BLOG
Insights on building trust infrastructure for global money movement
A final rule, three months before go-live
On October 21, 2026, the Office of the Comptroller of the Currency (OCC) announced its final rule implementing the GENIUS Act for the stablecoin issuers it supervises. The rule, new 12 CFR part 15, takes effect January 18, 2027, the same day the GENIUS Act does.
Part 15 covers subsidiaries of national banks and federal savings associations, Federal qualified payment stablecoin issuers, certain nonbank State issuers, and foreign issuers registering with the OCC. It sets the rules for reserves, redemption, capital, risk management, licensing and supervision. For issuers, and for the exchanges, custodians and payment firms connected to them, the rule settles a lot.
Importantly, the financial crime rules, along with BSA/AML and the Travel Rule, are in separate rulemakings from Treasury that are still in progress.
"…those related to the Bank Secrecy Act, anti-money laundering, and Office of Foreign Assets Control sanctions, which will be addressed in a separate rulemaking in coordination with the Department of the Treasury."
However, as part of the current application process, applicants still need to:
"… ensure that submissions are fully responsive to the questions and documentation requirements included in the relevant application form. This includes providing sufficient details on the proposed … Bank Secrecy Act/Anti-Money Laundering/Office of Foreign Assets Control; third-party risk management; enterprise risk management; compliance risk management; and audit functions." (OCC Bulletin 2026-51)
What changed from the March proposal
The OCC dropped two of the fixed rules it had proposed and will now review them on a case-by-case basis instead.
On yield, the OCC kept things pretty open-ended. It didn't define what counts as "interest" or "yield," and it said no to every carve-out people asked for (small payments, existing rewards programs, staking, white-label partners). Rewards tied to transactions aren't automatically banned, but they can't be used to pay people for holding the coin. And if Congress changes the law, the OCC said it will take another look.
Applications, waivers and reporting
The OCC isn't taking applications yet. It will start once the Office of Management and Budget approves the application forms, and will announce the date in a press release (Bulletin 2026-51).
- Waivers: Issuers already operating in the US need a substantially complete application on file by January 18, 2027 to request a waiver. The OCC expects to grant waivers from the prior approval requirement, but sees no general reason to waive anything else. Issuing without approval after January 18 carries criminal penalties.
- What applications must cover: The OCC lists BSA, AML and OFAC compliance and third-party risk management among the required topics, next to reserves, redemption, capital and audit. So AML readiness gets reviewed at licensing, before the AML rules are final.
- Timing: The OCC will say within 30 days whether an application is substantially complete, and decide within 120 days after that.
- Reporting: Revised weekly and quarterly reporting forms are out for comment. Pending OMB approval, weekly reports start with the January 25, 2027 report date and quarterly reports with March 31, 2027 (Bulletin 2026-52).
The Travel Rule lives in a different rulemaking
Part 15 does not set AML, sanctions or Travel Rule obligations. In the OCC's own words, the final rule covers everything it must issue under the GENIUS Act "other than those related to the Bank Secrecy Act, anti-money laundering, and Office of Foreign Assets Control sanctions, which will be addressed in a separate rulemaking in coordination with the Department of the Treasury." The OCC sent every comment on those topics to its separate AML/CFT proposal, and that proposal cross-references FinCEN and OFAC rules for the substance. As of October 22, none of the three is final.
The GENIUS Act gave regulators until July 18, 2026 to finalize their rules (section 13), and that date has come and gone. FinCEN has also proposed giving issuers 12 months to comply once its rule is final. So the new AML rules written for stablecoin issuers probably won't kick in until after the GENIUS Act itself takes effect.
That doesn't mean issuers get a break in the meantime. The OCC is clear that existing FinCEN and OFAC rules still apply. Most stablecoin issuers today are registered money transmitters, which means the Travel Rule already applies to them.
What issuers and their counterparties should do now
Every stablecoin payment raises two questions: who is behind the address on the other side, and how value settles once both parties are known. Here are five parts of the final rule that touch on both.
- Vendor oversight is now a rule requirement: Section 15.13(a)(7) requires issuers to run due diligence on service providers, write Part 15 and GENIUS Act compliance into their contracts, and review the providers' audits or test results. Issuers should map every provider touching redemption, screening and transfer data before January.
- Information security flows down: Section 15.13(b) requires breach notification to customers and the OCC, and resilience testing with critical service providers. Expect these terms in vendor contracts.
- Self-hosted wallets stay allowed: Issuers using them still have to meet the lawful order capability requirement and their AML and sanctions obligations. Knowing who sits behind an unhosted address, before value moves, is part of meeting both.
- Redemption speed now depends on onboarding speed: The OCC kept the two-business-day deadline partly to avoid conflict with BSA and sanctions duties, and expects issuers to screen and onboard new customers promptly, even under stress. A slow screening queue becomes a redemption problem.
- Travel Rule data and privacy rules don't collide: The OCC clarified Part 15's privacy provisions don't change BSA obligations.
One more point for banks entering the market: the OCC set no interoperability standards. It is assessing the question under section 12 of the GENIUS Act with NIST and other standard setters. Open standards for exchanging identity and authorization data between institutions have room to shape where this lands.
Where the next decisions get made
The rules still open will decide how the Travel Rule works for payment stablecoins. Notabene has commented on each of them: the FinCEN/OFAC program rule, the OCC AML/CFT proposal, and the joint CIP proposal.
Our position across all of them is the same. Once a stablecoin transfer goes through on the blockchain, it can't be undone. So the checks have to happen before the money moves. That means the two institutions share who is sending and who is receiving, check both against sanctions lists, and confirm the recipient is who they say they are, all before the transfer goes out.
We've asked regulators to recognize pre-transaction controls, and reliance on specialized compliance infrastructure, as evidence of an effective AML program. We've also asked for one rulebook per issuer and consistent requirements across the OCC, FDIC and Federal Reserve.
Part 15 is the prudential foundation. The financial crime layer comes next, and January 18 is fixed regardless.
