The most consequential line in the OCC's final rule on payment stablecoins is a line that does not appear in it. The "presumption of violation" clause โ the provision that, at the proposal stage, would have categorically constrained the commercial arrangements between issuers and the third parties who distribute, custody, and settle for them โ has been removed. What remains is not a softer rule. It is a different species of rule: case-by-case evaluation, enforced after the fact, at the discretion of the examiner.
Count what the final text, as reported, actually finalizes. Reserve duration limits: absent. Redemption latency, T+0 versus T+1: absent. Liquidity coverage ratio: absent. Custody concentration caps: absent. Attestation frequency: absent. A final rule that establishes an entire federal category without publishing a single binding quantitative threshold is not a finished product. It is a chassis with the engine bay empty โ and the market is already pricing the car as if it drives. Code compiles, but context reveals the exploit.
I have watched a document look complete and be hollow before. In late 2017 I reviewed the initial smart-contract logic for an ERC-20 token launch and found three arithmetic overflow vulnerabilities in its voting mechanism with a short Python script. The whitepaper was polished. The token price ran 400% while my report sat unread. Three months later the project was drained through those exact flaws. The lesson was never that I was right. The lesson was that a document can pass inspection at the surface and be structurally empty at the load-bearing joint, and the empty joint is precisely where the money exits. The OCC's stablecoin framework is the most important regulatory document in this industry's short life, and I am going to read it the way I read that whitepaper: not for what it announces, but for what it fails to specify.
The GENIUS Act, signed in 2025, did the easy thing: it created a category. Payment stablecoins โ fiat-redeemable liabilities issued against reserves โ would no longer be adjudicated under a securities framework that was never designed for them, nor under the enforcement-first posture that defined the prior decade of U.S. crypto policy. The hard thing was always going to be the operational rule set: who may issue, what must back the issuance, how fast redemption must clear, who may hold the reserves, and what happens when an issuer and its distribution channel get too close. That is the work the OCC has now completed first among the federal regulators, crossing from proposal to final rule, leaving the public comment phase behind.
The occasion matters because of sequence. U.S. stablecoin supervision is a multi-agency architecture, not a single regulator. The OCC governs national banks, federal savings associations, and โ under this rule โ federally licensed nonbank issuers. The Federal Reserve governs bank holding companies and the payment system plumbing. The FDIC governs deposit insurance and resolution. The NCUA governs credit unions. Treasury and FinCEN govern anti-money-laundering and sanctions compliance. OFAC governs the lists. State regulators govern the chartering of nonbank money transmitters. The OCC finishing first is a real signal, but it is a signal about one node in a network, not about the network being live. The effective date reported is January 18, 2027. Before that date has any operational meaning, the other nodes have to publish, and they have not.
The deletion is the story, and it deserves to be read as an economic event rather than a legal footnote. The presumption-of-violation clause, had it survived, would have functioned as an ex-ante ban on a class of arrangements: reserve assets parked with a third-party custodian, revenue-sharing between issuer and distributor, white-label issuance where one entity manufactures the token and another brands and sells it. Those are not exotic structures. They are the default commercial grammar of the industry. Removing the clause moves the regulator's instrument from the drafting table to the examiner's desk โ from "this structure is prohibited" to "this structure will be assessed, and possibly pursued." The trade is legal certainty for business-model flexibility, and like every such trade, it is paid for in a currency the counterparty does not control: discretion.
That is the first thing the market has mispriced. A rule that forbids is predictable; you read the text and you know your exposure. A rule that reserves judgment is not predictable, because the binding constraint is no longer the statute but the enforcement history that has not yet been written. For a due-diligence analyst, the distinction is not academic. When I built the compliance mapping for a Portuguese crypto-asset service provider ahead of MiCA in 2025, the constraint that actually governed the build was never the high-level obligation โ it was the annex. The statute said "monitor transactions." The annex said which fields, at what granularity, retained for how long. We found gaps in their KYC and AML algorithms that, on a strict reading of the annex, would have produced a fine in the eight figures. We closed them because the annex was specific enough to test against. A principles-based rule with an enforcement backstop is testable only after someone has been made an example of. Until the first enforcement action lands, every issuer is guessing at the examiner's threshold, and guessing is a cost.
Now the second structural fact: the rule opens two doors, not one. It provides a pathway for bank institutions and, separately, for non-bank institutions to conduct stablecoin payment business. The bank door is unsurprising. The non-bank door is the one that reorganizes the industry, because it creates the institutional space for a federally licensed non-bank issuer โ a charter that does not require a bank balance sheet, a deposit franchise, or the capital regime that comes with them. I want to be precise about confidence here: the source material does not use the term "federal qualified payment stablecoin issuer," so the specific label is my inference from the institutional logic, not a quotation. But the logic is not subtle. If you build a non-bank pathway into a final rule, you are building it for the entities that have been issuing stablecoins without a bank charter for a decade and would very much like a federal one.
