Fraud prevention combines rules, AI and behavioral analytics to stop scams, reduce false declines and keep automated decisions explainable through human review.
Itaú Unibanco, the largest private bank in Brazil, has formalized its role as a cryptocurrency service provider before the Central Bank of Brazil. The filing covers intermediation and custody of crypto assets, the same activities the regulator assigns to brokerage firms, according to local reports. The news arrives as the country’s crypto sector faces a compressed timeline to obtain licenses.
Itaú’s move places the bank inside a licensing framework that did not exist a year ago. Brazil’s central bank requires every company that holds, moves, or trades crypto for customers to register as a regulated provider. By filing, Itaú tells the market that it intends to be one of them.
For Brazilian users, the change matters most for custody. A provider that holds crypto for clients must keep those assets separate from the firm’s own money, meet minimum capital requirements, and follow the same governance and anti-money laundering standards that apply to securities brokers.
Clients of an authorized bank gain a clearer legal footing than clients of an unregulated app or an offshore exchange. For the bank, the filing is a commitment. A regulated crypto operation carries compliance costs, audit obligations, and reporting duties that smaller competitors may struggle to meet.
The move also signals that Brazil’s biggest lenders plan to keep crypto inside the domestic financial system rather than leave it to foreign platforms.
Itau’s embrace of bitcoin and crypto
Itaú’s crypto story started before the new rules. The bank announced plans for crypto custody in 2022, when it was building a tokenization platform. In late 2025, it began letting retail clients buy and sell bitcoin through its investment app, íon. The crypto assets traded on íon are held in custody by Itaú itself, which made the bank’s position an operational one long before it became a regulatory one.
The regulatory backdrop came in 2025 and early 2026, when the central bank published Resolutions 519, 520, and 521. They created a new license category called Sociedades Prestadoras de Serviços de Ativos Virtuais, or SPSAVs, and the rules took effect February 2, 2026.
The framework sorts providers into three categories: intermediaries, custodians, and brokers. It requires formal segregation of client and company assets, sets minimum capital levels, and extends the customer protection, governance, internal control, security, and anti-money laundering rules that already govern banks and brokers.
Resolution 521 brought crypto transactions into the foreign-exchange regime. Transfers with unauthorized counterparties face a $100,000 cap, which limits how crypto moves across borders outside regulated channels.
Companies already operating when the regime took effect had to file for authorization within a transition period.
That timing is why Itaú’s filing reads as a response to a pressure point, not a routine update.
Stricter standards follow. On July 1, 2026, the central bank approved tighter rules. Beginning in 2027, providers must meet financial security requirements similar to those for securities brokers and distributors.
The regulator also barred institutions in Segment 5, the simplified-rules category for smaller banks, from offering virtual asset services. That decision pushes crypto activity toward larger, better-capitalized players, the group Itaú belongs to.
Stablecoins accounted for 60% of crypto purchase value processed through Mercuryo’s on-ramp in H1 2026, up from 43% six months earlier. Meanwhile, accepted stablecoin off-ramp transactions grew 446% year on year, based on the company’s on-ramp report and off-ramp data.
These figures come from one provider, not the entire market. Still, they highlight something worth discussing: how money moves between bank accounts and crypto platforms.
If I were managing those flows for a business, I’d start with two questions. Which currencies are we moving, and where are our bank accounts? The answers help determine which payment routes make sense.
So, What Does Each Payment Route Actually Do?
A company with European partners, a Swiss bank account and international USD settlements might use several payment routes, even through the same crypto platform.
SEPA — for EUR transfers across Europe. It connects participating banks across the Single Euro Payments Area and supports euro transfers between eligible accounts.
SWIFT — for international bank transfers. A global financial messaging network used for cross-border payments in USD and other currencies. Costs and timing depend on the banks involved.
SIC — for Swiss franc transfers. Switzerland’s interbank clearing system handles CHF payments between participating financial institutions.
ZEN.COM — for local PLN payments. Unlike SIC, ZEN.COM is a payment provider rather than a clearing system. Its local PLN transfers use ELIXIR, with availability depending on the provider’s integration and customer eligibility.
Other routes, including ACH in the US and PIX in Brazil, become relevant when businesses need to serve customers in different markets.
Let’s Look at Three Different Business Scenarios
1. A Polish Fintech Needs Both EUR and PLN
Imagine a fintech in Warsaw receiving euros from European partners while paying local expenses in Polish zloty. It needs both currencies and a way to move funds into and out of crypto.
WhiteBIT On/Off-Ramp could be worth considering. It lists EUR transfers through SEPA and PLN through ZEN.COM within one crypto ecosystem.The fee for EUR deposits and withdrawals is a flat €5, while limits depend on KYB level and agreed conditions.
The service also lists USD via SWIFT and CHF via SIC, alongside TRY, GEL and AUD among its supported currencies. Routes for those additional currencies require separate confirmation.
For this fintech, having several fiat options in one place could simplify treasury operations. I’d first confirm which PLN transactions are available to its legal entity and whether the limits suit its volumes.
2. What If Your Wallet Serves Customers Across Different Markets?
Now imagine a wallet provider that wants customers to buy and sell crypto directly inside its app. Some users pay in EUR, others prefer cards or local payment systems. The company needs an integrated payment experience across its supported markets.
Kraken Ramp, also marketed as Payward Ramp, takes this approach. Its institutional offering lists 24+ payment methods, including SEPA, ACH, PIX, debit cards, Apple Pay and Google Pay. The service offers API and SDK integration, with payment processing, compliance and crypto conversion handled through Kraken’s infrastructure.
The attraction is the combination of local payment methods and embedded crypto access. However, supported methods differ by market, and the company would need to confirm which currencies, countries and transaction directions are available to its customers.
For this type of wallet, the integration experience matters alongside currency coverage. A payment method listed on a product page is useful, but the full customer journey — from funding to completed conversion — needs to work in the intended markets.
3. And What About Thousands of USD Payouts?
Imagine a US fintech where customers convert digital assets into dollars and withdraw funds to their bank accounts. With thousands of payouts, settlement speed and integration become important.
zerohash On & Off Ramp supports fiat-to-crypto and crypto-to-fiat conversions through ACH, RTP, SEPA and payment service providers. It also supports 100+ digital assets, with availability depending on the market and integration.
For this business, I’d check which USD payout methods are available, how returned payments are handled and whether prefunding is required. These details can make a big difference when customer withdrawals are part of everyday operations.
So, What Would I Check Before Choosing?
I wouldn’t rank these payment routes from best to worst. A longer currency list doesn’t necessarily mean a better setup, especially when availability depends on jurisdiction, account type and banking partners.
I’d start by checking three things: which currencies and payment methods are actually available, whether the money belongs to the business or its customers, and how much each completed transfer costs.
Processing times matter too. Domestic real-time payments may suit frequent customer withdrawals, while international transfers can work well for corporate treasury operations. Fees, conversion spreads and reconciliation requirements should all be part of the calculation.
Finance can map currencies and volumes, operations can verify settlement schedules, and compliance can confirm eligibility. Sometimes one provider will cover most needs, while other businesses may benefit from combining several services.
I’d rather check those details upfront than discover halfway through a transfer that the selected route doesn’t work as expected.
Disclaimer: This is not financial or investment advice. Do your own research before making any decisions. Use at your own risk.
Circle and ACI Worldwide plan a USDC settlement test in Colombia using ACI Connetic, exploring how stablecoins can work with existing banking infrastructure.
US banks are restricting third-party AI agents over concerns that automated tools could access accounts or initiate financial actions without clear customer control.
Everyone tells you to buy an ERC-20 token. Almost nobody tells you what that means or how it goes wrong.
I remember staring at Ethers can at around 1 a.m., refreshing the page like it would change something. Green checkmark. Transaction successful. And my tokens, about $400 worth [YOUR DETAIL: amount and year], sitting in a contract that had no idea what to do with them.
I wrote to support. I posted on Reddit. A kind stranger explained, politely, that the money was gone. Not lost, not delayed. Gone.
That night I realized I’d been buying and sending “ERC-20 tokens” for months without knowing what the term meant. So I went and learned. This is what I wish somebody had told me first.
Image Generated by ChatGpt
ERC-20 is just a set of rules
That’s all it is. No mystery.
In 2015, Fabian Vogelsteller and Vitalik Buterin put forward a proposal for how tokens on Ethereum should behave. Before then, every project built its tokens however it liked, and a wallet that supported one coin might choke on the next. Think of a drawer full of chargers that all almost fit.