Sources
- OCC final rule (PDF), Docket OCC-2025-0372, RIN 1557-AF41 (October 21, 2026). Docket
- FinCEN/OFAC PPSI AML/CFT and sanctions program proposal, 91 FR 18582
- OCC PPSI AML/CFT and sanctions risk management proposal, 91 FR 37840
- Joint PPSI Customer Identification Program proposal
- Freshfields on the CIP and OCC AML comment deadlines
- OCC news release on the March 2 proposal
- Tech Insider on the missed July 18, 2026 rulemaking deadline
- OCC News Release 2026-92
- OCC Bulletin 2026-50, GENIUS Act Regulations: Final Rule
- OCC Bulletin 2026-51, Waivers and Application Submission Guidance
- OCC Bulletin 2026-52, Revised Reporting Forms
- OCC GENIUS Act page
Not long ago, the question was whether banks would enter stablecoin payments at all. Today it is about how they enter, how fast they can move, and what it takes to build an offering that competes.
On October 28 at Merge Madrid, Catarina Veloso, our Director of Regulatory and Compliance, sat down with Deborah zu Hohenlohe, our EMEA Sales Director, to talk through what that looks like from the inside. Deborah spends most of her time with financial institutions that are making these decisions right now. Here are the themes from their conversation.
From exploration to implementation
Two years ago, banks were asking whether they needed a digital asset strategy at all. Now Deborah hears from banks that were openly cautious telling her they are accelerating: joining consortia, running pilots with stablecoin issuers, and choosing custody platforms against a deadline.
Regulatory clarity is part of the reason. Europe has MiCA and the US has the GENIUS Act. But clarity is not the same as readiness, and the questions have become practical ones. Which platform? Which counterparties? Which compliance workflow? How fast can the regulator sign off?
In some markets, the regulator is on the critical path. Deborah described a bank that is the first in its country to offer digital asset custody, whose supervisor's message was simple: go step by step, and we'll figure it out together.
Ownership has moved too. "The whole blockchain innovation lab era is pretty much over," Deborah said. These initiatives now sit with strategy teams and the business units that will own the product and its revenue. In her view, the next phase will reward the quality of execution far more than the ambition of the announcement.
Moving a token isn't completing a payment
For years, banks' interest in digital assets was mostly about giving customers access to crypto: buying, selling, custody and investment products. Stablecoins change the conversation from digital assets as investments to digital assets as payment infrastructure.
The requests are getting specific. The RFPs Deborah sees don't ask whether a vendor supports stablecoins. They name corridors, like South Africa to the Philippines or the Gulf to Pakistan. They ask for local-currency stablecoins, not only dollar ones, and they ask about stablecoins and tokenized deposits in the same breath.
But a token arriving at an address is not a completed payment. You still need to know who is on each side, carry the right information with the transfer, reach a counterparty that is ready to receive, and often convert back into local currency at the other end.
Banks are also bringing the protections their customers already expect. One European group is building a stablecoin scheme with several banks that works like a card scheme, disputes and chargebacks included. The opportunity is not only offering stablecoin transfers. It is combining new rails with what banks already have: trust, distribution, compliance and customer protection.
Compliance wasn't the problem. Connectivity was.
A payment doesn't happen in isolation, and Deborah called counterparty connectivity the most underestimated challenge in stablecoin payments.
This summer, our team sat on a call with two fully licensed institutions. Both were doing the Travel Rule properly, and they still couldn't exchange compliance data automatically because their providers spoke different protocols.
Connectivity is also more than a protocol. An address tells you where money goes. It doesn't tell you who is on the other side, or which legal entity, in which jurisdiction, is accountable. A global exchange might run ten licensed entities, and you need to know which one you are dealing with.
One bank put it in a way Deborah keeps coming back to: by solving the Travel Rule, the industry quietly built a strategic asset, a directory of who controls which addresses. In payments, connectivity isn't measured by how many institutions you know. It is measured by how many you can actually transact with, and how fast they answer.
You can outsource the technology, not the responsibility
The most common misconception Deborah sees is that outsourcing the technology also outsources the responsibility. Good infrastructure providers make the market much easier to enter, but tools aggregate signals. The risk appetite belongs to the bank: which jurisdictions it will transact with, which counterparties, and what happens when a name matches a sanctions list.
The most sophisticated banks understand this. They aren't buying one stack. They are assembling one and acting as the orchestrator, with custody from one provider, analytics from another and compliance messaging from a third, and they test whether each vendor works well with the others.
The due diligence shows how seriously they take it. One RFP our team answered ran to more than five hundred questions, covering where data lives, what happens when it crosses borders, and how an outcome would be reproduced for an auditor a year later. Compliance isn't something to bolt on before launch. It shapes the architecture from day one.
Three decisions to get right on day one
Catarina closed by asking what Deborah would tell a bank about to start its first stablecoin payment project. She named three decisions.
Define the use case and counterparties before choosing technology. Know which corridors you are serving and who you need to reach on the other end. Then pick the stack.
Put authorization into the payment flow from the start. Decide what information has to travel, which checks run and who makes the call, and make sure all of it happens before funds move.
Launch pragmatically, but design for change. The best teams start with the integration path that gets their first launch out fastest, but position themselves to adapt and scale as their program grows.
Her last point tied the three together. Your first corridor might have a handful of counterparties. Don't optimize for the first successful transaction. Design for the thousandth, and for the next hundred counterparties.
If your team is working through any of these decisions, get in touch. We're happy to compare notes.
TOKEN2049 Singapore still has the Ferrari at the entrance and the trading booths with robot dogs. But most of the conversations our team had on the floor and at side events were about something less flashy: moving money between regulated institutions, across borders, using stablecoins.
We spoke with exchanges, PSPs, custodians, infrastructure providers, banks and a few groups you wouldn't expect at a crypto conference. Five themes came up again and again.
1. Stablecoin payments set the agenda
Trading still had the biggest booths, but payments drove most of the serious conversations. Many of the PSPs we met are already adding stablecoins to their offering or integrating them more deeply into existing products. The interest was concrete: cross-border transfers, merchant settlement, treasury movement between entities.
2. The buyer list keeps getting longer
Alongside exchanges and VASPs, we met payment service providers, trading firms and other financial businesses that are moving into digital assets. Many are acquiring or applying for licenses to do it, with Singapore, Dubai and Bahrain coming up most often. Their business models are changing, and so are their compliance obligations.
