01
Key takeaways
- The Federal Reserve proposed its GENIUS Act rule on 29 September 2026. Comments close 30 November 2026.
- Its draft officer definition includes the CFO and the Bank Secrecy Act officer, whatever their title.
- The Act takes effect on 18 January 2027, or 120 days after final rules if that comes first.
- Issuers need a designated AML officer, and a CEO and CFO who certify reserves monthly.
- Hire the BSA officer and the controller before you file, not after approval.
02
What happened between 29 September and 2 October 2026
Two rules landed in two days, and a third deadline is close. On 29 September 2026 the Federal Reserve Board published a 104-page proposed rule for the stablecoin issuers it will supervise. Comments are due 30 November 2026.
On 30 September, Treasury issued an interim final rule on how state regulators get their stablecoin regimes certified. It took effect that day, though Treasury won't accept certifications until a paperwork approval clears. That matters for startups: an issuer with no more than $10 billion outstanding can opt for a state regime, if the state's rules are certified as substantially similar to the federal framework.
Comments on Treasury's separate proposal on who may issue and sell payment stablecoins in the US are due 19 October 2026.
None of these is final. Ledger Insights reported on 1 October 2026 that no federal regulator had finalized its GENIUS Act rules. The statute doesn't wait. It takes effect on the earlier of 18 January 2027 or 120 days after the primary federal regulators issue final rules. From then, it's generally unlawful to issue a payment stablecoin in the US without being a permitted issuer.
03
The two roles the Act already names
Here's the part founders skim past. The GENIUS Act, signed on 18 July 2025, doesn't just regulate tokens. It names jobs.
Section 4(a)(5) treats a permitted issuer as a financial institution under the Bank Secrecy Act. That means an effective anti-money laundering program, with risk assessments and the designation of an officer to supervise it. FinCEN and OFAC proposed the matching AML and sanctions program rules on 8 April 2026.
Section 4(a)(3) adds a monthly duty. A registered public accounting firm must examine the issuer's month-end reserve report, and the CEO and CFO must certify its accuracy to the regulator every month. A knowingly false certification carries the criminal penalties set out in 18 U.S.C. 1350(c).
The Fed's 29 September proposal then defines officer to include the CFO and the Bank Secrecy Act officer, plus anyone serving in the functional capacity of those titles, without regard to title.
Giving the BSA hat to your COO doesn't make the role disappear. It makes your COO the BSA officer.
04
Why the timing is tighter than 18 January suggests
Section 5 of the Act gives a federal regulator 120 days to decide on a substantially complete license application. Counted back from 18 January 2027, that's 20 September 2026. That date has already passed.
The same section lists what regulators weigh, including the competence, experience and integrity of the applicant's officers and directors. So the people come before the filing. An application with a placeholder BSA officer or an unnamed CFO asks a regulator to take your team on trust.
That means a recently funded stablecoin startup of 15 or 40 people should treat these as Q4 2026 hires, not 2027 hires.
05
What to look for in a stablecoin BSA officer
Search for this role and most results are written for candidates. On 6 October 2026, a US Google search for hire compliance officer startup returned job boards, a LinkedIn post and a Reddit thread. GENIUS Act compliance hiring returned mostly crypto compliance job listings. Here's the employer side.
A compliance officer from a large bank knows the rules. Your first BSA officer also has to build the program from zero, often as a team of one. Screen for that.
- Has been the named BSA or AML officer at a money transmitter, payments company or sponsor-bank fintech, not only a member of the team.
- Has owned SAR decisions end to end, including documented decisions not to file.
- Has run an OFAC sanctions program and can explain how screening works on-chain and off-chain.
- Can work with engineering on the Act's requirement to block, freeze and reject impermissible transactions.
- Has prepared for, or sat through, a regulatory exam.
See how TTR scopes compliance officer searches across AML, KYC and regulatory operations. If the freeze and block work needs engineers who understand the compliance boundary, see fintech systems engineers.
06
What to look for in the controller behind the CFO certification
The CFO signs. Someone has to produce a number worth signing, every month, that an outside accounting firm will examine. At a company under 50 people, that's usually a controller.
The Act also requires issuers to publish the monthly composition of their reserves on their website: outstanding stablecoins, plus the amount, average tenor and custody location of each category of reserve instrument. The Fed's proposal uses fair value, as determined under US GAAP, in its reserve requirements.
- Has closed the books monthly on a fixed calendar, not quarterly with catch-up.
- Has supported an external accounting firm's examination or attestation, not just a year-end audit.
- Can reconcile cash and Treasury bill positions across more than one custodian.
- Understands fair value under US GAAP for the reserve instruments the Act permits.
- Will tell the CFO no when a number isn't ready.
See how TTR scopes financial controller searches. Once redemptions and reserve tenor need forecasting, the next hire is often an FP&A analyst. If the CFO seat itself is open, that's an executive search mandate.
07
What this means for your hiring
If you plan to issue a payment stablecoin in the US, sequence the hires like this.
- First, name the BSA/AML officer. The statute requires the designation, and the program has to exist before an application can describe it.
- Second, hire the controller early enough to run at least two clean monthly reserve closes before anyone certifies one.
- Third, settle who holds the CFO certification. That person signs monthly under criminal penalty, so they'll want a controller and a close process they trust.
- Fourth, leave FP&A and a second compliance hire until the reserve and redemption workflow is live.
If you only integrate another issuer's stablecoin, your obligations differ. Treasury's proposal applies the restriction on offering non-permitted stablecoins to people in the US from 18 July 2028. Hire for the rules you're actually subject to.
Speed matters here. Industry-wide, offers take 60–90 days. TTR reports 3–5 days to first intro and 14–21 days to offer. These are TTR-reported benchmarks, not promises.
08
TTR's take
The team at TTR thinks most stablecoin startups will hire the BSA officer late and the controller far too late. The controller gets treated as a bookkeeping upgrade after launch. The Act makes it the role that feeds a monthly certification signed under criminal penalty.
Hiring early has a real downside. You'll carry two senior hires before the final rules exist, and those rules may change the details. The team at TTR still thinks that's the cheaper risk. A rule can be revised. An application can't be filed without the people.
09
What to do this week
Read Sections 4(a)(3), 4(a)(5) and 5 of the Act, then the officer definition in the Fed's proposal. Write down who holds each role today, by name. If the answer is the founder or TBD, that's your Q4 hiring plan.
Run the role through the ungated mandate audit. If the hire is critical and you want candidates in days rather than months, book an intro with Emily Landon (opens Calendly in a new tab).