The rules came first: banking and digital assets, January through October 2026

How many federal and state actions does it take to change what a bank can assume about digital assets? The Regulatory Radar on galoy.io holds 155 dated actions for 2026 so far, from January 1 through October 8, and 137 of them address digital assets in banking directly. Of the 155, the OCC accounts for 36, the SEC for 27, the CFTC for 16 and the Federal Reserve for 13. September alone logged 21.

I run marketing at Galoy, and part of that job is reading these documents and then explaining them to people who run banks. This post is the long version of that exercise: what happened this year, in order, what it adds up to, and what it means for community banks and credit unions. It ends with my read on where the bottleneck sits now.

January to March: the definitions got written

The year opened with the OCC clarifying its national trust bank chartering rule (Bulletin 2026-1, January 8). On January 12 the Senate Banking Committee released the Digital Asset Market Clarity Act text (committee release). Over the next ten weeks the agencies produced most of the vocabulary that the rest of the year depends on.

The NCUA proposed a rule on February 11 for credit unions that want to issue permitted payment stablecoins (NCUA announcement). The Federal Reserve proposed eliminating reputation risk from bank supervision on February 23 (BCREG20260223a), and the OCC proposed its GENIUS Act rule for permitted payment stablecoin issuers two days later (Bulletin 2026-3). On March 5 the agencies issued interagency guidance on the capital treatment of tokenized securities (FDIC release).

March 11 brought a memorandum of understanding between the SEC and CFTC (SEC release 2026-26). Six days later the SEC published its token taxonomy (release 2026-30), with the CFTC joining the interpretation and naming 16 digital commodities. A bank compliance officer reading those two documents had an agency answer to the question of which side of the securities line a given token sits on.

April to June: the charters arrived

The OCC conditionally approved Coinbase's national trust charter on April 2 (OCC licensing page). The FDIC approved its GENIUS Act proposal on April 7 (press release), and the Fed, OCC and FDIC finalized a rule on April 23 that lowers the community bank leverage ratio from 9 percent to 8 percent (Federal Reserve release). The leverage ratio rule says nothing about digital assets, but it is capital relief for the smallest institutions, which are the readers of this post, and it landed in the same quarter as the trust charters. Earlier that month, on April 10, the OCC and FDIC finalized a joint rule prohibiting examiners from using reputation risk (OCC Bulletin 2026-12).

May was dense. The Senate Banking Committee advanced the Clarity Act 15-9 on May 14 (committee release). A May 19 executive order directed federal agencies, including the Fed, to review digital-asset firms' access to payment rails (CoinDesk), and the Fed formally proposed limited-purpose "skinny" master accounts the next day (CoinDesk). The same day Minnesota enacted HF 3709, which gives banks and credit unions explicit statutory authority to custody virtual currency, effective August 1 (Bitcoin Magazine). On May 27 United Texas Bank, a Dallas community bank, completed its conversion to a national charter to pursue digital-asset correspondent banking (CoinDesk).

In June, FHFA's digital-asset directive produced the first Fannie Mae-backed mortgage collateralized by Bitcoin (Bitcoin Magazine). The OCC conditionally approved a Morgan Stanley digital-asset trust charter on June 18 (Banking Dive).

July to October: deadlines slipped and the work continued

Circle received final OCC approval for a national trust on July 10 (Circle). Eight days later the GENIUS Act's one-year deadline for final rules passed with none issued (The Block). The OCC denied Wise US a trust charter on July 21, citing AML and counter-terrorist-financing deficiencies (Corporate Decision #1381). In a year of approvals, the denial shows that an application can still fail on AML grounds.

August set the schedule for the fall. The FDIC adopted a two-phase deposit insurance process with a contingent decision within 120 days (American Banker). On August 18 Treasury proposed its issuance, offer and sale rule (FR Doc. 2026-16796) and the SEC proposed Regulation Crypto Assets (release 2026-76). The next day Comptroller Gould committed to a November final rule for stablecoin issuers (The Block). On August 27 the OCC and FDIC finalized a rule defining "unsafe or unsound practice" and refocusing supervision on material financial risk, effective November 2 (OCC Bulletin 2026-40).

September tied July as the busiest month on the Radar, with 21 entries each. The OCC granted OpenReserve Bank and Revolut Bank US preliminary conditional approvals for national bank charters on September 2 (CD 1389, CD 1390), released its approval of a stablecoin-issuing subsidiary of SoFi Bank the next day (CD 1388), and conditionally approved Bastion, Agora and Catena as national trust banks on September 18 (American Banker). The four agencies proposed principles-based third-party risk management guidance on September 11, with a companion statement on community banks and their core service providers (Federal Register). On September 15 the Senate voted 49-50 against cloture on the Clarity Act (American Banker). Two days later the SEC issued a five-year conditional exemption for tokenized securities venues (release 2026-90). On September 24 the Federal Reserve Board requested comment on two GENIUS Act proposals, one on reserves, capital and risk management for Board-supervised stablecoin issuers and one on the application process (Federal Reserve). Comments are due November 30 (Federal Register).

October began with the SEC proposing custody amendments that would let eligible state trust companies serve as custodians for investment advisers and regulated funds (release 2026-100). The ICBA sued the OCC the next day over its trust bank rule and an earlier interpretive letter (American Banker). The CFTC issued an advance notice on retail crypto asset transactions on October 5 (release 9307-26), and FinCEN withdrew its 2020 unhosted wallet proposal and its 2023 mixing proposal the same day (The Block).