Licensing is shaping the conversation. Dubai had its own pavilion with VARA represented, and a steady stream of companies stopped by to ask about setting up regulated digital asset businesses there. Most of them are still deciding on their infrastructure, which is the right time to think about compliance.
3. A license is only half of it
This was the clearest pattern of the week. Firms are working out that getting a license is the first step, not the last. Once licensed, they still need to connect with the other regulated entities they'll transact with, verify who those counterparties are, and handle different rules in every jurisdiction they touch.
We heard a version of this from banks that had started with a white-label setup. Outsourcing the technology didn't outsource the regulatory responsibility. They still own their compliance stack, and they still need to know who is on the other side of every transfer.
That is a reachability problem as much as a compliance one. A Travel Rule network is only as useful as the share of your counterparties that are actually on it and actually respond. Notabene's network connects thousands of counterparties across more than 100 jurisdictions, and every institution that joins makes it more useful for the next one.
4. Banks are buying the whole stack
Banks are now talking to vendors across the full compliance stack, the way exchanges did a few cycles ago: KYC, custody, analytics and Travel Rule. Among more mature firms, the Travel Rule is no longer seen as a blocker. It's a solved part of the stack that has to work every time.
Several people told us they value working with a team that stays focused on that problem, especially conservative institutions that have watched crypto companies change direction every market cycle.
5. Institutional adoption in APAC is early, but real
Use cases range from tokenized deposits to interbank transfers through stablecoin pilots. Product-market fit isn't settled yet, and banks are moving carefully. They're following regulator guidance closely and paying attention to which stablecoins they're comfortable holding and settling in.
Hong Kong is a good example of where this is going. Last week we announced that Notabene is providing Travel Rule compliance and transaction authorization for distributors of Anchorpoint's HKDAP, the HKMA-licensed Hong Kong dollar stablecoin. Distributors get real-time counterparty verification before a transfer settles, the same standard institutions expect from a wire.
One more thing: agents
A few exchanges were demoing agentic AI for trading, and banks are starting to use AI internally. As software starts initiating payments on someone's behalf, the counterparty question gets a new layer: who is the agent acting for, and what is it allowed to do? Lana Schwartzman covers this in Who KYCs the Agent?
What this means for teams building now
Many of the PSPs and financial institutions we met are still choosing their technology and compliance infrastructure. If that's you, plan for the second half of the license early: how you'll reach your counterparties, verify them and authorize each transfer before it settles, in every jurisdiction you operate in.
We'll be at Money20/20 in Las Vegas next week, then Merge Madrid and Ripple Swell in New York. If you met us in Singapore, or wish you had, get in touch.
Notabene Provides Trust Infrastructure to Support Distributors of Anchorpoint's HKDAP Stablecoin
Supporting Travel Rule-compliant, on-chain settlement as HKDAP's institutional rollout expands into cross-border payments and tokenised asset settlement
Hong Kong, 8 October 2026 – Notabene, the trust layer for global money movement, today announced it is providing Travel Rule compliance and transaction authorisation infrastructure to support authorised distributors of HKDAP ("HKD At Par"), the regulated Hong Kong Dollar-backed stablecoin issued by Anchorpoint Financial Limited ("Anchorpoint"), a Hong Kong-licensed stablecoin issuer. HKDAP is designed to support secure, efficient and compliant digital value transfers across payments, treasury and tokenised asset ecosystems.
HKDAP has entered its Beta Access in August 2026, with Anchorpoint's authorised distributors, including regulated financial institutions and licensed virtual asset exchanges, handling subscription, redemption, and fiat conversion for institutions, corporates, and professional investors. Given that HKDAP settles on a public blockchain network, distributors are subject to Travel Rule obligations requiring counterparty verification and pre-transaction compliance checks as adoption extends into cross border payments and the settlement of tokenised real-world assets. Notabene's enterprise grade transaction authorisation platform automates this Travel Rule compliance, giving distributing institutions real time counterparty verification and pre transaction authorisation before any transfer settles, applying the same trust standards regulated institutions already rely on for traditional cross-border payments.
Notabene's network connects thousands of trusted counterparties across over 100 jurisdictions, giving Anchorpoint's HKDAP authorised distributors immediate, Travel Rule-compliant counterparty reach and enabling connections of institutional clients without building bilateral compliance connections on a one-to-one basis.
To support HKDAP ecosystem, Notabene offers authorised distributors that join its network a dedicated onboarding and support team, and regional data residency options for institutions with data sovereignty requirements. The aim is to help distributors demonstrate to institutional clients their readiness to meet Travel Rule obligations, while bringing key counterparties onto the same open network of thousands of regulated institutions. Each distributor and counterparty that connects makes the network more useful for the next, extending compliant reach across the market.
"Financial institutions distributing HKDAP expect a stablecoin transfer to meet the same standard as a wire: you know who is on the other side before the money moves. We're putting dedicated teams and regional infrastructure behind Anchorpoint's authorised distributors so that check happens in real time and never slows a payment down. That's what it takes for HKDAP to be used for cross-border settlement at an institutional scale."
—Daniel Nicolas, VP of Global Sales at Notabene
"Trust is the foundation of every financial network. Technology can make transactions faster, but sustainable commercial growth happens when institutions have confidence in the people, standards and safeguards behind every interaction. With Notabene bringing its global capabilities and network to the region, this strengthens the infrastructure needed for the next phase of digital finance and reinforces Hong Kong's role as a leading gateway between traditional and digital economies,"
—Milton Lam, Chief Commercial Officer & Co-Founder of Anchorpoint
About Anchorpoint
Anchorpoint Financial Limited is a subsidiary of Standard Chartered Bank (Hong Kong) Limited (SCBHK) and a joint venture established by SCBHK, HKT, and Animoca Brands in February 2025. With the vision of utilising tokenised money to rewire and supplement existing financial infrastructure for the betterment of the real economy, the initial goal is to build and advance the regulated HKD stablecoin “HKDAP” to serve as a secure tokenised medium of exchange for digital economy and to facilitate international payments and capital flows. It is one of the first entities granted with a stablecoin issuer licence (licence number FRS01) by the Hong Kong Monetary Authority under the Stablecoins Ordinance in April 2026.
