This Week in Compliance: The GENIUS Act and Who Proves Identity When Value Moves — 6–12 June 2026

Four developments ran through the week of 6–12 June 2026 — a US debanking rule taking effect, an industry comment letter on the GENIUS Act stablecoin AML rule, Tether funding wallet-equipped robots, and a Philippine licensing gap for Binance — and a fifth, a SaaS data-exposure disclosure, sat underneath them. They are not obviously related, but each circled the same question: when value moves, who has to prove who is behind it, and where does that evidence safely live?

That matters because the obligation to verify identity does not disappear when value moves into a wallet, a sandbox, a machine, or a SaaS table. It relocates. The week was a tour of where it went — and we walk the five items in that order, starting with the stablecoin rule that asks the question most directly.

Who is responsible once stablecoins change hands

On 9 June 2026, Paradigm and the Hyperliquid Policy Center filed a joint comment letter to FinCEN, OFAC and Treasury on the proposed GENIUS Act stablecoin AML rule — the NPRM implementing the GENIUS Act for permitted payment stablecoin issuers. The letter argues that FinCEN “generally calibrates issuer obligations to the primary market,” and takes “a more limited approach to the secondary market, where the issuer typically knows nothing beyond wallet addresses and transaction amounts.” Reporting put it more bluntly: a wallet address that merely holds or transfers a stablecoin should not be classified as an issuer’s customer.

The distinction is the whole argument. At the primary market — minting and redeeming directly with the issuer — there is a clear customer to onboard and run customer due diligence against. In the secondary market, the same token moves between wallets, DeFi apps and validators the issuer never onboarded. The unsettled question is who owes the KYC and AML obligation once the token has changed hands beyond that first relationship — the spine of this recap: compliance obligation attaches at onboarding, but value keeps moving past it. Our explainer on what ongoing customer due diligence actually requires covers how that obligation persists.

The durable fix is to make proof-of-identity portable — verify the holder once, then let them present a reusable attestation to the next platform, rather than re-collecting documents at every hop. This is the model we build at Verifyo: a single Zero-Knowledge KYC attestation that proves a wallet owner’s verified status to an integrating platform. It addresses the identity side only. It does not monitor transactions or solve the issuer’s secondary-market surveillance obligation — which is exactly what the comment letter argues about.

A rule that takes “reputation risk” off the examiner’s table

A joint OCC and FDIC final rule, issued in April 2026, took effect on 9 June 2026. It prohibits the two agencies from criticising or taking adverse action against a bank on the basis of “reputation risk,” and from pressuring an institution to close or refuse an account on the basis of a person’s political, social or religious views, protected speech, or solely because a business is in a politically disfavoured but lawful sector. The prohibition is codified at 12 CFR §4.91(g) for the OCC and 12 CFR §302.100(g) for the FDIC, and responds to Executive Order 14331, “Guaranteeing Fair Banking for All Americans,” which framed reputation risk as a pretext for restricting lawful access to financial services. This is the reputation risk debanking rule the coverage has tracked since.

What the coverage tends not to draw out is the mechanism. By removing reputation risk as a basis for adverse action, the rule pushes the onboarding-and-retention decision back onto evidence-based, risk-based customer due diligence rather than discretionary judgement. If “reputation risk” can no longer justify an account closure, the decision has to rest on what the bank can actually evidence about the customer — sanctions exposure, screening results, a documented risk rating. That is the same “who has to prove what” question the GENIUS Act letter raises, seen from the bank’s side.

For lawful-but-debanking-prone sectors — crypto firms most of all — the practical effect is that defensible, documented CDD becomes the line of defence, not the examiner’s discretion. A bank that can show its risk rating and screening trail stands on firmer ground than one relying on an instinct the rule now bars.

