The FATF's seventh Targeted Update shows Travel Rule laws in place across 93% of surveyed jurisdictions. The gap now is enforcement.

Eight years after the FATF extended its AML/CFT Standards to virtual assets, the annual check-in on the progress has arrived. On 15 July 2026, the FATF published its seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs), drawing on survey responses from 147 jurisdictions, 149 mutual evaluations and follow-up reports, and a year of Virtual Assets Contact Group work, including the December 2025 symposium.

The report’s headline figure is clear: 83% (91 of 109) of surveyed jurisdictions now have Travel Rule legislation in force, up from 73% last year. When adding in the 11 jurisdictions with legislation in progress, 93% (102 of 109) of surveyed jurisdictions have Travel Rule either in force or in progress, compared with a combined 85% in 2025.

For years, the sunrise issue was cited as a major compliance barrier: firms subject to the Travel Rule often struggled to comply when transacting with counterparties in jurisdictions where equivalent obligations did not yet apply, leaving compliant firms to absorb the operational burden and cost. The latest data shows that this legislative adoption gap is now closing. Travel Rule laws are largely in place; the more persistent challenge is no longer adoption, but effective supervision and enforcement.

Here are our takeaways.

1. The Travel Rule question changed from "is there a law" to "does anyone check"

Of the 91 jurisdictions with Travel Rule legislation in force, 55 (or 60%) have not issued a single finding, directive, or enforcement action on Travel Rule compliance. The FATF partially attributes this gap to timing, noting that many of the laws are recent and supervisory frameworks are still being established.  It also directs supervisors to its 2025 Best Practices in Travel Rule Supervision paper.

Yet, the report cautions that persistent gaps in Travel Rule implementation remain a serious concern, and jurisdictions with the rule on the books should rapidly operationalize supervision and enforcement.

Notabene's commentary:

The sunrise issue is entering a second phase. The original problem was counterparties with no legal obligation to comply. The new one is counterparties with a legal obligation, and nobody is checking whether they meet it. From the perspective of a compliance officer of a compliant firm, the two look identical: incomplete data, unanswered transfers, and costs concentrated on the firms taking the rule seriously.

Our advice to VASPs has not changed. Build to the rule, not to the enforcement posture. Enforcement shows up unevenly, without much warning, and sometimes through channels nobody planned for. Firms waiting for the first knock end up remediating under pressure instead of complying on their own schedule.

2. R15 Technical Compliance Is Improving—But Slowly

Technical compliance with FATF Recommendation 15 improved modestly in 2026. One jurisdiction was rated fully compliant in both 2025 and 2026. The share rated largely compliant increased from 29% in 2025 to 34% in 2026, while the share rated partially compliant fell from 50% to 43%. The proportion rated non-compliant remained broadly unchanged, rising slightly from 21% to 22%. Overall, the results point to gradual progress, but nearly two-thirds of assessed jurisdictions remain only partially compliant or non-compliant.

Notabene's commentary:

The increase in largely compliant jurisdictions is encouraging, but the fact that nearly two-thirds remain only partially compliant or non-compliant shows that uneven regulatory maturity will continue to create operational complexity for VASPs. Firms still need to manage inconsistent requirements, supervisory expectations, and counterparty readiness across markets. In practice, technical compliance scores are improving, but the cross-border compliance environment remains fragmented.

3. Risk assessments are being written, not used

86% of jurisdictions (124 of 145) report having conducted an ML/TF/PF risk assessment covering VAs and VASPs, up from 76% in 2025. However, the mutual evaluation results tell a different story: Only 48 of 149 (32%) assessed jurisdictions were found to meet or mostly meet the criteria that assess whether preventive and/or mitigation measures are implemented in line with the identified risks.

Notabene's commentary:

A document is not a control. Where implementation stalls is the distance between writing a risk assessment and using one to steer supervisory resources. FATF has flagged this same pattern across several consecutive updates. For jurisdictions looking for a place to start, the report points to the December 2025 VACG symposium materials and to a VA/VASP annex to the ML National Risk Assessment Guidance, expected later in 2026 (para. 11).

4. Prohibition of VA activities more than doubled since 2023

The share of jurisdictions prohibiting VASPs has risen steadily over the past four years, more than doubling from 11% in 2023 to 23% in the latest survey.

Although prohibition is permitted under the FATF Standards, it does not remove the need for active oversight. Jurisdictions must still identify prohibited virtual asset activity, detect VASPs operating illegally, and take appropriate supervisory or enforcement action. Without that capacity, a prohibition may simply push activity outside the regulated perimeter rather than eliminate it.

There are signs, however, that jurisdictions adopting prohibitions are becoming more active in enforcing them. In the latest survey, 16 of the 21 jurisdictions explicitly prohibiting VAs and VASPs reported taking supervisory or enforcement action against operators acting illegally—approximately 76%. That compares with 9 of 17 jurisdictions, or 53%, in 2025. The increase indicates that prohibition regimes are becoming more operational, although their effectiveness still depends on whether authorities can consistently identify and sanction activity taking place outside the legal perimeter.

Notabene's commentary:

A prohibition nobody enforces is an unregulated market. Transactions keep flowing, no entity holds a license, and no Travel Rule data moves. For VASPs in permitting jurisdictions, this creates a quiet exposure: inbound flows from prohibited markets arrive with no compliant counterparty on the other side. Risk teams should treat prohibition jurisdictions as a distinct counterparty class, not an empty set.

5. Criminals are now building infrastructure because compliance is working

The report's most telling case study involves a Cambodia-based financial services conglomerate found to have laundered at least USD 4 billion between August 2021 and January 2025, including at least USD 37 million tied to DPRK cyber heists funding weapons programs.

A third-party stablecoin issuer froze more than USD 29 million in a wallet linked to the group. The group's response was to issue its own USD-pegged stablecoin, marketed as immune to freezing and deployed across multiple public blockchains plus a proprietary chain.

The freeze worked. Issuer-level controls did exactly what they were designed to do, and the criminals left the regulated asset entirely.

Notabene's commentary:

Two things worth noting. First, compliance controls shape criminal behavior, which is the whole point of having them. Second, the FATF now says openly what this case implies: obligated entities should not lean on issuer-level freeze and burn capability as a universal safeguard, because the highest-risk assets are increasingly issued by parties outside any oversight. Where the issuer is the adversary, controls have to live at the transaction and counterparty level.

The same section documents ISIL and Al-Qaeda shifting from Bitcoin toward stablecoins, paired with rotating wallet addresses, micro-split transfers, and OTC brokers with minimal customer due diligence. Stablecoin misuse is no longer an "emerging risk" in FATF language. This is a documented typology with named actors.

6. The regulatory perimeter is shifting from incorporation to activity

Offshore VASPs remain, in the FATF's words, a significant challenge. 39 of 114 jurisdictions with licensing frameworks (34%) now extend licensing or registration to offshore VASPs based on activity anchors: targeted marketing, onboarding of residents, and use of domestic payment rails. Some go further and require a local compliance officer with unrestricted access to customer data and enough seniority to act independently.

The report also walks through nested arrangements in which offshore VASPs open accounts on licensed platforms, posing as retail users, then push through illicit volumes far beyond anything retail. The FATF's private sector recommendations answer this directly: enhanced due diligence on offshore VASPs, detection of misrepresented accounts, restricting or exiting higher-risk relationships, and monitoring fiat on-ramp and off-ramp activity linked to weakly supervised platforms.

Notabene's commentary:

Activity-based licensing is expanding the regulatory perimeter beyond where a VASP is incorporated to where and how it operates. The nested VASP typology places a corresponding burden on regulated platforms: the risk may sit inside a customer account that is presented as retail but is, in practice, being used to provide virtual asset services at scale. Firms need controls capable of identifying when account behavior, transaction volumes, and payment flows are inconsistent with the stated profile.

