What the proposed rule requires
The attestation obligations under the proposed OCC framework
Note: The OCC NPRM (Docket ID OCC-2025-0372) is a proposed rule. The comment period closed May 1, 2026. Final rules are due by July 18, 2026. All requirements described here are proposed, not yet final, and subject to change.
Proposed OCC § 15.11(f) introduces two distinct attestation obligations. Understanding both is the starting point for any readiness program.
Obligation 1 · Monthly
Reserve composition report examination
Every month, a PPSI must publish its reserve composition report and have the prior month's report examined by a registered public accounting firm. The proposed rule requires a formal examination — not a review, an agreed-upon procedures engagement, or an internal attestation. The accounting profession's consensus, expressed in the CAQ's May 2026 comment letter, recommends that this examination be conducted at the reasonable assurance level under AICPA AT-C Section 205. The OCC's final rule is expected to name the standard explicitly. The CPA firm would express an opinion on whether the reserve composition report fairly states reserves in accordance with OCC § 15.11 criteria.
Obligation 2 · Annual · CAQ consensus
Internal controls attestation over reserve operations
The Center for Audit Quality, supported by multiple market participants, recommends that PPSIs obtain an annual attestation report on management's assertions concerning the effectiveness of internal controls over reserve operations — the direct analog of SOX Section 404 for Stablecoin issuers. This would require management to design and maintain effective internal controls, assert on their effectiveness, and have an independent CPA firm examine that assertion. The OCC is expected to incorporate this requirement in the final rule.
The recommended standard · AICPA AT-C 205
What the accounting profession recommends — and why it matters
The CAQ and active stablecoin attestation practitioners both recommend that the OCC require the examination at the reasonable assurance level — the same level obtained in a financial statement audit, and the highest level available under attestation standards. AT-C Section 205 is already the standard required by NYDFS for licensed Stablecoin issuers in New York. The OCC's proposed rule asks in Question 96 whether the examination should be at the reasonable assurance level or some other standard — meaning this is an active open question. Whatever standard the final rule names, the readiness work is the same: documented controls, management assertions, and an evidence package that a CPA firm can rely on.
Why this matters · Timing
The examination begins the month your charter is approved
There is no grace period in the proposed rule. The monthly examination obligation applies from the first month a PPSI publishes its reserve composition report. A Stablecoin issuer that receives OCC charter approval and immediately publishes its first report must have a registered public accounting firm already engaged and the examination scope already agreed. The readiness work — internal controls design, documentation, and management assertion preparation — must be complete before the charter is approved, not after.
The readiness gap
What the examination requires vs. what most issuers have on day one
A formal CPA firm examination of reserve composition reports — at whatever assurance level the final rule specifies — is an evidence-based process. The registered public accounting firm cannot issue an opinion without specific documentation, controls, and management assertions in place. Here is the gap most new PPSIs and Stablecoin operators face.
| What a formal CPA firm reserve examination is expected to require | Typical state for a new PPSI on day one |
|---|---|
| Written reserve management policies covering eligible assets, diversification, concentration limits, and WAM compliance | Policies informal, undocumented, or drafted without mapping to OCC § 15.11 criteria — insufficient for the CPA firm to use as examination criteria |
| Management assertion letter stating that the reserve composition report fairly presents reserves in all material respects in accordance with § 15.11 | No assertion framework exists — management has not been through a formal attestation process and may not understand their assertion obligations |
| Documented chain of custody from on-chain reserve balances to custodian statements to published composition report | Reconciliation process exists but is not documented at the level required for CPA firm reliance — no formal three-way tie-out procedure |
| Internal controls over reserve data completeness and accuracy — access controls, segregation of duties, change management for reserve calculation logic | Controls exist operationally but are not documented in a control inventory with owner assignments, evidence requirements, and testing procedures |
| Independence standards: the engaged CPA firm must be independent under AICPA standards — no financial relationships, no shared personnel with the issuer | CPA firm engagement not yet initiated — selection, independence assessment, and engagement letter negotiation not started |
| Audit trail: complete, immutable record of all reserve movements, asset purchases, disposals, and daily reconciliation results with timestamps | Audit trail partially maintained but not structured for examiner access — no formal data retention policy aligned to examination requirements |
| For annual IC attestation: COSO-based internal control framework documentation for all controls over reserve operations, with management testing evidence | No SOX-equivalent control documentation exists — control environment has not been mapped to COSO, FFIEC, or any formal internal control framework |
Why this engagement looks like SOX 404
The model already exists in traditional finance
The proposed reserve examination is structurally identical to the SOX Section 404 internal controls over financial reporting framework — with Stablecoin reserve operations substituting for financial reporting. Regardless of which attestation standard the final rule names, the methodology and the credential that matters are the same.
SOX 404 — Traditional Finance
Management designs and documents internal controls over financial reporting
Management asserts on the effectiveness of ICFR. The external auditor (CPA firm) examines management's assertion and the underlying controls. The auditor issues an opinion. Deficiencies trigger remediation requirements. Audit committees oversee the process.