When the payer is a wallet, not a person

On 10 June 2026, Tether announced it would lead a Series C of up to $1.4bn in NEURA Robotics, a German humanoid-robotics firm, deploying its Wallet Development Kit to embed self-custodial crypto wallets directly into robots so machines can be paid for work and transact autonomously. NEURA has stated a roadmap target of five million wallet-equipped robots by 2030; co-investors include Nvidia, Qualcomm, Amazon, Bosch and Schaeffler. Set the robotics spectacle aside: machine-to-machine payments are being wired into the settlement layer, with the wallet — not a person — as the paying party.

This is where almost no coverage develops the angle. Machine-to-machine payments raise the question of how an autonomous agent proves its operator’s sanctions and source-of-funds posture without re-keying KYC at every counterparty. The obligations do not soften because the payer is a wallet — they still attach to whoever is ultimately behind the agent. Those are landscape requirements, not capabilities we claim: Verifyo does not perform source-of-funds analysis. The tension is the one we treated in the mismatch between calendar-based KYC and transaction-paced value movement: identity is checked on a calendar, but agent wallets settle on a clock that never stops.

The architectural answer to “how does a wallet prove its operator is screened” is identity binding. Wallet ownership binding — proving a wallet belongs to a verified, sanctions-screened person — is exactly the Level 1 attestation we issue at Verifyo. It does not solve agentic payments end to end, but it answers the “who is behind this wallet” half, which does not vanish when the operator is a machine.

Two regulators, one licensing perimeter

On 11 June 2026, the Bangko Sentral ng Pilipinas (BSP) confirmed that neither Binance nor its local partner BlockShoals holds the VASP licence required to operate crypto payment and transaction services in the Philippines, and that a seat in the SEC’s StratBox sandbox does not exempt a firm from separate central-bank licensing. Sandbox participants, the BSP noted, “must continue to comply with all applicable laws, rules, and regulations”; BlockShoals must integrate with a licensed domestic VASP over a 90-day testing period before onboarding users. The story turns on a simple fact: a firm wanting to re-enter does not appear on the licensed VASP list the central bank maintains. This is the VASP licence Philippines gap stalling Binance’s return.

The mechanism worth naming is the dual-regulator licensing perimeter. A securities sandbox approval and a separate payments licence are two different gates, and clearing one does not clear the other — which multiplies the onboarding-evidence surface a re-entering exchange must satisfy per jurisdiction. The same KYC and AML evidence has to be re-presented to two regulators in one market, and that per-regulator re-proof is the cost portable, reusable attestations are designed to reduce.

The stored-PII honeypot, one zero-auth query away

On 10 June 2026, ServiceNow told customers that a bug it had patched on 5 June 2026 had allowed unauthenticated users to query hosted customer-instance tables — tables that commonly hold support tickets, employee records, passwords, keys and credentials — without supplying any credentials. The flaw sat in a REST API endpoint misconfigured to require no authentication. ServiceNow disputes the “breach” label, describing the matter as a security incident and saying the activity was likely tied to security researchers or customer-led testing rather than malicious actors. Readers searching for the ServiceNow data breach will find it under that name, but the access-control flaw ServiceNow frames as a security incident is the more accurate description.

The mechanism is the payoff of the week’s running question — the concrete answer to “where does the evidence live.” Identity records and secrets concentrated in one SaaS platform become a single zero-auth query exposure. The more identity evidence a platform stores as raw, queryable PII, the larger the target it presents. That is the stored-PII honeypot pattern — a structural property of how the data is held, not a one-off lapse. The misconfigured endpoint is the trigger; the concentration of raw credentials makes it costly.

What we’re watching

Across all five items — debanking, the GENIUS Act, robot wallets, VASP licensing and a SaaS data exposure — the common control point is the same: proof of identity that travels with the holder rather than being re-collected and re-stored at every platform, regulator and counterparty. The less raw PII a platform holds to satisfy its obligation, the smaller its honeypot and the lower its re-proof cost across jurisdictions. That is the principle we build Verifyo on — portable, privacy-preserving proof of compliance status, not another copy of the customer’s documents in another queryable table.

