The Bitcoin Banking Standard – Edition 18

On October 21 the OCC finalized its GENIUS Act rule, effective January 18, 2027, and bank trade groups objected to its treatment of stablecoin rewards. On October 23 the OCC sent its stablecoin application forms to OMB for review, with comments due November 23. On October 8 the OCC fined American Express National Bank $350 million, and on October 13 Treasury announced more than $1.21 billion in penalties against Bank of America, both over anti-money laundering programs. Upgrade announced on October 12 that it applied for an industrial loan company charter, Ramp applied to the OCC for a national trust bank charter, and the Independent Community Bankers of America's suit over the OCC's trust charters is pending. On October 6 Vice Chair for Supervision Michelle Bowman said the Federal Reserve will realign bank supervision into five regions, and on October 14 the OCC released a report on debanking policies at the nine largest national banks. The Digital Asset Market Clarity Act did not advance in the Senate and JPMorgan analysts said agency actions only partly offset that, the SEC's custody proposal is open for comment until December 7, and the Conference of State Bank Supervisors' community bank survey found 37% of respondents would participate in stablecoins through their core providers over the longer term. Standard Chartered agreed to buy Zodia Custody, JPMorgan deployed its JPM Coin deposit token on Ethereum, Mastercard released a stablecoin screening service, and HSBC launched a Hong Kong dollar stablecoin to retail users. Sui announced Hashi, a bitcoin-collateral lending protocol with $500 million in capital commitments.

OCC finalizes its GENIUS Act rule, effective January 18, 2027; bank trade groups object to the rewards approach

On October 21 the Office of the Comptroller of the Currency (OCC) issued a final rule implementing the GENIUS Act for permitted and foreign payment stablecoin issuers under its jurisdiction and for certain custody activities by OCC-supervised entities. The rule takes effect January 18, 2027, the same day as the Act. Bank Secrecy Act, anti-money laundering and sanctions requirements will come in a separate rulemaking with Treasury. Comptroller Jonathan Gould said the rule sets "strong standards for reserve backing, redemption, and risk management." The OCC's preamble says the rule keeps "core liquidity, diversification, and concentration requirements." Bitcoin Magazine reported that the rule drops the proposal's 20-day weighted-average maturity limit on reserve assets, removes a provision that would have extended redemption deadlines during a surge in requests, and requires issuers to notify the OCC within 24 hours if redemption requests exceed 10% of outstanding value in one day, a detail it attributed to Crypto in America.

The February proposal included a rebuttable presumption that certain issuer arrangements with third parties, such as exchanges paying rewards, violated the Act's yield ban. The final rule keeps the ban on issuers paying yield directly and drops the presumption. CoinDesk reported that the OCC "will apply the language of the statute to the facts and circumstances of any particular arrangement," that the word "solely" in the statute carries weight, so a reward made at least in part for other reasons may fall outside the ban, and that the OCC gave no examples of prohibited rewards. Existing programs get no safe harbor. On whether the Clarity Act might change the yield language, the OCC wrote: "Unless and until such legislation passes, the OCC must implement the GENIUS Act's yield prohibition, as enacted."

OCC Bulletin 2026-51 says that from January 18, 2027 a person generally must be approved as a permitted payment stablecoin issuer to issue a payment stablecoin in the United States. An issuer with a substantially complete application pending on or before that date may request a waiver of up to 12 months, generally limited to the prior approval requirement. The OCC generally expects to grant requests from existing U.S. issuers with substantially complete applications. An insured depository institution itself cannot receive a waiver, although its subsidiaries can request one, and prospective issuers not yet operating in the United States are expected to be approved before they begin. The OCC will tell an applicant within 30 days whether its application is substantially complete and aims to act within 120 days after that determination. Applications and waiver requests open after the Office of Management and Budget (OMB) approves the related information collection. On October 23 the OCC published a Federal Register notice saying it had submitted the application forms to OMB, where they are under 30-day review; comments are due November 23, 2026, and the OCC estimates about 40 respondents.

