Building trust in stablecoins with the new AICPA controls criteria

There’s a new way to grow trust

Stablecoins can be pegged to the dollar, but the full faith and credit of the US government doesn’t back them up. The issuer’s redemption assets do. Monthly reports that use the AICPA’s previously published criteria can show that these assets exist at a point in time. But for stakeholders to trust that reports are more than a “snapshot”—which could quickly be out of date—an issuer’s operations should include controls designed to maintain redemption assets between one monthly report and the next.

The AICPA’s controls framework has detailed guidelines to design and evaluate verifiable control processes. It covers controls related to private key management, token recordkeeping, redemption asset management and more. These controls can help identify and address risks in the issuer’s stablecoin operations, so an issuer can build this important trust—that it holds sufficient redemption assets.

The criteria are designed to address regulatory guidelines

At the AICPA, we constructed these criteria in close communication with regulators and with consideration of existing guidelines, especially those in New York State, which has some of the country’s most holistic stablecoin rules. The criteria should address regulatory expectations for stablecoin controls nationwide.

The GENIUS Act, which establishes a federal regulatory framework for stablecoins, is an important first step. Additional federal guidelines addressing controls for redemption asset reports could come soon. The AICPA’s controls framework is designed to build confidence with investors and regulators alike—showing that an issuer is adopting leading practices to help make and keep redemption asset reporting accurate.

Meeting the new criteria poses new challenges

The criteria are designed to be rigorous. Many stablecoin issuers have work to do to meet them—and this work takes time. For a strong control environment, stablecoin issuers may have to create new processes, implement new policies and standards, and train staff to perform and evidence controls. Many issuers may find that their current control environment has gaps to remediate.

The floodgates may open

Given the growing market demand for stablecoins and a consistent framework for issuers to follow, the stage seems set for stablecoin issuances to increase—along with that, expectations for effective reporting on redemption assets will be heightened for the issuers. Stablecoin issuers now have an outline to help meet expectations: the AICPA’s criteria for redemption asset reporting and related controls.

With regulations taking shape and transparent reporting frameworks ready to go, a key foundation for trust in stablecoins is here. As these pieces come together, you can expect a new phase of issuance and adoption—one that could reshape digital finance at scale.

Frequently asked questions

Q: What are the AICPA’s stablecoin controls criteria and why do they matter for issuers and users?
The AICPA’s Criteria for Controls Supporting Token Operations: Specific to Asset-Backed Fiat-Pegged Tokens are designed to help stablecoin issuers design and evaluate their internal controls. These controls support key aspects of token operations—such as private key management, token recordkeeping and redemption asset management—and complement reporting on reserves. By providing a structured approach to identifying and addressing operational risks, the criteria aim to help issuers build trust with users, investors, and regulators.

Q: How do stablecoin controls complement redemption asset (reserve) reporting to build trust in the peg?
Monthly redemption asset reports show that reserves exist at a point in time—but controls are what help maintain them between those reports. The AICPA’s new framework helps issuers consider the design of their controls that to help give stakeholders more confidence that the stablecoin can maintain its peg, even during market volatility.

Q: What types of controls should stablecoin issuers have over private keys, token operations and redemption assets?
The AICPA’s framework outlines implementation guidance for issuers to consider as they design their controls across key risk areas of stablecoin operations. This includes controls in areas such as managing private keys, maintaining accurate token records, and managing redemption assets. Together, these controls are intended to help issuers identify and respond to risks, and manage their reserves in line with the commitments to their users and regulators, and uphold trust in the stablecoin peg.

Q: How can stablecoin issuers assess and remediate gaps to align with the new AICPA controls framework?
Meeting the criteria may require issuers to take on meaningful changes, including creating new processes, implementing updated policies, and training staff to perform and document controls. Many may find gaps in their current environment—and remediating these gaps is part of strengthening their control environment and building stakeholder trust.

Q: How do the AICPA stablecoin criteria help issuers prepare for future US regulation and oversight of digital assets?
The criteria are designed to support regulatory alignment. With federal efforts like the GENIUS Act underway, the AICPA’s controls framework gives issuers a framework to design controls and show investors and regulators that they are taking proactive steps to support redemption asset reporting and operational accountability.