The ERC-20 rules fixed it. If a token follows them, any wallet or exchange on Ethereum can handle it without special code. The rules are six functions and two events. Check a balance, send tokens, see the total supply. And one slightly scary pair, approve and transferFrom, which let someone else spend your tokens. Hold that thought, because it comes up again below.
The reason this mattered so much is that it made launching a token almost embarrassingly easy. You didn’t need your own blockchain anymore. A developer with a free afternoon could write a small contract, deploy it, and have a coin that showed up in MetaMask by dinner. That’s how we got the 2017 ICO craze, and honestly, a lot of garbage along with the good stuff.
Today the big names you probably already hold work this way. Tether and USD Coin on Ethereum, Chainlink, Uniswap. When people say “the crypto ecosystem,” a big chunk of it is just contracts following this one old rulebook.
The approve button
Now the part that actually costs people money.
When you swap on a decentralised exchange, your wallet asks you to approve a token. You click it. Everybody clicks it. I did for a year without thinking.
What you’ve done is give a smart contract permission to take tokens out of your wallet. And many apps ask for an unlimited amount by default, so you never have to approve again. Convenient. Also, a loose key under the doormat.
If that app gets exploited six months later, the attacker doesn’t need your password. The permission you gave is still sitting there. A lot of “my wallet got drained, and I didn’t do anything” stories are exactly this. They did do something. They clicked approve in March and forgot.
So I do three boring things now. I set a custom amount instead of unlimited when the wallet lets me. Every month or so I open Revoke. cash, look at the list of contracts I’ve approved, and cancel the ones I’m not using. And I keep a second wallet for experiments, so the one holding real savings never touches a sketchy site.
Ten minutes. Genuinely worth it.
Back to my $400
Here’s what happened to me, and it’s baked into the standard itself.
The transfer function in ERC-20 doesn’t check whether the receiver can handle tokens. It subtracts from your balance, adds to theirs, and moves on. If you send tokens to a regular wallet, fine. If you send them to a smart contract that wasn’t built to receive and return them, they sit there forever, because the contract has no function to send them back out.
Developers have complained about this for years. Over time, huge amounts of tokens have ended up stranded in contracts this way, and nobody can touch them. Newer standards like ERC-223 tried to patch it. They didn’t take over, because by then the whole industry was built around ERC-20. Wallets, exchanges, lending apps. Replacing it would be like trying to replace the QWERTY keyboard. Flawed, familiar, and not going anywhere.
There’s a cousin of my mistake that catches even more people: the wrong network. USDT exists on Ethereum, Tron, and other chains, and the addresses can look similar. Send it over the wrong network to an exchange that doesn’t support it and you can be in for a long, painful support ticket, or no recovery at all. Always check which network you’re sending on, and send a tiny test amount first. I know it feels silly. Do it anyway.
Before you buy any ERC-20 token
Here’s something that surprised me. Calling a token “ERC-20” says nothing about quality. Anyone can make one in a few minutes, for free, with no approval from anyone. A scam coin and a serious project use the same standard.
So I run a short check every time.
First, the contract address. Scammers copy the name and logo of real tokens, and fake versions pop up constantly. I get the address from the project’s official site or Coin Gecko, never from a reply under a tweet.
Second, who owns the supply? Etherscan has a holders tab. If three wallets own 80% of everything, those three can crash the price whenever they feel like it. Not always a scam, but it should make you think.
Third, whether the code is verified on Etherscan and whether a known firm audited it. An audit isn’t a guarantee. Plenty of audited projects have still been hacked. But a big project with neither? I walk away.
I’m not a financial advisor, and this isn’t financial advice. It’s just the checklist I wish I’d had at 1 a.m. staring at that checkmark.
What this taught me
I used to think crypto was either genius or fraud, depending on who was shouting. ERC-20 changed my mind a bit. It’s a tool. A clever, simple, slightly flawed tool that lets anyone create digital money without asking permission.
That freedom is the whole appeal, and it’s also exactly why nobody is going to save you when you slip. The code does what it says, not what you assumed it said. No one picks up the phone.
You don’t have to become a developer. You just have to know what you’re clicking, and slow down for a few seconds before you do.
I paid $400 to learn that. If this post saves you the tuition, good.
Have you ever been burned by an approval or a wrong-address transfer? Tell me in the comments. Somebody scrolling by might dodge the same hole.
What Web3 actually is, without the jargon, the cartoon monkeys or the “to the moon” nonsense.
Every time someone said “Web3,” I zoned out.
Wallets. Gas fees. DAOs. Every explanation came with three more explanations I hadn’t asked for, and the person explaining usually had a cartoon ape as their profile picture. Not a great look.
Then a friend who works in payments watched me nod along for the tenth time and said, “Stop thinking about the tech. Just ask who owns what.”
That’s it. That’s the whole thing. I wish someone had said it to me in 2021.
Image Generated by ChatGpt
Two internets down, one to go
Web1 was a library. You walked in, read something, walked out. Late 90s, early 2000s. Somebody built the page and you looked at it.
Web2 is the one you’re on now. You can post, comment, upload, sell, review. Instagram, YouTube, Amazon. And it’s great, genuinely. But somewhere along the way the deal changed. You make the stuff. They hold the keys.
Web3 is the idea that you could read, write and own. The last word is the one doing all the work.
Quick test
Think about something you’ve built online. A following, a channel, a gaming account you’ve put hundreds of hours into.
Who can switch it off?
Not you. I know people who’ve lost accounts to a wrong automated flag, then spent weeks pinging a support form that answered with a template. Weeks without income, waiting on a reply from something that isn’t even a person.
Web3 is a bet that this setup is a design choice, not a law of nature. What if your account and your money and your stuff were with you, and the apps just plugged in?
What’s under the hood
It sounds complicated and it mostly isn’t. Four pieces.
Blockchain. A shared record book. Thousands of computers each hold the same copy. Somebody writes “Priya sent Tom five euros,” every copy updates, done. To fake an entry you’d need to fool most of them simultaneously, which is why nobody needs a bank to vouch for the book.
Wallet. Your account, except no company holds it. You hold a private key. Think front door key. Lose it and there’s no locksmith and no “reset password” link. Some people hear that and feel free. Others feel sick. Both reactions make sense to me.
Token. A digital item recorded on a blockchain. Could be money, a ticket, a membership, a piece of art. It sits in your wallet, so nobody can quietly take it back.
Smart contract. A small program that runs on the blockchain and does what it was told. Payment lands, item gets released. No middleman. Which is lovely until the code has a bug, because then there’s nobody to phone.
NFTs, DeFi, DAOs, all the names you keep hearing: those are just these four stacked in different combinations.
Picture a musician
She uploads a track to a streaming platform. The platform decides what a play is worth. Money arrives weeks later, after the label and the distributor each take a bite. If the platform changes the rules, she adapts or leaves.
Now imagine the split is written into a smart contract. Each sale divides automatically between her, the producer and the co-writer, in the percentages they agreed to. Minutes, not months. Nobody emails anybody about a missing payment.
Is that real today? In small pockets, yes. Will it replace Spotify next year? No chance. But it shows you the shape of the idea, and once you see it it’s hard to unsee.
The scam part (I won’t skip it)
Skipping this is how people get hurt, so here goes.
Web3 has an ugly history. In 2021 and 2022 people paid silly money for NFT images, and most of those prices fell off a cliff. Loads of crypto projects were pure speculation. Some were just fraud. People lost savings, and that’s not a small thing.
My own view, and you’re free to disagree: the technology and the casino that grew around it are two different things. A lot of people came for the casino and called it Web3. The dot-com crash wiped out a pile of companies in 2000 and the internet is still around.
Still, I’m careful. My rules:
Guaranteed returns means a lie. Walk away.
Your seed phrase stays with you. No real support team will ever ask for it.
If I can’t say in one sentence how a project makes money, I don’t touch it.
Only money I could lose without crying. Dull advice. Still true.
Where it’s quietly going
Forget the memes. The serious work is in finance. Banks and institutions are testing tokenized assets, faster settlement and payments that carry their own rules. Cross-border transfers are slow and pricey today, and blockchain rails could change that. Central banks have been running experiments with digital versions of their currencies too.
Nobody tweets about settlement times. That’s partly why it’s easy to miss.
So, should you care?
Know it. Don’t obsess over it.
You don’t need to buy anything this week. You don’t need a wallet by Friday. But the question underneath all of this, who owns your digital life, isn’t going away. More of our work, money and identity moves online every year, and someone will answer that question with or without your input.