On October 21 the American Bankers Association's chief executive, Rob Nichols, said the rule's gaps "risk undermining the distinction Congress drew between payment stablecoins and traditional bank deposits," and that addressing deposit flight after it occurs "is the wrong approach," The Block reported. The Independent Community Bankers of America (ICBA) urged implementation of Congress's intent to prohibit yield payments and cited analysis that stablecoin adoption could reduce community bank lending by at least $850 billion in the coming years, Banking Dive reported. TD Cowen's Washington Research Group wrote that "until the courts rule, there will be ambiguity on what is permitted and what is prohibited, which is a negative." The Blockchain Association said removing the third-party presumption "brings the final rule more closely in line with the statutory text." Treasury Secretary Scott Bessent called the rule a "watershed moment in American finance."

For context: Treasury's comment period on its separate proposed rule on who may issue and sell payment stablecoins closed on October 19 with 123 submissions, The Block reported on October 20, and the Federal Reserve's two GENIUS Act proposals are open for comment until November 30.

For banks: The final rule sets requirements for permitted issuers, including subsidiaries of insured depository institutions, and for certain custody activities. The OCC reviews third-party rewards case by case and gave no examples, so the sources describe no bright-line test. Applications are not yet open while the forms are under OMB review, Bank Secrecy Act and sanctions requirements have not been issued, and the Treasury and Federal Reserve rules are not final.

Sources: OCC, News Release 2026-92 | OCC, Bulletin 2026-51, "GENIUS Act: Waivers and Application Submission Guidance" | CoinDesk, "OCC's final rule to start fresh in weighing stablecoin rewards against GENIUS Act ban" | The Block, "American Bankers Association accuses OCC of undermining Congress with final stablecoin rewards rule" | Banking Dive, "OCC issues final rule on stablecoin framework"

Date	Status	Item
Oct 19, 2026	Closed	Treasury comment period on its stablecoin issuer rule (123 submissions; no final rule date reported)
Oct 21, 2026	Issued	OCC final rule implementing the GENIUS Act (effective January 18, 2027; waivers available to issuers with pending applications)
Nov 23, 2026	Comments due	OCC stablecoin application forms, under OMB review since the October 23 Federal Register notice; applications open after OMB approval
Nov 30, 2026	Comments due	Federal Reserve’s two GENIUS Act proposals
Dec 7, 2026	Comments due	SEC adviser and regulated fund custody proposal
Jan 18, 2027	Effective	OCC rule and GENIUS Act take effect (waivers of up to 12 months for issuers with substantially complete applications pending)

Treasury announces penalties against Bank of America; OCC fines American Express National Bank

On October 13 the Treasury Department announced more than $1.21 billion in penalties against Bank of America, which it described as the third-largest in Treasury history and the largest in OCC history. The Financial Crimes Enforcement Network (FinCEN) assessed $1.2 billion, finding that the bank willfully violated the Bank Secrecy Act by failing to maintain an adequate anti-money laundering program, conduct required correspondent account due diligence and file suspicious activity reports, and that it failed to report more than $5 billion in suspicious transactions. The Office of Foreign Assets Control settled 475 apparent sanctions violations for $11.6 million. The OCC assessed a $750 million civil money penalty, which Banking Dive reported FinCEN credits, and found that transaction monitoring failed to properly monitor trillions of dollars in transactions and that the bank did not correct problems after a December 2024 cease-and-desist order.

Separately, on October 8 the OCC assessed a $350 million civil money penalty against American Express National Bank and issued a cease-and-desist order. The Federal Reserve issued a concurrent order against American Express Company and American Express Travel Related Services Company. The OCC said the bank's anti-money laundering program was not reasonably designed, including a risk assessment that focused on demand deposit accounts rather than its larger credit and charge card products, and that about $13 billion in suspected trade-based money laundering went unidentified, evaluated or adequately reported over the past decade.

For banks: Both actions concern transaction monitoring, suspicious activity reporting and risk assessment. The agencies' findings identify what they tested: whether monitoring covered the full volume of activity, whether suspicious activity was reported on time, and whether the risk assessment matched the bank's business. The penalties apply to two large institutions, and the sources do not say how the agencies would treat smaller banks.

