Skip to content

561 Group · Public Services

Is x402 legal? The GENIUS Act, sanctions and open questions for stablecoin payments

The GENIUS Act regulates US stablecoin issuers, not x402 sellers; sanctions rules still apply to every payment. What the law settles and what remains open.

Public service

Using x402 is not itself regulated as a distinct activity in the United States: the central stablecoin law, the GENIUS Act, regulates who may issue the dollar tokens that x402 payments use, not the web servers that ask for them. Sanctions obligations apply to an x402 payment exactly as they do to any other payment, and several questions a careful seller would ask, about money transmission, tax on tiny receipts, consumer disputes and liability for an agent's purchases, are not settled. This article describes the US position as of September 2026 and says plainly where it is unsettled. It is not legal advice; a business planning to accept or make payments through x402 should consult a lawyer who practices in payments.

It adapts the tenth chapter of the Group's book *The x402 Economy*.

What is the GENIUS Act?

The Guiding and Establishing National Innovation for U.S. Stablecoins Act, known as the GENIUS Act, was enacted on 18 July 2025. It is the first US federal statute written for stablecoins. It defines a "payment stablecoin" and says who may issue one: only a permitted payment stablecoin issuer. There are three routes to that status:

  • a subsidiary of an insured bank, approved by the bank's federal regulator;
  • a federal qualified issuer, approved by the Office of the Comptroller of the Currency (OCC);
  • a state qualified issuer, approved by a state regulator.

The Act also sets rules for reserves, redemption and supervision. The rules are written for issuers, not for the businesses that accept their tokens.

When does the GENIUS Act take effect?

Federal regulators had until 18 July 2026 to write rules implementing the Act. The Act takes effect on 18 January 2027, or 120 days after final rules are issued if that comes first. The OCC published its proposed rule in the Federal Register on 2 March 2026, with comments closing on 1 May 2026. So in September 2026 the law was enacted, the rules were being finished, and the regime was not yet in force.

What does the GENIUS Act mean for x402?

For a seller or a buyer, the Act mostly changes the money, not the payment. Once in force, it defines which dollar tokens are payment stablecoins issued under US supervision. A seller that accepts USDC is accepting a token whose issuer must meet the Act's requirements once they apply. The Act does not, by itself, regulate a web server that answers 402.

That matters because x402 settles almost entirely in one stablecoin: 99.6% of the value in TRM Labs' analysis of about 199 million settlements through mid-September 2026 was USDC, issued by Circle. A seller deciding whether to accept a token faces a different question when a law defines who may issue it and what reserves they must hold.

Do sanctions rules apply to x402 payments?

Yes. US persons, including US companies, may not deal with people and entities on the Treasury Department's sanctions lists, and that obligation does not depend on the payment method. A US seller that takes an x402 payment from a sanctioned address has the same problem as one that takes a wire transfer from a sanctioned person.

Facilitators that screen payments reduce the risk. Coinbase's facilitator, for example, runs checks against the US Treasury's list of sanctioned addresses and declines payments from sanctioned or high-risk addresses. Screening by a facilitator is a service the seller relies on, not a transfer of the seller's legal obligation. Issuers can also freeze tokens: Circle can freeze USDC held at an address, in response to legal orders. Both controls have limits; a seller can settle payments itself and skip facilitator screening, and screening lists only catch known addresses.

Several questions have no clear answer in the sources the Group's research relied on. They are listed so a reader knows what to take to a lawyer or accountant.

  • Money transmission. US states license businesses that transmit money for others. Whether a facilitator that submits a buyer's signed transfer to a seller is transmitting money, and under which states' laws, is not settled by any source we read. It is more clearly not a question for a seller that only receives payments for its own services.
  • Tax on small receipts. A seller receiving thousands of one-cent payments a day has income to report. How receipts in a stablecoin are recorded and valued, and what records the tax authorities expect, depend on rules for digital assets that were still being clarified in 2026.
  • Consumer protection and disputes. Card and bank payments to consumers come with legal dispute rights. A stablecoin transfer from a person's own wallet has no chargeback. How consumer-protection law applies when a person's agent pays a seller that fails to deliver is an open question.
  • Liability for an agent's purchases. If an agent spends outside its owner's wishes, who bears the loss is partly a matter of contract between the owner and whoever runs the agent or its wallet, and partly a question the law has not answered. Google's AP2 protocol exists largely to produce evidence for exactly this dispute: a signed record of what the person authorized. See x402 vs MPP, AP2, ACP and L402.

What about law outside the United States?

Other jurisdictions have their own stablecoin regimes, and a seller serving buyers abroad may be subject to them. The European Union regulates stablecoins under its Markets in Crypto-Assets Regulation (MiCA), and Hong Kong has a stablecoin licensing ordinance. The Group's research does not cover them here. They show that stablecoin regulation arrived in several major markets within a few years of each other, and that x402's money is becoming a regulated instrument everywhere it is used.

What does a seller do in practice?

  • Know your facilitator's screening and policy, and know that your own obligations remain.
  • Keep records: receipts from the PAYMENT-RESPONSE header, with what each payment bought, for accounting and for any dispute. See x402 security.
  • Say what you sell clearly, including limits. The Group's market labels rights claims as seller testimony rather than verified resale authority, and its books state they are independent of the certificate issuers they accompany.
  • Ask a payments lawyer and an accountant before taking meaningful volume. The unsettled list above is where to begin.

What should I take from this?

  • The GENIUS Act, enacted in July 2025, defines payment stablecoins and who may issue them. It takes effect by January 2027, and regulators were finishing its rules in 2026.
  • The Act regulates issuers, not x402 sellers, but it defines the money most x402 payments use.
  • Sanctions obligations apply regardless of payment method; facilitator screening helps but does not transfer the obligation.
  • Money transmission, tax on micro-receipts, consumer dispute rights and liability for agents' purchases remain unsettled.

This article is general information, current to September 2026, about a fast-moving area. It is not legal, tax or investment advice. Continue with What is x402? or How big is the x402 market?

Contents

Explore

Tagged

  • x402
  • genius-act
  • stablecoins
  • regulation
  • sanctions