Q2 2026 brought one of the most active regulatory quarters in recent memory. Federal and state agencies issued final rules, proposed frameworks, and executive orders in rapid succession, some revising supervisory standards that had stood for decades. Two areas demand immediate attention: how examiners evaluate financial institutions, and what the GENIUS Act now requires of stablecoin issuers.
Why did regulators rewrite three foundational supervisory frameworks in one quarter?
Three foundational frameworks changed in a single quarter: CAMELS ratings, model risk management guidance, and the supervisory treatment of reputation risk. Together, they signal a clear shift toward demonstrated financial risk management over procedural compliance. Institutions that have relied on strong process scores should reassess their supervisory standing now.
FFIEC proposes first CAMELS overhaul in 30 years.
The Federal Financial Institutions Examination Council’s proposed revision shifts examiner focus on material financial risks rather than policies and documentation. Key changes remove special consideration for the Management component in composite ratings, set a material financial risk threshold before a Management rating of 3 or worse can be assigned, and limit the influence of specialty examination findings to those affecting overall financial condition.
Interagency model risk management guidance replaces SR 11-7 for the first time since 2011.
The FDIC, OCC, and Federal Reserve issued updated, principles-based guidance tailored to each institution’s size, complexity, and model risk profile. Noncompliance alone will not trigger supervisory criticism. Notably, generative and agentic AI systems fall outside the formal scope but still require governance under existing model risk policy, a distinction that matters for institutions building AI governance frameworks.
OCC and FDIC eliminate reputation risk as a supervisory category.
A final rule now prohibits examiners from criticizing institutions on reputational grounds, prompting the Federal Reserve, OCC, and FDIC to remove reputation risk references from 15 interagency guidance documents. This change runs alongside the FTC’s debanking warning letters, which preserve a parallel federal exposure for viewpoint-based account decisions. Documented, objective rationale for account decisions remains essential.
Institutions should assess each change against their specific exposure, rather than treat the quarter’s deregulatory signal as blanket relief.
What does the GENIUS Act mean for stablecoin compliance right now?
The GENIUS Act triggered multiple agency rulemakings this quarter covering prudential standards, BSA/AML, sanctions compliance, and customer identification. Each rule comes from a different regulator on its own timeline. Institutions planning stablecoin activities should treat each as an independent obligation with its own preparation timeline, rather than waiting for a single final rule.
Treasury proposes framework for state-level stablecoin oversight.
Issuers with $10 billion or less in outstanding stablecoins may elect state regulation if the state regime is deemed “substantially similar” to federal standards. States retain some discretion on calibrated requirements, but uniform requirements must align with federal standards. Institutions near the $10 billion threshold should monitor how individual states develop their frameworks, since the “substantially similar” determination will govern whether state regulation remains a viable option.
FinCEN and OFAC propose the first federal sanctions compliance program requirement for stablecoin issuers
The joint proposal creates a standalone sanctions obligation for Permitted Payment Stablecoin Issuers, built specifically for the sector rather than adapted from Money Services Business (MSB) requirements. Institutions that assumed MSB registration was sufficient will find this a material compliance gap.
Five agencies propose Know Your Customer standards for stablecoin issuers.
The Federal Reserve, OCC, FDIC, NCUA, and FinCEN jointly proposed a customer identification program rule bringing Permitted Payment Stablecoin Issuers under bank- and broker-dealer-equivalent standards. Reliance on parent institution programs are permitted, but require a formal contract, annual certification, and compliance responsibility stays with the issuer.
Waiting for a single final rule before building out digital asset compliance will compress timelines and create real execution risk.
How should compliance teams prioritize their response?
The right move this quarter is targeted action, not a pause. Map each development against your institution’s charter, size, and activity mix, then prioritize changes with defined compliance dates ahead of those still in comment periods. Learn more about how CrossCountry’s Banking and Capital Markets team helps financial institutions translate regulatory shifts into practical program updates.
For a detailed look at the Q2 regulatory updates, please view our reference document.
Frequently Asked Questions
What is the FFIEC’s proposed CAMELS overhaul?
The FFIEC’s proposal shifts examiner focus from process and documentation toward demonstrated financial risk management, requiring a material financial risk threshold before a management rating of 3 or worse can be assigned.
Does the new model risk management guidance cover AI systems?
Generative and agentic AI systems fall outside the formal scope of the updated guidance, but institutions must still govern them under existing model risk management policies and state-specific guidance.
Can stablecoin issuers choose state regulation over federal oversight?
Issuers with $10 billion or less in outstanding stablecoins may elect state regulation, but only if the state regime is deemed “substantially similar” to federal standards.
Is MSB registration sufficient for stablecoin sanctions compliance?
No. FinCEN and OFAC’s joint proposal creates a standalone sanctions compliance requirement for Permitted Payment Stablecoin Issuers, separate from MSB registration.