Three dated items sit on the near calendar. The MiCA transitional period ends on 1 July 2026, after which crypto-asset service providers without authorisation must wind down their EU client books, per ESMA’s statement of 17 April 2026. The US Executive Order “Restoring Integrity to America’s Financial System” of 19 May 2026 carries two deadlines — a Treasury red-flag advisory due around 18 July 2026 and a BSA customer-due-diligence reform proposal around 17 August 2026. And the AMLA consultation cliff runs through summer: the group-wide RTS and BWRA Guidelines close on 15 June and 15 July 2026, with the ongoing-monitoring Guidelines hearing on 2 July 2026.

Sources

1. Hyperliquid Policy Center & Paradigm. HPC and Paradigm File Joint Comment on Treasury’s GENIUS Act Proposed Rule. 9 June 2026. https://hyperliquidpolicy.org/blog/hpc-and-paradigm-file-joint-comment-on-treasury%E2%80%99s-genius-act-proposed-rule
2. Decrypt (Vismaya V). Paradigm, Hyperliquid Policy Center Push Back on GENIUS Act Stablecoin AML Rule. 10 June 2026. https://decrypt.co/370645/paradigm-hyperliquid-policy-center-push-back-on-genius-act-stablecoin-aml-rule
3. FinanceFeeds. Hyperliquid, Paradigm Urge FinCEN To Revise Stablecoin AML Rules Under GENIUS Act. June 2026. https://financefeeds.com/hyperliquid-paradigm-fincen-genius-act-aml-rules/
4. Federal Register / OCC & FDIC. Prohibition on the Use of Reputation Risk by Regulators (Final Rule). Published 10 April 2026; effective 9 June 2026. Doc 2026-06947. https://www.federalregister.gov/documents/2026/04/10/2026-06947/prohibition-on-the-use-of-reputation-risk-by-regulators
5. FDIC. Agencies Issue Final Rule to Prohibit Use of Reputation Risk by Regulators (Press Release). April 2026. https://www.fdic.gov/news/press-releases/2026/agencies-issue-final-rule-prohibit-use-reputation-risk-regulators
6. OCC. Prohibition on Use of Reputation Risk by Regulators: Final Rule — News Release nr-ia-2026-26a. April 2026. https://www.occ.gov/news-issuances/news-releases/2026/nr-ia-2026-26a.pdf
7. Goodwin. FDIC and OCC Issue Final Rule Prohibiting Use of Reputation Risk by Regulators. April 2026. https://www.goodwinlaw.com/en/insights/blogs/2026/04/fdic-and-occ-issue-final-rule-prohibiting-use-of-reputation-risk-by-regulators
8. Tether. Tether to Lead NEURA Robotics’ Series C Financing (up to $1.4bn). 10 June 2026. https://cryptonews.net/news/finance/32994215/
9. The Block (Daniel Kuhn). Tether leads up to $1.4 billion round in robotics firm Neura, plans crypto wallet integration. 10 June 2026. https://www.theblock.co/post/404303/tether-leads-up-to-1-4-billion-round-in-robotics-firm-neura-plans-crypto-wallet-integration
10. BitPinas. Exclusive: BSP Says Binance, BlockShoals Lack VASP Licenses; Coordinating With SEC on Sandbox. 11 June 2026. https://bitpinas.com/regulation/exclusive-bsp-binance-blockshoals-sec
11. CoinDesk. Philippines’ central bank says Binance and its local partner lack licenses to operate. 11 June 2026. https://www.coindesk.com/policy/2026/06/11/philippines-central-bank-says-binance-and-its-local-partner-lack-licenses-to-operate
12. crypto.news. Binance Philippines return hits wall as BSP flags license gap. 11 June 2026. https://crypto.news/binance-philippines-return-hits-wall-as-bsp-flags-license-gap/
13. BleepingComputer (Lawrence Abrams / Sergiu Gatlan). ServiceNow discloses security incident exposing customer data. 9 June 2026 (customer-advisory update 10 June 2026). https://www.bleepingcomputer.com/news/security/servicenow-discloses-security-incident-exposing-customer-data/