7. DeFi Oversight Remains at an Early Stage

The 2026 survey points to limited regulatory engagement with DeFi. Only 18% of responding jurisdictions have assessed DeFi-related risks, while a further 9% are in the process of doing so. At the same time, 93% have not identified any DeFi arrangements operating in their territory that would qualify as VASPs under the FATF Standards. Although 31% reported that their existing risk-mitigation measures apply to DeFi arrangements, implementation remains rare: only four jurisdictions have imposed licensing or registration requirements, and just two have licensed or registered a DeFi arrangement in practice. Overall, the data suggests that most jurisdictions remain at an early stage of identifying, assessing, and supervising DeFi-related activity.

Notabene’s commentary:

Regulatory uncertainty around DeFi is not merely a product of technological complexity; it reflects limited assessment and policy implementation at the jurisdictional level. 82% percent of jurisdictions have not completed an assessment of DeFi-related risks, and 69% have not applied risk-mitigation measures to DeFi arrangements. For regulated firms, this creates uncertainty over which arrangements authorities may classify as VASPs and what obligations apply when interacting with them. Until more jurisdictions take a clear stance, firms will need to manage DeFi exposure against an uneven and still-developing compliance landscape.

8. Inside the annex: what the data from 69 materially important jurisdictions shows

Annex A tracks every FATF member plus jurisdictions with materially important VASP activity, defined as trading volume above 0.25 % of the global total or a top 30 ranking by VA ownership and adoption. Together, these 69 jurisdictions handle roughly 97% of the global VA market. The table is therefore a useful snapshot of implementation across the markets that matter most, but FATF is explicit that it is based largely on self-reported information and is not, by itself, an assessment of either illicit-finance risk or effective compliance.

On paper, implementation is advanced. Excluding the six jurisdictions that fully prohibit VASP activity, 39 of the remaining 63 report completing every applicable step tracked in the annex: conducting a risk assessment, establishing a licensing framework, bringing qualifying stablecoin issuers within scope, conducting or planning inspections, taking supervisory or enforcement action, and enacting the Travel Rule. Yet these self-reported milestones do not consistently align with FATF ratings. Several jurisdictions reporting a nearly complete framework remain rated Partially Compliant or Non-Compliant, illustrating the distinction between having the formal components of a regime and implementing them to the standard tested through a mutual evaluation.

However, the ratings also need to be read with caution because they do not all describe the same point in time. Six jurisdictions in the annex—Greece, Panama, Portugal, the Republic of Korea, Saudi Arabia, and Spain—have not been assessed against the revised Recommendation 15. Among the 63 jurisdictions with a rating, 31 were last assessed in 2022 or earlier. FATF itself warns that these ratings may not reflect developments reported in the 2026 survey. A recent self-reported reform can therefore sit beside an older weak rating without either data point necessarily being wrong. Belgium illustrates this mismatch particularly clearly. It reports a risk assessment, licensing rules, stablecoin coverage, inspections, and an enacted Travel Rule, but no enforcement action—and holds a 2025 Non-Compliant rating.

The data from materially important virtual asset markets closely mirrors the broader survey findings: Travel Rule adoption is now approaching near-universal coverage. Among the 63 jurisdictions that do not fully prohibit VASP activity, 55 (87%) have enacted the Travel Rule and a further four are in progress, bringing enacted or pending coverage to 94%. This is broadly consistent with the overall survey result, where 94% of responding jurisdictions had Travel Rule legislation either in force or under development, reinforcing that the legislative sunrise gap is closing both globally and across the markets that account for the vast majority of virtual asset activity. Only Argentina, Cambodia, Colombia, and Vietnam report neither an enacted nor an in-progress Travel Rule framework.

The table also shows that different parts of the regulatory perimeter are developing at different speeds. Eleven jurisdictions report that they do not require stablecoin issuers to be licensed or registered when they qualify as VASPs under the FATF Standards. Eight of those jurisdictions already have the Travel Rule in force. This means transaction-transparency obligations may be established even where the treatment of qualifying stablecoin issuers remains incomplete. It is an important qualification to the broader implementation story: Travel Rule adoption is approaching universality in major markets, but adjacent licensing frameworks have not advanced in lockstep.

Notabene's commentary:

The annex shows that the main compliance challenge is shifting. Across jurisdictions representing 97% of the virtual asset market, the Travel Rule legislative gap is close to being resolved: 94% of jurisdictions that permit at least some VASP activity have rules either enacted or in progress. The next differentiators are whether those rules are operational, how supervisors interpret and enforce them, and whether adjacent parts of the regulatory perimeter—including stablecoin issuers licensing and offshore VASPs—are treated consistently. For compliance teams, the annex is a valuable starting point for jurisdictional risk analysis.

Where this leaves the industry

Seven updates in, the direction is clear. The standards are established and legislative adoption is accelerating. The remaining constraint is operational: effective supervision, consistent enforcement, reliable identification of both customers and counterparties, and a more level cross-border compliance environment.

For compliance teams, the report points to a practical agenda. Firms should strengthen monitoring of higher-risk unhosted wallet activity, apply enhanced due diligence to offshore VASPs, detect accounts being used to conceal nested VASP activity, assess exposure to DeFi protocols, bridges, mixers, and cross-chain tools, and treat counterparty reachability as a core control rather than a network metric.

Strong internal controls are necessary, but they are not sufficient. Travel Rule compliance is inherently bilateral: a transfer can only be completed compliantly when the institution on the other side can be identified, reached, and trusted to exchange the required information. FATF’s data shows that the legislative gap is closing, but supervisory maturity and operational readiness remain uneven. The next phase of implementation will therefore be defined less by whether jurisdictions have rules on the books, and more by whether those rules contribute to a level playing field that reduces friction in cross-border value movement.

Source: FATF (2026), Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs, FATF, Paris.

‍

Peru does not get enough attention in crypto compliance circles yet, the numbers argue otherwise. Close to 28 billion dollars in crypto changes hands there every year, and 9 of every 10 of those moves are dollar stablecoins people use for savings, remittances, and getting paid across borders. About 4.5 million Peruvians hold crypto. In 2025, transfers between banks and wallet services crossed 540 million, more than double the year before.

Hence, firms must pay close attention when Peru establishes a compliance timeline. The mandate is the Travel Rule, and the critical date is August 1, 2026.

The Superintendency of Banking, Insurance and Pension Funds, (“SBS”), runs AML supervision through its Financial Intelligence Unit, the UIF-Perú. In July 2024 the SBS published Resolution 02648-2024, the AML/CFT norm for Virtual Asset Service Providers, or PSAV in Spanish. Almost all of the norm went live the day after publication. One piece did not. Chapter VIII, the Regla de Viaje, got a two-year grace period, and the grace period ends this August.

Who has to comply

Any VASP domiciled or incorporated in Peru, plus Peru branches of foreign firms. The covered activities track FATF Recommendation 15: swapping crypto for cash, swapping one crypto for another, moving crypto, holding or managing crypto for someone else, and helping sell a new asset. If you do any of these for Peruvian users, you have to register with the UIF-Perú and stand up an AML program, as well as have a named compliance officer.

Registration is the only status Peru asks for right now. There is no crypto license, no capital regime, no market-conduct rulebook. A broader market law, the Ley Marco for crypto, would create an exchange register called the RUPIC, and Congress kicked the draft back to committee in March 2025. Until the law changes, the AML regime and Chapter VIII are what binds you today.

What Chapter VIII asks for

Peru treats every crypto transfer as an electronic transfer, domestic or cross-border, held to the same minimum data. The duty sits with both sides. The sending VASP and the receiving VASP each have to obtain, keep, and pass along originator and beneficiary details.

