Stablecoin CIP Comment Window Extended to October 23

What the proposed CIP rule covers

The proposal requires each permitted payment stablecoin issuer to establish a written customer identification program scaled to its size and business model. Before opening an account, issuers must collect a customer's name, date of birth or date of formation, address, and identification number, then verify identity through risk-based documentary or non-documentary procedures.

The rule also carries the standard banking-grade obligations: five-year record retention for all CIP information, screening against government terrorist watchlists, customer notice that identity will be verified, and an option to rely on the CIP of another federally regulated financial institution. None of this is exotic for a bank. All of it is new for an issuer whose onboarding flow was designed around a wallet address.

Why the window moved

Comment extensions usually mean one of two things: heavy industry response or unresolved definitional problems. This rulemaking has both. Issuers, exchanges, and trade groups filed extensively before the August deadline, with recurring disputes over how far verification obligations should follow a token after issuance. The proposal currently draws the line at the primary market: CIP obligations attach to the direct relationship between issuer and customer, not to secondary market transfers between third parties.

The line between primary and secondary markets

The primary-market limitation is the single most important design decision in the proposal. An issuer must verify the institutional trader redeeming tokens directly, but not every wallet that touches the token afterward. Critics argue that leaves the secondary market as an anonymity refuge; supporters answer that extending CIP to peer transfers would be unworkable and push activity offshore. Wherever the final rule lands, issuers will need verification infrastructure that can scale in either direction.

The compliance clock behind the deadline

The proposal sets compliance at 12 months after the final rule is issued. A final rule in early 2027 means live CIP programs in early 2028, with vendor selection, integration, and testing all inside that window. That is where automation earns its keep. deepidv's Luna compliance agent tracks the rulemaking docket, maps each proposed requirement against an issuer's existing onboarding flow, and flags the gaps while they are still design choices. Paired with the core verification platform, issuers can run bank-grade CIP collection and verification inside a single session, including watchlist screening and the five-year evidence trail the rule demands.