For further information, please visit our Website and follow us on LinkedIn. For media enquiry please reach out at [email protected]
About Notabene
Notabene is the trust layer for global money movement. The Notabene network connects thousands of trusted counterparties, facilitating trillions of dollars in transaction volume annually across over 100 jurisdictions. Notabene provides industry leading tools for stablecoin payment coordination, real-time transaction authorization, counterparty verification, and self-hosted wallet identification, helping institutions build trust into every transaction.
Media Contact:
Clay Fain
VP Marketing, Notabene
I’ve now spent over 20 years in AML, and the first question I keep getting is: Who decided to send this money?
Last week at Sibos in Miami, Fed Governor Christopher Waller asked the same question to a room full of bankers:
"Who is on the hook if an agent makes the wrong purchase?"
I haven't stopped thinking about his question since.
Funny enough, at a client dinner the same night, the table's verdict on Sibos was pretty blunt in that every panel sounded the same. The ongoing keywords of payments, tokenization, stablecoins, AI, and repeat. Buried in all the sameness was the question I think matters most for anyone in compliance.
Gov. Waller split agentic commerce into two models: Agent-assisted, where you stay in control and agent-delegated, where the buyer "grants authority to an AI agent to shop and make payments on their behalf." He expects consumer shopping to go first and B2B to follow, and he named the catch himself: "higher transaction values typical in B2B commerce amplify the financial exposure from agent errors."
In other words, for my compliance colleagues: larger transaction values, accelerated decision-making, and zero manual sign-off.
And the Sibos program already had the next step on the agenda. One session in the Securities and FX stream is called "AI as market agent and counterparty." The keyword here is “counterparty.” We're not talking about a chatbot helping someone fill out a form anymore.
Call it Know Your Agent (KYA), the agent-era version of KYC: who the agent acts for, what the agent is allowed to do, and how you shut it off.
We already know how to do this. Sort of.
Banks have handled "someone acting for someone else" for a long time. When a company wires $5 million, nobody checks only the company. You check the signatory list, the board resolution, the limit on each signer, the power of attorney, any standing instructions, etc. Authority has a paper trail, and every ops team knows where the paper lives.
The problem is the paper. An agent needs the same trail, in a format a machine reads before the payment moves, and one the counterparty on the other side sees too.
Six know your agent (KYA) questions for compliance teams
Six questions I'd put to any compliance team rolling out (or receiving) agent payments:
Who is the principal? Our CDD covers the person or the business. The agent's mandate sits outside the file.
What is the agent allowed to do? Limits, payees, assets, jurisdictions, an end date. Where do those rules live? Does the other side ever see them? And when both sides run agents, whose rules win?
Whose instruction is this? FATF's revised Recommendation 16 says the payment chain starts "with the financial institution which receives an instruction from the customer." Okay. A human sets a goal. The agent picks the payee, the amount, the timing and the rail. Which part was the instruction?
Who owns the sanctions hit? OFAC's own Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021) spells out the rule: civil penalties apply on "a strict liability legal standard." Liability attaches even without knowledge or intent. "The agent picked the payee" won't save you. The decision moved to software. The liability didn't.
What will the agent learn to game? This one worries me most. Tell an agent to minimize fees and friction, and the agent figures out payments under the $3,000 U.S. Travel Rule threshold move with less data. So ten payments of $2,900 instead of one of $29,000. If a human did this, we'd be opening a case. When an agent does this, the vendor calls the behavior optimization.
How do you take the authority back? Think about removing an authorized signer. The company sends a letter, the bank updates the signatory list, and the old signer is out. Now picture one agent connected to a company's bank account, corporate card and exchange account at the same time. The company drops the vendor. Who tells all three? If one of them misses the update, the old agent still holds working credentials, and the next payment goes out anyway. Granting authority to an agent takes one click. Taking the authority back has to be as fast, everywhere at once.
The part banks should worry about
Today, a business logs into the bank to pay a supplier. The bank sees the customer, the payment and the approval. The relationship lives at the bank.
With an agent, the business never logs in. The agent finds the supplier, agrees the price and sends the payment from whichever account is connected. The customer talks to the agent, not the bank. The bank still holds the money and still carries the regulatory risk, but loses the relationship.
So what keeps the bank relevant? Control. The bank sits in the right spot to check the agent's authority before money leaves the account:
- Is this agent allowed to make this payment?
- Is the amount inside the limits the customer set?
- Has the customer pulled the agent's authority?
- Is there a record of what the customer asked for and what the agent did?
- If the agent gets the payment wrong, who fixes the problem for the customer?
Compliance teams already do this kind of checking every day. With agents, those checks stop being back-office work. They become the reason customers keep banking with you.
Where the Travel Rule fits (and where the Travel Rule stops)
The Travel Rule already does half the job for virtual asset transfers. Originator and beneficiary data move with the transfer between the VASPs on each side. What the data doesn't carry yet is the mandate: who authorized the agent, for what, within which limits, and until when.
Look at IVMS101, the common data model for Travel Rule messages. There's an originator, a beneficiary, the VASPs on each side and any intermediary VASPs. There's no field for software acting on someone's behalf.
Timing matters too. On a blockchain or a shared ledger with final settlement, there's no recall. If an agent pays the wrong party at 2 a.m. on a Saturday, the money is gone before anyone wakes up. The check has to happen before settlement, not after.
And standards take a long time. The FSB's Martin Moloney noted in July ISO 20022 adoption sits around 77% of fast payment systems and 53% of settlement systems, more than two decades in. Agents won't wait twenty years for us.
This is why we built the Transaction Authorization Protocol (TAP) as an open protocol. Agents acting for each party exchange identity, authorization and settlement details before anything settles. A connect message (TAIP-15) carries the mandate itself: the principal, the agent asking for authority, allowed purposes, spending limits, approved beneficiaries and assets, and an expiry. The other side sees the authority before the money moves and not after.
At Notabene we talk about two problems: knowing who sits behind a blockchain address, and settling a payment with counterparties you know. Agents add a twist to the first one. Knowing who sits behind the address now includes knowing who speaks for them.
Even Waller pointed this way, toward standards showing what the buyer intended and how the agent carried out the instruction.
If I were back in a CCO seat
The things I'd start thinking about when it comes to an “AI Payment Agent Compliance Program” would be:
- Find the agents you already have. Ask where software, not a person, starts payments today. Look at treasury tools, invoice platforms and vendor apps, including the ones nobody calls "AI."