The bank and non-bank pathways are not symmetric, and the asymmetry is where the lobbying pressure will concentrate. A bank issuer enters with deposit-gathering infrastructure, existing supervision, and access to the payment rails. A non-bank issuer enters with distribution, product velocity, and none of the prudential apparatus. If the reserve, custody, and attestation standards are calibrated to the bank, the non-bank door is decorative. If they are calibrated to the non-bank, the bank door is redundant. The rule, as reported, does not tell us which calibration it chose โ because it does not publish the calibration.
And then there is the clause that will decide the global market and got the least attention: the standards for foreign stablecoin issuers. This is the gate through which the largest stablecoin in the world โ an offshore issuance with a market capitalization that has led the category for years โ either enters the U.S. market compliant or does not enter it at all. The source material confirms the standards exist and says nothing about their content. That silence is the single most expensive information gap in the entire document. Three questions resolve it, and none of them is answered. Does compliance require reserves to be held in U.S. custody? Does it require a finding of equivalent home-country supervision? Does it require a full audit rather than an attestation? Each of those three levers, pulled to its maximum, converts a foreign-issuer standard into a de facto market-access barrier, and the resulting redistribution of stablecoin share is not a rounding error โ it is the whole board.
I have run this comparative exercise before, in a different panic. After TerraUSD failed in May 2022, I spent weeks auditing competing algorithmic designs against Terra's collapse, and I produced a fifty-page comparison of Frax's partial-collateralization model against the failure it was being measured against. The finding that mattered was not that Frax was safer. It was that Frax's stability depended on market confidence in a way that hard collateral did not, and that this dependence was invisible in the headline collateralization ratio. A framework that tells you the reserve exists but not where it sits, who controls it, how fast it liquidates, and who can reach it in a resolution is a ratio without a denominator. The OCC rule, as reported, gives us the reserve requirement and withholds the resolution mechanics. That is the Terra lesson unlearned at the federal level.
The custody standard deserves its own paragraph, because its existence โ as a discrete provision rather than a sub-clause โ is the tell. A regulator that cared only about issuance would say "hold reserves." A regulator that writes a separate custody standard is telling you it has moved its attention from the liability to the asset, and specifically to the question of control. Who physically holds the reserve? Is it segregated? Does bankruptcy remoteness survive the issuer's failure? The answer to that last question was written in March 2023, when a portion of a major stablecoin's reserves sat at a bank that failed and the token traded below par for a weekend. The custody standard is the regulator's response to that weekend. It is also the provision that determines whether regulated banks become the toll booth of the stablecoin economy โ and if they do, the banking lobby's opposition to stablecoins softens, because the toll booth is a better business than the deposit it is losing.
That brings us to the economics, which is where this rule will actually be fought. A payment stablecoin is a fully elastic supply of fiat-redeemable liabilities, backed one-to-one by reserves, with no hard cap. The reserves earn the risk-free rate. The issuer is prohibited from paying interest or yield to holders. Therefore the reserve yield accrues, by default, to the issuer's balance sheet. In a high-rate environment that is an extraordinarily profitable structure: you are, functionally, a licensed intermediary between the Treasury market and a demand-deposit-like liability, and you keep the coupon. This is not a Ponzi, and I want to be exact about why, because the distinction is the one thing the bulls have right. The yield is real. It comes from short-duration government paper, not from the next buyer's deposit. The structural risk here is not insolvency-by-recruitment; it is regulatory arbitrage by design โ a deposit substitute that pays no deposit insurance premium, holds no reserve requirement, and answers to no interest-rate ceiling.
The interest prohibition is where the rule is deliberately unfinished. The statute bars the issuer from paying yield. It does not fully bar the platform โ the exchange, the wallet, the distributor โ from offering rewards. That gap is the entire controversy, and the banking industry has correctly identified it as the threat. If a platform can subsidize a reward out of its distribution margin, the user experiences a yield-bearing dollar that is not a bank deposit and is not insured as one. The banks are not afraid of the word "reward." They are afraid of an uninsured deposit substitute that competes for the same dollar at a better rate, and they are right to be.
But note what the rule does with that fear: it declines to resolve it. It leaves the boundary between "reward" and "economically equivalent interest" to be drawn case by case, under enforcement discretion. That is not a compromise; it is a deferral with a deterrent attached. The rational response from a compliance department is not to test the boundary but to stay well inside it โ a chilling effect that will suppress reward programs across the board, including ones that would have been lawful. The market will read that suppression as the absence of demand. It will actually be the absence of permission. That misreading is the second thing the market has mispriced.
