On 21 October, the Office of the Comptroller of the Currency announced its final rule implementing the GENIUS Act for payment stablecoin issuers under its jurisdiction. The full text was published in the Federal Register on 23 October. Both the rule and the Act take effect on 18 January 2027.
Most of the coverage has focused on reserves, yield and capital. Those matter, but the part of the rule we read most closely is quieter: how it defines a private key, what it means to "control" a digital asset, and where it draws the line between a custodian and a company that only builds wallet tools. For anyone who designs, builds or uses wallets, these definitions are now part of the operating environment.
What the rule covers, and when
The rule creates a new 12 CFR part 15 covering reserve assets, redemption, risk management, audits and reporting, custody, applications and capital. According to the OCC, it addresses every regulation the agency must write under the Act except anti-money laundering and sanctions rules, which will come in a separate rulemaking with the Treasury. The OCC says it received approximately 328 comments on its March proposal.
The timeline is tight. In a companion bulletin, the OCC states that from 18 January 2027 a person generally must be approved as a permitted payment stablecoin issuer to issue a payment stablecoin in the United States, and that noncompliance carries criminal penalties. Because the Act has no built-in transition period, an issuer with a substantially complete application pending on that date may ask the OCC to waive requirements for up to 12 months. The OCC will start accepting applications once the Office of Management and Budget approves the application forms, and says it will announce that date separately.
A private key is no longer a single string
The proposal defined a private key as "the unique alphanumeric string that allows an individual to transfer a particular unit of a digital asset." Commenters pointed out that this wording assumes a single static key and does not describe how many modern wallets actually work, with key shares split across independent parties or hardware environments so that the full key never exists in one place.
The OCC agreed and changed the definition. Under the final rule, a private key means "the cryptographic material, whether held in whole, in shares, or reconstructed ephemerally, that confers the ability to authorize a transaction on a distributed ledger."
This is a practical change. Multi-party computation, threshold signatures and sharded backups are not ways around the rule's custody concepts; they are explicitly inside them. Splitting a key does not change the question of who can authorize a transfer.
Control is defined by who can move the asset
The custody provisions in subpart C apply to "covered custodians" holding "covered assets": payment stablecoin reserves, payment stablecoins used as collateral, and the private keys used to issue payment stablecoins. Covered custodians must record customer assets separately, treat them as the customer's property rather than their own, protect them from the claims of their own creditors, and segregate them from their own assets. Omnibus accounts are allowed only with adequate recordkeeping and full disclosure in the custody agreement.
The key test is in section 15.21(b)(2). For payment stablecoins, tokenized reserve assets and issuance keys, a custodian maintains control if it can reasonably demonstrate that "no other party, including the covered customer, can transfer the payment stablecoin or tokenized asset without the consent of the custodian."
That is a functional definition. It does not depend on where a device sits or what a product is called. It depends on one thing: who can sign.
Building wallet tools is not custody, if you never hold control
Section 10(e) of the GENIUS Act says the Act's custody requirements do not apply to a person solely because it provides hardware or software that helps customers keep their own payment stablecoins or private keys. The final rule implements this in section 15.23 and adds a condition that was not in the proposal.
The exclusion applies only if the provider "neither controls nor holds itself out as controlling the relevant private keys associated with covered assets and does not provide or hold itself out as providing safekeeping and custodial services." The OCC explains that third-party services "may in practice resemble" custody arrangements, and that a non-control requirement is "a low-burden means of preventing regulatory avoidance."
Two details are worth noting. First, the test covers what a provider claims as well as what it does: marketing a tool as custody can count, even if the architecture is self-custodial. Second, the OCC declined to create a broad safe harbor for ancillary services such as trade execution, recordkeeping or tax reporting offered to self-custody users. If an institution's authority to offer those services rests on its custody powers, it is acting as a custodian and subpart C applies.
The rule also does not prohibit self-custody or non-hosted wallets. The OCC declined requests to bar issuers from dealing with such wallets, while noting that issuers must still meet the Act's requirement to have the technological capability to comply with lawful orders, and must follow anti-money laundering and sanctions rules.
Bridges, wrapped tokens and public addresses
Several smaller clarifications matter for multi-chain products:
- Wrapped stablecoins. The OCC notes that when a bridge takes a payment stablecoin as input, the minted wrapped asset "generally would not itself be a payment stablecoin," because a digital asset redeemable for another stablecoin does not meet the definition.
- Bridges in general. The agency says there are "a number of unsettled legal questions" about bridges and gives no definitive answer. It expects custodians to understand a bridge's code, contract terms, legal roles and redemption rights, and lists the presence of any administrative key as a factor in the analysis.
- On-chain data. Information broadly accessible on a distributed ledger is treated as publicly available. A public wallet address is not nonpublic personal information, but private data that links a customer's identity to that address is.
- Minting is not issuance. Tokens minted into an issuer's treasury do not count toward outstanding issuance value until the issuer owes redemption on them, and burned tokens drop out.
Redemption becomes a published commitment
For holders, the most visible change is redemption. Issuers must publish a redemption policy stating that timely redemption "may not exceed two business days" after the requested date, with a business day defined as any day other than a Saturday, Sunday or federal holiday. The policy must explain how to redeem, link to the redemption website, and state any minimum, while issuers must redeem any amount of one stablecoin or more, subject to customer screening and onboarding.
If redemption requests exceed 10 percent of a brand's outstanding issuance value in a single 24-hour period, the issuer must notify the OCC within 24 hours and may ask for an extension. Only the regulator, not the issuer, can impose discretionary limits on timely redemption. Issuers must also publish fees, a link to a monthly reserve composition report, and plain statements that payment stablecoins are not legal tender, not deposits and not insured by the FDIC.
How we read it
We build blockchain infrastructure, and we do not issue a payment stablecoin. Even so, this rule is useful well beyond the institutions it directly regulates, because it writes down in plain terms how a federal regulator thinks about keys and control.
Three points shape how we approach wallet and custody design:
- Architecture and description must match. Under section 15.23, what a product says about control is part of the test. Documentation, interfaces and marketing should describe exactly who can authorize a transfer, and nothing more.
- Split keys are still keys. The shared-key definition removes any doubt that threshold and MPC designs are judged by who can produce a valid signature, not by how many pieces the key is in.
- Bridges and admin keys deserve their own analysis. Where a design depends on a bridge or an administrative key, the control question has to be answered for that component specifically. The OCC has said it will look at both.
None of this decides the open questions. The anti-money laundering and sanctions rules are still to come, other agencies are writing their own GENIUS Act rules, and the OCC says it expects to update part 15 as the market develops. But the definitions of private key, control and self-custody tooling are now in final regulatory text, with an effective date less than three months away.
Sources: OCC News Release 2026-92, OCC Bulletin 2026-50, OCC Bulletin 2026-51 and the final rule in the Federal Register (Docket ID OCC-2025-0372).