↔
Proposed Reserve Examination — Stablecoin Operations
Management designs and documents internal controls over reserve operations
Management asserts that the reserve composition report fairly states reserves in accordance with OCC § 15.11 criteria. The registered public accounting firm examines management's assertion and the underlying reserve controls. The CPA firm issues an opinion under the examination standard named in the final rule. Deficiencies have direct regulatory implications.
The engagement model is the same. A practitioner who has spent nine years building, testing, and preparing control environments for SOX 404 external auditors — at institutions like Goldman Sachs and Tradeweb — already understands exactly how to position a Stablecoin issuer for a clean AT-C 205 examination. The technology stack is different. The blockchain architecture is new. The control design discipline — documenting controls, building management assertions, and preparing an evidence package that a CPA firm can rely on — is identical. The readiness work happens before the CPA firm arrives — that is where this engagement sits.
Sample examination scope
What the CPA firm is expected to test under the proposed framework
Based on the proposed OCC § 15.11 reserve requirements and the accounting profession's recommendation of reasonable-assurance examination. This represents the subject matter, criteria, and expected examination procedures under the proposed framework — the content a readiness engagement is built around. Subject to change when the final rule names the examination standard.
Reserve Composition Examination — Expected Scope
Subject matter: monthly reserve composition report per proposed § 15.11(e) · Criteria: OCC proposed § 15.11 reserve requirements · Standard: to be named in final rule (AT-C Section 205 recommended by CAQ) · All proposed — subject to change
| Subject matter area | Proposed criteria (OCC § 15.11) | Expected examination procedures | Evidence the PPSI must have ready |
|---|---|---|---|
| Reserve sufficiency | Outstanding issuance covered on at least a 1:1 basis at all times | Agree published reserve balance to custodian statements and on-chain verification; confirm no shortfall at any point during the reporting period | Daily reconciliation records, custodian account statements, on-chain balance snapshots, shortfall notification log |
| Asset eligibility | Reserves held only in eligible asset classes per proposed § 15.11(b): cash deposits, short-term Treasuries, government MMFs, tokenized deposits, insured shares | Inspect asset-by-asset eligibility classification; agree to custody records; test classification logic in reserve management system | Asset classification policy, custody statements by asset class, reserve management system configuration, ineligible asset exception log |
| Diversification & concentration | No single institution above concentration limits; minimum proportion in insured deposits; WAM compliance for money market fund holdings | Recalculate diversification ratios at each reporting date; test WAM calculation; confirm compliance with concentration limits throughout period | Daily diversification calculation workpapers, WAM monitoring records, concentration limit breach log, remediation documentation |
| Segregation of reserve assets | Reserve assets held in custody accounts segregated from PPSI's own assets; no commingling | Confirm custody account structure and legal segregation; test that no non-reserve assets appear in reserve accounts during the period | Custody agreements, account structure documentation, commingling exception log, custodian confirmation letters |
| Disclosure accuracy | Monthly public composition report accurately reflects reserve balances and asset breakdown as of the reporting date | Agree published composition report figures to underlying custodian records and on-chain data; test completeness of asset category disclosures | Published reserve reports, supporting workpapers, three-way reconciliation (on-chain / custodian / published), sign-off documentation |
| Management assertion | CEO/CFO-certified assertion that reserve composition report is accurate and complete in all material respects | Obtain and review management assertion letter; evaluate whether supporting evidence is sufficient to support the assertion | Signed management assertion letter, assertion support file, legal counsel review documentation, disclosure controls sign-off |
How to engage
Three ways this readiness work begins
The readiness engagement sits between the PPSI's operational team and the registered public accounting firm that will conduct the reserve examination. The specific entry point depends on where you are in the charter and compliance cycle.
Building from scratch
New PPSI designing its reserve control environment before charter approval
Design and document the full internal control framework over reserve operations — policies, procedures, control inventory, management assertion template, and CPA firm engagement scoping. The goal is to have everything ready before the first reserve composition report is published and the first CPA firm examination begins.
Pre-examination assessment
Existing issuer or operator preparing for the first formal examination
Independent gap assessment against the expected reserve examination scope. Walk through each subject matter area, identify documentation and control deficiencies, and produce a prioritised remediation plan. Typically 4–6 weeks ahead of the CPA firm engagement start date — enough time to close the most material gaps before the examination begins.
Placed on engagement
Firms staffing a GENIUS Act attestation readiness engagement for a PPSI client
Available embedded or co-sourced alongside your existing team. Brings SOX 404 internal controls methodology, FFIEC IT examination experience, and Stablecoin architecture knowledge — the combination required to both design the controls and communicate with the registered public accounting firm in the language of a formal reserve examination. Available for placement, co-sourcing, or retained advisory.
Start with a scoping conversation.
Describe your situation — charter stage, existing control environment, CPA firm status, and timeline. A short conversation determines whether and how the readiness engagement fits what you need. No charge for the initial scoping discussion.