So who captures the value? First, the issuer, unambiguously, as long as the yield stays on its side of the line. Second, the distribution channel, whose bargaining power rises precisely because the presumption-of-violation clause is gone โ the revenue-share arrangement between issuer and distributor now has more room to exist, and the platform's own reward programs are not prohibited outright. Third, and negatively, the deposit franchise of the banking sector. The squeezed party is the one whose product is a zero-rate demand deposit competing against a reward-bearing token, in an environment where the bank cannot raise its rate without repricing its entire book. The rule does not resolve the central economic question of stablecoins โ whether a dollar can bear a yield and remain a dollar. It moves that question twelve to twenty-four months into the future, where it will be repriced all at once.
Now the gap that should worry anyone holding a stablecoin balance through the transition. The framework is multi-agency and only one agency has finished. The OCC covers its supervised institutions. It does not cover the AML and sanctions obligations that FinCEN and OFAC will impose, the resolution mechanics the FDIC will demand, the holding-company supervision the Fed will apply, or the state-level chartering that non-bank issuers will still navigate. A January 2027 effective date on one node of a five-node network is not a launch date. It is the date the first node becomes testable, and the test will run against rules that do not yet exist. Any issuer that treats that date as the finish line is building to a specification that is still being drafted in four other buildings.
The transition mechanics are also unpublished, and their absence is itself informative. A final rule with a two-year runway almost certainly contains grandfathering or transitional provisions โ otherwise the runway has no operational content, because no existing issuer could comply on day one. I am inferring that, and I flag the inference: the source material does not describe them. But the logic is hard to escape. If you set a date two years out, you are either granting a transition or you are scheduling a cliff. A regulator that schedules a cliff does not call it a final rule; it calls it a warning.
Here is where I part company with the consensus bearish read, because the deletion is not merely a concession โ it is the correct institutional choice, and the people who wanted the presumption kept were wrong about what it would have done. An ex-ante prohibition on issuer-third-party arrangements would have frozen a business model that is still forming. It would have banned white-label issuance, the arrangement in which one regulated entity manufactures the token and another brands and distributes it โ a structure that, done properly, spreads compliance cost across more issuers and lowers the fixed-cost barrier that currently pushes the market toward two or three giants. A rule that forbids structures before they exist does not prevent risk; it prevents competition, and it concentrates the market in the hands of whoever can afford the legal team to litigate the boundary. The deletion is, on balance, pro-competitive, and the bulls who cheered it are right for a reason they have not articulated: the barrier to entry just moved from the statute book to the examiner's calendar, and calendars are cheaper than statutes.
The contrarian corollary is that the missing numbers may not be an oversight at all. A regulator that wanted bank-grade prudential standards would have published the ratios. A regulator that published a category, a pathway, a custody standard, and an enforcement backstop โ and withheld the ratios โ has chosen principles-based supervision with a deterrent attached. Read that way, the absence of the annex is not a drafting failure. It is the policy. And it is a coherent policy: it lets the regulator calibrate to the issuer rather than to the average, and it preserves the option to tighten without reopening the rulemaking. The cost of that coherence is borne entirely by the regulated, who must now price a discretion they cannot model. Code compiles, but context reveals the exploit โ and here the context is a blank page that the examiner fills in later.
There is a final structural consequence that almost no one is pricing. This rule does not regulate stablecoins as they are used. It regulates stablecoins as they are issued, reserved, and redeemed. It says nothing about what happens when a compliant stablecoin enters a permissionless lending market, becomes collateral, and is recursively rehypothecated across protocols that have no charter, no examiner, and no reserve. That interface โ between the regulated liability and the unregulated use โ is the next battleground, and the rule has simply not drawn the line. The compliance layer is being built at the issuance end while the risk is migrating to the usage end, and the two ends do not share a supervisor. This is also why the RWA narrative continues to disappoint: tokenizing the reserve does not put the reserve on your chain, it puts a claim on a bank's balance sheet inside a wrapper your chain can read. The institutions do not need the public chain to hold the collateral. They need it to sell you the exposure.
I will say what a due-diligence analyst is paid to say. The single most useful thing you can do with this rule is not to trade it. It is to read the Federal Register version and count the numbers. If the quantitative thresholds appear in the final text โ duration limits on reserves, a redemption deadline in hours, a coverage ratio, a custody-concentration cap, an attestation cadence โ then this is a bank-grade framework wearing a principles-based coat, and the compliance cost will consolidate the market toward the issuers who can carry it. If they do not appear, then the framework is a license to operate plus a promise to behave, and the real rule will be written by the first enforcement action, not by the OCC. Either way, the paragraph that matters is the one that is not in the press release. The deletion tells you the regulator's philosophy. The missing annex tells you the regulator's leverage. You need both to price the asset.
The date to watch is not January 18, 2027. The date to watch is the day the first issuer is pursued for a structure the rule permitted but the examiner did not. On that day, the boundary that the text declined to draw will be drawn, and every revenue-share agreement, every white-label arrangement, every reward program in the industry will reprice against a single precedent. The question worth asking is not whether the OCC finished first. It is whether, when the other four agencies finish, the map they draw still resembles the one the first mover published โ or whether the industry spent two years building to a specification that only one regulator ever intended to enforce.