Written by: Jakub Pietroszek, Partnership Manager, Digital Colliers
Bloomberg's reporting on the GENIUS Act is uncomfortable reading if you sit on a bank's risk committee. The safeguards that were supposed to make dollar-backed stablecoins bank-grade got softened during drafting, and the shape of what survived looks a lot like what one large issuer could already produce. Attestations instead of audits. Quarterly cadence. Broad discretion on what counts as a reserve.
If your bank is anywhere near stablecoin rails, whether you're custodying, settling, or just accepting them as collateral, the policy debate is not the interesting part. The interesting part is that a quarterly PDF from an issuer's accountant is now your primary window into the counterparty risk. That's not oversight. That's a receipt.
A PDF isn't a control
A static report tells you what was true on the last day of the quarter, filtered through whatever the issuer wanted to show. It doesn't tell you what's true on Tuesday morning when redemptions spike. It doesn't tell you the concentration of the reserve portfolio in any single counterparty. And it doesn't tell you what happens between reports, which is where every stablecoin wobble in the last five years has actually played out.
Compare the cadence to anything else on your risk stack. AML monitoring runs continuously and still generates 85 to 95% false positives at a typical mid-market bank. Vulnerability management is under constant scrutiny because only 3 to 5% of disclosed CVEs get patched within 30 days. Nobody argues those should be quarterly. But we're being asked to accept a 90-day blind spot on the reserves backing an instrument that settles in seconds.
The feed a mid-market bank actually needs
If you're building the internal case for what stablecoin oversight should look like, the shape is a data pipe, not a document. Concretely, you want a continuous feed covering at least four things:
- Reserve composition. Instrument-level breakdown, not category rollups. T-bill CUSIP, bank deposit counterparty, repo counterparty. Refreshed daily at minimum.
- Redemption activity. Gross redemptions, net flows, largest single redemption in the window. This is your early warning on a run.
- Concentration. Top 10 holders as a percentage of supply. Top 5 reserve counterparties. Anything that would make an examiner ask a follow-up.
- Reconciliation delta. On-chain supply versus attested reserves, calculated daily, with a variance threshold that pages someone when it breaks.
None of this is exotic. Most of it can be pulled from public chain data plus whatever the issuer will share under a bilateral agreement. The engineering is not the hard part. The hard part is that most mid-market banks still run month-end close in spreadsheets, pulling numbers across systems by hand. If your close takes 8 to 10 days to produce a static balance sheet, you're not going to stand up a real-time issuer feed with the same team, on the same tooling, without a deliberate build.
The deadline nobody's counting from
For European banks, this isn't a future problem. DORA has been in force since 17 January 2025, and its ICT third-party risk provisions apply squarely to any critical service provider you rely on. If a stablecoin issuer is providing settlement infrastructure or reserve custody that your bank depends on, the regulator's starting position is that you owe them a live view, not a quarterly one. The GENIUS Act debate is US-flavored, but the exam expectation in Europe is already here.
US banks watching this land will get the same question eventually, phrased differently. The Fed and OCC don't care what an issuer's accountant said in September. They care what you knew, when you knew it, and what you did about it.
The exam question you can't yet answer
Here's the question worth stress-testing before an examiner asks it. On any given business day in the last 90 days, what was our largest single-name exposure via stablecoin reserves, and how did we know?
Most banks touching this rail cannot answer that question today. They can point at a PDF that was accurate on one day out of the quarter. That gap between the PDF and the answer is where the next enforcement action gets written. The banks that move first on the data pipe won't be the ones with the biggest budget. They'll be the ones who stopped treating issuer risk as somebody else's reporting problem.