- Write down what each agent is allowed to do. Record who gave the permission, what the agent is allowed to pay for, the spending limits and the end date. Keep this in the customer file, next to the KYC.
- Get the same details from the other side. Before a payment settles, ask the bank or VASP on the other end which agent sent the payment and who authorized the agent. The Travel Rule and pre-transaction authorization would be a key mitigating control here. I would also spell out in your contracts who pays when an agent makes a mistake.
- Save the request and the result. Keep a record of what the customer asked for and what the agent did. When a dispute comes in, the answer sits in the difference between the two.
- Practice shutting an agent off. Turn off one agent's access and time how long until the payments stop. If the answer is hours, you have a gap to fix.
KYC tells us who the customer is. Know Your Agent has to tell us who speaks for the customer, how far the authority goes, and how to take the authority back.
If you're already seeing agent-initiated payments in production, I'd like to compare notes.
Summary and key takeaways
Most institutions have stopped asking whether to use stablecoins. The open question is how to run them safely at scale, and that is where the friction now sits.
Jack McDonald, SVP of Stablecoins at Ripple, joins Alice Nawfal, President and co-founder of Notabene, to talk through what that takes. Jack came to Ripple through its acquisition of Standard Custody & Trust, the institutional custodian he co-founded in 2018. Before that he spent more than a decade running a broker-dealer and fund administration business, so he approaches stablecoins as an operator.
His view is that the settlement infrastructure institutions need largely exists today, and that US regulation has moved from headwind to tailwind since the GENIUS Act. What remains is education and trust. Institutions need to understand what each counterparty's license means and who sits on the other side of a transaction. They also need to accept that a cross-border payment is only as good as its last-mile payout, which is where newer entrants most often underestimate the work.
Jack explains why Ripple made a strategic investment in Notabene, what changes when RLUSD runs inside Notabene Flow, and why RLUSD's daily activity matters more to him than its market cap. He also describes how Ripple is bringing 1,400 corporate treasury customers on chain, starting at the crawl stage.
He closes with a test for success: the day an operator stops switching between a TradFi screen and a digital asset screen.
Key takeaways
- The infrastructure is largely built. Jack sees three factors in institutional adoption: regulatory clarity, infrastructure, and education. Infrastructure is mostly in place, and education is now the bottleneck.
- Stablecoins are the easiest first step. Jack calls them the least controversial way for an institution to enter digital assets, helped by the GENIUS Act giving US stablecoins a federal framework.
- Institutions need to know who they are dealing with. That means understanding the licenses held by the issuer, the custodian, and the payment service provider, and verifying the counterparty on the other side of each transaction.
- The last mile decides straight-through processing. Payments into G7 banking corridors tend to run smoothly. Secondary and tertiary markets are where fragmentation shows up, and where local payout partners matter most.
- Daily activity beats market cap as a measure of utility. RLUSD's daily activity grew from about $100M at the start of 2026 to $1.3B a day by August, according to Jack, driven by payments and capital markets use.
- Success means one operating system. Jack's finish line is capital markets and payments running on one system, with stablecoins used as collateral and as a payment instrument, and nobody calling it crypto anymore.
Speakers
Jack McDonald, SVP of Stablecoins, Ripple
Jack leads Ripple's stablecoin business, including RLUSD. He joined Ripple in 2024 through its acquisition of Standard Custody & Trust, the New York-chartered institutional custodian he co-founded with Ripple co-founder Arthur Britto in 2018 and still leads as CEO. Before moving into digital assets, he spent more than a decade as CEO of Conifer Financial Services, which ran a broker-dealer, middle office, and fund administration business, and earlier worked on the sell side at UBS.
Alice Nawfal, President and co-founder, Notabene
Alice co-founded Notabene and leads its business and operations. She was previously Chief Operating Officer at uPort, the identity platform from ConsenSys built on Ethereum, and before that a management consultant at Bain & Company. She holds a public policy degree from the Harvard Kennedy School and an MBA from Wharton.
Links: Author page · LinkedIn
SAN FRANCISCO, September 17, 2026 —
Sardine, the leading agentic risk platform for fighting financial crime, today announced a partnership with Notabene, the trust layer for global money movement, to bring their industry-leading transaction authorization to Sardine's platform. Through the integration, Sardine customers can manage and automate their Travel Rule requirements and transaction authorization alongside fraud, KYC/KYB, AML transaction monitoring, and sanctions screening within a single, unified platform.
The partnership comes as regulatory clarity accelerates across the crypto and stablecoin industry with the EU’s Markets in Crypto-Assets Regulation and Transfer of Funds Regulation (MiCA/TFR), Brazil's BCB Resolution 520, and broader adoption of the Financial Action Task Force's Travel Rule standards giving companies the certainty to invest with confidence. That stability is drawing a new wave of fintechs and traditional financial institutions into the stablecoin market, and a rising demand to consolidate compliance infrastructure.
The integration pairs Notabene's transaction authorization platform, and the largest network of regulated entities in the industry, with Sardine's risk platform to provide joint customers with a single point of access to both. This allows customers to not only manage Travel Rule requirements alongside the rest of their risk and compliance operations, but also feed transaction-level decisions back into Sardine to strengthen their overall risk management posture.
"Notabene has the deepest counterparty network in the industry, and now it's integrated directly into Sardine's platform. That means our customers can handle Travel Rule compliance alongside fraud, KYC/KYB, AML monitoring, and sanctions screening all in one place, without adding another vendor to manage.”
—Soups Ranjan, CEO and Co-Founder of Sardine
“Crypto and stablecoin companies shouldn’t have to choose between transaction-level or customer-level risk. Both are critical components of a robust compliance stack. By bringing our network and transaction authorization platform together with Sardine's, joint customers get real-time counterparty verification and transaction authorization running alongside the fraud and AML tools they already rely on, in one place."
—Alice Nawfal, Co-founder and CEO of Notabene
Notabene's network connects thousands of trusted counterparties, facilitating trillions of dollars in transaction volume annually across more than 100 jurisdictions, extending the number of counterparties that customers can safely transact with, on the open-loop and ISO 20022-compatible Transaction Authorization Protocol. While Travel Rule compliance is the entry point for many of its customers, Notabene's core service is transaction authorization infrastructure, providing tools for stablecoin payment coordination, real-time transaction authorization, counterparty verification, and self-hosted wallet identification that help institutions increase their straight-through processing rates and build trust into every transaction.
