Rules and risks

How the rules work

US federal law. The GENIUS Act was signed on July 18, 2025 and takes effect on January 18, 2027, or 120 days after final rules if those come sooner. As of October 13, 2026 every agency rule is a proposal (Treasury's September 30 interim rule only covers certifying state regimes), and the OCC's promised November final rule wouldn't move the date. Only permitted issuers may issue: subsidiaries of insured banks, nonbanks licensed by the OCC, and state-licensed issuers with up to $10 billion outstanding. Reserves must be cash, deposits, Treasury bills of 93 days or less, repo or government money market funds. Issuers must redeem within two business days, publish monthly reserve reports, pay no interest, and be able to freeze, seize or burn coins under a lawful order; holders come first on the reserves if the issuer fails. From July 18, 2028, exchanges may offer only permitted coins or qualifying foreign ones. One open point for B2B: Treasury's proposal exempts transfers between individuals and through self-custody wallets, and it's unclear whether one business paying another wallet to wallet fits.

US states and banks. Ramps, custodians and payout firms still need state money transmitter licences or New York's BitLicense, and California's crypto licensing law went live on July 1, 2026. The market-structure bill, CLARITY, which would ban interest-like rewards on idle balances, failed a Senate procedural vote 49-50 on September 15, 2026. Bank regulators opened the door to crypto custody and network fees in 2025, and the FDIC's April 2026 proposal says reserves held at a bank aren't insured through to coin holders, while tokenized deposits are insured like any deposit.

The EU. MiCA has applied to stablecoins since June 30, 2024: redemption at par at any time, no interest, at least 30% of reserves in bank deposits. A coin in another currency used for payments in the euro area above about 1 million transactions and €200 million a day must stop being issued. Binance delisted USDT from EU spot trading on March 31, 2025, and the transition for crypto firms ended on July 1, 2026. The EU's Travel Rule has no threshold, with an ownership check on self-hosted wallets above €1,000. Circle's MiCA policy, updated September 15, 2026, lets it defer redemptions in a "Stress Event" if it can't move reserves between its French and US entities.

Elsewhere. The UK's regime starts October 25, 2027, Hong Kong licensed HSBC and a Standard Chartered joint venture as issuers on April 10, 2026, and Canada's regulations are expected in 2027. Brazil has treated stablecoin payments abroad as FX operations since February 2, 2026, and from October 1, 2026 bars eFX providers from settling in stablecoins, the biggest single rule for US-to-Brazil flows. In the UAE, foreign-currency tokens can't pay for goods priced in dirhams.

Sanctions. OFAC's lists now include wallet addresses, so screening covers addresses and their history as well as names; Tether froze about $475 million of USDT on Iran's central bank wallets after OFAC listed them in April and July 2026. The Travel Rule applies from $3,000 in the US and CAD 1,000 in Canada. FATF, the global anti-money-laundering standard setter, found in July 2026 that almost half of the jurisdictions with Travel Rule laws had taken no supervisory action.

Accounting and tax. FASB's August 18, 2026 proposal (comments to November 19) would let a stablecoin count as a cash equivalent when the holder can redeem it on demand directly with the issuer, against reserves of cash and short Treasury bills; a company that can only sell through an exchange may not qualify. Under IFRS, KPMG reads a coin without a contractual redemption right as an intangible or inventory. In the US every receipt and disposal of a digital asset is a tax event, with a $10,000 de minimis for qualifying stablecoins on brokers' Form 1099-DA; a House bill to ease this, marked up on September 16, 2026, isn't law.

What mistakes cost

Let's say a US distributor sends $50,000 of USDC to a supplier's "new address" from an email that was an attacker's. On my reading of the terms:

• The loss: all $50,000, the moment the transfer confirms. Circle's terms say it "bears no responsibility".
• The way back: an issuer freeze if the coins haven't moved on, which needs speed and usually an order, or law enforcement.
• Insurance: custody policies are written for the custodian, and commonly exclude price loss (so a depeg), compromised credentials and regulatory seizure (so a freeze).
• What prevention costs: an allowlist, a call to a known contact and a $1 test payment.

A failed middleman costs more. When Prime Trust, a Nevada trust company that fintechs used as a custodian and ramp, collapsed in 2023, the state regulator said it owed customers $85.7 million in dollars against about $3 million of cash.

The enforcement record, dated:

Incidents land on whoever holds the coin. When $3.3 billion of Circle's reserves was stuck at Silicon Valley Bank in March 2023, USDC fell to about 87-90 cents; holders who sold took the loss, and those who waited were made whole. When Bybit, an exchange, lost about $1.5 billion in February 2025 to a signing screen that hid a malicious change, the exchange covered its clients.

The costliest mistakes so far are anti-money-laundering failures at intermediaries and misstatements about reserves at issuers. I found no US penalty against a crypto firm in 2026 through October 13.