Sources: U.S. Department of the Treasury, "U.S. Treasury Announces Record Enforcement Actions Against Bank of America" | OCC, News Release 2026-87 | Banking Dive, "BofA fined $1.21B over AML"

Upgrade applies for an industrial loan company charter and Ramp for a national trust bank charter; the ICBA's trust charter suit is pending

Upgrade announced on October 12 that it applied to the FDIC and to Nevada's Financial Institutions Division for an industrial loan company (ILC) charter, Banking Dive reported. The company named Virginia Varela, who spent more than two decades at the OCC and later led SoFi's community banking unit, as proposed chief executive of Upgrade Bank. Some lawmakers argue that ILCs without demand deposit accounts can avoid Federal Reserve oversight. The ICBA opposed cutting the Fed out of ILC supervision, warning of a "dangerous gap in safety and soundness oversight."

On October 20 FinTech Futures reported that Ramp filed with the OCC to form Ramp National Trust Bank, which would offer fiduciary investment management and custody of digital assets. Ramp says the bank would not accept deposits or issue commercial loans. The application follows a $1.85 billion raise at a $60 billion valuation.

For context: the ICBA filed suit against the OCC in the U.S. District Court for the District of Columbia on October 2, arguing the agency exceeded its authority by letting national trust banks conduct activities beyond traditional trust banking, including for digital-asset firms. According to the lawsuit, as reported by American Banker, the OCC has approved or conditionally approved 21 national trust charters during the second Trump administration, 13 of them for digital-asset companies. Dorsey & Whitney partner Joe Lynyak told American Banker the case could move up to the Supreme Court, and the article notes that trial and appeals could take years.

For banks: Charter applications now include fintech-owned depository charters and digital-asset trust charters, and the second category is the subject of pending litigation. The ILC question and the trust charter suit are separate matters, and the sources give no decision date for the applications or the case.

Sources: Banking Dive, "Fintech Upgrade applies for ILC charter" | FinTech Futures, "Ramp applies for US national trust bank charter" | American Banker, "Post-Chevron landscape gives trust bank challengers the edge"

Federal Reserve plans five supervisory regions; OCC reports on debanking policies at the nine largest national banks

In a speech on October 6 at the 2026 Community Banking Research Conference in St. Louis, Vice Chair for Supervision Michelle Bowman said supervision "will initially take the shape of a realignment into five regions" aligned to state lines. She said the Reserve Banks' footprints stay in place. Banking Dive reported that the structure is modeled on the regional structure of the Conference of State Bank Supervisors, that Bowman plans to scale back committees she said caused delays and blurred responsibility, and that examiners remain at existing reserve bank locations. Christopher Appel of Better Markets told Banking Dive he doubts that changing reporting lines will improve oversight.

Bowman also said the Federal Financial Institutions Examination Council reaffirmed its support for de novo bank formation in June and that regulators "can and should do more," including clarifying capital-related approval standards and issuing conditional approvals where appropriate. She said the agencies eliminated the Novel Activities Supervision Program, "which had operated as a barrier to innovation."

On October 14 the OCC released a report on the nine largest national banks (News Release 2026-90). It found that all nine had policies between 2020 and September 2025 that disadvantaged certain Americans, including reputation risk policies without clear standards and restrictions on access for certain industry sectors. Digital asset activities are among the sectors listed. The OCC said it is considering actions to stop banks from discriminating based on political or religious beliefs and ways to address the role of reputation risk in bank decisions. Gould said the OCC "will be assessing further changes to the regulatory and supervisory framework applicable to the largest banks."

For banks: The realignment changes how Federal Reserve supervision is organized, and the coverage reviewed gave no implementation date. The de novo measures are described as areas for more work in the speech. The OCC report covers the nine largest national banks, and the release describes the follow-up actions as under consideration.

Sources: Federal Reserve Board, Vice Chair for Supervision Bowman, "Modernizing the Regulatory and Supervisory Landscape" | Banking Dive, "Fed consolidates bank supervision structure" | OCC, "OCC Releases Report on Large Banks' Debanking Activities," News Release 2026-90

Clarity Act stalls in the Senate and agencies carry digital-asset rulemaking; community bank survey shows split interest in stablecoins

CoinDesk reported on October 11 that the Digital Asset Market Clarity Act did not advance in the Senate. The article cites divisions over ethics provisions and a dispute with community banks over stablecoin yield. It lists agency actions now filling the gap: the SEC's five-year innovation exemption for tokenized stock trading (September 17), the CFTC's request for comment on retail digital-asset trading rules (October 5), and the SEC's October 1 custody proposal. A William & Mary law professor argued that only Congress can supply a durable framework, because agency action can be reversed.