Sardine backs that network with a risk platform built to help crypto and stablecoin companies detect and stop financial crime across the customer lifecycle, from onboarding and KYC/KYB through transaction monitoring and sanctions screening.
About Sardine
Sardine is the leading agentic risk platform for fighting financial crime. Our integrated fraud and AML solutions unify data across risk teams, enabling real-time fraud detection and automated compliance operations. More than 450 global enterprises rely on Sardine to secure and grow their products, including category leaders across banking, fintech, wealth and retirement, HR and payroll, payments, and software. Customers include FIS, Experian, National Bank of Canada, Nubank, GoDaddy, Deel, Gusto, Paylocity, Xero, and ZoomInfo. Learn more at sardine.ai.
About Notabene
Founded in 2020 and headquartered in New York, Notabene operates the largest open network of regulated on-chain transactions, enabling 280+ institutions — such as Ripple, Copper, Crypto.com, OKX, Boerse Stuttgart, and more — to confirm and verify counterparties in real time, authorize transactions before settlement, and unlock compliant B2B stablecoin payments. Notabene connects thousands of trusted counterparties, facilitating trillions of dollars in transaction volume annually across over 100 jurisdictions. To learn more, visit notabene.id.
Media Contacts
Aaron Berger
AM Partners (for Sardine)
917.355.8959
Clay Fain
VP, Marketing (for Notabene)
Stack Chats Episode 5: Bringing Stablecoin Payments to Latam with Andres Junge
Guest: Andres Junge, Founder, Anyenk
Host: Pelle Braendgaard, CEO & Co-Founder, Notabene
Topics: Stablecoins, Payments Infrastructure, Compliance, Interoperability, Latin America
In this episode of Stack Chats, Notabene CEO Pelle Braendgaard sits down with Andres Junge of Anyenk to discuss brining B2B stablecoin payments to Latam with Notabene Flow.
Watch the full episode below:
🎙️ Stack Chats is Notabene's video series for product leaders, fintech builders, and infrastructure innovators shaping the next generation of blockchain-based payments.
Anyenk, the Chilean company building digital-asset payment infrastructure for businesses across Latin America, has launched its native integration with Notabene Flow, the open B2B stablecoin payments network. Its customers can now invoice buyers and pay suppliers anywhere in the network in stablecoins, with the compliance and reconciliation work handled as part of the payment rather than after it.
The problem Anyenk set out to solve is familiar to any exporter in the region. A Peruvian manufacturer invoicing a buyer in Europe waits days for correspondent banking to clear and pays a fee at every stage. Moving to stablecoins fixes the speed and the cost, but settles a payment with no invoice reference, no verified sender, and nothing for the finance team to reconcile against.
Anyenk's founder and CEO, Andres Junge, co-founded Notabene in 2020 and served as its CTO through 2024, making him one of very few people who have architected payment infrastructure and then built a company that runs on it.
"I spent years building the trust layer that makes institutional digital-asset payments work. What I can see now, from the other side, is what it is worth to a manufacturer in Santiago. The same network that was built to ensure compliant digital asset transactions now enables an invoice to get paid in minutes instead of days, by a verifiable counterparty, with all of the invoice details attached so their finance team can reconcile the transaction.. That is exactly the long-term vision we had in mind when founding Notabene to bring crypto to the everyday economy, and I’m privileged to help make this a reality with the work we’re doing at Anyenk for the Latin American market."
—Andres Junge, Founder of Anyenk
On Notabene Flow, the counterparty, the chain, and asset are verified before anything settles. Travel Rule compliance data is carried securely and automatically, while the invoice reference travels with the payment, so the funds arrive ready to reconcile in the books.
One integration for Anyenk reaches counterparties held at any of the 290+ regulated institutions active on Notabene across more than 100 countries, with no bilateral relationship to negotiate per corridor.
"Latin America is where the case for compliant stablecoin payments is most obvious. Correspondent banking is expensive, and the businesses at both ends are sophisticated enough to move the moment something better exists. Anyenk is demonstrating what the Notabene network does for real trade, and there is no stronger validation of the architecture than one of its designers choosing to build his own company on it."
—Pelle Brændgaard, Co-founder of Notabene
Notabene and Anyenk are hosting a joint session on compliant stablecoin payments for Latin American businesses later in September — stay tuned for details.
To learn more about how Anyenk and Notabene can help with your B2B stablecoin payment infrastructure in Latin America, schedule time with our team.
About Anyenk
Anyenk builds digital-asset payment infrastructure for Latin American businesses, providing non-custodial institutional wallets and coordinated access to local and global fiat rails.
About Notabene
Notabene is the compliance and authorization layer for institutional digital-asset payments. Its network connects 290+ regulated institutions across more than 100 countries, reaches over 2,300 institutions, and has processed more than $2.5 trillion in transactions. Notabene Flow is its open B2B payments network, allowing companies to send and receive compliant stablecoin payments on the world’s largest network of regulated institutions.
We've designed a new analytics experience in Transact, built to show you how much of your transaction flow is clearing without human hands on it.
Most analytics products are designed for the quarterly review. Someone opens them once, exports a chart into a board deck, and closes the tab for six weeks.
That is not how compliance teams work.
So we designed against a different test. A compliance officer logs in at 8am with coffee. They glance at the status breakdown to see if anything stalled overnight. They check outstanding due diligence requests. They look at volume week over week. They scan top counterparties. They check what percentage resolved automatically. Then they close the tab and get on with the day.
Ninety seconds, start to finish.
If the dashboard supports that ritual, we built the right thing. If it takes five minutes to find any one of those answers, we didn't. Everything below follows from that.
Transaction Metrics
The first of two views. It answers the question you have before you've finished your coffee: is anything wrong, and how much did we have to touch by hand?
Percent resolved automatically is the number most teams end up watching hardest, because it is your straight-through processing rate made visible. Every transaction that clears without a person opening it is time your team didn't spend, and cost your business didn't carry. Watching that number is how you find out whether your policy configuration is doing its job or whether your team is quietly absorbing work that automation should be handling. When it dips, a policy usually needs attention. When you tune one and it climbs, you can see the return.