There is no de minimis exemption. Peru applies the rule to transfers of any size. What changes with size is how much you collect. Under 1,000 dollars, a lighter data set. At or above 1,000 dollars, you add the originator's address, date and place of birth, or a transaction ID.

The originating VASP has to send the data to the beneficiary VASP immediately and securely, which Peru defines as before, with, or alongside the transfer, and with the data kept intact and available. Authorities will request the same information later, and you must be ready to produce records on demand.

Self-hosted wallets are where a lot of programs get nervous, and Peru does not ban them outright. For a transfer to or from a self-hosted wallet, you collect your own customer's information and ask the customer for the counterparty's details, at the same level the table sets out.

Peru is not an outlier

This is the same FATF Recommendation 16 story playing out across Latin America, where Peru now ranks among the six largest crypto markets in the region. Stablecoins take off, transfer volume climbs, and a Travel Rule deadline follows. Peru gave two years of runway, then wrote a 120-day setup window into the resolution once the rule goes live, so real preparation time is tighter than August 1 suggests.

Where to start

Start from a clear picture of the rule. Our Peru jurisdiction page sets out the full Chapter VIII requirements, the data thresholds, and the self-hosted wallet handling in one place, and we keep the page current as the August start approaches. Use the page to brief your compliance team and product leads, then bring the counterparty and workflow questions to us.

Where Notabene fits

If you serve Peru, this is the problem we work on every day. Notabene Transact collects and checks originator and beneficiary data, lets you set policy per jurisdiction through a rules engine, and handles self-hosted wallet verification the way Resolution 02648-2024 expects.

Want to pressure-test your Peru readiness before August? Talk to our team.

‍

What we asked FinCEN to do, and why open compliance infrastructure is the strategic prize.

The AML/CFT Programs Rule is the most consequential installment yet in FinCEN's multi-year effort to modernize the Bank Secrecy Act under the AML Act of 2020. The rule (Docket FINCEN-2026-0034) will reshape how U.S. financial institutions design and supervise their compliance programs for the next decade. Comments closed June 9, 2026.

The rule does several things:

• Codifies the AML Act of 2020’s risk-based, effectiveness-focused mandate into program requirements.
• Introduces a new supervisory and enforcement framework at proposed 31 CFR 1020.221, giving the FinCEN Director discretion to consider an institution’s innovative compliance activities and demonstrable outputs when deciding supervisory action.
• Adopts five risk assessment categories every covered institution will evaluate against.
• Sets a 12-month effective date once a final rule publishes.

The most consequential piece for digital assets is in the Supervision and Enforcement section in Question 28 “FinCEN welcomes comment on provisions related to the use of innovative tools to achieve effective outcomes, specifically on how the Director may consider the performance of innovative activities that produce demonstrable outputs under the proposed supervision and enforcement framework.”. Basically, FinCEN built a new framework for recognizing innovative compliance activities under supervision, and asked the market what counts. The answer determines whether the technology stack getting supervisory credit a decade from now is built on open standards or on proprietary vendor platforms.

We made three asks.

01. Bring back the outcomes-based effectiveness definition.

The 2020 Effectiveness ANPRM proposed defining an effective AML program as one giving law enforcement timely, useful information the government uses. Thus, outcomes and not box-checking.

The current NPRM softens the language. We asked FinCEN to restore the 2020 definition. Without an outcomes anchor, examiners default to checklists, and the new innovation framework has nothing substantive to anchor against.

02. Recognize Travel Rule infrastructure as a preventive AML control.

Question 28 asks which compliance activities deserve formal recognition as innovative. Our answer contained five things:

1. Travel Rule infrastructure. Pre-settlement data exchange enabling block, freeze, and reject decisions.
2. Pre-transaction authorization including the Transaction Authorization Protocol (TAP). Authorization before settlement, rather than monitoring after.
3. IVMS 101 data standardization. Common counterparty data structure across institutions.
4. Counterparty due diligence interoperability. GDF VASP Due Diligence Questionnaire as the shared baseline.
5. Counterparty-assisted false-positive resolution. Bilateral information exchange resolving sanctions screening hits.

All five are common and open compliance infrastructure. Open standards, implementable by any party. Not proprietary single-vendor networks.

Travel Rule deserves a closer look. Most AML controls are detective and after the fact.   Travel Rule, on the other hand, is preventive. Data exchange happens before settlement, which means the receiving institution blocks, freezes, or rejects a transfer before funds move on-chain.

03. Clarify the boundary between this rule and the PPSI rule.

This rule defines “distribution channels” narrowly: the methods institutions use to open accounts and deliver products. Remote onboarding, non-face-to-face channels, mobile, and similar.

A different FinCEN rulemaking already in progress, on permitted payment stablecoin issuers (Docket FINCEN-2026-0100), uses the same term much more broadly. Under the PPSI rule, blockchains themselves count as distribution channels.

Same term, two very different scopes. If institutions covered by both rules read the term the same way in their risk assessments, they end up running duplicate compliance frameworks against the same underlying risk. We asked FinCEN to clarify the boundary in the final rule.

What happens next

Twelve months after FinCEN finalizes this rule, every covered institution will be measured against a new supervisory framework. The institutions building on common and open compliance infrastructure now will have the evidence FinCEN says it wants to see. The institutions still on proprietary stacks will need a different story.

You can read Notabene's full response here: https://notabene.id/reports/notabene-response-to-fincen-aml-cft-program-nprm-fincen-2026-0034

‍

We’ve launched a new way to turn any invoice into a stablecoin payment link via Notabene Flow.

No integration required. Just upload a PDF invoice, generate a payment link, and let your customer pay with stablecoins — settled instantly to the asset of your choice.

Our new payment link generator can be found at flow.link

‍

Let's take a look at how it works:

‍

Notabene Flow is the open stablecoin payment network that authorizes every B2B invoice before it settles and reconciles it as it arrives — across any wallet, network, or jurisdiction.

It’s built on the Notabene network, the largest global network of regulated institutions, and completely open to build on thanks to the Transaction Authorization Protocol (or, TAP) which is an open-source, fully interoperable messaging protocol that allows Notabene customers, and their customers, to reach the counterparties they need to in a scalable, compliant, and trusted way.

Finance teams are going to love the way we’re enabling payments in the stablecoin of your choice, and transforming what used to be a cryptic transaction hash into a fully reconcilable payment record that includes all of the rich metadata and context needed to reconcile your transactions with whatever accounting systems you already use.

‍

We’d love for you to try it out for yourselves — grab the next invoice that you’re about to send out for payment and and upload it to flow.link and let us know what you think.

And if you’re a payment service provider, wallet provider, custodian, bank, or any platform that facilitates stablecoin payment flows, we’re able to bring the power of Notabene Flow directly to where your customers already live with a direct integration on your platform.

You can get in touch with our team at [email protected] or learn more and sign up to join the network at notabene.id/flow

On 11 June, Notabene hosted a panel of leading policy and compliance experts to take stock of MiCA's implementation journey and look ahead to what comes next. Here's what we heard.

The EU's crypto regulatory experiment has entered its final chapter. On 1 July 2026, MiCA's transitional period ends across all member states. From that date, crypto asset service providers operating in the EU must operate under full MiCA authorization — no exceptions.

At the same time, the European Commission has opened a targeted consultation asking a pointed question: is MiCA, as written today, still fit for purpose? The consultation covers stablecoins, DeFi, offshore CASPs, tokenization, and the relationship between MiCA and broader EU financial regulation — opening the door to MiCA 2.0, even before MiCA 1.0 has been fully implemented.

To make sense of this pivotal moment, Notabene's Director of Regulatory & Compliance, Catarina Veloso, ‍hosted a panel of senior experts from Bitpanda, VASPnet, Chainalysis, and Fireblocks for an honest assessment of where we are and where we're going.

