DEV Community: VASP Tracker

Tracking GENIUS Act rulemaking with the Federal Register API (and why a naive search lies to you)

VASP Tracker — Tue, 27 Oct 2026 02:14:26 +0000

The US stablecoin law, the GENIUS Act, was signed on 18 July 2025. Since then the federal banking agencies and Treasury have been publishing proposed rules, notices and, now, final rules. Every one of them lands in the Federal Register, which has a free, keyless JSON API.

This post walks through a short script that builds a clean list of those documents, and through the two traps I hit on the way: a search term that matches far too much, and a "document type" field that does not mean what you think.

The endpoint

GET https://www.federalregister.gov/api/v1/documents.json

Useful parameters:

conditions[term] for full-text search
fields[] (repeatable) to choose which fields come back
per_page (up to 100) and order
the response's next_page_url for pagination

No API key and no auth. Be polite with request rates anyway.

Version 1: search for "GENIUS"

import requests

API = "https://www.federalregister.gov/api/v1/documents.json"
ENACTED = "2025-07-18"  # GENIUS Act signed into law

def fetch(term):
    params = {
        "conditions[term]": term,
        "per_page": 100,
        "order": "oldest",
        "fields[]": ["document_number", "publication_date", "type",
                     "action", "title", "effective_on", "citation"],
    }
    url, docs = API, []
    while url:
        r = requests.get(url, params=params, timeout=30)
        r.raise_for_status()
        page = r.json()
        docs += page.get("results", [])
        # next_page_url already carries the query string
        url, params = page.get("next_page_url"), None
    return docs

raw = fetch("GENIUS")
print(len(raw))

When I ran this on 27 October 2026 it returned 116 documents. Most of them have nothing to do with stablecoins. The full-text search matches the word anywhere, so you get State Department notices about exhibitions of "culturally significant objects" with "genius" in the exhibition title, and Interior Department notices about the Theodore Roosevelt Genius Prize.

Version 2: filter on title and date

The cheap fix worked well. Keep a document only if it was published on or after the enactment date and its title mentions "stablecoin" or "genius":

def relevant(doc):
    t = doc["title"].lower()
    return (doc["publication_date"] >= ENACTED
            and ("stablecoin" in t or "genius" in t))

docs = [d for d in raw if relevant(d)]

from collections import Counter
print(len(docs), Counter(d["type"] for d in docs))

Output on 27 October 2026:

23 Counter({'Proposed Rule': 16, 'Notice': 5, 'Rule': 2})

Twenty-three documents. That matches the list VASP Tracker keeps on its US stablecoin rulemaking page. I treat that agreement as a sanity check, not proof. If you need completeness, also query by agency and by docket.

Trap 2: "Proposed Rule" doesn't always mean a proposal

The type field is the Federal Register's category, not a description of what the document does. One example is FDIC document 2026-02665, published 11 February 2026. Its type is "Proposed Rule", but it is an extension of a comment period on an earlier proposal.

So if you want to know what a document actually does, read the action field:

for d in docs:
    if d["type"] == "Rule":
        print(d["publication_date"], d["document_number"], d["citation"],
              d["action"], "| effective:", d["effective_on"])

2026-09-30 2026-19966 91 FR 61688 Interim final rule; request for comments. | effective: 2026-09-30
2026-10-23 2026-21706 91 FR 67000 Final rule. | effective: 2027-01-18

The first is a Treasury interim final rule on forms and procedures for the review of state certifications by the Stablecoin Certification Review Committee. Comments close 30 November 2026. The second is the OCC's final rule implementing the Act for issuers under OCC jurisdiction. Its dates section says it "is effective on January 18, 2027."

The "earlier of" rule, in code

Why does a final rule matter so much? Section 20 of the Act says it takes effect on the earlier of:

18 months after enactment, or
120 days after the primary Federal payment stablecoin regulators issue any final regulations implementing the Act.

That second trigger is why people kept watching for final rules. The arithmetic is easy to check:

from datetime import date, timedelta

enacted = date(2025, 7, 18)
eighteen_months = date(2027, 1, 18)          # 18 calendar months later
occ_final = date(2026, 10, 23)               # Federal Register publication
via_rule = occ_final + timedelta(days=120)   # 2027-02-20

print(min(eighteen_months, via_rule))        # 2027-01-18

Even if you count from the OCC's announcement on 21 October 2026, the 120-day date is 18 February 2027. Both are later than 18 January 2027, so the 18-month limb wins. That is consistent with the OCC's own news release (NR 2026-92), which says "the final rule and the GENIUS Act take effect on January 18, 2027". Treasury's interim final rule also expects the Act to take effect on that date.

Two caveats before you hard-code that date into anything:

A date in a press release is not a licence. The OCC says applications are not open yet and that it will announce them separately. Its AML/sanctions rules for issuers are coming separately too, coordinated with Treasury.
Another clock runs longer. Section 3(b)(1) makes it unlawful for a digital asset service provider to offer or sell a payment stablecoin to a person in the United States unless a permitted issuer issued it, starting three years after enactment. By my calculation that is 18 July 2028.

