The GENIUS Act Creates a New Regulatory Framework for Stablecoins in Puerto Rico
Puerto Rico has positioned itself as a jurisdiction where digital asset businesses can operate under clear regulatory rules. The GENIUS Act (Growth via Energy and Innovation on Unrestricted Sectors Act) establishes specific requirements for stablecoin issuers and operators who want to conduct business in Puerto Rico. Understanding these rules is essential if your business plans to issue, hold, or transfer stablecoins within the territory or to Puerto Rico residents.
The regulatory framework applies to any entity that creates, manages, or maintains a stablecoin. This includes companies that peg their tokens to fiat currency, commodities, or other assets. The rules are designed to protect consumers while allowing innovation to proceed within defined boundaries. Compliance is not optional, and violations carry significant penalties including fines, license revocation, and potential criminal liability.
Who Must Comply with GENIUS Act Stablecoin Rules
The GENIUS Act applies to stablecoin issuers and operators regardless of where they are incorporated. If your company issues or operates a stablecoin and markets it to Puerto Rico residents or conducts any part of your operations in Puerto Rico, you fall under this regulatory regime. This includes domestic Puerto Rico corporations, foreign corporations with Puerto Rico operations, and even companies that only provide services to Puerto Rico-based customers.
The definition of a stablecoin under the GENIUS Act is broad. It covers any digital asset designed to maintain a stable value relative to a reference asset, basket of assets, or algorithm. This means tokens pegged to the US dollar, the euro, gold, or other commodities all require compliance. Even algorithmic stablecoins that maintain stability through smart contracts or other mechanisms fall within the regulatory scope.
Certain entities may be exempt from full compliance requirements. Banks licensed under Puerto Rico banking law, credit unions, and other financial institutions regulated by the Puerto Rico Office of the Commissioner of Financial Institutions may have different obligations. However, exemption status requires careful analysis of your specific business model and regulatory status. Assuming you qualify for an exemption without proper legal review can result in unintended violations.
Core Requirements for Stablecoin Issuers
Stablecoin issuers must obtain a license from the Puerto Rico Office of the Commissioner of Financial Institutions before conducting any business. The application process requires detailed information about your company's ownership structure, management team, business plan, and risk management procedures. You must demonstrate that your organization has the financial capacity and operational infrastructure to maintain the stablecoin's stability and protect customer assets.
Capital requirements are a central component of the licensing framework. Issuers must maintain minimum capital reserves that correspond to the total value of stablecoins in circulation. The specific reserve requirement depends on the type of stablecoin and the assets backing it. Fiat-backed stablecoins typically require 100 percent reserves held in approved depository institutions. Commodity-backed stablecoins may have different reserve calculations based on the volatility and liquidity of the underlying asset.
Reserve assets must be held in segregated accounts separate from the issuer's operating funds. This segregation protects stablecoin holders if the issuer faces financial distress or bankruptcy. The accounts must be held with approved custodians, which generally include banks licensed in Puerto Rico or the United States. Regular audits by independent accountants are required to verify that reserves match the outstanding stablecoin supply.
Issuers must establish and maintain comprehensive risk management policies. These policies must address market risk, liquidity risk, operational risk, and cybersecurity risk. Your company must document procedures for monitoring reserve adequacy, managing redemption requests, and responding to market stress events. The Puerto Rico Office of the Commissioner of Financial Institutions will review these policies as part of the licensing process and may require modifications before approval.
Redemption Rights and Consumer Protections
Stablecoin holders must have the right to redeem their tokens for the underlying asset or fiat currency at the stated peg value. This redemption right cannot be suspended except in extraordinary circumstances, such as a declared emergency or court order. Your company must establish clear procedures for processing redemptions and must complete redemption requests within a specified timeframe, typically within two business days.
Redemption procedures must be transparent and accessible to all stablecoin holders. You cannot impose unreasonable fees or conditions that effectively prevent redemption. The redemption mechanism must function continuously during normal business hours and must be available through multiple channels if possible. If your stablecoin operates on a blockchain, redemption must be possible through smart contracts or other automated mechanisms that do not require manual intervention by your company.
