The OCC's new rules for stablecoin issuers are a step forward. But a compliance program that can't actually freeze a terrorist's wallet is no compliance program at all.
Terrorist organizations have already moved to stablecoins. Hamas, Palestinian Islamic Jihad, the al-Qassam Brigades — they've all solicited funds through digital wallets tied to dollar-pegged tokens. The transactions settle in minutes. Once the assets hop across two or three unhosted wallets, recovery is functionally impossible.
That is the reality the Office of the Comptroller of the Currency is now trying to regulate.
The GENIUS Act — signed into law this year — created a new category of regulated institution: the permitted payment stablecoin issuer (PPSI). The OCC's proposed rules would require these issuers to maintain anti-money-laundering programs, sanctions screening, and suspicious-activity reporting. Shurat HaDin submitted a formal comment letter supporting the framework. We also told the OCC where it falls short.
The core problem: paper compliance
Under the proposed rules, a stablecoin issuer can maintain a written AML program, staff a compliance officer, document its procedures — and still be unable to freeze a sanctioned wallet when the moment arrives. Nothing in the current draft explicitly requires the issuer to demonstrate that its controls actually work. That is not a regulatory gap. It is a national-security gap.
We've seen this pattern before. In traditional banking, institutions with thick compliance manuals still processed transactions for sanctioned entities — because nobody tested whether the screening systems could catch a real threat under real conditions. Stablecoins move faster than wire transfers. The margin for failure is smaller. And the consequences — funding a rocket attack on Israeli civilians, financing an operative in Europe or the United States — are irreversible.
Our recommendations to the OCC are specific
First, the safe harbor the OCC is offering to compliant issuers should require independent testing of operational capability. A stablecoin issuer shouldn't be shielded from enforcement simply because its written program looks adequate. The safe harbor should be available only to issuers that can prove — through testing, not documentation — that they can screen, block, freeze, reject, and report prohibited transactions.
Second, the OCC needs to define what counts as a "significant or systemic failure." That phrase is the boundary between the safe harbor and enforcement action. Right now, it's undefined. Leaving it vague invites inconsistent supervision — and gives well-lawyered issuers room to argue that a failure to freeze terrorist funds was merely "isolated."
Third, when terrorist financing or sanctions evasion is happening in real time, the OCC must be able to act immediately — without waiting for standard consultation timelines with FinCEN. Digital-asset transactions don't wait 30 days. The expedited-action provision in the proposed rules should explicitly cover urgent illicit-finance threats, not just generic "unsafe or unsound practices."
Fourth, revoking a stablecoin issuer's license for AML failures should be classified as an enforcement action. The OCC's proposed rules list cease-and-desist orders, civil penalties, and consent decrees — but not revocation. That omission matters. Revocation is the most powerful tool the OCC has. It should carry the same procedural requirements and the same accountability.
None of this is theoretical
Shurat HaDin has spent two decades litigating against the financial networks that fund terrorism — suing banks under the Anti-Terrorism Act and JASTA, tracing assets through shell accounts and digital wallets, recovering funds for American victims of attacks. We know what effective compliance looks like. We also know what happens when a financial institution's compliance program exists only on paper: the money moves, the attack happens, and the families are left to sue for accountability after the fact.
Stablecoins are not inherently dangerous. They are fast, efficient, and increasingly central to global payments. But speed is a weapon in the wrong hands. A dollar-pegged token that settles instantly across borders is exactly the instrument a sanctions evader or terrorist financier wants. The regulatory framework has to match the speed of the threat.
The OCC has the right instinct. The GENIUS Act gives it the authority. What the final rule needs is a simple principle: compliance is not what you write down — it's what you can execute when it matters.
Every stablecoin issuer that wants the privilege of operating inside the U.S. financial system should have to prove it can stop a prohibited transaction before the funds disappear. Not describe how it would. Prove it.
Nitsana Darshan-Leitner is an Israeli attorney and the president and founder of Shurat HaDin – Israel Law Center, which represents victims of terrorism in legal actions worldwide. She has led landmark cases against banks, governments, and organizations that finance terrorism, and has been named one of the most influential lawyers in Israel.
