This supplemental comment addresses consumer disclosure requirements under GENIUS Act Section 6. It recommends three mandatory disclosures (no insurance, not legal tender, redemption rights) with specific delivery methods, individual acknowledgment requirements, wallet activation gating, disclosure versioning with SHA-256 hashing, and standardized examination procedures for disclosure compliance.
ZKProva Inc.
Compliance Technology & Infrastructure
April 6, 2026
National Credit Union Administration
1775 Duke Street
Alexandria, VA 22314
Re: Docket No. NCUA-2026-0265; RIN 3133-AF69 — Notice of Proposed Rulemaking: Investments in and Licensing of Permitted Payment Stablecoins Issuers (GENIUS Act PPSI Licensing Framework for Federally Insured Credit Unions), 91 FR 6531 — Supplemental Comment on Consumer Disclosure Standards
Dear Members of the NCUA Board:
ZKProva Inc. previously submitted comments on this proposed rulemaking on April 4, 2026 (Tracking ID: mnk-icx3-0rd5), addressing pre-licensure compliance testing, standardized validation frameworks, federation standards, and privacy-preserving compliance verification. We submit this supplemental comment to address an area of particular technical importance that warrants separate, detailed treatment: the consumer disclosure requirements that should govern PPSI operations under GENIUS Act Section 6.
ZKProva has built and deployed production consumer disclosure infrastructure for credit union PPSIs that implements the GENIUS Act Section 6 requirements. Our comments below are informed by direct engineering experience with the technical challenges of disclosure delivery, acknowledgment verification, audit trail integrity, and the relationship between disclosure compliance and wallet activation gating.
GENIUS Act Section 6 requires that payment stablecoin issuers provide consumers with certain mandatory disclosures prior to the establishment of a custodial relationship. The proposed rule references these disclosure obligations but does not specify: (a) which specific disclosures are mandatory versus recommended; (b) acceptable delivery methods and their evidentiary requirements; (c) what constitutes legally sufficient acknowledgment; (d) how disclosure compliance should be verified during NCUA examinations; or (e) whether disclosure acknowledgment should be a precondition to wallet activation or stablecoin issuance.
This lack of specificity creates compliance risk for credit unions. Without clear technical standards, each credit union PPSI will implement disclosures differently, leading to inconsistent member experiences, varying levels of legal protection, and examination uncertainty. Given that credit unions serve members who may be less financially sophisticated than typical cryptocurrency users, the stakes of getting disclosure right are particularly high.
Based on our analysis of GENIUS Act Section 6 and related consumer protection requirements, we recommend that the final rule require PPSIs to deliver and obtain acknowledgment of at minimum the following three disclosures before activating any stablecoin wallet or issuing any stablecoin to a member:
1. No Insurance Disclosure (NOT_INSURED)
Payment stablecoins issued by a credit union PPSI subsidiary are not deposits and are not insured by the National Credit Union Share Insurance Fund (NCUSIF) under the Federal Credit Union Act, 12 U.S.C. § 1781 et seq. Members must understand that stablecoin holdings do not carry the same protections as share accounts. This disclosure is critical in the credit union context because members may reasonably — but incorrectly — assume that all financial products offered through their credit union carry NCUSIF coverage.
2. Not Legal Tender Disclosure (NOT_LEGAL_TENDER)
Payment stablecoins are not legal tender of the United States Government and are not backed by the full faith and credit of the United States. While stablecoins are designed to maintain a stable value relative to the U.S. dollar, they are not U.S. currency. This disclosure addresses a fundamental consumer comprehension gap identified in multiple Federal Reserve surveys regarding digital asset understanding among credit union members.
3. Redemption Rights Disclosure (REDEMPTION_RIGHTS)
Members have the right to redeem payment stablecoins at par value (one-to-one with the U.S. dollar) subject to the PPSI's published redemption policy, as required by GENIUS Act Section 4(a). The redemption disclosure should specify applicable timeframes, any conditions or limitations on redemption, and the process for initiating a redemption request. This disclosure operationalizes the GENIUS Act's core consumer protection: the guaranteed right of redemption.
We further recommend that the NCUA encourage — but not initially require — four additional disclosures that address terms of service, fee schedules, privacy practices (including the applicability of Gramm-Leach-Bliley Act protections to stablecoin transaction data), and risk warnings regarding irreversibility of blockchain transactions, potential regulatory changes, and smart contract risks.
The final rule should specify acceptable delivery methods for mandatory disclosures and establish minimum evidentiary standards for each. We recommend that the NCUA recognize four delivery channels, each with specific audit trail requirements:
| Delivery Method | Description | Minimum Audit Trail |
|---|---|---|
| WEB | Delivered through authenticated web session in member's browser | IP address, user agent string, session identifier, UTC timestamp |
| MOBILE | Delivered through authenticated mobile application session | Device identifier, IP address, app version, UTC timestamp |
| Delivered via transactional email to member's verified email address | Email address, message identifier, delivery confirmation timestamp | |
| API | Delivered programmatically through authenticated API call | API key identifier, IP address, request identifier, UTC timestamp |
For each delivery, the PPSI should record: the exact disclosure text delivered (or a cryptographic hash thereof, such as SHA-256, that can be verified against a canonical version), the delivery method, the UTC timestamp of delivery, and sufficient identifying information to associate the delivery with a specific member and, where applicable, a specific stablecoin wallet.
