United States Payments & Fintech Regulation

Licensing, Authorisation & Market Access

Maryland enacted SB0261 as Chapter 21, effective 1 October 2026, altering the definition of money transmitter under the Maryland Money Transmission Act. The amendment excludes a person designated as an agent of a payor, for purposes of that agent's provision of payroll-processing services, from the licensing definition under certain specified circumstances. The effect is to remove a defined category of payroll-processing activity from Maryland's money transmitter licensing perimeter rather than to alter the licensing regime generally.

Outlook

The carve-out is narrow and targeted at payroll-processing agents specifically, so its near-term effect is confined to that business model within Maryland. Watch for whether other states adopt a similar exclusion for payroll-processing agents as they revisit their own money transmitter definitions.

Licensing, Authorisation & Market Access

The Section 1033 open-banking rule, promulgated under the Consumer Financial Protection Act's data-rights provisions, remains procedurally unsettled. A federal court in the Eastern District of Kentucky enjoined CFPB enforcement of the October 2024 final rule while the Bureau conducts a full reconsideration, and as a direct consequence the phased compliance schedule that would have begun in April 2026 for the largest covered data providers did not take effect as a binding market-access obligation. This affects both bank and non-bank participants in the open-banking data-sharing chain: the rule as originally written applied to data providers regardless of charter type, so the injunction's practical effect is to leave the entire covered population, banks and non-bank account-information intermediaries alike, without an enforceable compliance deadline.

Rather than abandoning the underlying mandate, the CFPB has continued to advance a revised approach. In August 2026 the Bureau submitted a new proposed rule, Personal Financial Data Rights Reconsideration, to the Office of Information and Regulatory Affairs for review, a step that precedes Federal Register publication and public comment. This signals institutional intent to preserve some form of consumer financial-data access right, even as the specific compliance architecture, timelines, and scope for both bank and non-bank market participants remain to be determined through the reconsideration process. A lower-tier tracker separately corroborated that the original April 1, 2026 deadline for the largest data providers lapsed without triggering enforcement, consistent with the injunction.

Outlook

The determinative event to track is the Federal Register publication of the CFPB's reconsideration NPRM, which will disclose the substantive scope of any revised open-banking access obligations. Until that publication and the subsequent comment period conclude, market-access planning for both bank and non-bank data providers in the open-banking space cannot be anchored to a fixed compliance date.

Licensing, Authorisation & Market Access

The United States operates a dual federal/state licensing model for payment firms that has no unified EMI/PI equivalent to the UK or EEA regimes. At the federal layer, money transmitters and other money services businesses (MSBs) must register with FinCEN under the Bank Secrecy Act; at the state layer, the same firms typically also require a Money Transmitter Licence (MTL) in each state where they operate, with 49 states requiring an MTL and only Montana exempting most money transmission activity from state licensing — the canonical case of US federalised divergence. Critically, FinCEN registration via Form 107, which must be completed within 180 days of commencing MSB activity, does not substitute for state licensing: operators need both tracks simultaneously to be compliant nationally.

The state MTL track itself carries a materially heavier compliance burden than federal registration alone. Applicants must complete NMLS applications, undergo FBI fingerprint background checks, and post surety bonds ranging from approximately $25,000 up to more than $2,000,000 depending on the state, while maintaining minimum tangible net worth typically between $100,000 and $500,000. Bond requirements alone diverge enormously by state — from as little as $250 in Montana to more than $500,000 in California — making state-level cost divergence a materially under-indexed factor in US market-access economics for non-bank payment service providers assessing where to establish operations.

Set against this fragmented backdrop, the clearest structural development of the period is Stripe's Merchant Acquirer Limited Purpose Bank (MALPB) charter from the state of Georgia. Stripe's application was accepted March 31, 2025, and — correcting earlier reporting that had characterised the charter as still pending — the charter was in fact granted in July 2025 and is now operative. The MALPB charter enables Stripe to obtain direct Visa and Mastercard scheme access without relying on a sponsor bank, mirroring the precedent set by Fiserv, which became the first entity to process transactions under a MALPB charter in April 2025. This is a structural shift in how non-bank acquirers can access card networks in the United States, reducing dependence on the sponsor-bank model that currently defines market access for the large majority of non-bank PSPs.

Outlook

The MALPB charter route is likely to mature further as a market-access channel for other non-bank acquirers seeking to replicate Stripe's and Fiserv's direct-access model, while the underlying federal/state licensing patchwork — and its associated state-by-state bond and net-worth divergence — remains a standing structural feature of US market entry with no unification currently in prospect. Montana's exemption will continue to stand as the reference case for federalised regulatory divergence in this space.

Conduct, Safeguarding & Financial Promotions

US customer-fund protection for payments operates through the same state Money Transmitter Licence framework that governs market access, rather than through a unified federal safeguarding regime. The operative mechanism is the 'permissible investments' requirement embedded in state MTL regimes: licensees must hold qualifying liquid assets equal to their outstanding payment obligations, backed additionally by surety bonds and minimum tangible net worth, with compliance examined state-by-state at the licensee's expense. This stands in clear contrast to the UK's CASS safeguarding regime and the EEA's PSD2 safeguarding rules, both of which operate as unified frameworks; the US model is fragmented and state-administered, a divergence in customer-fund protection that is under-indexed relative to its practical significance for operators comparing jurisdictions. There is similarly no single federal financial-promotions regime for payments products: oversight of promotional conduct is split across the CFPB, the FTC, and state attorneys general, rather than concentrated in one supervisory body.