VASP Tracker has a longer write-up of the effective-date question if you want the legal background rather than the code.

Making it a daily job

Store document_number as the primary key. It is stable.
Diff each run against yesterday's set and alert on new rows where type == "Rule". Also alert on any action containing "final".
Keep the raw JSON. effective_on can be null on rules that set their dates in the text.
Don't trust the term search alone. Log what your filter rejects and skim it now and then, because a document titled "Payment stablecoins..." from a new agency is exactly what you don't want to drop.

The whole thing is about 40 lines and runs in under a second. That makes it one of the cheapest regulatory monitors you can build.

Not legal advice. This post describes public records and code; check the primary sources before relying on any date.

VASP Tracker is an independent tracker. It is not an official source and is not affiliated with any regulator.

Parsing ESMA's MiCA CASP Register in Python: Six Data Gotchas (and a Deadline Calendar to Go With It)

VASP Tracker — Wed, 21 Oct 2026 19:39:29 +0000

Since the last MiCA transitional periods ended on 1 July 2026, "is this firm authorised in the EU?" has a single first place to look: ESMA's interim MiCA register. It isn't a database with an API. It's a set of CSV files that ESMA re-publishes on its MiCA page, weekly according to ESMA. That makes it easy to download and surprisingly easy to misread.

This post walks through a small, dependency-free Python script that:

pulls a machine-readable calendar of upcoming crypto licensing deadlines, and
loads ESMA's authorised-CASP file and cleans up the quirks I hit doing it.

Everything below was run on 22 October 2026 against the file ESMA lists as last updated on 19 October 2026. Your counts will differ when ESMA refreshes the file. That's the point of scripting it.

Step 1: A Deadline Calendar as Data

At VASP Tracker we publish our jurisdiction and deadline data as open data (CC BY 4.0). The JSON file has two arrays: jurisdictions (one row per jurisdiction, with its regulator, status and official register URL) and events (one row per dated event).

The fields you'll care about in events:

field	meaning
`date`	ISO date of the event
`event_type`	e.g. `application_deadline`, `transition_end`, `ban`, `regime_start`, `in_force`
`key_date`	`true` for the dates that change what firms may do
`our_calculation`	`true` when the date isn't printed in the source but derived from it (e.g. "one year from commencement")
`source_urls`	pipe-separated links to the law, gazette or regulator notice

The our_calculation flag matters. If you build alerts on these dates, show calculated dates differently from dates the regulator actually printed.

Step 2: The Script

Standard library only, Python 3.9+.

import csv, io, json, urllib.request
from collections import Counter
from datetime import date, datetime

def get(url: str) -> bytes:
    req = urllib.request.Request(url, headers={"User-Agent": "licence-deadline-check/0.1"})
    with urllib.request.urlopen(req, timeout=60) as r:
        return r.read()

# --- 1. The deadline calendar -------------------------------------------
cal = json.loads(get("https://vasptracker.com/data/global/deadlines.json"))
today = date.today().isoformat()

upcoming = sorted(
    (e for e in cal["events"] if e["key_date"] and e["date"] >= today),
    key=lambda e: e["date"],
)
for e in upcoming:
    calc = "  (calculated)" if e["our_calculation"] else ""
    print(f'{e["date"]}  {e["jurisdiction"]:<15} {e["event_type"]}{calc}')
    print(f'            source: {e["source_urls"].split(" | ")[0]}')

print(Counter(j["register_format"] for j in cal["jurisdictions"]))

# --- 2. ESMA's interim MiCA register (authorised CASPs) ------------------
raw = get("https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv")
rows = list(csv.DictReader(io.StringIO(raw.decode("utf-8-sig"))))  # strip the BOM

def d(s: str):
    """ESMA dates are dd/mm/yyyy. A few cells hold values like '06-May'
    (no year), so return None instead of guessing."""
    s = (s or "").strip()
    try:
        return datetime.strptime(s, "%d/%m/%Y").date()
    except ValueError:
        return None

casps = []
for r in rows:
    r = {k: (v or "").strip() for k, v in r.items()}           # 'NL ' -> 'NL'
    r["services"] = [x.strip() for x in r["ac_serviceCode"].split("|") if x.strip()]
    r["passports"] = [x.strip() for x in r["ac_serviceCode_cou"].split("|") if x.strip()]
    r["authorised_on"] = d(r["ac_authorisationNotificationDate"])
    r["ended_on"] = d(r["ac_authorisationEndDate"])
    casps.append(r)

active = [r for r in casps if not r["ended_on"] or r["ended_on"] > date.today()]
print(len(rows), "rows,", len({r["ae_lei"] for r in casps}), "distinct LEIs,", len(active), "without a past end date")
print(Counter(r["ae_homeMemberState"] for r in active).most_common(5))
print("latest record update:", max(d(r["ac_lastupdate"]) for r in casps if r["ac_lastupdate"]))
print("unparseable authorisation dates:",
      sum(1 for r in casps if r["ac_authorisationNotificationDate"] and not r["authorised_on"]))
print(Counter(r["ac_legal_basis"] for r in casps))

Output (22 Oct 2026)

