Banks Want the OCC to Test Risk Controls at Nonbank Stablecoin Issuers

The first comment period on the Office of the Comptroller of the Currency’s proposed application forms for payment stablecoin issuers closed on Friday, Sept. 25, and banks used the filing window to ask for a harder look at nonbank applicants. For high-risk payment players, the point is simple: if you want to issue stablecoins, the review should cover governance, cybersecurity, operational resilience and what happens after launch, not just the paperwork on day one.

1. The July 27 OCC notice laid out the information prospective issuers would need to submit under the GENIUS Act, including business plans, financial condition, management, reserves, redemption policies and risk management programs.
2. Traditional financial institutions — through the Bank Policy Institute, American Bankers Association, Consumer Bankers Association and Independent Community Bankers of America — said in a joint letter on Friday that the OCC should expand its review for applicants that are not subsidiaries of insured depository institutions (IDIs).
3. The groups want non-IDI applicants to demonstrate the adequacy of their governance, risk management procedures, operational resilience, cybersecurity practices and recovery planning. In other words, if a nonbank wants the same issuance privilege, banks want the regulator to check whether its controls look like a payment institution’s, not a pitch deck’s.
4. The banks also want the OCC to look beyond the application itself and into post-launch compliance. Their letter says a nonbank applicant should show it can comply with applicable law, including federal consumer protection laws, and calls for regular examinations where appropriate to cover compliance and related risk management.
5. The argument, as the letter frames it, is that nonbank applicants are operating under different regulatory structures and “may not be subject to the same robust federal prudential framework to which every IDI is subject.” That would extend the OCC’s assessment from whether the issuer has adequate operational controls to how it manages its obligations to stablecoin users once it is live.

The second 30-day comment period gives the industry another chance to respond. For PSPs, banks and other stablecoin-adjacent firms, the useful read is that the application process is already being fought over as a proxy for how much ongoing supervision nonbank issuers will face after approval.