Knowing the basics is also just self-defence. The people who get burned are usually the ones who didn’t know what they were buying.
At a dinner party
If someone asks, try this: “It’s the idea of an internet where you own your accounts, your money and your stuff, instead of renting them from a few big companies.”
Bank of America. Citi. Goldman Sachs. UBS. Deutsche Bank. Santander. BBVA. MUFG. Wells Fargo. Fidelity. Names that compete on everything, lining up behind a single dollar token.
They did not announce a company name. Or a CEO. Or a blockchain. Or who owns what.
What they announced was the shape of the thing. One coin. Not twenty-one.
That choice is the real story, and almost nobody wrote about it.
Any one of these institutions could have shipped its own dollar token this quarter. They chose not to. Liquidity does not split twenty-one ways.
Why one bank consortium stablecoin instead of twenty-one competing ones?
Because a stablecoin is not a product. It is a network.
The market already ran this experiment, at full scale, with real money. As of 1 October 2026 there were 195 stablecoins from 152 issuers across 47 blockchains, about $300.9 billion in total supply, and 308.4 million holder addresses.
Eleven months from ten banks exploring to twenty-one committing. Still no company name.
It grew out of something smaller. In October 2025, ten global banks said they were exploring a reserve-backed digital payment asset on public blockchains. Eight of those ten are still in.
Read the verb carefully, though. They committed to form a company. Nothing has launched.
The GENIUS Act question nobody in the press release answers
Section 4 of the GENIUS Act is blunt. A permitted payment stablecoin issuer cannot pay the holder any form of interest or yield, in cash, tokens or anything else, purely for holding the token.
So picture the finished product in 2027.
A corporate treasury holds the consortium dollar. The reserves sitting behind it are earning in Treasury bills. The treasury holding the token earns zero.
Same dollar, same rulebook, two very different destinations for the yield.
That is not an oversight. Congress wrote it that way on purpose, so a payment token would not quietly turn into a competitor for bank funding.
There is already a well-worn workaround, and it is worth knowing about. Issuers cannot pay holders, but they can pay distribution partners, and nothing stops those partners from paying users.
Circle discloses that it passes a share of its reserve income to Coinbase. The money still reaches the end holder.
It just takes a detour through someone else’s balance sheet, and picks up someone else’s incentives on the way.
The consortium is building a very good dollar. It is not building a reason to hold one.
Here is the part that matters for anyone planning around 2027. The restriction names issuers. It does not name third parties. Which means the yield question does not disappear.
It just moves one layer out, to whoever is willing to put that capital to work and take responsibility for how.
Six of the twenty-one are hedging their bet, and that tells you plenty
Six consortium members, among them Citi, Bank of America, Wells Fargo, PNC, Santander and TD, are also backing The Clearing House’s shared tokenized deposit network. Seventeen institutions, announced in June, same H1 2027 target.
Two competing designs. Overlapping backers. Identical deadline.
Tokenized deposits stay inside the banking system as bank liabilities. A GENIUS stablecoin is a separate instrument with segregated reserves.
Nobody at that table knows which one wins, so several of them bought tickets to both.
And they are not the only ones racing:
Open USD, the Visa and Stripe-backed effort with around 140 companies behind it, has been live since July
Qivalis and the Eurøpe Consortium are chasing MiCA-compliant euro stablecoins
Almost everyone is building the issuance layer. Very few are building the layer underneath it.
Issuance is the easy half. Capital allocation is the hard half.
Ask anyone who has run a treasury desk. The hard question was never how to hold the dollar. It was always what the dollar is doing while you hold it.
Minting a fully backed token is an engineering problem with known answers.
Deciding where billions in collateral actually go, under limits anyone can audit, with a rate that holds up when conditions change, is a different kind of problem.
It is operational, it is continuous, and you cannot ship it once and walk away.
That second half is what Sky Ecosystem is built around.
They deploy it across diversified strategies. The revenue those deployments generate flows back to the protocol.
The allocators are operating businesses, not line items on a slide. Spark runs lending markets. Grove runs institutional credit.
Figures as shown on the Sky Ecosystem dashboard at the time of writing:
$14.15 billion in Protocol Collateral
$11.48 billion in stablecoin supply
Roughly $1.23 of collateral sitting behind every dollar in circulation
Overcollateralised and published in public. Both numbers are checkable on the dashboard right now.
You can check all three yourself. That is the point of publishing them.
Why sUSDS and the Sky Savings Rate sit on the other side of that gap
USDS is the base unit. Fully backed, converts 1:1, deep liquidity, no drama.
sUSDS is where the Sky Savings Rate lives. Hold sUSDS and the position accrues the governance-set rate programmatically. No lockups, no minimums, redeem back to USDS whenever you want.
The distinction worth holding onto: the rate is not a promise from an issuer. It is the output of an allocation network that has to keep working for the number to hold.
And institutions have started treating it that way.
What institutional adoption of a yield-generating stablecoin looks like in numbers, not adjectives.
The detail I keep coming back to: clients who post sUSDS against a loan keep accruing the Sky Savings Rate on the full position for as long as the loan runs. Collateral that does not go to sleep while it is pledged.
That relationship did not start there. Grove had already extended Galaxy a $500 million warehouse lending facility. Galaxy has since borrowed on Spark as well.
For context on the base underneath it: Sky Protocol entered Q3 2026 with $5.41 billion supplied through independent allocators and institutional tokenized funds, including anchor positions in BlackRock’s BUIDL and Janus Henderson’s JTRSY.
sUSDS supply closed Q2 2026 at $5.52 billion, up 149% year on year, on $107.35 million of Gross Protocol Revenue and $33.29 million of Protocol Surplus for the quarter.
What 2027 probably looks like
My guess is the consortium ships, roughly on time, and the coin is clean, compliant and boring in the best possible sense. Widely accepted, too. Twenty-one distribution networks is a serious advantage.
And on day one, its holders will start asking the question the GENIUS Act will not let the issuer answer.
If you are tracking this, watch the follow-on announcements rather than the launch. Which chain they pick. How custody is handled.
Whether the euro version slips. Those three will tell you more than any launch-day release.
By 2027 there will be no shortage of dollar tokens. There will be a shortage of places to put them.
So, back to the title.
Twenty-one separate bank stablecoins would have been twenty-one failures. One shared coin is the right call, and the people who made it know exactly why.
But a shared dollar with no allocation engine behind it is half a product. The other half already exists, it is already audited in public, and it is already on a Nasdaq-listed balance sheet.
Which half do you think decides 2027: who issues the dollar, or who puts it to work? I would genuinely like to be argued with in the comments.
If you take card payments, even five a day, read this before your bank emails you first.
The mistake is simple. You think your payment provider takes care of PCI DSS for you.
It doesn’t. Some of it, sure. But if your checkout page looks like most checkout pages, a big chunk of the responsibility is still sitting on your desk.
[Add two or three sentences of your own here. A time you or a client assumed “Stripe handles it” and found out otherwise. Real beats polished.]
I’ll get to the gap in a second. First, the title.
Image Generated by ChatGpt
Is it actually illegal?
Mostly no, and I’d rather say so now than have someone say it for me in the comments.
PCI DSS isn’t a federal law. The card brands wrote it, and you agreed to it when you signed your merchant agreement, probably without reading page nine. Break it and your bank can fine you, raise your fees, or close your account.
But a few US states have pulled PCI DSS into their own law. Nevada is the best known. Minnesota and Washington have versions too. And after a breach, nobody asks whether the standard was legally binding. They ask whether you followed it. A lawyer on the other side will enjoy that question.
So “breaking the law” is a little strong, and “breaking your contract” is accurate nearly everywhere. Either way, you don’t want to be there.
Who’s living on your checkout page?
Open your checkout page. Right-click, view source, and search for “script.”
Go on. I’ll wait.
Analytics. A chat widget. Maybe a heatmap tool somebody trialled once. A font library. A retargeting pixel from a campaign in 2022 that nobody turned off. Every one of those is code written by a stranger, running in the same window where your customer types a card number.
Attackers love this. It’s called web skimming, and you’ll also see the name Magecart. They don’t bother attacking your bank. They compromise one small third-party script, add a few lines of JavaScript, and copy card details as people type. Your site looks fine. Your processor sees normal transactions. It can go on for weeks.
This is the gap. Your provider secures its side. It has no control over the fifteen scripts you invited onto your side.
