Coin Center Urges FinCEN and OFAC to Prioritize Data Privacy and Security in New Stablecoin Regulatory Framework

The landscape of digital finance faces a significant inflection point as the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC) move forward with rulemaking under the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act. As regulators draft requirements for Permitted Payment Stablecoin Issuers (PPSIs), the policy debate has intensified, centering on the tension between robust anti-money laundering (AML) protocols and the protection of individual privacy. Coin Center, a prominent nonprofit research and advocacy organization, recently submitted a formal response to these agencies, arguing that current compliance models—which rely on the massive collection of static identity data—may inadvertently increase systemic risks to the American financial infrastructure.

The Regulatory Context and the GENIUS Act

The GENIUS Act was introduced to provide a comprehensive federal framework for the issuance and management of payment stablecoins in the United States. While the legislation aims to integrate these digital assets into the broader financial system, it mandates that issuers implement rigorous Anti-Money Laundering (AML), Countering the Financing of Terrorism (CFT), and sanctions compliance programs.

In response to the recent Notice of Proposed Rulemaking (NPRM), Coin Center has cautioned that the implementation of these mandates must not inadvertently transform stablecoin issuers into engines of mass financial surveillance. The organization contends that if PPSIs are compelled to create databases that map real-world identities to permanent, immutable blockchain transaction histories, they will inevitably construct "honeypots" for hackers and foreign adversaries, potentially creating more security risks than the regulations intend to solve.

Chronology of the Policy Shift

The current regulatory discourse follows a multi-year effort by U.S. federal agencies to address the intersection of decentralized technology and national security:

• 2021–2023: FinCEN reports a significant increase in identity-related suspicious activity, with identity-related fraud reaching an estimated $394 billion by 2023.
• June 2025: The National Institute of Standards and Technology (NIST) updates its Digital Identity Guidelines, emphasizing the urgent need for privacy-preserving solutions due to the rising sophistication of cyber threats.
• June 2026: The formal comment period for the GENIUS Act implementation opens, prompting industry participants and advocacy groups to weigh in on the proposed compliance architecture.
• Present: FinCEN and OFAC are evaluating these public submissions to refine the final rules governing PPSI operations, particularly regarding secondary-market monitoring and data retention.

Data Vulnerabilities and the Myth of "More Data, More Safety"

A central pillar of Coin Center’s argument is that the traditional "collect everything" approach to Know Your Customer (KYC) requirements is increasingly obsolete. Historical data supports this assertion: as institutions accumulate vast repositories of personally identifiable information (PII)—including Social Security numbers, passport scans, and biometric templates—they become primary targets for large-scale data breaches.

The Identity Theft Resource Center (ITRC) 2025 report highlights a shift in criminal tactics from indiscriminate identity theft to the weaponization of static identifiers for long-term fraud. Because these identifiers are permanent, their compromise allows criminals to impersonate victims across multiple platforms indefinitely. A 2024 University of Brasília study of 506 corporate data breaches found that financial institutions remain the most targeted sector, as they hold the exact credentials needed to bypass modern authentication systems.

When applied to stablecoins, the risk is amplified. Because blockchain ledgers are public and immutable, an identity-linked breach does not just reveal a customer’s name and address; it exposes a complete, persistent map of their financial associations and behaviors. Coin Center warns that this creates a "dossier" effect, which, if accessed by hostile state actors, could lead to the targeted harassment of political dissidents, journalists, or members of vulnerable populations.

The Case for Privacy-Preserving Innovation

Rather than relying on legacy methods, Coin Center advocates for a paradigm shift toward "data-minimized compliance." This involves the use of zero-knowledge proofs, attribute-based credentials, and dynamic risk-scoring mechanisms. These technologies allow a PPSI to verify that a customer is a U.S. person or is not on a sanctions list without actually holding or storing the underlying, sensitive raw data.

The proposal includes five specific recommendations for regulators:

1. Operational Risk Recognition: Formally classify the overcollection of sensitive PII as an operational and AML risk in itself.
2. Validation of Privacy Tools: Expressly authorize the use of privacy-preserving digital identity solutions that produce auditable compliance outputs.
3. Safe Harbor Provision: Create a pilot program for data-minimized onboarding to encourage technological experimentation.
4. Secondary Market Clarity: Clarify that secondary-market transfers do not automatically trigger burdensome recordkeeping or "Travel Rule" obligations for the original issuer.
5. Procedural Safeguards: Implement strict legal processes and procedural checks before any secondary-market freezes of U.S. persons’ property can occur.

Implications for the Financial Sector

The broader implications of this debate extend far beyond the stablecoin market. The tension between the Fourth Amendment and modern financial surveillance is reaching a critical stage. Coin Center’s reference to Carpenter v. United States is particularly salient; in that case, the Supreme Court recognized that users do not necessarily forfeit all privacy expectations regarding their movements just because they utilize modern technology.

If FinCEN and OFAC adopt the recommendations for privacy-preserving identity, it could set a new global standard for financial regulation. Conversely, if the agencies mandate full-scale, persistent tracking, the U.S. may create a financial system that is theoretically compliant but practically vulnerable to the very cybercrimes it aims to prevent.

Industry analysts suggest that the final rules will likely be a compromise. Regulators are under intense pressure to stop illicit flows, but they are also increasingly aware of the national security risks posed by centralized databases. If the agencies choose to incentivize "privacy-by-design" architectures, they could foster a market where PPSIs serve as high-security, low-risk financial intermediaries. If, however, they prioritize legacy data-collection mandates, the industry may see a rise in decentralized, off-shore, or non-compliant alternatives that operate entirely outside the U.S. regulatory perimeter.

As the comment period concludes, the focus shifts to the drafting of the final rules. The final regulatory package will reveal whether the U.S. government views the future of digital money as an extension of 20th-century surveillance or as a chance to pioneer a more secure, privacy-respecting financial infrastructure. For the millions of Americans expected to use stablecoins for daily transactions, the outcome of this rulemaking will define the balance between their security and their autonomy for years to come.