The calendar part prints the next key dates with their primary source:

2026-10-30  Brazil          application_deadline
2026-11-04  Kenya           transition_end  (calculated)
2026-11-06  Brazil          ban
2027-01-18  United States   effective_date
2027-02-28  United Kingdom  application_deadline
2027-04-09  Australia       in_force
2027-07-01  Russia          transition_end
2027-07-22  Japan           effective_date  (calculated)
2027-10-25  United Kingdom  regime_start

(Source lines omitted here for space.) The register_format counter shows why "just scrape the registers" is harder than it sounds. Across the 76 jurisdictions in the file, 31 official registers are CSV, 26 are HTML pages, 7 are PDFs, one is CSV plus an API (Brazil's Central Bank), one is HTML plus an API (the UK FCA), and 10 have no register we could find.

The ESMA part printed:

379 rows, 376 distinct LEIs, 377 without a past end date
[('DE', 109), ('FR', 36), ('NL', 28), ('CY', 24), ('MT', 23)]
latest record update: 2026-10-15
unparseable authorisation dates: 10
Counter({'': 180, 'Article 60 - Notification': 117, 'Article 63 - CASP authorisation': 66, 'Article 63': 10, 'Article 60': 6})

The Six Gotchas

1. There's a UTF-8 BOM. The file starts with EF BB BF. Decode with utf-8-sig, or your first column will be called \ufeffae_competentAuthority and every row["ae_competentAuthority"] lookup will raise KeyError.

2. Values have trailing whitespace. All 29 Dutch rows have ae_homeMemberState set to "NL ", not "NL". Group by country without stripping and the Netherlands quietly splits in two. Strip every cell.

3. Dates are dd/mm/yyyy strings, and a few aren't dates at all. Calling max() on the raw ac_lastupdate strings returned 31/08/2026. The real latest update after parsing was 15 October 2026. Ten ac_authorisationNotificationDate cells hold values like 06-May, with no year (it looks like a spreadsheet auto-format). Parse explicitly and treat failures as unknown, not as today.

4. One row is not one firm. 379 rows, 376 distinct LEIs. The duplicates I found are firms with more than one entry (separate notifications with different dates and services). If you want "number of firms", count distinct ae_lei. If you want "number of authorisation events", count rows. Decide which one you mean.

5. Multi-value fields use inconsistent separators. ac_serviceCode lists the MiCA services (a. custody â€¦ j. transfer services). 205 rows separate them with " | " and 64 with a bare "|". Split on | and strip, never on " | ". ac_serviceCode_cou (the passporting countries) uses | too.

6. The legal-basis column is half empty and not normalised. 180 rows have no ac_legal_basis. The rest mix Article 63 - CASP authorisation with Article 63, and Article 60 - Notification with Article 60. The difference is real: Article 63 is the standard CASP authorisation, while Article 60 lets certain already-regulated financial entities (credit institutions and investment firms, for example) provide crypto-asset services after notifying their regulator. Normalise on the article number, and keep "unknown" as its own bucket rather than guessing.

Bonus: ESMA says withdrawn authorisations stay in the file, with the date the withdrawal took effect. Only 2 rows had an ac_authorisationEndDate when I ran this. Filter on it anyway, or you'll count a withdrawn firm as live.

What This Doesn't Tell You

The ESMA file is interim and second-hand. ESMA compiles it from what national competent authorities send. ESMA itself warns that information already in a national register may not show up immediately. For a decision that matters, check the national register of the home member state too.
Absence isn't proof of anything. A missing firm may be authorised under another legal entity name (always search by LEI and by legal name, not by brand), or the record may simply not have arrived yet.
Calculated dates are calculations. Treat our_calculation: true events as "derived from the source", and link users to the source.

If you'd rather not maintain the cleaning code yourself, our EU open-data page has a dated snapshot of ESMA's CASP file (selected columns) plus a per-firm table with ISO dates, LEIs, service codes and passporting states, and per-member-state transition data, under the same CC BY 4.0 licence. Corrections are welcome at press@vasptracker.com.

VASP Tracker is an independent project and is not affiliated with ESMA or any national regulator. Nothing here is legal advice. Always confirm a firm's status with the competent authority.

Sources

ESMA, Markets in Crypto-Assets Regulation (MiCA) page: Interim MiCA Register (update frequency, field description, treatment of withdrawn records): https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica
ESMA, interim MiCA register, authorised CASPs file (CASPS.csv), accessed 22 Oct 2026: https://www.esma.europa.eu/sites/default/files/2024-12/CASPS.csv
ESMA, Public Statement on the end of MiCA transitional periods (June 2026): https://www.esma.europa.eu/sites/default/files/2026-06/ESMA75-113276571-1710_Public_Statement_MiCA_transitional_period_ends.pdf
Regulation (EU) 2023/1114 (MiCA), Arts. 60, 63 and 143(3): https://eur-lex.europa.eu/eli/reg/2023/1114/oj
VASP Tracker open data, deadlines.json (CC BY 4.0): https://vasptracker.com/data/global/deadlines.json
VASP Tracker, EU open data: https://vasptracker.com/en/eu/data/