What stayed the same when Congress stopped

The failed cloture vote drew the year's biggest headlines. The Clarity Act's bank permissibility provisions, covering lending against digital-asset collateral, node operation and direct holdings, went down with it (American Banker).

Most of the year's rules never depended on that bill. The Radar logs 32 proposed rules and requests for comment in 2026 against 16 legislative actions, and the GENIUS Act, which Congress did pass, supplies the statutory frame for most of the rules. Treasury, the Fed, the OCC, the FDIC, the NCUA and FinCEN each have a stablecoin proposal in the Federal Register. The SEC and CFTC are writing market structure through exemptions and rulemaking. Both market regulators said before the vote that they would keep going without it. CFTC Chairman Selig directed staff on August 20 to draft a market structure regime under existing authority (CoinDesk), and SEC Chair Atkins said on September 14 that the agency would keep writing rules if the bill stalled (CoinDesk).

The limit on that is real. Agency rules are easier to reverse than statute, and the ICBA lawsuit shows that the charter path itself is contested. By the ICBA's count in its October 2 suit, the OCC has approved or conditionally approved 21 national trust charters during this administration, 13 of them for digital-asset companies, and the ICBA argues that those approvals exceed the agency's authority under the National Bank Act. Legal experts quoted by American Banker expect the case to take years.

What the rules have in common

When I read the documents side by side, nearly every rule this year, whatever agency wrote it, ends in a records question.

The Fed's stablecoin proposal requires one-to-one reserve backing, segregation of customer assets by firms holding the reserves, and capital standards that a bank must evidence. The OCC, FDIC and FinCEN proposals set BSA, AML and sanctions compliance program standards for stablecoin issuers (FDIC, FinCEN and OFAC). The SEC's custody proposal would allow blockchain records to count toward compliance under conditions. The third-party risk guidance directs supervisory attention toward core arrangements that limit a bank's transparency or its ability to monitor a provider. Comptroller Gould's September 28 announcement of workday limits on examiner visits (American Banker), details still unpublished, raises the value of producing records quickly.

Each of those is a different agency asking, in different language, whether an institution can show how a balance came to be. Dallas Fed researchers added a macro version in August (CoinDesk), estimating that tokenized deposits could reduce bank capacity for long-term lending by $700 billion, which is a claim about where balances sit and who holds them. The common question is operational. It is answered by the system of record, which for a bank is the core.

What this means for community banks and credit unions

Entry costs and timelines moved. The OCC reported on August 11 that it had received 40 de novo applications in the previous 18 months, against 48 in the 14 years from 2011 through 2024 (PYMNTS). Nola Bank opened in New Orleans in September as the seventh de novo of 2026 (American Banker). The FDIC's two-phase process gives a qualified applicant a contingent decision within 120 days and up to 12 months to organize (ABA Banking Journal). A charter-stage bank now picks its technology inside a published timeline.

Capital and supervision moved too. The community bank leverage ratio fell to 8 percent. The "unsafe or unsound" rule takes effect November 2. The OCC and FDIC finalized their reputation-risk rule in April, and the Fed's version is still a proposal. The OCC has also said it will limit examiner time on site.

The deposit question is the live one for banks that are not building anything. The White House Council of Economic Advisers estimates that prohibiting stablecoin yield would add about $2.1 billion in bank lending, with community banks under $10 billion in assets accounting for roughly $500 million (CEA FAQ). Eight bank trade groups wrote Senate leaders on September 14 that a circuit breaker "that activates only after substantial deposit flight has already occurred is not a safeguard at all" (joint letter). The rewards question is unresolved. That is where I start with bankers: your depositors already own Bitcoin, and the question is whether those dollars sit on your balance sheet or on an exchange's.

Credit unions have a narrower set of facts. The NCUA's February 11 proposal covers credit union stablecoin issuers, and the comment period on its supplemental proposal closed July 17. Minnesota's law gives credit unions in that state explicit custody authority. The Clarity Act's section 401, which would have addressed federal credit union permissibility, stalled with the rest of the bill. Galoy published a brief on it in May, and that brief is now a record of what the statute would have done rather than what it will do.

What remains open is a list with dates. Comments on Treasury's issuance rule close October 19 and on Regulation Crypto Assets on October 20. The "unsafe or unsound" rule takes effect November 2, comments on the third-party risk guidance close November 16, and the Fed's GENIUS proposals close November 30. The OCC has committed to a November final rule, and FDIC Chairman Hill has said the FDIC is on track for year-end (ABA Banking Journal). I would watch the ICBA case and the first final GENIUS rule, because they decide how much of the charter path rests on interpretation.

Where the constraint moved

My own read is that the year changed what limits a community bank or credit union from acting on digital assets. In January the limit was regulatory ambiguity. Ten months later the agencies have published a token taxonomy, a capital treatment for tokenized securities, a steady run of charter decisions and a custody pathway for state trust companies, along with stablecoin proposals from the Fed, FDIC and OCC. Some of those are final and some are proposals with comment dates, so the uncertainty has not vanished. A good share of the limit now sits inside the institution, in whether its ledger can carry dollars, Bitcoin and stablecoins in one set of books with each balance's history attached, and whether it can produce the records an examiner asks for in the time an examiner now allows.

That is the problem Galoy is building toward. The Galoy Core is a core banking system in active development, designed around one double-entry ledger for dollars, euros, Bitcoin and stablecoins, where, in the language on our site, every balance carries its history. I believe community banks and credit unions are exactly where Bitcoin belongs, and the rules published this year give that sentence an operating basis.

The record is public and I have linked each item. If you want to check my math, the full archive is on the Regulatory Radar, and the next update will carry the November dates.

Dan