GENIUS Act for Exchanges and Custodians: What Digital Asset Service Providers Must Do Before 18 July 2028

Under the GENIUS Act, from 18 July 2028 a digital asset service provider, which covers exchanges, brokers, custodians and transfer services, may not offer or sell a payment stablecoin to a person in the United States unless a permitted payment stablecoin issuer, or a foreign issuer meeting the Act's conditions, issued it. An earlier obligation starts on 18 January 2027: a platform may only make a foreign issuer's stablecoin available in the United States if that issuer can comply, and will comply, with US lawful orders such as freezes. Platforms need a coin inventory, an issuer vetting process and a delisting plan well before 2028.

Who counts as a digital asset service provider

The Act defines a digital asset service provider as a person that, for compensation or profit, engages in the business in the United States, including on behalf of US customers or users, of any of five activities:

• Exchanging digital assets for money
• Exchanging digital assets for other digital assets
• Transferring digital assets to a third party
• Acting as a digital asset custodian
• Participating in financial services relating to digital asset issuance

Developing or operating a blockchain protocol, validating transactions and providing self-custody wallet software are excluded. Treasury's proposed rule of 18 August 2026 adds that a person in the business of issuing payment stablecoins is also a digital asset service provider.

The definition reaches offshore platforms. Section 3 of the Act is expressly intended to apply outside the United States where a coin is offered or sold to a person located there.

The two deadlines

The first deadline is often missed in planning because it sits in a different subsection. Treasury's proposal confirms that the foreign issuer condition in section 3(b)(2) applies from the effective date, while the general prohibition in section 3(b)(1) applies from 18 July 2028.

What "offer or sell" means in Treasury's proposal

Treasury's proposal gives examples of conduct that counts as an offer or sale to a person located in the United States:

• Directly soliciting a person in the United States to buy the coin
• Advertising the coin as available to persons in the United States
• Responding to an unsolicited enquiry from a US person by indicating willingness to sell
• Advising buyers how to evade location checks such as IP address blocks
• Entering into a sale contract with a US person, whatever the payment or delivery timing

An individual counts as located in the United States if physically present there, unless a non-resident on a temporary visit. A company counts if it is organised in the United States or has its principal place of business there. The proposal also covers listing a coin that has not yet been issued, because making it available for purchase is an offer.

There is a safe harbour. A provider is treated as not offering to US persons if it reasonably believes the customer is outside the United States, has adopted and implemented controls reasonably designed to exclude US persons, and does not advertise or solicit in a way that targets them. Comments on the proposal closed on 19 October 2026.

Step one: build the coin inventory

Start with a list of every payment stablecoin the platform lists, holds in custody, accepts as collateral or uses in settlement. For each coin, record:

• The legal issuer and where it is organised
• The issuer's current status: applying, approved, state qualified or foreign
• For a foreign issuer, its home regulator, whether Treasury has determined that regime comparable, and whether the issuer has registered with the OCC
• Whether the issuer can freeze and block tokens on the chains the platform supports
• US exposure: balances held for US customers, trading volume and collateral use

Inventory should cover internal uses too. A coin issued by a non-permitted issuer cannot be treated as cash or a cash equivalent for accounting, cannot serve as cash-equivalent margin for broker-dealers, futures commission merchants and swap dealers, and cannot be used as a settlement asset between banks. Treasury and collateral teams need the same list as the listings team.

Step two: vet issuers

For US issuers, the test from 18 July 2028 is simple: is the issuer a permitted payment stablecoin issuer? Check the approving regulator's records rather than relying on marketing. During 2027 many issuers will be pending, and some may be operating under a waiver of up to 12 months from 18 January 2027. A provider should document which issuers rely on a waiver and when it ends.

For foreign issuers there are two tests. From 18 January 2027 the issuer must have the technological capability to comply, and will comply, with US lawful orders. Treasury proposes that a provider may rely on the issuer's representation of this only after reasonable due diligence, and not where it knows, has reason to know or should know the representation is false. From 18 July 2028 the issuer must also meet section 18: a comparable home regime determined by Treasury, OCC registration, sufficient reserves in a US financial institution, and a home country free of comprehensive US sanctions.

Step three: plan delisting and migration

Some coins will not qualify by 18 July 2028. A provider that keeps offering them to US persons breaches section 3. Plan the exit early:

• Set internal dates for restricting new purchases, then for full delisting for US persons
• Decide whether US customers may continue to hold and withdraw, or must convert into a permitted coin
• Notify customers in good time and give clear conversion paths
• Unwind collateral and margin positions that rely on the coin
• Update geofencing and customer location controls to support the safe harbour for non-US customers

The Act gives one built-in grace period. If Treasury rescinds a comparability determination, providers have 90 days before offering or selling that issuer's coins becomes a violation. There is no equivalent grace period for a US issuer that never obtains approval.

Custodians: section 10 from 18 January 2027

A person that holds payment stablecoin reserves, payment stablecoins used as collateral, or the private keys used to issue permitted coins must be supervised by a federal banking regulator, the SEC or CFTC, or a state bank or credit union supervisor that shares information with the Federal Reserve. It must treat customer property as belonging to the customer, protect it from its own creditors, keep it separately accounted for and not commingle it with its own assets, subject to omnibus account exceptions at banks and trust companies. Customers' claims to stablecoins held for them rank ahead of other creditors. Providers of hardware or software for self-custody are excluded.

Licences the platform itself still needs

The GENIUS Act does not license exchanges or custodians as such. A US-facing platform still needs FinCEN MSB registration and, in most states, state money transmitter licences, or a charter such as an OCC national trust bank. If the platform also plans to issue its own coin, it needs US payment stablecoin issuer approval. Our guide on how to become a permitted payment stablecoin issuer covers that application, and our comparison of an OCC national trust charter and state money transmitter licences covers the platform's own licensing choice.

Platforms also serving Europe should align the US coin inventory with their MiCA compliance as a crypto-asset service provider, so one listing policy covers both markets.

Questions Treasury has left open

Treasury's proposal asks for views on several points that will affect platforms, so the final rule may differ. The most important are:

• Whether to create safe harbours for a de minimis volume of transactions, and whether they should be time based, for example for a period after 18 July 2028, or size based, for example below US$1 million a year
• Whether any safe harbour should apply to coins from domestic issuers, foreign issuers or both
• How to treat coins from a state qualified issuer whose state does not certify its regime in time, or whose certification is denied, including whether those coins should become unlawful if the issuer does not obtain a federal or another state's approval within a set period

Treasury also says it considered, and rejected, a longer 36-month transition with a safe harbour for unregistered foreign coins below US$1 billion of US-held capitalisation, on the basis that the delay in consumer protection would outweigh the reduced cost. Platforms should not plan on an extension beyond 18 July 2028.

Until the final rule is issued, build processes that work under the proposal as drafted. The statutory dates in sections 3 and 18 will not change, and the proposal's tests for location, reliance on representations and the safe harbour are the best guide to what the final rule will ask platforms to prove.

A timetable for platforms

• By December 2026: complete the coin inventory and identify every foreign issuer listed
• By 18 January 2027: obtain and test lawful order representations for every foreign issuer coin, and confirm custodians meet section 10
• During 2027: track US issuer approvals and waivers, and Treasury comparability determinations
• By early 2028: set delisting dates for coins unlikely to qualify, and notify US customers
• By 18 July 2028: offer and sell to US persons only coins from permitted or compliant foreign issuers