What changed, and why old blog posts will mislead you
The old version, 3.2.1, was retired in March 2024. Version 4.0 replaced it, and a batch of requirements that started out as “best practice” became mandatory on March 31, 2025. The current release, 4.0.1, only clarifies wording. It doesn’t relax anything.
Two of the new rules hit online sellers hardest.
Requirement 6.4.3 says you need an inventory of every script on your payment pages. You have to confirm each is authorized and write down why it’s there.
Requirement 11.6.1 says you need a way to detect unauthorized changes to those pages and be alerted when something shifts.
So if nobody on your team can name every script on your checkout, you have a compliance problem and a security problem. They happen to be the same problem, which is almost funny.
What it costs when it goes wrong
The card brands don’t bill you directly. They penalize your acquiring bank, and the bank passes it along, usually with a little extra for its trouble. Figures commonly reported run from about $5,000 to $100,000 a month of non-compliance, depending on your size and how long it drags on.
That’s the fine. A real breach is its own bill: forensic investigators, reissuing cards, lawyers, notifying customers, and the quiet loss of people who just stop buying from you.
Target in 2013 is the example everyone uses, because it’s true. Attackers got in through a third-party vendor (an HVAC contractor, of all things) and left with around 40 million payment card records. A company that size absorbs it. A small shop usually can’t.
What to do this week
None of this is glamorous. That’s sort of the point.
Start by asking your bank or processor which Self-Assessment Questionnaire applies to you. It depends on how card data touches your business, and plenty of merchants fill out the wrong one. They end up compliant on paper and exposed in practice.
Then shrink your scope. If you use a fully hosted payment page or tokenization, card numbers never touch your servers, and that’s less for you to secure and explain. Do an audit of your payment page scripts while you’re at it, and delete anything that isn’t earning its spot. Your heatmap tool doesn’t need to sit next to the card field.
Never store the CVV after authorization. Ever. Turn on multi-factor authentication for any account that can reach card data. If you’re required to run quarterly external scans, use an Approved Scanning Vendor and put the dates in your calendar, because PCI DSS is yearly, not once and done.
And write a security policy. One page is fine. One page your team has read beats sixty pages nobody opened.
The honest takeaway
I don’t think PCI DSS exists to make your life miserable, though it can feel that way around audit time. It exists because card fraud is automated and endless, and small merchants are favorite targets because they assume nobody’s watching.
The businesses that stay out of trouble mostly aren’t the ones with big security budgets. They just ask three dull questions early. What touches card data? Who has access to it? What’s running on my checkout page?
Ask them this week. Your future self will be grateful, and so will your bank.
Do you know which SAQ applies to your business? Tell me in the comments. [Add your own honest answer here.]
This is general information, not legal or compliance advice. Confirm your requirements with your acquiring bank or a Qualified Security Assessor.
TL;DR: Cross River Bank announced an integration of Ripple’s RLUSD stablecoin into its Core Operating System on October 15. The bank aims to give fintech customers access to blockchain settlement alongside conventional payment rails.
A US bank is adding a stablecoin to the machinery it uses to move money for fintech customers. Cross River Bank said on October 15 that it is integrating Ripple USD, or RLUSD, into its proprietary Core Operating System, with support for the XRP Ledger.
The idea is to make on-chain settlement another available route rather than an entirely separate payment product. Businesses connecting through Cross River’s platform could use stablecoin rails alongside familiar systems such as ACH, wire transfers and other bank payment services.
On the XRP Ledger, transactions are designed to settle in roughly three to five seconds at costs that can be a fraction of a cent. Those network characteristics help explain why Ripple is pitching RLUSD for cross-border payments, merchant settlement and treasury transfers that do not fit neatly into traditional banking hours.
There is an important gap between blockchain transaction speed and the full time required to deliver money to an end recipient. Compliance reviews, currency conversion and the off-ramp back into a bank account can all introduce additional steps.
For Cross River, which supplies financial infrastructure to other businesses, stablecoin support is part of a broader attempt to make different payment methods accessible through one integration. For Ripple, it gives RLUSD another path into regulated banking workflows.
Neither company described the deal as an overnight replacement for existing payment networks. The more realistic near-term picture is a bank adding another settlement tool, with actual adoption depending on which fintechs find it useful enough to integrate into their operations.
Warehouse lending, two levels of security and a stablecoin balance sheet. A walkthrough of the structure behind institutional onchain credit, and how it connects to the Sky Savings Rate.
The structure matters more than the headline number.
In July 2026, a $500 million credit line went live. No bank sat on either side of it.
No syndicate. No six-week term sheet shuffle. No wire instructions faxed to a custody desk in New Jersey.
Most people read the headline and scrolled past it.
The number was never the interesting part. The structure was.
What is an onchain credit facility, and how is it actually structured?
An onchain credit facility is a committed line of credit where the lender’s capital is stablecoin, the collateral is digital assets held with qualified custodians, and the eligibility rules are published and monitored continuously instead of reviewed once a month.
The skeleton is borrowed almost entirely from traditional credit:
A lender commits a maximum facility size.
An originator draws against it to fund loans it underwrites itself.
Every loan has to clear written eligibility criteria before it counts.
Advance rates decide how much of each loan the facility actually funds.
Concentration limits stop the book crowding into one collateral type.
Loan-to-value is tracked against independent price feeds.
Nothing exotic here. Mortgage lenders and auto finance companies have funded their books this way for decades.
What changed is the funding currency and the reporting speed.
Why warehouse lending is the oldest trick in credit
A warehouse facility is a credit line given to an originator to finance its lending business.
The originator does the underwriting, takes the collateral and services the loans.
The warehouse lender supplies the capital and takes security over the resulting loan portfolio.
Capital in, loans out, collateral held separately. The oldest shape in secured lending.
Why originators want one:
They can lend before permanent capital is raised.
They recycle the same line over and over.
They keep the client relationship and most of the spread.
Why lenders write them:
They sit senior and secured.
The book is short-dated and self-liquidating.
They see the collateral before anyone packages it into a product.
This matters now because crypto-backed credit stopped being a niche. Outstanding crypto-collateralised loans hit roughly $73.6 billion by Q3 2025.
Markets that size need warehouse plumbing. Someone has to fund the lender.
Inside the $500 million facility: collateral, custodians and concentration limits
The clearest live example is the facility Grove announced with Galaxy Digital (Nasdaq: GLXY) on 15 July 2026. Grove is a Prime Agent in the Sky Agent Network.
Grove is the warehouse lender. Galaxy is the originator and servicer.
For context on who is doing the lending: Grove Labs, a subsidiary of Steakhouse Financial, says its team has facilitated more than $5 billion of onchain capital allocations.
Eligible collateral: BTC and ETH, including natively staked and liquid-staked ETH.
Qualified custodians: Anchorage Digital and BitGo.
Loan profile: senior secured, fully funded, with a first-priority claim on the pledged crypto.
Tenor: original terms of two years or less.
Long-dated cap: no more than 20% of the facility in loans running beyond twelve months.
Concentration limits: ETH-backed loans capped at half the facility, staked ETH capped at half of that share.
Price feeds: Chronicle, with loan-to-value monitored continuously.
Advance rates: tiered by collateral type and borrower profile.
Every disclosed term of the facility, in one place.
The part worth pausing on is the double security.
Grove’s financing is secured against the portfolio of loans. Each loan inside that portfolio is separately overcollateralised with crypto pledged by the borrower.
Two layers. One protects the facility. The other protects every loan sitting in it.
Buying a CLO tranche means buying loans somebody else already made. A warehouse facility means funding the loans before they exist.
That gap is the whole story. In December 2025, Grove anchored Galaxy’s first tokenized CLO with a $50 million participation.
The warehouse facility moves Grove a step earlier in the credit chain, closer to origination and closer to the collateral itself.
The risk box is written into the facility, not left to discretion.
How is an onchain credit facility different from a DeFi lending pool?
This is where most explainers get sloppy. They are not the same instrument.
A DeFi lending pool is open, anonymous and priced by a utilisation curve. Anyone can supply, anyone can borrow against listed collateral, and the rate moves with demand.
An onchain credit facility is a bilateral, negotiated structure:
One named counterparty, underwritten before anything funds.
Eligibility criteria agreed in advance, not inferred from a contract parameter.
Collateral held with regulated custodians rather than deposited into a pool.
Concentration limits, tenor caps and covenant-style controls written into the terms.
Committed capacity, so the originator can plan a lending book around it.
One is a market. The other is a credit relationship that happens to settle onchain.