What MiCA Got Right

The panel kicked off on a positive note. Acknowledging that despite implementation friction, the framework itself has delivered something meaningful: a harmonized regulatory perimeter that replaced a fragmented patchwork of national regimes.

Neil Samtani, CEO of VASPnet, put it directly: before MiCA, firms operated across 27 different national registers, with wildly uneven supervisory maturity — "silver and gold plating" practices that prevented a level playing field . MiCA replaced that with a single standard, a clear route to market, and genuine access to the EU single market via passporting.

"Today we have a mature, harmonized regulatory perimeter that's been drawn out — and that's especially valuable when you compare it to what things looked like pre-MiCA. There is a clearer route to market, and especially access to the single market, which is so important." — Neil Samtani CEO, VASPnet

Michał Truszczyński from Bitpanda made the operational stakes concrete: before MiCA, Bitpanda held 17 separate licenses and registrations across EU member states. One MiCA license now replaces that entire stack.

Matthias Bauer-Langgartner from Chainalysis highlighted a less-discussed benefit: MiCA has forced traditional financial services firms to engage seriously with crypto for the first time. He sees banks, MiFID firms, and EMIs now exploring stablecoin arrangements, custody, and trading platforms — participation that simply didn't exist before the regulatory legitimacy MiCA provided. Beyond its impact on market participation within Europe, Bauer-Langgartner also emphasized MiCA's growing role as a reference point for crypto regulation globally.

"MiCA has provided a global standard that is the baseline of discussions for other jurisdictions — which is extremely important, particularly around crypto assets, which are inherently global. It's not only a common standard for Europe, it actually sets the baseline for the international community, particularly the US and other jurisdictions now." — Matthias Bauer-Langgartner Head of Policy Europe, Chainalysis

Dea Markova from Fireblocks pointed to evidence of this institutional adoption in the licensing data. In some EU markets, roughly half of all CASP and issuance licenses have gone to banks or bank-affiliated entities, underscoring how traditional financial institutions are embracing the opportunities created by MiCA. Markova also observed that MiCA has attracted significant non-European players who are choosing Europe precisely because of the regulatory certainty it provides. Large global crypto firms are increasingly selecting EU member states as their MiCA domicile — a vote of confidence in the framework despite the compliance burden.

The Numbers Behind the Transition

Drawing on VASPnet's tracking of crypto businesses' regulatory footprints across Europe, Neil painted a striking picture of consolidation. Pre-MiCA, there were approximately 3,500 active VASP registrations EU-wide. Today, 1,700 transitional registrations remain active across member states still inside the grandfathering window — and just over 220 full MiCA licenses have been issued. His projection: roughly 400 CASPs will hold MiCA licenses once the dust settles.

‍

But Neil stressed that this should not be viewed simply as a shrinking market. While some businesses exited the market amid more challenging regulatory and commercial conditions, much of the reduction reflects regulatory consolidation enabled by passporting: firms that previously maintained multiple registrations across Europe can now serve the entire EU under a single MiCA license. The numbers have also been shaped by M&A activity, as larger firms acquire smaller operators.

With around 60% of CASP authorizations concentrated in just five jurisdictions — Germany, the Netherlands, France, Malta, and Cyprus — some observers have questioned whether MiCA is encouraging regulatory arbitrage or a race among member states to attract crypto firms. Matthias pushed back on any reading of this as a regulatory race to the bottom. The concentration in Germany, the Netherlands, France, Malta, and Cyprus — roughly 60% of CASP authorizations — is, in his view, a direct product of pre-MiCA history. Germany required banking licenses for crypto custody before MiCA existed; France ran a full DASP regime. Firms that were already operating inside a proper prudential framework had a materially easier path to MiCA authorization than firms accustomed to AML-only registration. The licensing map, in other words, largely reflects where regulatory infrastructure was already built. He also drew an important distinction between where firms are licensed and where crypto activity actually takes place.. Spain and Italy — countries with far fewer licensees — rank alongside the Netherlands in the top five for on-chain transactional inflows.

That gap is passporting working as intended, but it is also, as Matthias put it, precisely why supervisory convergence across member states matters. A firm can be domiciled in one jurisdiction and serve customers across the bloc. If the NCA in that jurisdiction is under-resourced or slower to act, the entire EU's consumer base carries the risk.

The Offshore CASP Problem

With full MiCA supervision beginning, one of the most urgent enforcement questions becomes: what happens to crypto firms that are not authorized and continue to serve EU customers?

Neil walked through research VASPnet conducted on the top 78 centralized exchanges:

• 8 held a MiCA license
• 20 were operating under at least one legacy member state registration
• 50 had no EU regulatory presence — but their terms of service didn't restrict European business

That last figure is the enforcement challenge. MiCA's reverse solicitation provisions are tight — Michał noted that even making a product available in EU app stores, in EU languages, or at EU-targeted conferences could constitute solicitation. But enforcement requires NCA capacity that varies significantly across member states.

Neil's read on Article 19B of the Transfer of Funds Regulation is particularly significant in this context: if an EU-licensed CASP is transferring value to an offshore firm, that relationship carries correspondent-level due diligence obligations. In other words, the Travel Rule isn't just a compliance checkbox — it's becoming a mechanism to map and contain the offshore CASP problem from within the authorized perimeter.

The MiCA Review: Fine-Tuning or Major Overhaul?

Here the panel's views were nuanced — and the audience's poll result was revealing.

When asked whether MiCA 2 is on the horizon, a clear majority of the audience expected a legislative follow-on.

Michał's reaction: Bitpanda would vote no on a major MiCA 2.0 overhaul.

"MiCA itself has 150 pages. The 47 implementing acts beneath it run to 2,000–3,000 pages. Add TFR and DORA, and you're looking at 5,000 to 10,000 pages of compliance reading in an industry that moves at pace. The ask from industry isn't a new framework — it's simplification and supervisory convergence."— Michał Truszczyński Senior Specialist Public Affairs, Bitpanda

The panel broadly agreed that the priority should be fine-tuning at levels 2 and 3. There are 47 implementing acts beneath MiCA's level 1 text — and beyond MiCA, firms must also contend with TFR and DORA running in parallel. The ask from industry isn't a new framework — it's simplification, coherence, and supervisory convergence across member states.

With firms and regulators still adapting to MiCA, launching a new legislative process too soon could create uncertainty, divert resources from implementation, and risk disrupting a framework that is only beginning to deliver the benefits of regulatory harmonization. The consensus was that Europe should focus first on making MiCA 1 work as intended before considering a more ambitious second phase of reform.

The Stablecoin Question

Euro-denominated stablecoins were a key discussion topic for the panel — and to ground the conversation in live audience sentiment, we put a question drawn directly from the Commission's consultation to the room:

The results didn't go unchallenged. Dea pushed back on the skeptical reading. While acknowledging that domestic payments within the Eurozone don't have much friction, with SEPA and instant payments regulation having done significant work,  the case for euro stablecoins, she argued, is strongest elsewhere: cross-border and programmable payment contexts, intraday yield, AI-native payment flows, and tokenized money market fund access all become meaningfully easier with a euro-denominated on-chain asset.

By creating efficient, regulated payment rails between Europe and key international corridors, euro stablecoins could allow more value to move directly in euros rather than requiring conversion into dollars or local currencies at multiple points in a transaction. In that sense, stablecoins could strengthen the international role of the euro by embedding it more deeply into digital payment infrastructure.

Matthias agreed with the direction but noted the scale reality: less than 0.5% of on-chain crypto activity is currently denominated in euros. The deepest, most liquid pools remain dollar-denominated.  The opportunity for euro stablecoins is real, but demand and liquidity still have a long way to go before they can rival the dollar's dominance.

