Build GENIUS Act-ready stablecoin controls
Formance Ledger gives stablecoin issuers the point-in-time balance queries, per-brand attribution, and immutable transaction history the GENIUS Act's January 18, 2027 deadline requires. Explore the open-source Ledger on GitHub to run it yourself.
The GENIUS Act was signed July 18, 2025, as Public Law 119-27. It governs who may issue a payment stablecoin and the reserve, disclosure, redemption, and freeze duties every issuer runs under. Each duty must be recorded in the issuer's ledger and reconciled to custodian statements and on-chain supply.
Stablecoin builders should plan against January 18, 2027 as the working go-live date for Genius Act compliance. If you issue a payment stablecoin, you have to understand the GENIUS Act's reserve, disclosure, freeze, and redemption duties at the posting level.
Stablecoin builders must ensure their platform can issue and redeem stablecoins at par, hold 1:1 identifiable reserves, and provide custody for tokens, reserves, or private keys to align with the GENIUS Act
Meeting this issuer-and-redeemer mandate requires builders to be defined as a payment stablecoin under the Act, choose one of the three qualification pathways, and translate the statutory activity limitation into a ledger whitelist.
Builders need to work from the enrolled text of S.1582, which defines a payment stablecoin as a digital asset used for payment or settlement that the issuer must redeem for a fixed amount of monetary value and hold stable against it.
The same text limits builders operating as a permitted issuer to five activities:
If builders need to support additional "incidental activities," they may do so only with case-by-case authorization from the issuer's federal or state regulator.
Builders must select one of three pathways to permitted-issuer status, set out in Sections 5 and Section 7 of the Act:
The pathway builders choose determines the primary regulator, the examination cadence, and the ceiling on outstanding supply before a mandatory transition. Builders should lock it in before designing the stablecoin ledger.
For the ledger, builders must implement the activity limitation as a whitelist. Every posting family in the chart of accounts builders design has to trace to mint, redeem, reserve purchase and sale, custody movement, or a directly supporting fee.
Any posting builders introduced that fit none of the five families belong to the operating business and should never touch a reserve account.
Encoding that whitelist as programmable money lets builders turn each statutory duty into a posting rule the ledger enforces at commit time, rather than a policy the operations team polices after the fact.
A permitted payment stablecoin issuer must back every outstanding token with identifiable reserves at least 1:1, with the ledger proving that backing at any moment.
Two things determine what that looks like in practice: which assets actually qualify as reserves, and what an issuer can and can't do with those reserves once they're held.
The FDIC's April 10, 2026 proposal counts cash and Federal Reserve balances, deposits withdrawable on request at an insured depository institution or credit union, and Treasury bills, notes, or bonds with a remaining maturity of 93 days or less.
It also counts overnight Treasury repurchase agreements, reverse repurchase agreements, and government money market funds.
Each category, plus the 93-day and overnight limits, becomes a segment in the reserve account path.
Builders can trace any dollar of reserves back to the specific instrument and maturity bucket it belongs to.
The Act's reserve reuse ban prohibits an issuer from pledging, rehypothecating, or reusing reserve assets.
Three narrow exceptions apply: margin on permitted reserve investments, standard custodial obligations, and repo of Treasury bills to create redemption liquidity.
Builders should treat these exceptions as distinct posting types, not general-purpose transfers. Each carries its own statutory conditions and needs its own audit trail.
The CEO and CFO must personally certify a monthly reserve report, under criminal penalties for false certification, before a registered public accounting firm examines it and the issuer publishes it on its website. The ledger is the system of record backing the certified outstanding-supply figure.
Section 4 of Public Law 119-27 requires the monthly reserve report to cover outstanding count and reserve composition, published by close of business month-end with prior-month data. Issuers above $50 billion also file audited annuals, OCC-supervised issuers face confidential supervisory reporting, and every issuer must publish a redemption policy disclosing all fees.
Producing the certified outstanding-supply figure takes two ledger controls: a per-chain finality rule that decides which on-chain state is authoritative, and a three-way reconciliation that ties chain supply, ledger balances, and custodian statements to the number the CFO signs.
Define a finality policy for each supported chain before reconciling its supply snapshot to the ledger. Which confirmation depth authorizes a mint or burn posting is a finality decision.
