor protection for PPSI freeze, burn, and reissue actions taken in good faith in coordination with federal law enforcement.
Moreover, beyond the core framework for payment stablecoin issuers, the industry would benefit from regulatory guidance on proceduralizing these technical capabilities and indirect risk standards.
There is currently a gap in industry knowledge on how financial institutions should design internal policies for freezing and burning capabilities. While the GENIUS Act establishes the obligation to hold these capabilities, it does not address how institutions should govern their use: under what circumstances a freeze is appropriate, what internal escalation and approval processes are required before action is taken, how decisions are documented for audit purposes, or how compliance teams manage the legal and reputational risk of exercising these controls.
We must fill this gap because burn and freeze are powerful compliance tools. They are potentially irreversible actions that affect customer assets and have the potential for abuse by authoritarian governments.
Without supervisory guidance, institutions will develop inconsistent internal frameworks, creating uneven compliance outcomes and leaving institutions exposed when regulators examine their decision-making processes. Clearer guidance — or safe harbor provisions — around the governance of these controls would enable compliance to act decisively when required while maintaining the documentation and oversight structures their examiners expect.
Secondly, as illicit laundering networks become more sophisticated, the identification of their involvement becomes increasingly dependent on how institutions manage the concept of indirect risk. A compliance framework could also address what principles PPSIs can leverage to manage indirect exposure — transactions that did not involve a designated address directly but passed through one at some remove. This is where most real-world compliance complexity lives. A PPSI that screens only for direct sanctions matches will miss the layering patterns that characterize sophisticated evasion infrastructure; a PPSI that treats any indirect exposure as a per se violation will generate unresolvable alert volumes, drive lawful users off compliant platforms and potentially further contribute to the volume of unactionable SARs. Neither outcome serves the rule's objectives.
FinCEN and OFAC should provide risk-based guidance on how PPSIs should assess and threshold indirect exposure — specifying that the appropriate response is proportionate to proximity, the nature of the intermediary, and the overall transaction context — rather than leaving each issuer to resolve this question independently and inconsistently.
On OFAC sanctions program requirements: A first in OFAC's history — and what the technology now makes possible
OFAC has never, in its history, imposed an explicit, codified sanctions compliance program requirement on any class of financial institution. Banks, money services businesses, broker-dealers, insurance companies, securities firms — none of them operate under a legal mandate to maintain a documented sanctions compliance program.
OFAC publishes a framework describing what an effective compliance program looks like, and enforcement actions have long treated the absence of adequate controls as an aggravating factor in civil penalty calculations. But that framework is guidance, not law. This proposed rule would be the first time in OFAC's history that explicit sanctions compliance program requirements are enshrined in regulation for any class of regulated entity.
TRM recommends that the agencies treat this dimension of the proposed rule as a subject for continued study and engagement with the compliance community as the rulemaking moves toward finalization.
What further study should examine is not whether sanctions compliance in the stablecoin ecosystem is working — it is — but whether the technology now available to PPSIs opens a path to something better still.
An AI-powered intelligence platform can start from a single wallet address, a designation, or a pattern of on-chain behavior and automatically build a living network map of connected entities, counterparties, and criminal infrastructure across chains and data sources — identifying the signatures of sanctions evasion infrastructure before exposure accumulates to the scale TRM research documented in the IRGC-linked exchange cases.
That capability goes well beyond what any program requirement currently contemplates, and the question the agencies should study is how a regulatory framework can be designed to accelerate its deployment rather than simply to require documentation of more familiar controls.
The stablecoin issuer's unique position in the ecosystem adds further dimension. PPSIs hold freeze, burn, and reissue authority — a sanctions enforcement capability with no analog in traditional finance.
Stablecoin FIUs like T3 FCU, with the technical authority to monitor native token flows in real time and the operational relationships to act on that intelligence before proceeds move beyond reach, are already producing outcomes that no codified program requirement envisioned. That model is what the compliance ecosystem is already building toward, and it is the right frame for whatever the agencies ultimately conclude about program requirements in this space. TRM encourages the agencies to use the period between proposed and final rule to engage the compliance community, law enforcement, and technology providers on these questions openly.