Where does the capital actually come from?
Grove commits USDS capital through a dedicated lending vehicle.
That phrase does more work than it looks. USDS is the base unit of capital in Sky Ecosystem, and it works as a decentralised credit facility in its own right.
Allocators supply governance-approved collateral and draw USDS liquidity directly from Sky Protocol.
So the chain runs like this:
Sky Protocol makes USDS liquidity available under governance-set risk parameters.
Independent allocators in the Sky Agent Network compete to access it.
Grove draws USDS and commits it to the Galaxy warehouse.
Galaxy originates crypto-backed loans to its institutional clients.
Loan interest and principal flow back up the chain.
Nobody in that chain is managing anyone’s money. Parameters are set in public by Sky Governance, and the protocol enforces them automatically.
Six steps from protocol liquidity to a yield-generating stablecoin.
How does an onchain credit facility connect to the Sky Savings Rate and sUSDS?
Returns from agent deployments contribute to Sky Protocol revenue. Sky Governance sets the Sky Savings Rate from that revenue. sUSDS is the token that gives you access to it.
That is the loop. A warehouse facility funding BTC-backed loans in Miami is, several steps removed, part of what makes the Sky Savings Rate work.
The scale underneath it, as published:
Total Protocol Collateral of roughly $14.15 billion, against a stablecoin supply of about $11.48 billion.
sUSDS supply of $5.52 billion at the end of Q2 2026, up 149% year on year.
$107.35 million in gross revenue and a $33.29 million net surplus in Q2 2026, a fifth consecutive profitable quarter.
$5.41 billion supplied through independent allocators and into institutional tokenized funds entering Q3 2026, including anchor positions in BlackRock’s BUIDL and Janus Henderson’s JTRSY.
The yield is an output of that system. It is not a product somebody promises you.
The balance sheet the facility draws from.
Why institutions suddenly got comfortable with onchain credit
It also approved sUSDS as eligible collateral across its institutional trading business, which carries a $1.4 billion average loan book and serves more than 1,600 trading counterparties.
Here is the detail most coverage skipped.
Clients who post sUSDS against a loan keep accruing the Sky Savings Rate on the full position for as long as that loan runs.
Collateral that does not stop working while it sits pledged. For a treasurer, that changes the arithmetic of posting margin entirely.
Galaxy has also since borrowed on Spark, a second Prime Agent, to support the Galaxy Onchain Financing Rate.
One relationship that started as a warehouse line now runs across two independent allocators and a treasury position.
The macro backdrop fits. Tokenized real-world asset AUM reached $34.18 billion by 15 September 2026, up 85.2% year to date, with bonds and money market funds holding the largest share. Roughly four times where the category sat in early 2025.
The collateral pool institutions are underwriting against is growing fast.
What the structure gets right, and what to watch
What it gets right:
A short-dated book, so exposure turns over instead of ageing.
Continuous loan-to-value monitoring rather than a monthly mark.
Concentration caps written into the facility, not into a memo.
Independent custody at Anchorage Digital and BitGo.
Terms published in full, so anyone can audit the risk box rather than trust a summary.
What deserves scrutiny:
Crypto collateral is volatile, so advance rates and margin discipline carry the weight.
The Sky Savings Rate is variable and governance-set, never fixed.
The real takeaway
Onchain credit is not winning because it invented new structures.
It is winning because it took structures that already worked and made them legible.
Eligibility criteria you can read. Collateral you can verify. Loan-to-value monitored continuously rather than reported a quarter late.
A warehouse facility is boring technology. Publishing its terms is not.
So here is my question for you. What would you want disclosed about a credit facility that a traditional lender would never put in writing? Advance rates? Borrower concentration? Real-time collateral composition?
Tell me in the comments. I think the answers say more about where onchain capital markets are heading than any TVL chart will.
Stablecoins are winning distribution while Europe concentrates on regulation and settlement. The strategic answer is not one rail, but orchestration across many.
Europe is building trusted rails for tokenised finance. The strategic question is who will own the customer, liquidity, and distribution layers.
In 2015, before “Blockchain Island” became a recognised part of Malta’s economic positioning, I joined a pressure group advocating for the country to take distributed-ledger technology seriously.
The opportunity appeared larger than crypto. Malta had spent decades building an international financial-services industry. A clear DLT framework could attract new foreign direct investment, widen the fintech sector and give companies the confidence to establish real operations in the country.
From 2016 to 2018, I became involved more directly as an adviser and consultant, supporting the framework’s development, positioning and communication. The work brought together government, legal advisers and industry participants around a relatively simple proposition: regulatory clarity would allow serious businesses to plan.
I still believe that proposition was right.
But with hindsight, it was incomplete.
Regulation can create permission to build. It cannot create adoption on its own.
Malta did important work in creating a legal vocabulary for a fast-moving industry. Where we could have done more was education: translating legislation into something the public could understand, building trust beyond the professional community and explaining why the technology might matter in everyday life.
That lesson became much more tangible a few years later.
I was recruited by the Calamatta Cuschieri Group to lead its overall marketing and expand its fintech arm, which operated under Moneybase. The mission ultimately included bringing Malta’s first neobank to market.
Inside the business, the technology was central. The product depended on digital onboarding, payments infrastructure, card controls, identity checks, and a regulated operating model working together.
Customers did not describe the value in those terms.
They valued opening an account from home, at a time that suited them, without being constrained by branch hours. They valued controlling their finances from a phone. They could issue, freeze, restrict, or replace a card without waiting for someone else to act.
Trust was the first barrier. Onboarding was the second. Once both were addressed, convenience became the proposition.
The early uptake reinforced that point: new accounts and card creation exceeded their targets during the first six months, and the service reached more than 40,000 monthly active users within its first 90 days.
The technology enabled the experience. It was not the experience.
That distinction now shapes how I view Europe’s position in stablecoins and tokenised finance.
Europe is doing difficult and necessary institutional work. But it risks repeating an old assumption: that credible architecture will naturally translate into customer adoption and market leadership.
Stablecoins have moved beyond the crypto market
The stablecoin story is changing because usage is changing.
Stablecoins remain essential to exchange liquidity and on-chain trading, so raw blockchain volume should never be confused with commercial payments. Transfers between exchanges, minting, decentralised-finance activity and automated transactions can make the headline numbers look more economically significant than they are.
Even after those caveats, however, identifiable payment activity has become substantial.
Visa and Allium estimate annual stablecoin payment volume at between $401 billion and $527 billion. Within that activity, service-fee payments represented $56 billion, payroll $43 billion, and supplier payments $28 billion. Among B2B transactions for which geography could be established, 43% of volume was cross-border.
Visa has also reported that business and commercial programmes represented approximately 17% of stablecoin-linked card volume in its 2026 financial year to date. The company supports more than 160 stablecoin-linked card programmes, whose payment volume grew by almost 200% year on year.
The point is not that stablecoins have already replaced established payment systems. They have not.
The point is that they are solving identifiable operational problems: moving value outside banking cut-off times, reducing some forms of prefunding, reaching markets through digital wallets and simplifying cross-border treasury flows.
As Visa executive Mark Nelsen observed, businesses are not pursuing payment technology for novelty; they want trusted and reliable ways to move money.
Stablecoins are gaining distribution because the value proposition is practical.
Europe is securing the settlement layer
Europe is working on a different part of the problem.
In September 2026, the Eurosystem launched Pontes, an initiative connecting eligible DLT market platforms with TARGET Services so wholesale tokenised transactions can settle in central-bank money.
Pontes uses two settlement routes. Transactions can use cash tokens on the Eurosystem’s DLT platform, or they can settle through T2, Europe’s real-time gross settlement system. Hash-Link technology synchronises the movement of the asset and the cash, enabling delivery-versus-payment and other transactions in which both legs must complete together.
This is easy to reduce to another central-bank technology project. That would miss the significance.
Tokenising a bond does not remove settlement risk if the asset moves on one system while the money moves elsewhere, under different rules and at a different speed. Institutional markets require a credible cash leg, legal finality and confidence that the asset and payment cannot become separated.
Pontes is designed to provide that anchor.
ECB Executive Board member Piero Cipollone described the initiative as bringing “the stability and trust of central bank money to the European tokenised finance ecosystem.”
That is an institutional advantage. It is not yet a distribution advantage.
Europe’s real vulnerability
Europe has many of the components needed for a credible tokenised-finance market: a large regulated economy, experienced banks and payment institutions, MiCA, instant-payment infrastructure and now an operational bridge between DLT markets and central-bank settlement.