Disclosure requirements are extensive. Issuers must provide clear, accurate information about the stablecoin's characteristics, the assets backing it, the risks associated with holding the token, and the redemption process. This information must be provided to prospective holders before they acquire any stablecoins. Updates to key information must be communicated promptly to existing holders. Misleading or incomplete disclosures can result in regulatory action and civil liability.
Consumer complaint procedures must be established and maintained. Stablecoin holders must have a clear mechanism for reporting problems, requesting information, or filing complaints. Your company must respond to complaints within a specified timeframe and must maintain records of all complaints and resolutions. The Puerto Rico Office of the Commissioner of Financial Institutions may review complaint records during examinations or investigations.
Operational and Governance Requirements
Your company must maintain a board of directors or equivalent governing body with appropriate expertise and independence. Board members must have relevant experience in finance, technology, risk management, or related fields. At least one board member must be independent, meaning they have no material financial interest in the company beyond their board compensation. The board must meet regularly and must maintain detailed minutes of all meetings and decisions.
Management must include individuals with demonstrated competence in the areas of finance, technology, and compliance. Key personnel must undergo background checks and must not have criminal convictions or regulatory sanctions that would disqualify them from managing a financial services company. Changes in key personnel must be reported to the Puerto Rico Office of the Commissioner of Financial Institutions within a specified timeframe.
Cybersecurity standards are mandatory. Your company must implement security measures appropriate to the risks posed by digital asset operations. This includes encryption, multi-factor authentication, regular security audits, and incident response procedures. You must maintain insurance coverage for cybersecurity risks and must report any security breaches to regulators and affected customers within the required timeframe.
Business continuity and disaster recovery plans must be documented and tested regularly. Your company must be able to continue critical operations in the event of system failures, natural disasters, or other disruptions. Backup systems must be maintained in geographically separate locations. Testing of backup systems must occur at least annually, and results must be documented and provided to regulators upon request.
Reporting and Examination Obligations
Licensed stablecoin issuers must file regular reports with the Puerto Rico Office of the Commissioner of Financial Institutions. These reports typically include financial statements, reserve verification reports, transaction volume data, and compliance certifications. The frequency and content of required reports will be specified in your license agreement. Failure to file required reports on time can result in penalties and potential license suspension.
The Puerto Rico Office of the Commissioner of Financial Institutions has the authority to examine your company's operations, records, and systems. Examinations may be conducted on-site or off-site and may occur with or without advance notice. Your company must cooperate fully with examiners and must provide access to all requested documents and systems. Obstruction of an examination can result in significant penalties.
Annual audits by independent accountants are required. The auditor must verify that reserves match the outstanding stablecoin supply and must assess the adequacy of risk management procedures. The audit report must be filed with the Puerto Rico Office of the Commissioner of Financial Institutions. The auditor may be required to report directly to regulators if significant deficiencies are identified.
Suspicious activity reporting requirements apply to stablecoin issuers. If your company detects transactions that may involve money laundering, terrorist financing, or other illegal activity, you must report this activity to the appropriate authorities. These reporting obligations exist independently of any customer privacy concerns and must be fulfilled even if the customer objects.
Anti-Money Laundering and Know Your Customer Requirements
Stablecoin issuers must implement comprehensive anti-money laundering (AML) and know your customer (KYC) programs. These programs must include customer identification procedures, beneficial ownership verification, and ongoing transaction monitoring. Your company must establish policies for identifying and reporting suspicious activity and must maintain records of all customer identification information.
Customer identification must occur before any stablecoin is issued or transferred. You must collect and verify the customer's name, address, date of birth, and government-issued identification. For business customers, you must identify the beneficial owners and verify their identities. The level of due diligence required may be enhanced for customers in high-risk jurisdictions or with high-risk profiles.
Transaction monitoring must be continuous and systematic. Your company must establish thresholds for transaction amounts and patterns that trigger enhanced review. Transactions that exceed specified amounts or that match patterns associated with money laundering must be investigated and reported if warranted. Automated monitoring systems are typically required for companies with high transaction volumes.
Record retention requirements are extensive. Your company must maintain customer identification records, transaction records, and suspicious activity reports for a minimum of five years. Records must be organized and indexed in a manner that allows for rapid retrieval in response to regulatory requests or law enforcement inquiries.
