The Bitcoin Banking Standard – Edition 16

On September 15 the Senate voted 49-50 against ending debate on the Digital Asset Market Clarity Act, after a weekend in which Republican sponsors released a final text with a Treasury "circuit breaker" on stablecoin rewards and eight bank trade groups said the mechanism arrives too late to count as a safeguard. The next day the SEC and CFTC chairs said they will write digital-asset market rules under existing authority, and on September 17 the SEC issued a five-year exemption for tokenized-stock trading venues and convened a roundtable on 24-hour trading. On September 11 the Federal Reserve, FDIC, OCC and NCUA proposed supervisory guidance on core-provider relationships. On September 16 the Conference of State Bank Supervisors published an AI examination framework covering generative and agentic systems. Block applied for a national trust charter, Chime agreed to buy its sponsor bank, and the OCC's capital conditions on OpenReserve Bank were reported. U.S. Bank settled a live cross-border payment with its own stablecoin, DBS and Citi settled a weekend payment on Swift's ledger, and Circle opened its Arc network to institutions. And the Liquid Network lost and mostly recovered about 4,000 BTC, Revolut disclosed customer records to an impersonator, and a Wyoming bank spent more than a week offline after a cyber incident.

Senate rejects Clarity Act cloture 49-50 after a final text adds a Treasury "circuit breaker" on stablecoin rewards

On September 15 the Senate voted 49-50 against cloture on the motion to proceed to H.R. 3633, the Digital Asset Market Clarity Act, eleven votes short of the 60 required. Every Democratic negotiator voted no, including Senators Gallego, Warner and Gillibrand, and Republicans Josh Hawley, Susan Collins and Jerry Moran joined them. Senator Thom Tillis voted no as a procedural step that preserves a motion to reconsider. Talks broke down over the ethics provision governing officials' digital-asset holdings. Minority Leader Schumer said Republican leadership ended a bipartisan discussion that afternoon and forced the vote; Senator Lummis said Democrats' Monday counteroffer was the same position they held before the August recess.

The text that would have been offered as a substitute amendment was released late on September 13 by Senators Lummis, Boozman and Scott, who described it as incorporating 126 changes requested by Democrats. New in that draft was authority for the Treasury secretary to restrict stablecoin rewards for 18 months after enactment if payment stablecoins caused substantial deposit outflows from community banks under $10 billion in assets. The underlying yield language was unchanged: platforms may not pay interest on idle stablecoin balances, but activity-based rewards remain permitted. On September 14 the American Bankers Association, Bank Policy Institute, Independent Community Bankers of America and five other groups wrote to Majority Leader Thune and Minority Leader Schumer that a trigger which activates only after substantial deposit flight has already happened is not a safeguard. Treasury Secretary Bessent said he would use the authority if stablecoins harmed community banks. Separately, attorneys general from 17 states and the District of Columbia, led by New York's Letitia James, asked senators to reject the bill unless it expressly preserved state authority to bring securities and commodities cases.

Hours before the vote, the White House Council of Economic Advisers posted a FAQ and interactive model defending its April paper on stablecoin yield. Its baseline finding: banning yield would add about $2.1 billion in bank lending, 0.02% of outstanding loans, with community banks under $10 billion accounting for roughly $500 million, at a net welfare cost of about $800 million a year. The FAQ says the $531 billion figure cited by trade groups requires four assumptions at once, and that the change in the Fed's reserves regime alone moves the estimate to about $15 billion.

For banks: The bill's bank-permissibility provisions, which would have given banks affirmative authority to lend against digital-asset collateral, hold digital assets directly and operate nodes, did not advance with it; Senator Warren said on the floor she would oppose those measures in any rewrite. The stablecoin-yield status quo under the GENIUS Act stands, meaning issuers may continue activity-based reward programs. The operative federal framework for bank digital-asset activity remains GENIUS Act rulemaking, OCC interpretive letters and chartering decisions, and SEC and CFTC agency action. Senator Kennedy said a lame-duck attempt after the election is possible.