But global digital-money distribution is not organised around regulatory credibility alone.
Dollar stablecoins benefit from deep on-chain liquidity, widespread wallet support, exchange integration, developer adoption and the global demand for dollars. US-led platforms and private networks increasingly influence how customers encounter digital money, even when the users and underlying economic activity sit outside the United States.
This creates a strategic possibility that Europe should take seriously.
Europe could write the rules, supervise the institutions and provide trusted settlement while non-European companies own the wallet, interface, transaction data and customer relationship.
MiCA illustrates both the strength and the constraint of Europe’s position. By 1 September 2026, 39 e-money tokens had been issued under the framework, but no asset-referenced token had been authorised. The European Banking Authority has acknowledged that classification complexity can add cost and delay product development, with consequences for competitiveness.
The answer is not weaker regulation.
Trust is an asset, particularly in financial markets. The challenge is converting that trust into products that are easier to use, liquidity that is easier to access, and distribution capable of competing across borders.
Europe cannot regulate its way into distribution.
It has to make regulated infrastructure commercially useful.
The strategic answer is multi-rail
If I were building a European fintech today or advising a crypto founder entering the European market, I would not begin by choosing between stablecoins and bank money.
I would begin with the transaction.
Where does it start? Where must it end? Who carries the risk? What form of finality is required? Which customer or institution must trust the result?
The answer will not always lead to the same rail.
Stablecoins are compelling when 24/7 portability, global liquidity and onchain access matter. Tokenised commercial-bank deposits are stronger where the banking relationship, regulated balance sheet and treasury structure matter. Central-bank money should anchor wholesale settlement where risk-free finality is essential. Existing bank and instant-payment rails remain effective where local reach, familiarity and acceptance are already strong.
This is not indecision. It is architecture.
The customer should not have to choose the rail. The platform should choose the right rail for the transaction.
The most defensible opportunity may therefore sit less in issuing another token than in orchestrating the system around it: identity, compliance, liquidity, foreign exchange, custody, settlement, reconciliation and routing.
Issuance can create visibility. Distribution and orchestration create repeatable utility.
Foundations do not guarantee leadership
My experience with Malta’s DLT framework taught me why clear rules matter before serious institutions can commit.
Helping launch a neobank taught me that customers adopt outcomes, not infrastructure.
Working across global Web3 markets has made the connection between those lessons more visible. Regulation, product, narrative, trust, and distribution are not separate conversations. They are parts of the same strategy.
Europe is building credible foundations. Pontes provides a bridge to central-bank settlement. MiCA creates a common perimeter. Euro stablecoins, tokenised deposits, the digital euro and established payment systems could become complementary parts of a broader digital-money architecture.
But foundations do not guarantee leadership.
Europe’s position will depend on whether it can connect institutional trust with products customers choose, liquidity markets can use, and distribution that travels beyond national boundaries.
If it succeeds, Europe can build a model for tokenised finance that is both regulated and globally relevant.
If it does not, it may provide the safest rails while dollar stablecoins and foreign platforms own the journey.
The strategic question is no longer whether finance will become more tokenised.
It is where, in that multi-rail system, Europe and the companies building within it have the right to win.
About the Author
Joseph Zammit is a CMO and CSO in fintech and crypto, with 25+ years at the intersection of marketing, strategy, and regulation. He helped design Malta’s pioneering DLT framework, launched the country’s first Neobank, and led the global expansion of crypto and Web3 platforms. He works with Europe-based licensed neobanks, EMIs, PSPs, and crypto-native infrastructure teams on strategy, regulation, and go-to-market. He is a member of the Crypto Valley Association.
Everyone moved on from the hype. The people still building didn’t.
Okay, so 2021.
I [where were you in 2021? what did you do, buy, almost buy, roll your eyes at?]. Everybody I knew had a take on crypto. My group chat was basically a casino. Someone’s uncle was selling a cartoon ape for more than my car was worth. Brands were announcing “metaverse strategies” like it was a real department.
And then it all fell apart, fast.
FTX went down in November 2022. NFT prices cratered. The metaverse became a joke people told at parties. And I thought what most people thought: well, that’s that, it was a scam, it’s over.
Except I kept noticing something weird. The tech kept shipping. Quietly. Nobody was tweeting about it, which is exactly why I missed it.
Image Generated by chatgpt
A bubble isn’t the same as a technology
This is the thing I wish I’d understood sooner.
Hype is a price chart. Technology is something that either works or doesn’t. When the speculators left, they took the noise with them, and what stayed was a smaller crowd fixing boring problems. Boring is where actual adoption usually starts. Nobody brags about plumbing, but you’d notice pretty quickly if it stopped.
Think about the dot-com crash. Pets.com is dead. Amazon isn’t.
The Merge, the least-celebrated win in crypto
The loudest criticism for years was energy use, and honestly, it was fair. Proof-of-work burned a ridiculous amount of power.
Then in September 2022, Ethereum switched to proof-of-stake. The Ethereum Foundation says energy use dropped by about 99.95%. That’s not a rounding error, that’s a fixed problem. And it landed in the same news cycle as the FTX mess, so almost nobody heard about it. Good news really does have terrible timing in this industry.
Stablecoins, where it quietly works
If you pushed me to name one place where Web3 found real use, I wouldn’t say NFTs. I wouldn’t say DAOs either, and I say that as someone who sat through way too many DAO calls. [optional: your own experience]
I’d say stablecoins. Tokens pegged to the dollar. Sounds dull, and it is dull, which is kind of the point.
Picture sending money to family in another country. A bank wire can take days and eat a chunk in fees. A stablecoin transfer can land in minutes, on a Sunday, for pennies, even if the person on the other end doesn’t have a proper bank account. Freelancers in countries with shaky currencies use them to park savings. Companies use them to settle payments across borders.
And the grown-ups have noticed. Visa and Stripe have both been building stablecoin payments into what they offer, and in 2025 the US passed its first federal stablecoin law, the GENIUS Act. When Visa and Congress both start paying attention to something, “dead” is the wrong word.
Remember paying $30 to move a token?
Yeah. That experience killed a lot of curiosity. [your own gas fee horror story, if you have one, it’ll land better than anything I write]
What fixed it wasn’t a big flashy launch. It was Layer 2 networks, things like Arbitrum, Optimism and Base, which bundle a pile of transactions together and settle them on Ethereum in one go. Fees often fall to a few cents or less. Coinbase launched Base in 2023 with basically no drama, just “here’s a cheaper place to build.” And builders went there.
That’s the pattern really. Less manifesto, more “does it work.”
Wall Street showed up, which is kind of hilarious
This part still cracks me up. The whole movement started as a way to get around traditional finance, and now traditional finance is one of its biggest customers.
US spot Bitcoin ETFs were approved in January 2024, and spot Ether ETFs came later that year. Big asset managers have also been playing with tokenization, putting things like treasury funds on a blockchain so they settle faster. Whether you think that’s a win or a betrayal of the original idea, it’s not what a dead industry looks like.
But was it a scam?
Parts of it, yes. I’m not going to pretend otherwise.
A lot of the last cycle was rotten. Rug pulls. Influencers hyping tokens they’d already bought. Wash trading. FTX, which wiped out regular people’s savings. If you lost money, you’re allowed to be furious, and nobody should tell you to get over it.
Plenty of things deserved to die:
NFT projects with no plan beyond “price goes up”
Tokens bolted onto products nobody asked for
Metaverse worlds that were basically empty malls
Founders who treated their users as exit liquidity
So no, I’m not here to tell you everything was fine. I’m saying the garbage and the useful stuff got mixed together, and when we threw out one we threw out the other.
What I’d actually watch
Ignore token prices for a while. Seriously. Look at this instead:
Payments volume. Real people moving real money is the most honest number there is.
Developer activity. Builders vote with their time. They don’t hang around dead ecosystems.
Regulation. Annoying, yes. But clear rules are what let big companies and normal users show up without being scared.
Invisible use cases. Ticketing, ownership records, digital identity. If the blockchain vanishes into the background and nobody notices, that’s the win.
That last one is the real test. Nobody says “I’m using TCP/IP today,” and I suspect that’s how this ends up too.
So where does that leave us?
I don’t think the question is “is Web3 dead?” That’s a price-chart question, and price charts are the wrong place to look.
I’d ask: what’s working right now that I’m not paying attention to?
