The OCC's stablecoin rulebook is final
The OCC finalises the first federal stablecoin-issuer rule, an €825M GDPR fine lands on automated decisions, and a cluster of deadlines hits between 25 October and 1 November.
At a Glance
OCC finalises GENIUS stablecoin rule — New 12 CFR 15; rule and Act effective 18 January 2027.
California DROP deadline 29 October — Data brokers' first deletion cycle due.
Italy NIS2 baseline binds 31 October — Basic security measures mandatory.
Uber fined €825M, automated deactivations — Dutch DPA, GDPR Arts. 22 and 13; Uber appealing.
DHS orders DeepSeek out of federal IT — FASCSA order published 20 October.
Greece votes on under-15 ban today — Outcome not yet confirmed.
Critical Actions
OCC final GENIUS Act rule — On 21 October the OCC set requirements for permitted and foreign payment stablecoin issuers and certain custody activities; the rule and the Act take effect 18 January 2027. BSA/AML/OFAC rules come separately with Treasury; the OCC will announce when applications open. Action: map issuance, reserve, redemption and custody operations to the final text. OCC NR 2026-92
California DROP: first deletion cycle due 29 October — Each registered data broker must complete a full cycle within 45 days of its first download; the earliest cohort lands 29 October (7 days). Action: verify completion in the DROP dashboard. CPPA
Italy NIS2 baseline measures, 31 October — Registered essential and important entities must have basic measures in place (9 days); Sweden's MCFFS 2026:11 already applies; Austria registration is due 1 January 2027. Action: document baseline controls and management training. ACN
Enforcement Watch
Dutch DPA / Uber, €824,990,000 — Fully automated driver deactivations breached GDPR Art. 22 and Art. 13; Uber has appealed. EDPB
Datatilsynet / Xandr, NOK 92M (~€8.6M) — Per our tracker, Grindr data relayed into ad auctions without explicit consent; not final; decision not retrieved by us.
DHS FASCSA order on DeepSeek — Excludes DeepSeek products from federal civilian procurement and orders their removal, including third-party products built on them; no deadline stated. Federal Register
FCA / Vector Wealth ex-CEO — Banned and fined nearly £270,000 for fronting for a disqualified director. FCA
Deadline Watch
25 Oct — China TC260 ASMM/DSMM drafts, comments (3 days).
26–27 Oct — UK Cyber Security and Resilience Bill, Lords Report (4 days).
28 Oct — UK PS19/26 high-LTI rules effective (6 days).
29 Oct — California DROP first cycle; Ofcom skilled-persons questionnaire; Brazil ANPD hearing (7 days).
31 Oct — Italy NIS2 baseline measures (9 days).
1 Nov — Türkiye under-15 ban and e-Devlet age token (10 days).
5 Nov — Saudi PDPL regulation consultation closes (14 days).
18 Jan 2027 — OCC GENIUS rule and Act effective (88 days).
Around the World
Greece — Plenary vote on the under-15 bill was scheduled for today; reported to require every user to link a government age token. Outcome unconfirmed; press-based.
United States — Eleventh Circuit upheld Georgia SB 351 and reversed the injunction on Florida HB 3; both enforceable. Eight state AGs sued OpenAI over child safety (14 Oct). Arizona AG
Saudi Arabia — SDAIA's draft PDPL amendments would default to in-Kingdom storage. SDAIA
China — MOFCOM/MOST catalogue adds 23 AI technologies; comments to 15 Nov; interim export registration live. MOFCOM
Healthcare — FDA early alert on Edwards Commander M delivery systems: balloons can burst; one death reported. FDA
Deep Dive
United States · Financial
The GENIUS rule lands: what 18 January 2027 changes
The OCC's final rule turns the GENIUS Act into an operating regime for permitted payment stablecoin issuers, foreign issuers under OCC jurisdiction and certain custody activities, with one date — 18 January 2027 — for both rule and Act. AML, sanctions and BSA obligations are deliberately held back for a joint rulemaking with Treasury.
For banks the rule reaches beyond a licence category: per our tracker it amends capital and prompt-corrective-action provisions, so issuing a stablecoin changes the balance-sheet conversation. For non-bank applicants the sequencing of approvals may decide who is live on day one, and the pending AML carve-out means any programme built now rests on a rule only partly written. Here is where the real planning decision sits...
The analysis continues for CyberEyeQ Pro subscribers. Unlock the full deep-dive recommendations, all five weekly action items, source documents, and jurisdiction-specific compliance checklists.
Subscribe to Pro to read the rest.
Become a paying subscriber of Pro to get access to this post and other subscriber-only content.
UpgradeA subscription gets you:
- Deep dives of each updated regulation
- Source verification documents
- Extended jurisdiction-specific analysis
- Compliance deadline tracker
- Regulation crosswalk