Sources: American Banker | The Block | White House CEA

SEC and CFTC say they will write rules under existing authority; SEC issues a five-year exemption for tokenized-stock venues

On September 16 SEC Chairman Paul Atkins posted that "with or without legislation, we will act decisively within the SEC's statutory authority," and CFTC Chairman Mike Selig said his agency is "locked in and ready to ship its rules." JPMorgan analysts noted that agency rules are less durable than statute, since a future administration can reverse them and courts can vacate them. Two days earlier, at a Solana Policy Institute event, Atkins had described three workstreams that would continue regardless of the bill: the proposed Regulation Crypto Assets for issuance, an overhaul of transfer-agent rules to accommodate blockchain ownership ledgers, and a custody proposal for investment advisers and regulated funds. On custody, he said he has asked staff to draft rules that would let advisers self-custody digital assets under certain conditions and use state trust companies as custodians.

On September 17 the SEC granted temporary, conditional relief from the Exchange Act definition of "exchange" to a new category it calls Tokenized Securities Venues, which pair permissioned automated market makers and liquidity pools with tokenized National Market System stock. Liquidity providers get a parallel exemption from the "dealer" definition. Conditions include symbol and volume limits, a requirement that the token carry the same rights as the underlying share, a 30-day notice-and-objection window for issuers whose stock a third party tokenizes, auditable smart contracts on a public permissionless ledger, coordinated trading halts, and public disclosure of the venue's own activity. Venues file notice and operate rather than seeking SEC designation. The exemption expires five years after publication, and the order requests comment. Atkins called it "a bridge toward durable rulemaking." Commissioner Peirce's statement notes the order excludes synthetic tokens and does not address decentralized systems.

An hour later the SEC held a full-day roundtable on moving U.S. equity markets toward around-the-clock trading. Atkins said "several needed preparations are already underway or in place" and asked staff to consider how tokenization could support real-time inventory management. Peirce listed the operational concerns firms raise about overnight hours: wider spreads, higher volatility, less time to resolve technology issues, and thinner human monitoring. Public comment on 24-hour trading remains open.

For banks: The exemption applies to trading venues, not to banks. The conditions the SEC attached to those venues are open for comment. The adviser custody proposal Atkins described has not been published; if issued as described, it would name state trust companies as acceptable custodians for adviser and fund digital assets. Both agency chairs have said their rulemakings will proceed without the bill, so the market-structure items still pending are agency notices and comment periods rather than floor votes.

Sources: SEC | The Block | CoinDesk

Four agencies propose supervisory guidance on core-provider relationships

On September 11 the Federal Reserve, FDIC, OCC and NCUA proposed principles-based third-party risk management guidance aimed at the relationship between community banks and core service providers. The proposal calls for added supervisory scrutiny of core arrangements that offer limited transparency to banks or that "unreasonably limit" a bank's ability to conduct due diligence, monitor the provider, or negotiate contract terms. It flags the concentration of the core market as a competitive problem and asks for closer oversight of providers' technology investments. A companion proposal would apply lighter third-party guidance to "traditional" community banks that do not engage in fintech partnerships or digital-asset services. The Fed Board voted 6-1 to issue it; Governor Michael Barr dissented, arguing that banks with complex models and digital-asset activity need more specific third-party guidance than the proposal offers. The comment period runs 60 days from Federal Register publication.

For context: three days later, CORA Group, a subsidiary of Constellation Software, relaunched the U.S. core banking system it bought from Finastra in June as PhoenixWorx, bundling the Phoenix core with the MalauzAI digital banking platform for its roughly 200 community bank and credit union clients. CCG Catalyst's Paul Schaus told American Banker the proposal is "a positive for the smaller vendors and a negative for the vanguards," and that the switching friction that has protected FIS, Fiserv and Jack Henry "is now a supervisory topic." Analyst Tyler Brown countered that PhoenixWorx is a rebrand of existing software and that its market share will not structurally change.

For banks: If adopted, contract transparency, access for due diligence, and negotiability of terms become items an examiner may review in a core arrangement. Institutions without fintech partnerships or digital-asset services would fall under the lighter companion guidance; the dissent argues that institutions with digital-asset activity need more specific direction than the proposal gives. The 60-day comment window has not yet opened, pending Federal Register publication.