The Multi-Issuance Debate

Closely related is the multi-issuance question: can the same stablecoin be issued through separate legal entities in different jurisdictions, and how does that interact with MiCA's reserve, redemption, and supervision requirements?

Matthias framed the multi-issuance debate as one of MiCA's most difficult unresolved questions: how to preserve the global utility and fungibility of stablecoins while maintaining European supervisory standards and consumer protections. He noted that stablecoins are inherently global instruments, with cross-border payments among their clearest use cases, yet MiCA must also account for concerns around monetary sovereignty, reserve location, and redemption rights for EU holders. Splitting a stablecoin into separate EU and non-EU versions may look attractive from a supervisory perspective, but in practice it risks fragmenting liquidity, duplicating smart contract infrastructure, and making the token less useful across both DeFi and centralized markets. For Matthias, the challenge is supervising global stablecoins without undermining the very cross-border functionality that makes them valuable. Enhanced supervisory cooperation, such as the recent EBA–NYDFS memorandum of understanding, may be an important step toward that balance, but the path to globally usable, well-supervised stablecoins remains complex.

What Comes Next

Two important milestones now sit directly ahead of the industry. On July 1, MiCA's grandfathering period comes to an end across the EU, closing the transition window that allowed firms to continue operating under pre-MiCA national registrations. At the same time, the European Commission's consultation on the future evolution of MiCA remains open until 31 August, inviting industry feedback on everything from stablecoins and global issuance models to DeFi, staking, and tokenized deposits.

As Michał explained, the expiry of the grandfathering period should bring the market closer to a true level playing field. Firms operating in the EU are expected to be authorized under MiCA, reducing the inconsistencies that existed under the previous patchwork of national regimes.

The next test is supervision. Michał emphasized that tighter enforcement will be essential, but also acknowledged that this remains new territory for national competent authorities. NCAs differ in resources, risk appetite, and supervisory focus, and the interaction between home and host member states — and with ESMA — will become increasingly important.

The consultation raises a different but connected question: how much MiCA should now evolve. Dea's view is  MiCA should be improved, not reinvented. The first draft was written roughly six years ago, in response to a very different market environment. Since then, particularly in payments, use cases for stablecoins have become far more concrete. For Dea, that makes the consultation a timely opportunity to be somewhat bolder in revisiting the payments titles, while preserving MiCA's broader architecture.

The panel's message was consistent: the priority is to make MiCA work in practice, while using the consultation to identify targeted improvements where experience has exposed genuine gaps.

Watch the full webinar on demand →  https://notabene.id/webinars/from-transition-to-transformation-mica-grandfathering-ends

‍

‍

Meet Alex, VP of Finance at Notabene.

Every month, a customer asks Alex the same question: "Can we pay you in stablecoins?" And every month, Alex understands exactly why they're asking. Stablecoins are faster than a wire, cheaper than a card, and they don't care that it's a Saturday or a bank holiday in another timezone. For a finance team trying to close the books and keep cash moving, that's genuinely appealing.

For a long time, though, Alex's honest answer was closer to "yes, but."

The "but" wasn't for lack of interest, but rather an operational hurdle. When a stablecoin payment landed, it arrived as a transaction hash. No business name, no invoice number, nothing tying the money to the customer who sent it. Before any of it could touch the books, someone on Alex's team had to play detective: whose payment is this, which invoice does it close, is the amount even right? Multiply that across a month of payments and you've turned a faster rail into slower accounting.

Then there was the chain problem. One customer wanted to pay USDC on Base. Another only held funds on Ethereum. A third was set up on Solana. Each one kicked off the same tedious negotiation about which network everyone could live with, a back-and-forth that ate hours nobody wanted to spend when there was real work waiting.

So the friction was never the stablecoins themselves. It was that the payment systems around them hadn't been built for the way a finance team actually operates.

Notabene CEO Pelle Braendgaard and Sam Broner (Founder and CEO of The Better Money Company) explain on an episode of Stack Chats:

‍"You talk to the accounting guy and they're like, wait, so you're saying I can finally bill someone seven hundred and eighty-nine dollars and eighty-seven cents? Thank you, that is exactly what I needed."

(Watch the full episode of Stack Chats with Pelle and Sam)

What changed

Notabene Flow was built for Alex's side of the table. It's the payment network that authorizes every B2B invoice before it settles and reconciles it as it arrives. The invoice reference, the counterparty's verified identity, and the payment context travel with the money, so finance teams reconcile as they receive instead of investigating after the fact. The transaction hash stops being a mystery to solve.

Alex also gets to set the rules. Flow lets him specify exactly which stablecoins and which chains he's willing to accept, the way he'd set any other treasury policy. His customer sends a payment link, pays through their own provider, and Alex receives a clean, reconciliation-ready record on the other end. No chasing references. No crypto expertise required on either side.‍

"How does plumbing work? You just turn the sink on, but there's 200 years of infrastructure under these streets... the simple thing is you get to flip the tap."

(See how you can turn any invoice into a stablecoin payment link with Notabene Flow)

The part that makes the answer a clean "yes"

There was still one gap: what happens when Alex wants to settle in his preferred stablecoin, but the customer holds a different one? That's where our partnership with The Better Money Company comes in.

Better Money runs a stablecoin clearinghouse. Instead of trading one stablecoin for another on the open market and eating the slippage, it clears at par, going directly to the issuers the way banks settle between themselves. Integrated into Flow, it means the payer can send whatever stablecoin they hold, on whatever chain, and Alex receives exactly what he asked for, in his preferred stablecoin, down to the cent.

For Alex, all of that machinery disappears. The question comes in, and the answer is just "yes."

Interested in giving your finance team the same convenience that Alex now has? Schedule a quick conversation and we'll show you all you need to know to get started with Notabene Flow.

‍

In a recent appearance on Utila's podcast, Notabene CEO Pelle Brændgaard made a point that runs against one of crypto's founding assumptions: that once a transaction settles, there is nothing anyone can do about it.

He explained why that assumption is starting to give way, and what opens up when regulated institutions can actually communicate with one another.

"For a lot of different fraud use cases, having a messaging system between trusted institutions allows you to do things that the crypto industry thought was impossible." — Pelle Brændgaard, CEO, Notabene

The missing response to fraud and error

Every payments system has to deal with fraud, theft, and honest mistakes.

Traditional finance built its answers over decades: returns, recalls, and coordinated processes between banks that trust each other enough to make them work. Crypto inherited none of that.

The moment funds land in the wrong place, whether because of a scam, a compromised account, or a payment sent in error, the sending side has had little real recourse. Recovery has often meant an email, a message to whoever might be on the other end, and hope that the counterparty cooperates.

That does not scale. And when it matters most, it leaves institutions without a consistent workflow or audit trail.

A trust layer changes the equation

The shift Pelle describes is not a change to how blockchains work. Settlement stays final, exactly as it was designed to be.

What changes is the layer above it.

When two regulated institutions speak a common language, they can do more than watch a transaction move one way. Either side of a transaction can request a return, attach the reason, and coordinate the return to a wallet address that has been verified before any funds move.

This is where the industry conversation needs to move beyond finality alone. Final settlement is important, but it is not the same as a complete payments operating model. If digital assets are going to support mainstream financial activity, institutions need the ability to manage exceptions, document decisions, and coordinate with counterparties when a transaction is technically complete but operationally unresolved.

That is the practical problem Revert  is designed to address: giving institutions a way to coordinate after settlement, for the fraud and error cases where both sides of the transaction are trusted parties in a shared network.

It is a response to the the unilateral transaction problem that has defined crypto since the beginning. Not by undoing settlement on-chain, but by creating a trusted communication layer around it.

Built for the real world

Revert is not a magic recovery tool for funds that have already left the regulated perimeter. It works for fraud and error cases that move between institutions who have chosen to participate in a shared network.

And that participation is the whole point.