That has always been the point of configurable authorization workflows. Until now you had to infer the effect. Now you can watch it.
Status breakdown shows where your transactions actually sat, so a pile-up in one state is visible immediately rather than at month-end.
Median response latency tells you how long counterparties actually take to come back to you. Median rather than mean, deliberately: a handful of outliers shouldn't distort your view of a normal day. Slow counterparties are one of the largest drags on straight-through processing, and this is where you find out which ones they are.
Hosted vs self-hosted splits, broken out by proof of ownership type, show the shape of your self-hosted wallet exposure. Given where supervisory attention is going, this is a view worth knowing before someone asks you for it.
Counterparty Metrics
The second view is about who you're transacting with.
Active counterparties and top counterparties by volume show concentration. Most teams have a rough sense of their largest relationships. The ranked view tends to surprise people anyway.
Top jurisdictions does the same for geography, which matters more each quarter as obligations activate in new markets on different timelines.
Due diligence status is the one we're most pleased with, because it doesn't dead-end. Every counterparty's DD status links straight through to DD Management. You spot the gap and you act on it in the same motion, rather than noting it somewhere and coming back later. Incomplete due diligence is a common reason transactions fall out of automation, so closing those gaps feeds directly back into the number at the top of the page.
The global transaction flow map
An interactive map of your transaction flows, showing where value is actually moving across your network.
It is the fastest way to explain your business to someone who doesn't live in it. Auditors, boards, and new team members understand a map immediately, in a way they don't understand a table.
Export when you need it
CSV export is included throughout. The dashboard is built for the daily glance, but reporting season is real, and your data should come with you when it arrives.
Where to find it
Look for Analytics in the left-hand menu. It's rolling out now, with no configuration required.
Book a walkthrough with your customer success manager or schedule a demo with the team
This guide explains what the Notabene Flow MCP server is, how to connect it to Claude and Codex clients—claude.ai in the browser, Claude Desktop, Claude Code, Codex desktop, and Codex CLI—and how to use its tools once connected.
What is the Notabene Flow MCP server?
MCP (Model Context Protocol) is the open standard that lets AI assistants such as Claude and Codex call tools on external services. Notabene Flow provides a hosted MCP server that brings compliant stablecoin payment link generation directly into your AI assistant.
In practice, that means you can hand your assistant an invoice—a PDF, an image, pasted text, or just a description—and ask it to “create a payment link for this.” The assistant extracts the invoice data, helps you choose where the funds should settle, and creates a payment link you can share with your customer, with Notabene handling Travel Rule compliance behind the scenes.
Key properties:
- The assistant acts for the merchant—the business getting paid. Your identity is your verified login email; it is never something the assistant or an uploaded invoice can override.
- Login is simple. Connecting from any supported client opens a login page where you enter your email and a one-time code sent to it. Sessions last up to 7 days, then you sign in again.
- Interactive previews. On ChatGPT, claude.ai and Claude Desktop, previewing or creating an invoice renders a live invoice preview in the conversation. CLI clients return equivalent text summaries instead.
Endpoint
https://flow.link/mcp
Authentication endpoints are discovered automatically—this is the only URL you enter.
Connecting
Claude (web)
- Click your initials in the lower-left corner, then select Customize → Connectors.
- Click Add → Add custom connector.
- Enter
https://flow.link/mcpand click Add. No OAuth client ID or secret is needed. - Click Connect. Enter your email in the Notabene Flow login, then the one-time code sent to it.
- In a chat, click the + button, open Connectors, and make sure the connector is enabled.
On Team and Enterprise plans, an organization admin adds the connector first under Admin settings → Connectors. Members then connect with their own email from Customize → Connectors.
Claude Desktop app
Open Customize → Connectors → Add → Add custom connector, enter https://flow.link/mcp, then click Connect and complete the email login. Enable it in a conversation through the + → Connectors menu.
Claude Desktop supports the interactive invoice preview, so previews and created payment links render inline in the conversation.
Claude Code (CLI)
Add the server over HTTP transport:
claude mcp add --transport http notabene-flow https://flow.link/mcp
Use --scope user to make it available in all your projects, or --scope project to write it to a shareable .mcp.jsonfor your team.
Inside a session, run /mcp, select the server, and choose Authenticate. Your browser opens the Notabene Flow login. claude mcp list shows the connection status.
Claude Code does not render the interactive preview; the tools return text summaries instead.
ChatGPT/Codex desktop app
- Open the Plugins page.
- Click Add in the upper-right corner, then select Add MCP server.
- Enter
notabene-flowas the name andhttps://flow.link/mcpas the server URL. - Complete the form to add the server.
- When prompted, complete the Notabene Flow login using your email and the one-time code sent to it.
- Open the MCPs tab on the Plugins page to check that Notabene Flow is connected.
Once connected, try: “Use Notabene Flow to list the supported settlement assets and chains.” Then provide an invoice and ask Codex to validate and preview it before creating a payment link.
Codex CLI
Register the server and sign in from your terminal:
codex mcp add notabene-flow --url https://flow.link/mcpcodex mcp login notabene-flow
Complete the Notabene Flow email login in your browser. Run codex mcp list to inspect the configuration, then start Codex and run /mcp to check the active connection.
Codex desktop and Codex CLI share MCP configuration on the same host, so setup in either client is sufficient. Restart an already-running client after adding the server.
Codex CLI does not render the interactive invoice preview. Ask it to use preview_invoice_text, then review the invoice and settlement destination before requesting the payment link.
Using the tools
Available tools
update_profile— Sets your merchant display name and optional tax ID or address shown on every payment link.get_invoice_extraction_guide— Gives the assistant the extraction guide to follow when you upload or paste an invoice.validate_invoice— Normalizes and validates an invoice without creating anything.preview_invoice/preview_invoice_text— Shows the invoice before committing, as an interactive preview in supported clients or as text in CLI clients.list_supported_assets— Lists the stablecoin assets and chains a payment link can settle in.find_provider— Looks up an exchange or custodian such as Kraken, Coinbase, or Fireblocks.request_wallet_proof— Creates a single-use, 24-hour signing link for proving ownership of a self-hosted wallet. No funds move.get_wallet_proof_status— Checks a wallet-proof request and returns the settlement address once signed.create_invoice_payment_link— Issues the payment link.