Sources: American Banker (guidance) | American Banker (PhoenixWorx)

State bank supervisors publish an AI examination framework covering generative and agentic systems

On September 16 the Conference of State Bank Supervisors published its Artificial Intelligence Supervisory Framework: a core examiner guide, a 28-page work program, a nonbank supplement, a risk-tiering worksheet and a source list. It is written for examiners at the 3,355 state-chartered institutions, which make up 79% of FDIC-insured banks, and CSBS says it "doubles as a resource for industry." The framework is discretionary; each state agency decides whether to adopt it, and it creates no new legal obligation.

In April the Fed, OCC and FDIC revised their model risk management guidance and placed generative and agentic AI out of scope; the CSBS framework addresses those systems for state examiners. For agentic systems, the work program asks how a bank bounds the actions an agent can take, where humans intervene, what is logged, whether actions are reversible, and whether the system can be halted.

For context, one example of agentic tooling at a small regulated institution: on September 8 Kyndryl said it completed a proof of concept with Google Cloud at Switzerland's Incore Bank for AI agents that run customer risk assessment across onboarding and ongoing review, combining Kyndryl's agentic framework and policy-as-code with Google's Gemini models and keeping an auditable trail. Incore CEO Mark Dambacher said the work shows agentic AI can operate "while maintaining the rigorous oversight and controls required in a regulated environment."

For banks: A state-chartered institution whose regulator adopts the framework may face examiner questions on action boundaries, human checkpoints, logging, reversibility and halt capability for any agentic system in use. Federally chartered institutions remain under the April model risk guidance, which does not address these systems. Adoption is state by state, so the applicable work program depends on the chartering agency.

Sources: CSBS | American Banker | Banking Dive

Block applies for a national trust charter; Chime buys its sponsor bank; OCC conditions on OpenReserve reported

On September 8 Block said it has applied to the OCC to establish Builders Bank & Trust, N.A., an uninsured national trust bank that would take no deposits and make no loans. Per the public portion of the application, the bank would custody Bitcoin and other digital assets, execute customer buy and sell orders on a riskless principal basis, and settle stablecoins. Block has run these activities for about eight years under more than 50 state money transmitter and virtual currency licenses, handling roughly $10.7 billion in Bitcoin transaction volume in 2025. Lee Woolley, a former Northern Trust and BNY Mellon executive, would serve as chair and CEO; the bank would be headquartered in Sioux Falls, South Dakota, with no branches. The application relies on the OCC's April amendment to its chartering rule, which replaced "fiduciary activities" with "operations of a trust company and activities related thereto." The OCC has received 40 de novo applications since 2025, approving 21 and denying two.

The same day, Chime said it will acquire Stride Bank of Enid, Oklahoma, its sponsor bank of seven years, for $590 million in cash, about 1.5 times tangible book value. Stride, with about $4 billion in assets, would become Chime Bank, N.A., led by current Stride chairman and CEO Brud Baker. Chime said buying a bank rather than applying de novo "provides a faster and more proven path to full-stack ownership," and CEO Chris Britt told American Banker the deal lets Chime connect "Chime Core," its proprietary technology core, directly to the bank's infrastructure. Chime expects roughly $100 million in net synergies and plans to keep assets under $10 billion to stay below the debit interchange cap. Closing is expected in the first half of 2027, subject to OCC and Federal Reserve approval.

On September 9 American Banker reported details from the OCC's decision letter on OpenReserve Bank's preliminary conditional approval: initial capital of at least $210 million, a Tier 1 leverage ratio of at least 12%, and formal acknowledgment of banking-as-a-service as a planned service, which Klaros Group's Roman Goldstein called a first. Co-founder Dee Choubey said a separate subsidiary application for a dollar-backed stablecoin, ReserveUSD, is coming "in short order." The OCC published its approval of SoFi's stablecoin issuance subsidiary the same day.

For banks: Block's filing puts custody, riskless-principal execution and stablecoin settlement in front of the OCC as trust-company activities under the April chartering rule. Chime's purchase, if approved, places a proprietary core and a national charter under one owner. OpenReserve's decision letter is a published data point on the capital an on-chain de novo is being asked to hold. Each remains subject to regulatory action, and the OCC's 40-application count includes two denials.

