read the FinCEN/OFAC stablecoin NPRM all week

the FinCEN/OFAC joint NPRM landed April 8 and i've been chewing on it for a week. payment stablecoin issuers are about to be treated as financial institutions under the BSA.

full AML/CFT program, US-based compliance officer, SAR filing, and for the first time ever a federal sanctions compliance program tied to a specific category of institution (that last one is historic).

what keeps me up about it is the buildout cliff as most of these issuers don't have a case management system, they don't have alert triage workflows, and a lot of them have never written a SAR. banks took 30 years to operationalize the BSA.

comment period closes June 9, then it's a sprint to a final rule, and the issuers in scope will have to compress that into 12-18 months once the rule lands.

the $5K SAR threshold being limited to primary market transactions is one of the few concessions in the text but the rest is heavy. the rule mandates a technical capability to block and freeze transactions at the wallet level, and that's a different muscle than running OFAC screening against a customer list. on-chain enforcement at the issuer level is something most of these teams have never built and most vendors haven't fully solved either.

if you walked in monday as the new compliance lead at an issuer with $3B circulating and basically no program, where would you start? case management first, then SAR writers and triage analysts, then a sanctions screening stack?

i've done 2 greenfield AML buildouts in tradfi and tbh the order isn't obvious to me on this one.