On the T3 Financial Crime Unit model and the case for recognizing stablecoin FIUs
The final rule should formally recognize stablecoin financial intelligence units as a distinct and authorized compliance mechanism within the PPSI framework. The T3 Financial Crime Unit — TRM's collaboration with Tether and TRON — demonstrates what this architecture achieves in practice. Since launching in September 2024, T3 FCU has frozen more than USD 450 million in illicit USDT across 23 jurisdictions on five continents, intercepting 43.9% more illicit proceeds in 2025 than the prior year. The unit executes asset freezes within 24 hours of law enforcement requests — including during active account takeovers, kidnappings, and extortion cases. FATF recognized T3 FCU in its November 2025 Asset Recovery Guidance as an invaluable resource for law enforcement worldwide — cited alongside TRM's Beacon Network as a leading model for public-private partnership in digital asset enforcement.
What makes T3 FCU structurally significant beyond the numbers is the architecture it represents: a dedicated financial intelligence unit embedded within the stablecoin ecosystem itself, with the technical authority to monitor native token flows across the entire blockchain, the analytical capability to identify illicit activity in real time, and the operational relationships with law enforcement to act before proceeds can be moved beyond reach.
The final rule should establish legal standards for the establishment and operation of stablecoin FIUs like T3.
On a digital asset hold law
The final rule should be designed in alignment with the emerging framework for a digital asset hold law — and the agencies should affirmatively support its enactment. When a Beacon Network alert fires and an institution has high-confidence intelligence that funds about to be withdrawn are illicit, every hour of legal uncertainty is an hour that criminal networks use to move proceeds to the next wallet. Traditional banks have held statutory authority to temporarily freeze funds linked to high-confidence illicit indicators for decades. The digital asset ecosystem deserves the same foundation.
The Digital Asset Market Clarity Act, currently making its way through Congress, would allow exchanges and financial institutions to temporarily freeze funds linked to high-confidence illicit indicators pending law enforcement review.
The final rule should provide liability protection for PPSIs taking risk-based compliance actions — including temporary transaction holds — on the basis of intelligence received through validated real-time networks, and should explicitly recognize participation in OFAC-validated, law enforcement-verified intelligence-sharing networks as a positive supervisory indicator under 31 CFR 1033.221.
On decentralized finance and the limits and possibilities of compliance
A question TRM hears from regulators and policymakers with increasing frequency is whether true decentralized finance protocols can comply with BSA obligations.
The answer is no — a genuinely decentralized protocol cannot comply with BSA obligations in the same way a PPSI would. There is no legal entity to register as a financial institution, no compliance officer to designate, no customer relationship through which to conduct KYC, and no central operator with the authority to respond to a law enforcement request to freeze funds.
The architecture that makes DeFi decentralized is the same architecture that makes it structurally incompatible with the customer-identification and reporting obligations the BSA imposes on financial institutions. The PPSI framework appropriately focuses on the issuers of the stablecoins that move through DeFi protocols rather than on the protocols themselves.
However, many DeFi protocols are taking action to keep bad actors off their platforms. A large and growing number of DeFi protocols screen for sanctions and other high-risk activity through their front-end interfaces. When a user connects a wallet to a DeFi protocol's interface, many protocols run that wallet address against OFAC's SDN list and against TRM’s blockchain intelligence database that flag wallets associated with sanctioned entities, darknet markets, and other high-risk counterparties.
A wallet that clears those checks proceeds to the protocol. A wallet that triggers a match is blocked from the interface. The underlying smart contract may remain accessible through direct on-chain interaction, but the vast majority of retail and institutional users interact through the front end — and front-end screening catches the vast majority of the risk.
A number of DeFi protocols and DeFi-adjacent platforms are also Beacon Network members, participating in real-time intelligence sharing with law enforcement and other participating institutions. Beacon membership means that when law enforcement flags a wallet address as illicit, participating DeFi front ends receive the alert and can block that address from accessing the protocol interface in real time, before proceeds are laundered through the protocol.
That is a compliance contribution that looks nothing like BSA compliance in the traditional sense, and looks everything like effective risk management applied to a genuinely novel infrastructure.