Sources: The Block | American Banker (Chime) | American Banker (OpenReserve)

Live settlement on bank-issued tokens at U.S. Bank and on Swift's ledger; Circle opens Arc to institutions

On September 9 U.S. Bank said it completed a live cross-border payment using USBDC, its dollar-backed stablecoin, between U.S. Bank entities in North America and Europe. The transaction ran on the Stellar blockchain and follows the custom-issuance pilot the bank disclosed in November 2025. The pilot tested minting, redemption, freezing and clawback, and the bank said it also validated its internally developed Digital Asset Platform, which connects blockchain networks to its finance, compliance, risk and operations systems. U.S. Bank named cross-border treasury operations, liquidity management and collateral movement as the uses under consideration, and gave no timeline for client availability.

On September 7 DBS and Citi said they completed the first cross-border dollar payment over a weekend using tokenized deposits on Swift's Digital Ledger. The transaction ran September 5 between DBS in Singapore and Citi in New York and settled in minutes. It is the second confirmed live transaction on the ledger, after HSBC and Standard Chartered in August; Citi has now completed three transactions on it in a week, with First Abu Dhabi Bank and OCBC as well as DBS, and plans a fourth with United Overseas Bank later in September.

On September 16 Circle released Arc, its USDC-settled blockchain, to public mainnet. Gas fees are paid in USDC. Founding validators include BlackRock, DTCC, Global Payments, Mastercard, Visa, Standard Chartered and ICE; BNY, HSBC, Lead Bank and State Street are named as live participants or evaluating participation, and Anchorage Digital and BitGo will offer custody for assets on Arc. The opt-in privacy feature for institutional treasury payments is still in development. In its first 24 hours the chain recorded 7.83 million transactions and roughly 400,000 new accounts, but only about 624,000 USDC transfers over its life, with memecoin trading filling most blocks; average fees quadrupled to three cents, and the network ran without congestion.

For banks: Live transactions now exist on a bank's own stablecoin, on tokenized deposits over Swift's ledger, and on a stablecoin issuer's network with named bank participants. U.S. Bank described a purpose-built platform to connect the blockchain to its finance, risk and compliance systems; the Swift and Arc announcements did not describe the equivalent integration at the participating banks. Payment volume on Arc is small relative to its total activity so far.

Sources: CoinDesk (U.S. Bank) | CoinDesk (Swift ledger) | American Banker

Security incidents at Liquid Network, Revolut and a Wyoming bank

On September 6 the Liquid Network, the Bitcoin sidechain operated by a federation of more than 80 exchanges and infrastructure firms, said a self-described white-hat group had withdrawn about 4,000 of the roughly 4,200 BTC in its federation wallet, then worth about $320 million. Blockstream attributed the incident to a range-proof caching bug in Elements, the sidechain software, that allowed L-BTC to be created without backing; no keys were compromised. The group returned 3,400 BTC on September 7 after Blockstream confirmed on-chain that bridge nodes were patched. Elements v23.3.4 shipped September 9 and Liquid resumed block production on September 10, with peg-outs still disabled. On September 11 Blockstream said it would not pay a bounty for the roughly 598.5 BTC still outstanding, describing the retained funds as theft.

On September 12 Revolut told The Block that an unauthorized third party used an email account on a legitimate government agency domain to submit fraudulent requests for customer records, and that the company complied. A customer notice shared publicly listed names, dates of birth, addresses, identity documents, verification selfies, account statements, IBANs, withdrawal records and full transaction histories including Bitcoin transactions. Revolut said funds and systems were unaffected, declined to say how many customers were involved or name the agency, and has notified law enforcement, data protection authorities and financial regulators. The company received OCC conditional approval for a U.S. national bank charter on September 3.

The $1.14 billion-asset Hilltop National Bank in Casper, Wyoming took all systems offline on September 9 after identifying a cybersecurity incident, and as of September 15 had no restoration date. Online and mobile banking were down, debit cards were capped at $1,000 a day, and seven of eight offices handled a narrow set of transactions. The bank notified the OCC and the Kansas City Fed under the 36-hour incident rule but declined to tell American Banker what caused the incident, whether data left its systems, or which vendor runs its core.