Because the folks who were right about the internet weren’t the ones yelling in 1999. They were the ones still building in 2002. [your closing thought, one sentence about where you stand now]
Not financial advice. I’m a writer, not your broker.
What’s your honest take: dead, dormant, or just getting started? Tell me in the comments, I actually read them.
Today is the last day of a $750 million experiment. Here is what it proved about where stablecoin yield actually comes from.
The synthetic dollar arc, from a $15 billion peak in October 2025 to under $5 billion as token incentives end.
Tonight, something quietly ends.
From October 1, 2026, Ethena stops paying ENA token rewards to anyone holding USDe or sUSDe.
The protocol announced it on September 26. Incentives tied to USDe growth had already fallen roughly 85% since the first airdrop in 2024. Now they go to zero, permanently.
Here is the price tag. More than $750 million in rewards distributed since launch.
And here is what happened to the thing those rewards were buying.
USDe peaked near $15 billion in October 2025. By late August 2026 it had dropped below $5 billion. A contraction of more than 65% in under a year.
This is not a scandal. Nobody got hurt. The peg held.
It is a receipt. And it is the clearest lesson onchain dollars have handed us in years.
For scale: in September 2025, USDe alone held roughly 4.5% of the entire stablecoin market at a $14.4 billion market cap. A year on, it is a fraction of that.
Why did the USDe supply decline happen this fast?
Three things stacked up at once.
The subsidy switched off. Token rewards were the growth engine. Capital that arrives to farm rewards leaves when the rewards shrink. Ethena said so itself.
Funding rates cooled. USDe earns from a delta-neutral basis trade, long spot and short perpetual futures. That pays well when leveraged traders crowd the long side. It pays very little when they do not.
October 2025 forced the unwind. The crash triggered a deleveraging event. Supply fell from above $14 billion to roughly $8.5 billion within weeks, then kept sliding.
One more detail worth holding onto. A governance proposal approved in September ties future ENA buybacks to USDe supply climbing back above $7.5 billion. From around $4.9 billion, that is roughly 53% of growth still to find.
Ethena kept every promise it made about the mechanism. The mechanism simply did what that kind of mechanism always does.
USDe circulating supply fell from roughly $15 billion to under $5 billion in under a year. The dashed line marks the $7.5 billion ENA buyback threshold.
What happens to stablecoin yield when funding rates go quiet?
It compresses. Fast.
sUSDe paid above 35% at its Q1 2024 peak. By mid-September 2026 it sat near 5%.
Now put that next to the risk-free floor. The effective federal funds rate was 3.63% on September 11, 2026.
So a strategy carrying derivatives exposure, exchange counterparty exposure and hedge execution risk was paying roughly 1.4 points over cash.
A yield that depends on other people staying leveraged is a yield you are renting, not one you own.
That is the real story inside the usde supply decline. The model did not break. It was always cyclical. The cycle finally showed up on the chart.
sUSDe yield fell from above 35% to roughly 5%, closing most of the gap to the risk-free rate.
Where does a durable yield-bearing stablecoin get its rate?
This is where the two designs part ways.
A synthetic dollar sources yield from one market condition. A capital allocation network sources it from many.
USDS is the fully backed stablecoin at the base of Sky Protocol. It is the unit of account and the credit facility for allocators. Holding it pays nothing on its own.
Supply USDS and you receive sUSDS, the yield-generating stablecoin that carries the Sky Savings Rate.
Value accrues against USDS continuously. No lockups, no cooldown, convertible back on demand.
The Sky Savings Rate is governance-set, not market-set. That single distinction is the whole argument.
Here is the actual path the money takes:
Sky Protocol makes USDS liquidity available under risk parameters set in public
Independent allocators in the Sky Agent Network draw on that liquidity
They deploy it across credit, lending markets, treasury strategies and tokenized funds
Fees flow back as Gross Protocol Revenue
Sky Governance sets the rate from that revenue base
sUSDS holders capture it automatically
Six steps. Not one of them needs a perpetual futures funding rate to stay positive.
The Sky Savings Rate is the output of a five-step capital allocation loop, not of a single market condition.
Is diversified collateral more durable? Check the 2026 tape.
Fair challenge. So here are the numbers, published by the Sky Frontier Foundation.
Q1 2026: $123.79 million in Gross Protocol Revenue and $46.04 million in Net Protocol Surplus. Record quarter.
Q2 2026: $107.35 million in Gross Protocol Revenue and $33.29 million in Net Protocol Surplus. Fifth consecutive positive quarter.
Protocol Collateral: up 45.5% year over year to $12.32 billion at the Q2 close.
sUSDS: up 149% year over year to $5.52 billion at the Q2 close.
sUSDS came through that stretch as the largest single yield-bearing stablecoin in the market.
Now the part most brands would quietly skip.
In the August 2026 update, Gross Protocol Revenue came in 11.47% below August 2025. Protocol Collateral closed the month at $11.10 billion, stablecoin supply at $9.53 billion.
So no. Diversification is not immunity. Rates fall, revenue follows.
The difference is the shape of the fall. One model shed two thirds of its supply.
The other posted five straight positive quarters and still grew Protocol Collateral 18.2% year over year.
Protocol Collateral of $11.10 billion against stablecoin supply of $9.53 billion at the August 2026 close.
Who is allocating into USDS and sUSDS right now?
Names, not adjectives. As of September 1, 2026, Sky Agents held roughly:
$1.23 billion with Janus Henderson
$618.32 million with BlackRock
$304 million with Galaxy
$239.60 million in PayPal USD
$220 million with Anchorage
$103.11 million with Securitize
Galaxy is the mover here. Exposure sat at $27 million at the Q2 close and reached about $304 million by September 1.
Then on September 23, Galaxy Digital added $100 million of sUSDS to its own corporate treasury and approved sUSDS as eligible collateral across an institutional business carrying a $1.4 billion average loan book.
Token Terminal data as of August 21 placed Sky Protocol at $4.6 billion in tokenized funds. Largest single issuer in a $34.4 billion category, ahead of Securitize, Circle, Franklin Templeton and Ondo Finance.
Across the full Sky product suite, $7.1 billion was reported on August 19, with $4.92 billion of it sitting in the Sky Savings Rate.
A synthetic dollar’s collateral is a hedge. This collateral is a list you can read.
Sky Agent allocations by counterparty as of September 1, 2026. Galaxy exposure moved from $27 million to roughly $304 million in one quarter.
Five questions to ask before you trust any stablecoin yield
Steal this checklist. Run it on every token in the category, including this one.
What pays the yield? Name the source out loud. If the honest answer is “market conditions,” you are holding a cyclical asset and should size it that way.
Who sets the rate, and how? Market-set rates move with sentiment. Governance-set rates move on a vote you can read before it happens.
Is the backing verifiable right now? Not quarterly. Right now. Sky’s public dashboards publish collateral, revenue and supply continuously.
How fast is the exit? Lockups and cooldowns are risk. sUSDS converts back to USDS on demand, with no lock-up period and no exit fee.
What does the issuer publish on a bad month? This is the real tell. Anybody can publish a record quarter.
Sky Protocol held $4.6 billion of a $34.4 billion tokenized funds category in August 2026, the largest single issuer.
What the synthetic dollar contraction actually teaches
Here is the part nobody says out loud.
Ethena built something genuinely new, and it is now diversifying its reserves into institutional lending, real-world assets and tokenized equities.
That is not a retreat. That is the whole category converging on the same answer.
Diversified backing. Verifiable collateral. A rate that survives a quiet market.
The wider tape agrees. Total stablecoin supply sat near $302.8 billion in September 2026, up about 14% year over year, and it held close to record highs straight through a downturn that took 20% off total crypto market cap in Q1 alone.
Dollars onchain are not going anywhere. The only real question is which ones pay you, and out of what.
Regulators are tightening around who may pay yield, too. The GENIUS Act bars payment stablecoin issuers from paying holders directly, and in September the European System of Central Banks proposed tighter limits on stablecoin rewards. Structure is quietly becoming the differentiator, not marketing.
USDe’s chart did not prove synthetic dollars were a bad idea. It proved that where a yield comes from matters more than what the yield says today.
The subsidy era of onchain dollars ends tonight. What comes next gets funded by revenue, or it does not get funded at all.
Your turn. Would you rather hold a stablecoin paying 8% sourced from one strategy, or 4% sourced from twenty? Drop your answer below and tell me what would change your mind.
The rate did not break. It reported. Here is what that tells you about how stablecoin yield is actually built.
sUSDe APY fell from a 35.2% all-time high in Q1 2024 to roughly 4.76% in late September 2026. The Sky Savings Rate was moved to 3.60% over the same window.