In a note reported by The Block on October 22, JPMorgan analysts led by Nikolaos Panigirtzoglou said agency actions partly offset the Senate's failure to advance the Clarity Act, that political and legal risks remain until Congress passes a market structure law, and that the Act is unlikely to pass this year and may return in 2027. They warned that the current patchwork "could be overturned in as soon as two years, if a Democrat wins the White House," and said charters, once granted, tend to be difficult to unwind in practice. The note also cites the ICBA's suit against the OCC and the Financial Accounting Standards Board's consideration of letting companies classify certain stablecoins as cash equivalents, with comments due November 19.

The SEC's proposal would let state trust companies serve as custodians for client and regulated fund digital assets and would permit self-custody under certain circumstances. It was published in the Federal Register on October 6, and comments are due December 7, 2026.

ABA Banking Journal reported on October 6 on the Conference of State Bank Supervisors' 2026 community bank survey. Eighteen percent of community bankers plan to offer tokenized deposits within 12 months, and 16% plan stablecoin solutions. About 4% offer tokenized deposits today and half of those plan to exit within a year; about 3% offer stablecoin solutions and two-thirds of those plan to exit. Over the longer term, 50% have no plans, 37% would participate through their core providers, 12% would partner with existing issuers and 2% would provide custody. Sixty percent expect a moderate or significant effect on deposit erosion, and 16% see moderate or significant revenue and fee opportunities. More than a quarter are dissatisfied with their core providers.

For banks: Custody eligibility and trading rules are currently set in agency proposals, each with its own comment period, and proposals can be changed or withdrawn before they become final. The JPMorgan note is an analyst view, not a regulatory finding. The survey measures stated plans, and the exit figures show that some early offerings have been discontinued.

Sources: CoinDesk, "Crypto executives see upside in Clarity's failure, but legal experts warn uncertainty will persist" | SEC, Proposed Rule S7-2026-35, Adviser and Regulated Fund Custody Rules | The Block, "JPMorgan says crypto regulatory moves partly offset Clarity Act failure, but risks remain" | ABA Banking Journal, "New survey probes community banks' plans for digital assets"

Standard Chartered agrees to acquire Zodia Custody; JPMorgan deploys JPM Coin on Ethereum; Mastercard releases Stablecoin Security; HSBC launches a Hong Kong dollar stablecoin

On October 21 Standard Chartered announced definitive agreements to acquire 100% of Zodia Custody Limited, the parent of regulated custody entities in Singapore, Hong Kong, Australia, the United Arab Emirates and Luxembourg. Completion is subject to regulatory approvals and customary closing conditions, and financial terms were not disclosed. Before completion, Zodia's digital asset software and professional services business will move to a new independent entity, Zodia Solutions, under SC Ventures. Afterward Zodia's regulated custody business will be integrated into Standard Chartered's custody activities within Securities Services, and the announcement says existing clients will continue to be serviced as usual.

On October 19 JPMorgan deployed JPM Coin, its dollar deposit token, on Ethereum mainnet and made it available to institutional clients, CoinDesk reported. The token launched on Base in November 2025. JPMorgan said it chose Ethereum for its liquidity and existing institutional use. Emma Landriault, head of Kinexys Labs, said in a statement: "Issuing JPM Coin first on Base and now on Ethereum is a meaningful step."

Also on October 19, at Money20/20 USA in Las Vegas, Mastercard announced Stablecoin Security, which combines payment and blockchain data to check transaction context, source of funds, exposure to restricted parties and scam indicators, and produces a risk score before a payment completes. It is delivered through an API that connects to existing fraud, compliance and case management workflows. Borderless.xyz and Keyrails are the first partners. The service launches first in North America, with worldwide commercial availability expected in 2027.

On October 23 HSBC launched RedCoin (RCHKD), its first Hong Kong dollar stablecoin, to retail users through its PayMe app, The Block reported. Users can activate a stablecoin wallet for peer-to-peer transfers and payments at more than 100,000 merchants. The Hong Kong Monetary Authority issued its first stablecoin licenses, to HSBC and Anchorpoint Financial, in April 2026. John O'Neill, HSBC's managing director for digital assets and currencies, said the bank plans more products, including wholesale corporate and institutional uses.

