The signal
The Financial Stability Institute, hosted by the Bank for International Settlements, published a comparison on 27 August of rules for stablecoin issuers in the European Union, Hong Kong, Singapore, the United Kingdom and the United States. Its three authors identify a common pattern: frameworks generally restrict the issuer to issuance, redemption and reserve management, although banks and non-bank issuers are treated differently.
Their warning concerns the regulatory perimeter. These restrictions follow the legal entity that issues the token, not necessarily the corporate group around it. A sister company or parent can therefore conduct lending, staking or crypto custody without facing the same limits. A loss or breach at that affiliate does not automatically drain the reserve, but it can create conflicts of interest, operational dependencies or a confidence shock capable of reaching the issuer.
The brief is FSI analysis, not a new rule, and it states that the views belong to its authors. The appropriate verdict is therefore “watch”: the blind spot is documented, but closing it still depends on supervisors and national rulemaking.
Why it matters
A segregated 100% reserve answers one question: are there enough assets to cover the tokens? It does not answer another: which group activities could weaken the issuer, its service providers or holders’ confidence? Banking groups already face consolidated supervision that monitors capital, liquidity and exposures across entities. The FSI finds no general equivalent for non-bank groups built around stablecoin businesses.
This distinction changes how a licence should be read. Authorising one subsidiary does not mean that the supervisor controls every activity of its parent, sister companies or related service providers. The risk has not necessarily disappeared; it may have moved elsewhere in the corporate chart.
What changes
Marc Norat’s legal reading confirms the gap in the US GENIUS Act. Section 4(a)(7) confines a “permitted payment stablecoin issuer” to five categories: issuing, redeeming, managing reserves, providing specified custody and directly supporting those functions. The provision, however, applies to the issuer itself.
Another clause allows a supervisor to tailor requirements to the issuer’s financial activities, including those of the issuer’s own subsidiaries. It does not turn that discretion into consolidated oversight of every parent and sister company in a non-bank group. By contrast, the Financial Stability Board’s 2023 recommendations call for supervision of the stablecoin “arrangement” and all its functions, extending the lens beyond one legal person.
The caveat
The FSI identifies a possible channel of contagion, not proven misconduct at any named issuer. Legal segregation of reserves, senior claims for holders, audits, intragroup contracts and existing supervisory powers can reduce the risk. Their effectiveness depends on the applicable framework and the actual relationships among the entities.
It is also important to distinguish a consolidated banking subsidiary from a non-bank group. Calling every affiliate “unregulated” would be inaccurate: some have their own licences, answer to another supervisor or follow conduct rules. The issue is the possible absence of one shared view of risks moving between them.
What to watch
Useful next indicators include organisational-chart disclosures, reporting of intragroup exposures, limits on related-party transactions and continuity plans imposed during licensing. In the United States, the test will be whether implementing rules and OCC decisions genuinely extend scrutiny to parent and sister companies.
The decisive question is observable: can a supervisor identify and contain a loss, custody failure or conflict of interest at an affiliate before it reaches stablecoin redemptions?