In March 2024, sUSDe paid 35.2%. On 28 September 2026, it paid about 4.76%.
Nobody moved the goalposts. The rate did precisely what its own documentation always said it would.
That is the part most people skipped.
I have spent most of 2026 reading stablecoin yield dashboards. Two products can land on the same number and mean completely different things by it.
Quick answer, for anyone who typed “sUSDe APY 2026” into a search bar:
sUSDe paid roughly 4.76% on 28 September 2026, with a 30-day average near 4.79%, per DefiLlama. Its all-time high was 35.2% in Q1 2024. Its all-time low was 4.1% in August 2024.
The rate is not administered. It is whatever perpetual futures funding happened to pay.
What is the sUSDe APY in 2026, and how far has it actually fallen?
Here is the honest picture.
Late September 2026: roughly 4.76% APY, 30-day average 4.79%
All-time high: 35.2%, during the Q1 2024 bull run
All-time low: 4.1%, during the August 2024 funding inversion
2024 average: around 19% across the year
USDe supply: near $4.95B, down from a $14.8B peak
One more number worth sitting with. In August 2024, the rate went from 19% to 4% in eleven days.
Eleven days.
Nothing was hacked. No collateral failed. Funding simply flipped.
Two rate-setting mechanisms, plotted side by side. One is discovered by perpetual funding markets. One is voted on by Sky Governance. Approximate published rates, February 2024 to September 2026.
A yield that can fall 15 points in eleven days is not a savings rate. It is a market price wearing a savings rate costume.
Where did that 35% sUSDe yield actually come from in the first place?
sUSDe earns from a delta-neutral basis trade. Strip the jargon and it works like this:
Hold spot crypto collateral
Short the matching perpetual futures to cancel price exposure
Collect the funding payments longs pay shorts
Pass those payments to sUSDe holders
When crypto is euphoric and everybody is levered long, longs pay shorts a lot. That is your 35%.
When the market cools, longs stop paying. That is your 4%.
The engine never changed. The fuel did.
So the right way to read sUSDe APY in 2026 is not “the yield collapsed.” It is “leverage demand normalised, and the instrument reported it.” Ethena documented this from day one. Credit where it is due.
Why a falling sUSDe APY is a feature of the design, not a scandal
This is where a lot of commentary got lazy.
A funding-rate yield is a thermometer. It reads the room. When positioning is crowded, it runs hot. When positioning is flat, it runs cold. Asking it to hold 35% is asking a thermometer to hold summer.
The design risk was never that the rate might fall. It is that the rate falls exactly when you most want it to hold, because both are driven by the same sentiment.
That is correlation, and correlation is exactly what treasury teams pay to avoid.
Same label on the screen, opposite order of operations. One rate is an outcome you find out about. One is a decision with a paper trail.
How the Sky Savings Rate is built the other way round: revenue first, rate second
This is the structural contrast, and it is a difference in mechanism, not a scoreboard.
The Sky Savings Rate is not discovered by a market. It is set by Sky Governance, out of revenue that Sky Protocol has already generated.
The sequence runs in this order:
Sky Protocol makes USDS liquidity available under governance-set risk parameters
Independent allocators in the Sky Agent Network borrow that liquidity and deploy it across diversified strategies
Those allocators pay fees back to Sky Protocol for access
Revenue accumulates as Protocol Surplus
Sky Governance then votes, onchain and in public, on what the rate should be
sUSDS holders receive it automatically, compounding block by block
Notice the order. The revenue exists before the rate is announced, not after.
As I write this, the Sky Savings Rate sits at 3.60% APY on skyeco.com. Sky Governance moved it there on 3 September 2026, up from 3.52%.
It is variable. It can move. But when it moves, there is a vote, a forum thread, and a timestamp attached to it.
It went up in September, incidentally. Not down.
One rate is an outcome of a market. The other is a decision with a paper trail. Neither is free of risk. They just fail in completely different ways.
What the Sky Protocol numbers look like underneath the sUSDS rate
Rates are opinions. Balance sheets are evidence.
Total Protocol Collateral: $14.15B
Stablecoin supply: $11.48B
Q1 2026: $123.79M Gross Protocol Revenue, $46.04M Protocol Surplus, the strongest quarter on record
Q2 2026: $107.35M Gross Protocol Revenue, $33.29M Protocol Surplus, a fifth consecutive quarter of positive surplus
sUSDS supply at the end of Q2 2026: $5.52B, up 149% year over year
Sky Protocol generated $123.79M Gross Protocol Revenue in Q1 2026 and $107.35M in Q2 2026, with $46.04M and $33.29M in Protocol Surplus respectively. Verify at financial.skyeco.com.
One more that surprised me. In Q1 2026, yield-bearing stablecoins added roughly $4.3B in net new supply as a category.
sUSDS alone brought in more than $2.5B of that, more new capital than the next four yield-bearing tokens combined.
sUSDS supply reached $5.52B at the end of Q2 2026, up 149% year over year. In Q1 2026 it took in more new capital than the next four yield-bearing tokens combined.
And in August 2025, S&P Global became the first rating agency to rate a decentralised finance protocol. The protocol was Sky Protocol.
You can argue about what a B-/Stable means. You cannot argue about who went first.
sUSDS vs sUSDe in 2026: two honest answers to two different questions
This is not a “one is good, one is bad” story. They answer different questions.
sUSDe answers: what is leverage demand paying right now?
Upside is uncapped in bull regimes
Correlated to crypto sentiment
Seven-day cooldown on unstaking
Rate can compress to near zero if funding inverts
sUSDS answers: what has this network actually earned, and what did governance decide to pass on?
Governance-set and published before it applies
Funded from aggregate Protocol Surplus, not any single strategy
No lockup, redeem to USDS on demand
Backed by diversified institutional-grade collateral you can inspect onchain
Trading a regime? The first is your instrument. Financing a payroll eighteen months out? Different tool entirely.
Where each rate has travelled since 2024, and where it sits today. Both are variable. They vary for completely different reasons.
Why September 2026 is when institutions stopped watching and started allocating
On 23 September 2026, Galaxy Digital (Nasdaq: GLXY) added $100 million of sUSDS to its corporate treasury and approved sUSDS as eligible collateral across its institutional trading business, which carries a $1.4 billion average loan book.
The clever detail: clients who post sUSDS against a loan keep accruing the Sky Savings Rate on the full position for as long as the loan runs. The collateral does not go to sleep.
That relationship started with a $500 million warehouse lending facility from Grove, an independent allocator in the network. Galaxy has since borrowed on Spark too.
Context for the trend: Sky Protocol entered Q3 2026 with $5.41 billion supplied through independent allocators and into institutional tokenised funds, including positions in BlackRock’s BUIDL and Janus Henderson’s JTRSY.
Meanwhile, onchain real-world assets excluding stablecoins passed $33 billion in July 2026, roughly four times early-2025 levels.
A treasury committee will not sign off on a rate that swings with funding sentiment. It will look at one with a governance record and a published balance sheet.
What I would actually check before parking a dollar in any yield-bearing stablecoin
Not advice. Just the checklist I use.
Where does the rate come from? Funding payments, lending spreads, treasury bills, or protocol revenue. Say it in one sentence or walk away.
Who sets it, and can you watch them set it? A public vote beats a dashboard update.
What is the exit? Instant redemption and a seven-day cooldown are not the same product.
What happens in the bad regime? Ask what the rate does when crypto is boring, not when it is exciting.
Can you verify the backing yourself? If the answer is a quarterly PDF, that is a different trust model.
You can check every Sky Protocol figure in this piece against info.skyeco.com and financial.skyeco.com. I would rather you verified me than believed me.
The uncomfortable truth about high stablecoin yields
Here is what nobody in this industry likes saying out loud.
A high APY is not a reward for being smart. It is usually compensation for a risk you have not priced yet.
sUSDe at 35% paid you to hold the other side of a very crowded trade. At 4.76% it is paying for a much quieter one. Both are honest. Only one made headlines.
And a governance-set rate at 3.60% is not trying to win a yield beauty contest. It is trying to still be there in 2028.
The rate you can plan around is worth more than the rate you can screenshot.
Now I want to hear you disagree. Do you want a yield that tells you the truth about the market every single day, even when the truth is 4%? Or one that a group of token holders decides on in public, with a vote you can read?
Drop it in the comments. I will post the receipts for any number above.
Login