For banks: The Liquid event affects institutions holding or settling L-BTC, and peg-outs remain disabled. Revolut said no systems were breached; the records left through a request the company treated as legitimate, nine days after its conditional OCC approval. Hilltop has not said what caused its outage or which vendor runs its core. Under the bank incident-notice rules, a regulator is notified within 36 hours, and customers are notified only if a data breach is confirmed.

Sources: The Block (Liquid) | The Block (Revolut) | American Banker

What to Watch

• Core-provider guidance comment period. Comments on the interagency proposal are due 60 days after Federal Register publication, which had not occurred as of September 18. The companion proposal for "traditional" community banks runs on the same clock.
• SEC comment requests. The tokenized-securities exemption order requests comment, and the 24-hour trading docket remains open. The adviser custody proposal Chairman Atkins described has not been published.
• Lame-duck session. Senator Tillis's procedural vote preserves a motion to reconsider the Clarity Act, and Senator Kennedy said a post-election attempt is possible. Two House bills advanced from committee on September 16 and await floor action after November 3: the Digital Asset Tax Certainty Act, approved 38-5 by Ways and Means, which would exempt network and transaction fees of $10 or less from taxation beginning December 2027 and tax mining and staking income as ordinary income; and the American Reserve Modernization Act, which would codify the Strategic Bitcoin Reserve created by executive order in March 2025.
• GENIUS Act rulemaking. With market-structure legislation stalled, the GENIUS Act's pending implementing rules remain the operative federal stablecoin timeline.
• Charter decisions pending. OCC review of Block's application; OCC and Fed review of Chime's Stride Bank purchase, targeted to close in the first half of 2027; final approval for OpenReserve and its ReserveUSD subsidiary filing; regulatory approval of OppFi's purchase of BNC National Bank, which BNCCORP stockholders approved September 17. Nubank went live in the U.S. through Lead Bank on a 3.5% APY account with USDC, digital euro and Bitcoin holdings, ahead of final approval of the national charter the OCC conditionally granted in January.
• De novo pace. Nola Bank opened September 14 in New Orleans, Louisiana's first new charter since 2010 and the seventh de novo of 2026, against five in all of 2025; Portrait Bank in Winter Park, Florida was scheduled to open September 19. The FDIC has received seven deposit-insurance applications since July. Enova International withdrew its Fed and OCC applications to buy the $1.6 billion-asset Grasshopper Bancorp, with CEO Steve Cunningham saying the process "has not evolved enough to clearly articulate the standards."
• Mobile driver's licenses. FinCEN and the four banking agencies published FAQs confirming that an unexpired state-issued mobile driver's license satisfies the Customer Identification Program rule where the bank has the systems to read it. Twenty-two states and Puerto Rico issue them; the AAMVA public-key registry covers 14 states; NIST's standardization work is in draft. Jack Henry and Fiserv did not respond to American Banker's questions about supporting them, and FIS did not answer them.
• Deutsche Bank custody. The bank said it will offer digital-asset custody to corporate and institutional clients in Europe before year-end, pending regulatory clearance, with Bitcoin, ether, USDC, EURC and EURAU as initial assets.
• Liquid Network recovery. Peg-outs remain disabled and about 598 BTC remain outstanding.
• Hilltop National Bank. No restoration date had been given as of September 15.
• Bitcoin-collateralized credit terms. Better and Coinbase's mortgage, generally available since August 26, pairs a conforming first mortgage with a down-payment loan secured by Bitcoin at a 250% collateral ratio. Better disclosed it may rehypothecate pledged Bitcoin provided it keeps equivalent Bitcoin on hand; collateral stays pledged until the conforming loan is repaid, there are no margin calls, and liquidation follows 60 days of delinquency. Pre-applications reached $360 million in requested volume.
• Stablecoin supply. Bloomberg reported that USDT fell by nearly $3 billion to about $184 billion and USDC by a similar amount to about $72 billion in the first half of 2026, the first contraction since 2022. Circle agreed September 9 to acquire Singapore-based Tazapay for $400 million for its local payout rails and banking relationships in more than 100 markets.

Looking to integrate Bitcoin and stablecoin products into your financial institution? Learn how at galoy.io. Track developments between issues on the Regulatory Radar.