DEF and SPI Submit Comment Letter to FinCEN on GENIUS Act Customer Identification Program Rulemaking

On August 21, 2026, DEF and Solana Policy Institute (SPI) submitted a comment letter responding to the Department of Treasury Financial Crimes Enforcement Network (FinCEN) and the federal banking agencies’ joint proposed rule implementing customer identification (CIP) requirements for permitted payment stablecoin issuers (PPSIs) under the GENIUS Act. The proposal would require PPSIs to maintain written, risk-based programs for identifying and verifying their customers.

DEF and SPI support FinCEN’s focus on direct relationships between stablecoin issuers and their customers, but urge the agencies to ensure the final rule does not expand those obligations to secondary-market activity or decentralized infrastructure. 

Consistent with our prior comment letters regarding implementation of the GENIUS Act, the proposed rulemaking should be guided by three overarching principles: (1) obligations should attach to entities with custody of customer funds or technical control over funds, (2) requirements should be function-based and technology-neutral rather than tied to a particular architecture, and (3) the final rule should remain anchored in the statutory text of the GENIUS Act and existing FinCEN guidance. 

Most importantly, the agencies should preserve the proposed distinction between the primary market, where a PPSI directly interacts with a customer, and the secondary market, where users may hold or transfer stablecoins without any direct relationship with the issuer. Simply holding a stablecoin or interacting with it through a smart contract does not create an “account” with the issuer. Extending CIP obligations beyond those direct relationships would be operationally difficult, create unnecessary privacy risks, and exceed the framework Congress established in the GENIUS Act.

The final rule should preserve the GENIUS Act’s exclusions of distributed ledger protocols, self-custodial interfaces, validators, and liquidity pool participants. Non-custodial software developers, wallet providers, and infrastructure providers should not become PPSI customers merely because their technology is used in connection with a stablecoin transaction. 

Our Executive Summary: 

• The Final Rule Should Ensure CIP Obligations Remain Tied to PPSI Accounts and Direct Relationships: The GENIUS Act places CIP obligations only on PPSIs, a narrow, regulator-approved category of stablecoin issuers that FinCEN and the Agencies expect to number just 50 nationwide. The NPRM appropriately defines “customer” by reference to a direct relationship with a PPSI, excluding secondary-market activity that does not directly involve the PPSI. Non-custodial software developers, front-end operators, blockchain validators, self-custody wallet providers, and other infrastructure providers should not be treated like intermediaries merely because non-custodial software or technology is used in connection with a PPSI-regulated stablecoin. The final rule should preserve this statutory perimeter as proposed in the NPRM.
• The DASP Definition Should Not Be Expanded to Reach Statutorily-Excluded Non-Custodial Infrastructure Activities: The GENIUS Act excludes distributed ledger protocols, self-custodial software interfaces, transaction validators, and liquidity pool participants from the DASP definition. The NPRM’s proposed DASP definition rightly preserves these exclusions and remains consistent with FinCEN’s 2019 CVC Guidance, which similarly declined to treat unhosted wallets and decentralized exchanges as money transmitters absent “total independent control” over user assets. The final rule should consistently incorporate these statutory exclusions and should avoid any interpretation of intermediary status that would directly impose CIP obligations on actors who lack the technical capability to exercise custody or control.
• CIP Obligations Should Not Transform Self-Custody Wallets or Secondary Market Interactions Into PPSI Accounts: FinCEN and the Agencies should clarify that a self-custody wallet address, smart contract address, or interaction with a PPSI-issued stablecoin does not by itself create an “account” relationship between the wallet holder and the PPSI. Such a clarification is consistent with the NPRM’s inclusion of the “formal relationship” threshold in its definition of an account. Treating every address that holds or transfers a payment stablecoin as a PPSI “account” would collapse the statutory distinction between primary market customer relationships and secondary market activity, and would conflict with the GENIUS Act’s protections for self-custody and direct peer-to-peer transfers.

You can read our full submission here.