These flows work because the parties involved are regulated, want to be trusted, and have an interest in being trustworthy. Trust is not a nice-to-have layered on top of the technology. It is the mechanism that makes coordinated recovery possible at all.

As crypto matures into infrastructure that businesses depend on, the constructs that traditional payments take for granted are finally arriving. Not by changing the chain, but by building coordination on top of it.

Crypto settlement can stay final. But finality does not have to mean silence.

Learn more about Notabene Revert

‍

Stack Chats Episode 4: Making Stablecoins Work Like Money with Sam Broner

Guest: Sam Broner, Founder & CEO, Better Money Company

Host: Pelle Braendgaard, CEO & Co-Founder, Notabene

Topics: Stablecoins, Payments Infrastructure, Stablecoin Clearing, Digital Money, Compliance, Interoperability

In this episode of Stack Chats, Notabene CEO Pelle Braendgaard sits down with Sam Broner, Founder and CEO of Better Money Company and former Andreessen Horowitz investor, to discuss stablecoin clearing, payment interoperability, and the infrastructure required to make stablecoins work at global scale.

Sam shares lessons from his career spanning Microsoft, MIT, the Boston Fed, and venture investing, and explains why the next phase of stablecoin adoption depends less on trading infrastructure and more on payment infrastructure.

Watch the full episode below:

Watch on YouTube →

Stablecoins are already faster, cheaper, and more global than traditional payment systems. Yet businesses still face operational challenges when using them for invoicing, treasury management, and cross-border payments. Pelle and Sam explore how Better Money Company is building the clearing infrastructure needed to make stablecoins behave more like traditional money while preserving the benefits of blockchain-based settlement.

📌 Topics include:

• Why stablecoins need clearing, not trading
• The hidden accounting challenges of stablecoin payments
• Stablecoin interoperability across chains and issuers
• Building payment-grade infrastructure for businesses
• The future of global stablecoin clearing networks

Pelle and Sam begin by discussing Sam's path from distributed systems engineering to stablecoin infrastructure. Their conversation quickly turns to one of the industry's biggest bottlenecks: businesses need certainty, predictability, and reconciliation tools before they can fully adopt stablecoin payments.

What follows is a look at the key themes they explored and why they matter for the future of financial infrastructure.

Key Takeaways

• Stablecoins have solved many money movement challenges but still lack payment-grade clearing infrastructure.
• Businesses require exact settlement amounts for accounting and reconciliation.
• Stablecoin interoperability is becoming increasingly important as more issuers and networks emerge.
• Clearing infrastructure can simplify payments while preserving compliance requirements.
• Better Money Company and Notabene are working to reduce friction in stablecoin payment workflows.

Stablecoins are better money, but payments are still too complicated

One of Sam's core arguments is simple: stablecoins have already solved many of the problems associated with moving money.

They are:

• Faster than traditional payment rails
• Available globally
• Programmable
• Available 24/7
• Lower cost than many existing systems

Yet despite these advantages, businesses still struggle to use stablecoins as a payment mechanism.

The reason is that moving between stablecoins often requires trading rather than payment processing.

Today, if a business wants to receive a specific stablecoin on a specific chain, the sender may need to swap assets through an exchange, liquidity provider, or trading venue. While this works for crypto-native users, it introduces unnecessary complexity for finance teams and payment operations.

As Sam explains, people do not exchange Wells Fargo dollars for Bank of America dollars before making a payment. The financial system already provides clearing infrastructure that abstracts away those differences.

Stablecoins need the same capability.

The missing layer: stablecoin clearing

Better Money Company's core product is a stablecoin clearinghouse.

Rather than forcing businesses to manage multiple chains, stablecoins, and liquidity venues, the clearinghouse allows participants to send one supported stablecoin and have the recipient receive exactly what they requested.

This creates a payment experience rather than a trading experience.

The model introduces several benefits:

• Predictable settlement
• Fixed-fee transactions
• Simplified reconciliation
• Reduced operational complexity
• Greater flexibility for senders and recipients

Instead of worrying about how funds move between assets behind the scenes, businesses can focus on the payment itself.

For finance teams, this distinction is critical.

Why finance teams care about exact amounts

One of the most practical parts of the conversation focuses on accounting and reconciliation.

Crypto-native users often focus on liquidity, swaps, and settlement speed. Finance teams care about something different: receiving the exact amount expected.

For invoicing, treasury operations, and accounting workflows, "close enough" is not good enough.

A business invoicing $789.87 needs to receive exactly $789.87.

Small variations caused by slippage, trading spreads, or liquidity fragmentation create operational headaches for finance teams that must reconcile every transaction.

This is where stablecoin clearing becomes particularly valuable.

By guaranteeing that recipients receive the exact amount specified, businesses can integrate stablecoin payments into existing accounting workflows without introducing additional reconciliation burdens.

Building the bridge between crypto and traditional finance

Sam's experience spans several worlds.

Before founding Better Money Company, he worked:

• As a distributed systems engineer at Microsoft
• On digital money research initiatives connected to the Boston Fed
• As an investor at Andreessen Horowitz focused on payments and stablecoins

Those experiences helped him identify a recurring challenge.

Crypto infrastructure often optimizes for traders, while financial institutions need systems optimized for payments, controls, and operational certainty.

The gap between those two worlds remains one of the biggest barriers to institutional adoption.

Rather than replacing existing financial processes, Better Money Company focuses on providing the payment guarantees businesses already expect.

Stablecoin interoperability will drive adoption

Another major theme is interoperability.

The stablecoin ecosystem is becoming increasingly fragmented.

New issuers, chains, and payment networks continue to emerge. While this innovation is healthy, it also creates complexity for businesses trying to accept payments.

Companies do not want to support dozens of different payment paths individually.

Instead, they want a simple way to:

• Send the stablecoin they hold
• Receive the stablecoin they prefer
• Maintain compliance requirements
• Reduce operational overhead

Sam argues that clearing infrastructure can serve as the connective tissue that enables this interoperability without requiring every participant to manage countless integrations.

Why compliance still matters

Throughout the discussion, both Pelle and Sam emphasize that stablecoin adoption requires trust.

Businesses need confidence that incoming funds originate from compliant sources and that payment flows meet regulatory expectations.

This is one reason the integration between Notabene Flow and Better Money Company is significant.

By combining:

• Better Money Company's stablecoin clearing infrastructure
• Notabene Flow's compliance and payment orchestration capabilities

businesses gain a payment experience that is both operationally simple and compliance-ready.

For regulated businesses, both pieces are necessary.

Bringing stablecoin clearing into Notabene Flow

Toward the end of the conversation, Pelle and Sam discuss the upcoming integration between Better Money Company and Notabene Flow.

The goal is straightforward:

A business can issue an invoice requesting payment in a specific stablecoin, while the payer can send a different supported stablecoin.

For example:

• An invoice requests RLUSD
• The payer holds USDC or USDG
• Better Money Company's clearing infrastructure handles the conversion and settlement
• The recipient receives the exact asset and amount requested

This reduces friction for both sides while preserving accurate reconciliation and compliance workflows.

The result is a simpler stablecoin payment experience that feels more like traditional financial infrastructure.

What comes next

As stablecoin adoption accelerates, infrastructure providers are increasingly focused on making digital asset payments easier to use rather than simply faster to settle.

The next phase of growth will depend on solving practical business challenges:

• Reconciliation
• Accounting
• Interoperability
• Compliance
• Operational efficiency

Sam believes stablecoins have already won on technology.

The next challenge is making them work seamlessly within the systems businesses already use every day.

If successful, stablecoin clearing could become one of the foundational layers that enables broader adoption across payments, treasury, fintech, and global commerce.

Episode breakdown

Here is a quick minute-by-minute guide to the conversation:

00:00 - 04:00

Sam's background from Microsoft and MIT to Andreessen Horowitz and the founding of Better Money Company.