Tax Implications and Act 60 Considerations
Puerto Rico offers significant tax incentives for businesses operating in certain sectors, including digital assets and blockchain technology. The Act 60 regime provides reduced corporate tax rates and other benefits for qualifying businesses. Stablecoin issuers and operators may be eligible for these incentives if they meet specific requirements and obtain proper certification.
However, Act 60 benefits are not automatic. Your company must apply for Act 60 certification and must maintain compliance with all Act 60 requirements to retain the benefits. These requirements include maintaining a Puerto Rico office, employing Puerto Rico residents, and conducting substantial business operations in Puerto Rico. Failure to maintain compliance can result in loss of tax benefits and potential back tax liability.
For more information about Act 60 tax incentives and how they may apply to your stablecoin business, visit our Act 60 page.
Compliance Challenges and Common Pitfalls
Many stablecoin companies underestimate the complexity of Puerto Rico's regulatory requirements. The licensing process is rigorous and time-consuming. Applications that lack sufficient detail or that fail to address regulatory concerns will be rejected, requiring resubmission and additional delays. Companies should budget six to twelve months for the licensing process and should engage experienced legal counsel early in the process.
Reserve management is a frequent source of compliance problems. Companies must maintain precise records of reserve assets and must reconcile these records with outstanding stablecoin supply on a regular basis. Discrepancies, even small ones, must be identified and corrected promptly. Failure to maintain adequate reserves can result in license revocation and criminal prosecution.
Cybersecurity incidents can have severe regulatory consequences. Companies that experience security breaches must report them to regulators and customers within the required timeframe. Failure to report promptly can result in penalties even if the breach itself was not the company's fault. Companies should maintain comprehensive incident response procedures and should conduct regular security audits.
Redemption failures are particularly serious. If your company cannot meet redemption requests due to insufficient reserves or operational failures, this constitutes a material breach of the regulatory framework. Customers may file complaints with regulators, and regulators may initiate enforcement action. In extreme cases, redemption failures can trigger license revocation and civil or criminal liability.
Blockchain Compliance and Technical Considerations
The technical implementation of your stablecoin must comply with regulatory requirements. Smart contracts that govern stablecoin issuance, transfer, and redemption must function as intended and must not contain bugs or vulnerabilities that could compromise the stablecoin's stability or security. Code audits by independent security firms are strongly recommended and may be required by regulators.
Blockchain selection is an important decision with regulatory implications. Public blockchains offer transparency and decentralization but may present challenges for regulatory compliance and customer identification. Private or permissioned blockchains offer greater control but may raise questions about decentralization and security. Your choice of blockchain platform should be made in consultation with experienced legal and technical advisors.
For detailed information about blockchain compliance requirements in Puerto Rico, visit our blockchain compliance page.
Enforcement and Penalties
The Puerto Rico Office of the Commissioner of Financial Institutions has broad enforcement authority. Violations of the GENIUS Act stablecoin rules can result in civil penalties, license suspension or revocation, and criminal prosecution. Civil penalties can reach hundreds of thousands of dollars. Criminal penalties can include imprisonment and substantial fines.
Enforcement actions typically begin with a warning letter or notice of violation. Your company will be given an opportunity to respond and to cure the violation. If the violation is not cured within the specified timeframe, regulators may initiate formal enforcement proceedings. These proceedings can include administrative hearings, civil litigation, or criminal prosecution.
Reputational damage from enforcement actions can be severe. News of regulatory violations or enforcement actions can damage customer confidence and can make it difficult to attract investors or business partners. Companies should take compliance seriously and should address potential violations promptly.
Next Steps for Your Stablecoin Business
If your company plans to issue or operate a stablecoin in Puerto Rico, compliance with the GENIUS Act is not optional. The regulatory framework is complex and the consequences of non-compliance are serious. You should engage experienced legal counsel to review your business model, assess your compliance obligations, and guide you through the licensing process.
Christian M. Frank Fas, Esq. has over 20 years of experience in commercial and business law in Puerto Rico. The firm can help you understand the GENIUS Act stablecoin rules, prepare your license application, establish compliance procedures, and maintain ongoing regulatory compliance. Schedule a free initial evaluation to discuss your stablecoin business and your compliance obligations. Visit our free evaluation page to get started.