Typical flow
- Set your profile once: the assistant calls
update_profilewith your business display name. - Get the invoice in: upload or paste an invoice, or describe it. Your customer’s email is required so the payer is identifiable.
- Preview: the assistant validates and previews the invoice so you can confirm it before committing.
- Choose the settlement wallet where funds land. Use a wallet from a previous invoice, an account at an exchange or custodian found with
find_provider, or a new self-hosted wallet verified throughrequest_wallet_proof. - Create the link:
create_invoice_payment_linkreturns the payment link URL. Share it with your customer, who opens it, picks an asset and chain, and pays. You are shown as the beneficiary.
Example prompts once connected:
“Here’s an invoice PDF—create a payment link for it. Settle to my Kraken account.”
“Create a $500 payment link for consulting services for [email protected], settled to the wallet I used last time.”
Good to know
- After you sign a wallet proof, it can take up to a minute for the signature to appear. The assistant will wait and re-check.
- Wallet ownership proofs are per wallet, not per invoice: sign once, and later invoices skip the step.
- An optional bank account adds a fiat payment fallback to the link.
- Payment links are valid for 60 days by default. If the invoice has a due date, the link stays payable until 60 days after it, capped at 2 years from creation. Wallet-proof signing links are single-use and expire after 24 hours.
- Travel Rule compliance is handled by Notabene. A new self-hosted wallet needs a signed ownership proof before it can receive a link.
Notabene Announces Strategic Investment from Ripple
Ripple invests in the trust infrastructure needed to scale stablecoin payments
NEW YORK — Notabene, the operator of the world’s largest open network for regulated on-chain transactions, today announced a strategic investment from Ripple, the leading provider of blockchain-based enterprise solutions across traditional and digital finance.
Alongside the investment, Notabene and Ripple will collaborate to expand enterprise stablecoin payments by integrating Ripple USD (RLUSD) into Notabene Flow and exploring how trusted payment authorization can complement Ripple Payments. Notabene Flow is Notabene’s B2B stablecoin payments platform that enables payment coordination and authorization capabilities, which leverage and are built on top of Notabene’s scaled transaction authorization network. By combining Ripple’s global enterprise ecosystem and RLUSD stablecoin with Notabene’s trusted institutional network, which today facilitates over $2 trillion in annualized transaction volume, the partnership is set to accelerate adoption of compliant stablecoin payments while creating a pathway for RLUSD to be integrated across one of the world’s largest institutional payment networks for digital assets. Together, the companies aim to make compliant stablecoin transactions easier for financial institutions to adopt at scale.
To date, Notabene has built the largest open network for moving value on-chain safely, combining Travel Rule compliance with broader pre-transaction verification and authorization capabilities. The network spans more than 2,300 connected institutions, 100+ global jurisdictions, and 280+ customers, including tier-1 banks, custodians, fintechs, and global exchanges, and has facilitated over $2 trillion in annualized transaction volume. Through Notabene Flow, the company is extending its trust network and infrastructure into novel capabilities for B2B and agentic stablecoin transactions, including pull payments, recurring payments, and automated invoicing solutions.
As financial institutions move from experimentation to production with stablecoins, institutions need to know who they are transacting with, verify counterparties and transaction details before value moves, and meet regulatory and internal risk requirements without introducing friction. Notabene's trust network helps solve that challenge, making it a natural complement to Ripple’s enterprise payments and stablecoin infrastructure.
“Stablecoins are quickly becoming part of mainstream financial infrastructure, but institutional adoption depends on more than efficient settlement rails alone. It requires trusted identity, compliance, and transaction authorization before value moves. Notabene’s network addresses one of the fundamental barriers to enterprise adoption, and together we're helping build the compliant infrastructure institutions need to move value at global scale while expanding the utility of RLUSD.”
Jack McDonald, SVP of Stablecoin at Ripple
Ripple’s investment comes amid growing demand for regulated digital asset infrastructure, as banks, payment networks, fintechs, and new stablecoin consortia move to launch tokenized cash products and embed stablecoin rails into their existing offerings. Institutional momentum in adopting digital assets as core financial infrastructure has been reinforced by growing regulatory clarity globally, including the passage of the GENIUS Act in the United States and MiCA in the European Union. As stablecoins become increasingly utilized in regulated, high-value flows, institutions must verify counterparties and authorize transactions before value moves—capabilities that sit at the core of Notabene’s platform.
“Every institution I talk to has moved past whether to use stablecoins. They are stuck on how to do it safely at scale within the context of their existing business. They need to know who is on the other side, what the transaction is for, and how to authorize payments without adding friction. That is what Notabene and its network of regulated institutions solve. Paired with an enterprise-ready stablecoin like RLUSD and Ripple’s global payments reach, it turns compliant stablecoin payments from a pilot into a real growth engine that reaches more counterparties and moves more volume, faster,”
Pelle Braendgaard, Co-Founder and CEO of Notabene
With the investment, Notabene will leverage Ripple’s enterprise ecosystem to accelerate the rollout of Notabene Flow, extending compliant stablecoin payments to institutions worldwide.
Establishing strategic partnerships is a core pillar of Notabene's strategy for scaling Notabene Flow, and it expects to bring on other leading financial institutions over the coming quarters.
About Notabene
Founded in 2020 and headquartered in New York, Notabene operates the largest open network of regulated on-chain transactions, enabling institutions to confirm and verify counterparties in real time, authorize transactions before settlement, and unlock compliant B2B stablecoin payments. Notabene serves 280+ customers across global banks, fintechs, custodians, and exchanges. To learn more, visit notabene.id.
About Ripple
Founded in 2012, Ripple is the leading provider of blockchain-based enterprise solutions across traditional and digital finance. Its solutions span global payments, custody, liquidity, and treasury management, serving as a one-stop shop for moving, storing, exchanging, and managing value. Ripple’s stablecoin, RLUSD, and the cryptocurrency XRP underpinning these solutions allow Ripple and its customers to shape the modern financial system.
Media Contacts
Notabene Media Contact: Clay Fain, VP of Marketing <[email protected]>
Ripple Media Contact: Amy Dunn, Product Communications <[email protected]>