For banks: The Standard Chartered transaction is subject to regulatory approvals, and Zodia's custody entities operate outside the United States. The JPM Coin deployment is available to institutional clients, and the reports do not describe usage volumes. Mastercard's service is described as launching first in North America, with no bank customers named. HSBC's stablecoin operates under a Hong Kong license and is outside the U.S. framework.

Sources: Standard Chartered announcement, via FX News Group | CoinDesk, "JPM Coin, JPMorgan's token for dollar deposits, is coming to Ethereum" | Mastercard, "Mastercard brings risk intelligence to stablecoin payments" | The Block, "HSBC rolls out its first HKD stablecoin RedCoin to retail users"

Sui announces Hashi, a bitcoin-collateral lending protocol; lenders describe how borrowers use bitcoin-backed loans

CoinDesk reported on October 9 that Sui is launching Hashi, an institutional protocol that lets bitcoin holders borrow against BTC locked in a vault on the Bitcoin network secured by a 2-of-2 multisig, with a one-to-one voucher token (hBTC) used on Sui. More than 20 partners have made $500 million in capital commitments, which are commitments and not immediate deposits. Anchorage Digital is a day-one partner and plans to supply stablecoin liquidity. Mainnet is to roll out in phases, with the first phase slated for later in October.

CoinDesk reported on October 8 that lenders SALT and Ledn say borrowers increasingly use bitcoin-backed loans for tuition, emergency costs, business cash flow and large purchases without selling their BTC. Ledn has funded more than $11 billion in loans. SALT now sees institutional borrowers and is aiming at longer fixed-rate terms, and Ledn expects collateral lending to expand to gold.

For banks: Bitcoin-collateral credit is being offered by non-bank lenders and protocols, one with a chartered custodian as a participant. The sources do not address regulatory treatment, and the $500 million figure is a set of commitments that the source does not describe as funded loans.

Sources: CoinDesk, "New tech to power bitcoin lending is set to debut with $500 million in commitments" | CoinDesk, "Bitcoin loans are paying for tuition and working capital, not just trades, lenders say"

What to Watch

• OCC stablecoin applications. The rule takes effect January 18, 2027. The application forms are under 30-day OMB review, with comments due November 23, and the OCC says it will announce by press release when it begins accepting applications and waiver requests. (OCC News Release 2026-92; Federal Register notice, October 23)
• Treasury and Fed GENIUS Act rules. Treasury's comment period closed October 19 and no final rule date has been reported. Comments on the Federal Reserve's two proposals are due November 30. (The Block)
• FASB stablecoin comments. Comments on the Financial Accounting Standards Board's consideration of cash-equivalent treatment for certain stablecoins are due November 19, according to the JPMorgan note. (The Block)
• SEC custody comments. Comments on the adviser and fund custody proposal are due December 7, 2026. (SEC)
• ICBA v. OCC. No schedule had been reported in the coverage reviewed, and American Banker notes that trial and appeals could take years. (American Banker)
• ESMA stablecoin window. The European Securities and Markets Authority told authorized EU platforms to stop offering stablecoins without MiCA authorization and to resolve remaining holdings within three months of publication, which CoinDesk counts as January 8, 2027. (CoinDesk)
• Coinme settlement. Thirty-four state financial regulators settled with Coinme for $2.5 million over bitcoin ATM compliance, with a further $4 million penalty if kiosks stay open in participating states and an independent compliance consultant required. (ABA Banking Journal)
• Finzly. American Banker reported on October 20 that an extortion group says it stole Finzly access keys and threatened to publish them on October 23 at 8:20 p.m. ET. Finzly said it is operational and investigating and had not said whether credentials were taken. The reviewed coverage as of October 26 includes no report on whether the keys were released and no further Finzly statement. (American Banker)
• Hashi mainnet and 2027 timelines. Hashi's first mainnet phase was slated for later in October. Morgan Stanley's Amy Oldenburg told The Block on October 12 that the firm now sees support for tokenized equities on its alternative trading system as more realistic for the first quarter of 2027, later than the second half of 2026 she indicated in March. (The Block)

Looking to integrate bitcoin and stablecoin products into your financial institution? Learn how at galoy.io. Track developments between issues on the Regulatory Radar.