Once the finality rule is set, the balance in @platform:stablecoinLiabilities:brands:001:outstanding is the number that gets certified, and on-chain supply is what the certified balance is reconciled against.
Reconcile three sources at month-end (on-chain supply, ledger balances, and custodian statements) snapshotted at the finality-approved block.
Snapshot on-chain supply per chain at the month-end block that meets the finality rule, then read the ledger's outstanding and reserve balances as of the same timestamp, and reconcile each custodian statement against its reserve account balance.
Emit the report and freeze the query parameters as the artifact the accounting firm examines.
Under the GENIUS Act, the CFO certifies the outstanding-supply figure every month, so the underlying query must be reproducible on demand against the frozen month-end parameters.
Freeze and seize run as two posting lifecycles: a restrict posting moves tokens into an order-keyed restricted account, then an atomic burn-and-reissue posting transfers value to a government-controlled wallet.
Every posting commits atomically alongside the lawful-order reference in ledger metadata.
Under the Act's definition of "lawful order", issuers must seize and freeze stablecoins when required by law and prevent transfers. Separately, issuers are treated as financial institutions under the Bank Secrecy Act, requiring AML, KYC, and sanctions screening programs.
A freeze restricts the holder address on-chain and moves the token balance into a restricted-state account under the order key. The backing reserves do not move, because the frozen tokens remain outstanding and therefore remain subject to the 1:1 backing requirement.
A seizure warrant directs the burn and reissue of the restricted tokens at equal value to a government-controlled wallet. The ledger posts the burn and mint in one transaction, and the reserve lots that backed the frozen tokens now back the reissued ones.
Every restrict and burn posting carries the legal-process document reference, the issuing authority, and the receipt timestamp. Therefore, the ledger shows the elapsed time between the freeze request and the lawful order without staff having to reconstruct the event.
Par redemption runs as a three-state lifecycle: requested, funded, and settled. The token burn and reserve drawdown must commit as one atomic ledger transaction, and expected redemptions can be funded through short-term repo.
Two controls make this work: the atomicity and idempotency that make burn and payout inseparable, and the T-bill repos that fund expected redemption volume.
Design the redemption flow so neither the burn posting nor the reserve-drawdown posting can commit independently: a burn without a wire leaves the holder unpaid, and a wire without a burn leaves an unbacked token in circulation.
Orchestration through connected providers must handle retries, failures, and reconciliation because ledger atomicity alone cannot ensure that an on-chain burn and bank wire either both execute or neither executes. The orchestration layer should enforce an idempotency key on the request so a duplicated redemption call cannot drain reserves twice.
Treasury's third exception permits an issuer to sell T-bills into repurchase agreements of 93 days or less to fund expected redemptions. The repo must clear through an SEC-registered clearing agency or receive regulatory approval.
Where reserve, freeze, and redemption controls attach across the issue, transfer, and redeem flow is laid out in the stablecoin sandwich.
Build four ledger controls before January 18, 2027: 1:1 identifiable reserves, monthly certified reporting, lawful freeze/seize, and par redemption.
A programmable ledger enforces all four as commit-time invariants:
The Numscript records a par redemption for brand 001: burning 1,000,000 USDX against the outstanding-liability account and drawing $1,000,000 from the custodian.
A reserves to the redemption wire account, in one atomic transaction stamped with the idempotency key and custodian confirmation reference.
// STABLECOIN_REDEEM
// Event: burn 1,000,000 USDX and draw $1,000,000 from custodian A reserves
send [USDX/6 1000000000000] (
source = @platform:stablecoinLiabilities:brands:001:outstanding
destination = @world
)
send [USD/2 100000000] (
source = @platform:reserves:brands:001:custodians:a:deposits
destination = @platform:wires:brands:001:outbound:redemption
)
set_tx_meta("event_type", "stablecoin_redeem")
set_tx_meta("redemption_id", "red001")
set_tx_meta("idempotency_key", "red001-2027-01-19T14:32:00Z")
set_tx_meta("custodian", "custodian_a")
set_tx_meta("custodian_confirmation", "conf_9f83a1")
set_tx_meta("holder_reference", "holder_7712")