04:00 - 08:00

Why stablecoins are already better money and the limitations of today's payment infrastructure.

08:00 - 13:00

The difference between trading and clearing and why payment flows need a new model.

13:00 - 18:00

Accounting, reconciliation, and the operational challenges businesses face when using stablecoins.

18:00 - 24:00

Interoperability across stablecoins, chains, and payment networks.

24:00 - 30:00

Building payment-grade infrastructure for financial institutions and enterprises.

30:00 - End

The Better Money Company and Notabene Flow integration and the future of stablecoin payments.

‍

🎙️ Stack Chats is Notabene's video series for product leaders, fintech builders, and infrastructure innovators shaping the next generation of blockchain-based payments.

‍

For the first time in OFAC's history, U.S. regulators are codifying an explicit sanctions compliance program requirement in regulation. For the first time, FinCEN is treating stablecoin issuers as a distinct financial institution category under the Bank Secrecy Act rather than as money services businesses with a crypto wrapper.

The joint proposed rule FinCEN and OFAC issued in April implementing the Permitted Payment Stablecoin Issuer (PPSI) framework under the GENIUS Act is the most consequential digital asset rulemaking the U.S. has embarked on in a decade.

Notabene filed our response to the notice of proposed rulemaking (NPRM), answering eleven substantive questions across the AML/CFT and sanctions program sections.

Three positions anchor what we filed, and the choices regulators make in finalizing this rule will shape the next decade of stablecoin payments.

Travel Rule codification has to be designed for cross-border use

The Travel Rule already applies to stablecoin transfers under existing 31 CFR 1010.410(e) and (f), as FinCEN's 2019 guidance made clear. Codifying it in a dedicated Part 1033 for PPSIs removes the ambiguity slowing U.S. implementation and gives institutions a clean foundation to build compliance programs on.

The codification has to be designed for international interoperability from day one. We recommended FinCEN endorse IVMS 101 as the data standard for transmittal-level identifying information, and require the messaging layer carrying it to operate on open and interoperable standards.

Read more about our commitment to open standards here

We also asked FinCEN to align the U.S. threshold with the FATF Recommendation 16 as Travel Rule compliance is collaborative by design. One institution's ability to comply depends on its counterparty's ability to receive and process the data, and the U.S. threshold of $3,000 is now the highest among peer jurisdictions with active enforcement. The EU and UK, for example, enforce at zero threshold.

Threshold and data-set divergence is not abstract and it causes operational headaches. When a U.S. institution sends a stablecoin transfer to an EU counterparty with only the U.S. data set, the receiving EU CASP is required by the EU Transfer of Funds Regulation and the EBA Travel Rule Guidelines to detect the missing fields and decide whether to execute, request the missing data, reject, return, or suspend the transfer. When the EU CASP requests missing data from a non-EU sender, the EBA Guidelines give the sender a five working day window to supply it. The transfer is treated as suspended in the meantime. Repeated sub-standard transmissions can show up as a counterparty-risk flag on the EU side and trigger reporting to the EU CASP's competent authority under Article 17 of the TFR.

The result is that U.S. PPSIs and their global counterparties end up at a disadvantage relative to actors operating outside regulated channels, where no such friction applies. Threshold and data-set alignment with the FATF Recommendation 16 trajectory is what closes that gap.

Block, freeze, and reject only work before settlement

Public blockchains have no built-in mechanism for evaluating a transaction before settlement. Once a transfer is initiated on-chain, it settles. A PPSI without pre-transaction authorization infrastructure is limited to reactive measures, freezing assets after they arrive rather than preventing transfers from occurring.

The GENIUS Act's block, freeze, and reject obligations under proposed 31 CFR 502.201(b)(3) are therefore architectural requirements, not just programmatic ones. Pre-transaction authorization is the mechanism that meets them.

Authorization-before-settlement models work through a private messaging layer operating alongside the blockchain. The two institutions party to a transfer exchange Travel Rule data, perform sanctions screening, assess counterparty risk, and make an explicit authorize-or-reject decision before on-chain settlement. The Transaction Authorization Protocol (TAP) is one open standard implementation of this approach.

We asked OFAC to recognize pre-transaction authorization architectures as a compliant technical implementation, without mandating any specific protocol.

The recognition matters because pre-transaction authorization pairs with, rather than replaces, the freeze, burn, and reissue capabilities GENIUS Act Section 5(a)(2) grounds. Proactive authorization at the transaction level and reactive freeze at the asset level form a complete sanctions architecture no traditional financial institution has access to.

The primary and secondary market distinction is operationally correct

FinCEN's proposed framework draws a clean line between activity where the PPSI is a direct party (primary market, where full programmatic obligations apply) and activity where the PPSI is observing smart contract operation as an issuer rather than as a transacting party (secondary market, where contract-layer interventions are narrowly scoped). We agree with how the line is drawn and think the rule should preserve it.

Any secondary market intervention authority outside lawful orders should be narrow, explicit, tied to defined triggers, and paired with an express liability safe harbor. Institutions holding the customer relationship and the Travel Rule channel are best positioned to enforce sanctions and AML controls in secondary market activity. The PPSI is best positioned to execute targeted contract-layer interventions when an objective trigger is met.

A narrow scope here protects the predictability making payment stablecoins viable as payment infrastructure. A broad or discretionary one shifts effective authorization control to an actor not party to the transfer and not participating in pre-transaction review. That breaks the architecture, and the institutions party to the transfer end up with no certainty about whether an authorized transfer will settle.

What's at stake

This rulemaking will decide whether the U.S. ends up with a stablecoin payment system designed for cross-border interoperability or one engineered around U.S.-specific architectures the rest of the world has already moved past.

The full Notabene submission can be found here, and is on regulations.gov under Docket FINCEN-2026-0100.

Additional analysis will follow over the coming weeks on OFAC sanctions architecture, the special standards of diligence framework for cross-border PPSI counterparty relationships, and the foreign payment stablecoin issuer equivalence question.

Questions? Contact our Regulatory & Compliance team here.

Any payer holding funds at an institution on the Notabene Network can now complete a Notabene Flow payment with no additional integration required

NEW YORK, June 4: Notabene, the trust layer for global money movement, today announced that customers of hundreds of regulated digital asset institutions can now complete Notabene Flow payments directly from accounts they already use. The milestone extends Notabene Flow's reach to the customers of every institution integrated on the Notabene Network — the largest global network of regulated digital asset institutions, spanning 2,000+ entities across 100+ jurisdictions and processing trillions of dollars of transaction volume annually.

The activation follows a network-wide rollout of Notabene Flow responder capabilities to Notabene's existing customer base — the exchanges, custodians, payment providers, and banks already running Travel Rule-compliant multi-party flows on the Notabene Network. Any business that issues a Notabene Flow payment link today can expect the recipient to complete the transaction directly from their hosted wallet at one of these institutions, with no separate onboarding required on their end. Payers can also complete Notabene Flow payments using a self-hosted wallet through the Notabene platform.

"The value of a payment network comes down to reach — whether the person you're trying to pay can actually receive it from wherever their funds are held," said Pelle Braendgaard, CEO of Notabene. "Hundreds of live responders means that when a business sends a Notabene Flow payment link today, the recipient can pay from their existing account at an institution already on the network. Building that kind of reach on an open network, rather than a closed one, is what makes it genuinely useful at scale."

Notabene Flow launched in September 2025 as the first open stablecoin payments network that authorizes every B2B invoice before it settles and reconciles it as it arrives — across any wallet, network, or jurisdiction. The network is built on the Transaction Authorization Protocol (TAP), an open messaging standard that any regulated institution can implement regardless of which custody or infrastructure provider, assets or blockchain they use.