Delivery alone is insufficient. The final rule should require that PPSIs obtain affirmative acknowledgment of each mandatory disclosure from the member before wallet activation. "Acknowledgment" should mean an affirmative action by the member — such as clicking an "I understand and acknowledge" button, submitting a signed acknowledgment form, or completing an equivalent affirmative step — that is distinct from mere delivery or passive receipt.
The acknowledgment record should capture: the disclosure identifier, the member identifier, the UTC timestamp of acknowledgment, the IP address from which the acknowledgment was submitted, and the user agent or device information. This creates an auditable chain of evidence that the member was informed of and affirmatively accepted the disclosed terms before engaging in stablecoin activities.
Critically, we recommend that the final rule require acknowledgment to be individually recorded for each disclosure type. A single "I accept all terms" checkbox is insufficient because it does not establish that the member was separately presented with and understood each distinct disclosure. The no-insurance disclosure, the not-legal-tender disclosure, and the redemption rights disclosure address materially different consumer protection concerns, and each deserves individual member attention.
The final rule should explicitly require that wallet activation — the transition of a stablecoin wallet from an unbound or inactive state to an active state capable of receiving, holding, and transferring stablecoins — be gated on completion of all mandatory disclosures. A wallet should not be activated, and no stablecoins should be issued to a member, until the PPSI's systems have verified that all three mandatory disclosures have been delivered to and acknowledged by the member.
This gating requirement serves two purposes: first, it ensures that no member can inadvertently acquire stablecoins without understanding the fundamental terms of the product; second, it creates a verifiable compliance checkpoint that NCUA examiners can audit during examinations. The PPSI's wallet management system should enforce this gate programmatically — not merely as a policy requirement, but as a technical control that prevents activation without completed disclosures.
The final rule should address disclosure versioning. When a PPSI materially modifies the text of a mandatory disclosure — for example, when redemption terms change or when new risks emerge — the PPSI should be required to deliver the updated disclosure to affected members and obtain fresh acknowledgment. The disclosure record should include a version identifier (e.g., "1.0", "2.0") and a unique constraint that ensures each member has at most one active disclosure per type per version, preventing duplicate or conflicting records.
To implement this, we recommend that the NCUA require PPSIs to maintain a cryptographic hash (SHA-256 or equivalent) of each disclosure's text content. When the hash changes, the version increments, and re-acknowledgment is triggered. This approach provides a tamper-evident record that the disclosure text a member acknowledged matches the text that was approved by the PPSI's compliance officer.
During PPSI examinations, NCUA examiners should verify: (a) that the PPSI's disclosure texts accurately reflect current GENIUS Act requirements and the PPSI's actual redemption policy; (b) that disclosure delivery and acknowledgment records exist for every member with an active stablecoin wallet; (c) that the SHA-256 hashes of delivered disclosures match the canonical disclosure texts on file; (d) that no wallet was activated without prior completion of all mandatory disclosures; and (e) that the PPSI has a process for re-delivering updated disclosures when material changes occur.
The PPSI should be able to produce, on demand, a disclosure status report for any member showing: which disclosures have been delivered, which have been acknowledged, which are missing, and the associated timestamps and audit trail data.
ZKProva has implemented the disclosure framework described above in production. Our implementation includes: seven disclosure types (three mandatory, four recommended); four delivery methods with full audit trail capture (IP address, user agent, timestamps); individual acknowledgment per disclosure type with idempotent recording; SHA-256 text hashing for tamper-evidence; programmatic wallet activation gating that blocks the UNBOUND-to-ACTIVE state transition until all mandatory disclosures are acknowledged; a unique database constraint on (member, disclosure type, version) to prevent duplicate records; and a status-check API that returns all-acknowledged status, missing types, and acknowledged types for any member.
This implementation demonstrates that the standards recommended in this comment are technically achievable with standard web application infrastructure and do not impose disproportionate technical burden on credit unions or their technology vendors.
We respectfully request that the NCUA include the following consumer disclosure standards in the final rule:
Consumer disclosure is the first line of defense for credit union members entering the stablecoin economy. The proposed rule establishes the obligation to disclose; the final rule should establish how. The standards recommended in this comment are technically proven, operationally feasible, and designed to protect the members that credit unions exist to serve.
ZKProva Inc. welcomes the opportunity to provide technical demonstrations, implementation specifications, or testimony in support of these comments.
Respectfully submitted,
Viswanadha Pratap Kondoju
Founder & CEO
ZKProva Inc. (incorporation pending)
Disclaimer: This page is an informational archive of a public regulatory comment. It does not constitute legal advice. ZKProva Inc. is not a law firm and no attorney-client relationship is created. Not affiliated with, endorsed by, or sponsored by the NCUA, OCC, or U.S. Department of the Treasury.