On AI-powered compliance, SAR modernization, and privacy
The proposed requirements under 31 CFR 1033.210 and 1033.320 should be calibrated to reward effective compliance rather than compliance volume. Approximately four million SARs are filed annually, and FinCEN estimates law enforcement acts on roughly 2% of them. That ratio reflects an incentive structure that drives institutions to file defensively and broadly. The result is intelligence volume without intelligence value.
AI-powered intelligence—on and off chain—can map the network around a suspicious transaction, identify connected entity clusters across thousands of wallets and multiple chains, score risk based on behavioral signals, and surface pattern-level signatures linking activity to known criminal typologies — all within minutes.
The output is a case-ready intelligence product that an investigator can act on immediately — orders of magnitude more useful than a SAR narrative describing a single wallet's outbound transfer. The final rule should explicitly recognize AI-generated, network-level intelligence products as compliant tools for meeting monitoring and reporting obligations under 31 CFR 1033.320, and should direct FinCEN to establish a feedback mechanism through which law enforcement can signal which intelligence formats are generating actionable leads. That feedback loop is entirely absent from the existing BSA architecture, and fixing it is among the highest-value changes the final rule can make.
On privacy: the final rule should enshrine data minimization as an explicit governing principle. Every centralized database of sensitive customer financial information is a target for the same ransomware groups and state-sponsored cyber actors this rulemaking is designed to address. Every stablecoin transaction is already permanently recorded on a public blockchain — an immutable audit trail no traditional financial system provides.
Recordkeeping requirements should focus on identity data, CDD records, and internal intelligence products, not on duplicating records that exist permanently on the public ledger. PPSIs achieving superior risk outcomes through advanced analytics and targeted data collection meet their compliance obligations fully. Bulk data accumulation beyond what risk management requires is a vulnerability, not a compliance virtue.
Conclusion
The compliance ecosystem is working. T3 FCU has frozen USD 450 million in illicit assets at the speed of the blockchain. Beacon Network is coordinating real-time interdiction across 85% of centralized cryptocurrency transaction volume. AI-powered intelligence is generating case-ready intelligence products that compress weeks of manual analysis into minutes. Less than 0.5% of stablecoin transactions in 2025 were tied to illicit activity, and sanctions-related activity fell 60% year-over-year as enforcement and compliance tools took hold.
What the final rule should do is give this infrastructure the legal foundation it needs to operate at full scale: recognize stablecoin FIUs, provide safe harbor for burn-and-reissue authority, support enactment of a digital asset hold law, codify real-time intelligence sharing as a compliance expectation, reward effectiveness over volume, and protect the privacy of the vast majority of lawful users who represent 99.5% of the ecosystem. On the novel question of codified OFAC sanctions program requirements — a step without precedent in the history of financial regulation — TRM encourages the agencies to continue studying how the technology now available to PPSIs can produce outcomes that exceed what any program requirement currently contemplates, and to engage the compliance community openly before that question is resolved in final rule text.
TRM looks forward to working with FinCEN, OFAC, and the broader compliance community as this rulemaking moves to finalization, and welcomes the opportunity to discuss any of the issues raised in these comments in a closed setting.
About TRM Labs
TRM Labs Inc. ("TRM") provides AI-powered intelligence to help financial institutions, cryptocurrency businesses, and public sector agencies detect, investigate, and prevent financial crime. TRM's platform includes solutions for transaction monitoring and wallet screening, entity risk scoring, AI-powered investigative tools, and real-time disruption infrastructure.
TRM produces original research on the digital asset threat landscape, such as our annual TRM Crypto Crime Report, the 2025 Crypto Adoption and Stablecoin Usage Report, and the white paper on On-Chain Privacy and Financial Compliance published in February 2026. TRM operates the Beacon Network, the first real-time global intelligence-sharing system for illicit cryptocurrency activity, and serves as a founding partner of the T3 Financial Crime Unit (T3 FCU) alongside Tether and TRON.
For more information on this response, please contact: Ari Redbord, Global Head of Policy: ari@trmlabs.com