Businesses can join the Notabene Flow network today to enable high-value cross-border B2B payments, using pull payments, structured invoicing, and Travel Rule-compliant multi-party payment flows at notabene.id/join-flow.

‍

‍

‍

About Notabene

Notabene is the trust layer for global money movement. The Notabene network connects thousands of trusted counterparties, facilitating trillions of dollars in transaction volume annually across over 100 jurisdictions. Notabene provides industry-leading tools for stablecoin payment coordination, real-time transaction authorization, counterparty verification, and self-hosted wallet identification—helping institutions build trust into every transaction.

Learn more at notabene.id

Media Contact:
Clay Fain
VP Marketing
[email protected]

‍

According to the Chainalysis 2026 Crypto Crime Report, in 2025, illicit crypto addresses received over $154 billion which is a 162%increase year over year. Further, 84% of all illicit volume moved through stablecoins, which is up from 63% the year before. Sanctions evasion alone grew 694%.^[1] The numbers should reframe how every compliance team in the United States is reading the GENIUS Act.

Now read the GENIUS Act and ask yourself: does this law address where the risk lives?

The Architecture Is Pointed at the Wrong Thing

The GENIUS Act is a serious piece of legislation. The first federal statute to define payment stablecoins as a distinct asset class. Reserve requirements. Redemption mechanics. Issuer governance. Bank-level AML obligations for permitted issuers. All necessary.

But here is the thing nobody is saying out loud. The entire architecture of GENIUS is built around regulating the issuer. The act defines who is permitted to issue. Who must hold reserves. Who must attest monthly. Issuer, issuer, issuer.

The problem is the risk does not live with the issuer.

Risk in stablecoin payments lives in the network. Wallets. Exchanges. Intermediaries. Cross-chain flows. Counterparty institutions in jurisdictions with weak or nonexistent supervision. 

Regulate a stablecoin issuer perfectly and the 84% still flows right through. Require pristine reserves, monthly attestations, full BSA compliance at the issuance point. None of these addresses what happens to the tokens once they leave the issuer's custody.

The Rulemaking to Read First

One piece of GENIUS implementation is focused on the network reality. The FinCEN/OFAC joint NPRM, released for public comment in April with a June 9 deadline, amends 31 CFR 1010.100(eee). ^[2] For the first time, the U.S. is codifying the Travel Rule for digital assets into federal statute.

This matters more than the headline rulemakings most teams are tracking. The Travel Rule is the only mitigating control we have before a transaction settles. No correspondent bank holding the message in a queue. No three-day window for sanctions review. The compliance work has to happen before the transaction broadcasts.

The Travel Rule pairs two BSA obligations the U.S. has had on the books since the mid-1990s for wire transfers. Recordkeeping for what you hold. Information exchange for what you pass to the next institution in the chain. FinCEN extended these obligations to crypto in 2019. ^[3] The April NPRM is the codification.

The international picture has moved further. According to FATF, 87% of material jurisdictions have either implemented Travel Rule for crypto or are in the process. ^[4] The UK has been live since September 2023. ^[5] The EU went live under the Transfer of Funds Regulation on December 30, 2024. ^[6] The U.S. is now closing the implementation gap.

What Winners Are Doing Differently

Most firms approach a new regulatory regime by reading the rule, writing a memo, running the memo through legal, building a compliance program around the memo. Six months later they realize they have a policy and no operational capability.

The teams winning this approach the work differently. They start with their transaction flows. They map their counterparty universe. They identify decision points where data has to be collected, screened, exchanged, or held. They architect for configurability because GENIUS is one regime among several. 

Address screening alone is no longer sufficient. Identifying a counterparty institution at the time of every transfer is no longer optional. Real-time pre-transaction authorization is what counterparties and examiners now expect. The firms reading GENIUS as a checkbox on issuer reserves are going to be surprised when their counterparty diligence questionnaires double in length next quarter.

The Read

The act addresses issuer accountability, which is necessary. But the risk lives in the network. Miss the network framing and you have a beautifully regulated issuer base with bad actors flowing 84% of their illicit volume right through the rails.

From where we sit at Notabene, supporting Travel Rule and transaction authorization across more than 2,000 institutions in 100 plus jurisdictions, the firms moving fastest right now are treating GENIUS as a network problem from day one. They are not waiting for final rules. They are architecting for the operational reality the NPRMs already describe.

Bad compliance is a barrier to growth. Good compliance is infrastructure for growth. Compliance is now a feature of the platform, not a wrapper around the platform.

The winners here won't be the most compliant. They'll be the most operationally adaptable.

‍

Last week at Stablecon in Amsterdam, I was on a panel called "Killing the Fiat Stablecoin Sandwich" with Simon Taylor (Tempo), Tyler Sherwin (BVNK), and Tedd Huff (Fintech Confidential).

We had a good debate about the pros and cons of the current implementation of the stablecoin sandwich. But I came away thinking the whole framing, mine included, was off.

The stablecoin sandwich isn't the real problem. The word "stablecoin" is.

The day prior to the panel I had a call with the digital assets GM at a major European bank. He said something that stuck:

"From our perspective, a stablecoin is just a settlement mechanism between fiat accounts. The enterprise instructs us to move money. Whether it goes via Swift or stablecoin rails, it lands as fiat on the other side."

That's it. He's right. And once you accept that, the whole "sandwich" debate looks different.

The "stablecoin" name is doing a lot of damage

"Stablecoin" sounds like a crypto asset that happens to be price-stable. Something exotic. Something you need to convert into and out of. That framing comes from crypto, from a world where on/off ramps are real because you're genuinely leaving fiat when you buy Bitcoin.

But USDC is just dollars. EURC is just euros. When you "on-ramp" to USDC, you never left fiat. You just changed the form factor. There is no ramp. There's no sandwich. There's just fiat sitting in a different kind of account.

It's all just money

M0, M1, and M2 are all fiat. Physical cash, checking accounts, savings accounts: different properties, different forms, same underlying asset. We don't call a savings account an "M2coin." We don't build conversion infrastructure between your checking account and your money market fund and call it a sandwich.

Tokenized money market funds are basically M2. Tokenized deposits are M1 or M2 depending on the form. Stablecoins don't fit neatly into the existing categories, but they belong in the same family. They're a new form of fiat with slightly different properties that they share with their other tokenized money cousins: programmable, blockchain-settled, 24/7. Not a foreign asset.

So why does the sandwich exist?

Because we borrowed crypto infrastructure (tokenization, blockchains, wallets) for a fiat asset, but kept the crypto mental model around it. The result is two conversion events that don't need to exist, a PSP sitting in the middle taking margin, and correspondent banking rebuilt at higher cost with extra steps.

The current batch of stablecoin orchestrators (as they came to be known) built the Wise model for stablecoins. That's useful. It works. But it's a stepping stone, not the destination. This PSP model exists because banks aren't plugged into stablecoin rails natively. Once they are, the on/off ramps dissolve.

One of the things we did discuss on stage at Stablecon is that this model, just like Wise recreates all the bad parts of correspondent banking. Not because of any specific properties of stablecoins, but because they still rely on pre-funded accounts and bilateral agreements to operate (aka correspondent banking).

The end state is simpler than the sandwich

It's account-to-account transfers on open, programmable rails. The stablecoin is the settlement layer, invisible to the enterprise, just like ACH or SWIFT is invisible today. The bank's treasury team picks the right stablecoin for the corridor. The CFO sees euros leave and euros arrive.

No sandwich. Just payments.

I argued at Stablecon that the sandwich scales badly: custody concentration, treasury risk, limited reachability. That's still true. But the deeper point is that we've been debating how to improve the sandwich when we should be asking why we're making sandwiches with fiat in the first place.

Stablecoins are just fiat. The sooner we name them that way, the better the infrastructure we'll build around them.