On conduct specifically, the CFPB issued a Compliance Aid on January 15, 2025 addressing Electronic Fund Transfer Act (EFTA) and Regulation E obligations for peer-to-peer payment services. The Aid clarifies that both non-bank P2P providers and the depository institutions that hold the underlying consumer accounts carry error-resolution obligations under Regulation E, and — significantly for platform operators — that private network rules purporting to offer less consumer protection than federal law cannot be relied upon to limit liability. This allocates error-resolution exposure across both non-bank P2P operators and account-holding banks, raising compliance exposure specifically for the non-bank side of P2P arrangements.

Outlook

Absent a move toward a unified federal safeguarding or financial-promotions regime, the state-by-state permissible-investments model and the CFPB/FTC/state-AG conduct split are likely to remain the standing US architecture for the near term; the practical compliance question for P2P and non-bank operators is how strictly the January 2025 EFTA/Reg E Compliance Aid is enforced in practice.

Stablecoins & Digital Money

The OCC's 21 October 2026 final rule is the first completed piece of federal stablecoin rulemaking under the GENIUS Act, and it establishes the licensing, custody, reserve, and redemption architecture that Permitted Payment Stablecoin Issuers and foreign payment stablecoin issuers operating under OCC jurisdiction will build toward ahead of the rule's legal effective date of 18 January 2027. The licensing category created by the rule — Permitted Payment Stablecoin Issuer — is new, and the rule sets the requirements an entity must satisfy before it may operate under that status, including capital and risk-management obligations alongside the custody and reserve terms. The Comptroller's public description of the rule as providing a clear, practical framework signals that the agency views this as a durable architecture rather than an interim or provisional step.

The finalized reserve and redemption terms moved in a direction that eases issuer liquidity obligations relative to what had been proposed. Secondary reporting describes a reduction in the daily liquidity floor from a proposed 10% down to 5%, paired with a requirement that issuers notify the OCC within 24 hours when redemption requests exceed 10% of a stablecoin brand's outstanding value. The combination suggests a rule that trades a lower standing liquidity buffer for a faster disclosure obligation when redemption pressure actually materializes, rather than holding issuers to a uniformly higher buffer regardless of observed redemption activity.

A further dimension of the stablecoin signal is the extension of eligibility to community banks. Statements attributed to the OCC on 26 October and to Comptroller Gould on 27 October indicated that community banks may issue payment stablecoins under the finalized framework. If this eligibility is carried through into supervisory practice at scale, it would broaden payment stablecoin issuance beyond the largest chartered institutions toward a more fragmented population of smaller issuers, each separately subject to the same licensing, custody, and reserve terms.

The framework remains incomplete at the federal level, however. The OCC's rule covers only the issuer population within its own chartering jurisdiction; the Federal Reserve and the Federal Deposit Insurance Corporation retain rulemaking responsibility for the issuer populations that fall within their respective jurisdictions, and both of those parallel rules remain at the proposed, not final, stage. The practical effect is that as the 18 January 2027 effective date approaches, one category of federally chartered stablecoin issuer has a finalized rulebook while two others do not yet.

Outlook

The principal open question through the effective date is whether the Federal Reserve and FDIC, in finalizing their own parallel rules, will adopt terms consistent with the OCC's eased reserve and redemption requirements or set a materially different prudential standard for the issuer populations under their respective jurisdictions. A convergent outcome would produce a genuinely uniform federal stablecoin regime; a divergent one would mean an issuer's prudential obligations depend materially on which federal regulator charters it, a condition that would itself become a competitive and structural consideration for issuers choosing a charter. The community-bank eligibility statements also bear watching: whether that stated eligibility translates into actual licensing activity by smaller institutions, and under what supervisory conditions, will determine whether the OCC's framework produces a broad-based expansion of payment-stablecoin issuance or remains concentrated among larger chartered entities.

Stablecoins & Digital Money

The GENIUS Act's implementation reached a key milestone this period with the Office of the Comptroller of the Currency finalizing its payment-stablecoin rule on 21 October 2026, effective 18 January 2027. The rule covers reserves, redemption, custody, capital, audits, reporting and risk management for payment-stablecoin issuers under OCC supervision, a category spanning national banks, federal savings associations, foreign branches, nonbank federally qualified issuers, and certain state-qualified issuers that fall within OCC's regulatory reach.

On the substantive yield question, the final rule retains the GENIUS Act's statutory prohibition on issuers paying interest or yield directly to stablecoin holders, with no de minimis safe harbor adopted and no grandfathering extended to rewards programmes that predate the Act — meaning legacy reward structures are assessed under the identical standard applied to newly designed ones. The OCC did, however, drop a previously proposed presumption that would have treated affiliate-routed rewards programmes as presumptively constituting prohibited yield, a narrowing of the final rule's reach relative to the proposal stage, even though the core yield prohibition itself remains unchanged and strictly applied.

The Federal Reserve's companion leg of the same statutory framework remains incomplete. Two notices of proposed rulemaking issued 24 September 2026 address reserve custody requirements, tying restrictions on payment-stablecoin issuers, and a transition framework specifically applicable to uninsured state depository institutions that have already secured approval as payment-stablecoin issuers. The comment period on these proposals runs to 30 November 2026, with no final rule yet issued, producing a bifurcated near-term compliance timeline: issuers supervised by the OCC now face a fixed effective date, while issuers supervised by the Federal Reserve remain under an open proposal with no confirmed finalization date.

Outlook

The principal marker to watch is whether the Federal Reserve finalizes its companion rules before the OCC's 18 January 2027 effective date, which would avoid a sustained period in which only part of the payment-stablecoin industry operates under finalized rules while the remainder continues to operate under proposals. The 30 November 2026 close of the Federal Reserve's comment period is the next concrete date on this timeline.

Stablecoins & Digital Money

Implementation of the GENIUS Act's payment stablecoin framework continues across parallel regulatory tracks this cycle, with the statutory effective date for the full regime remaining no later than 18 January 2027. The Office of the Comptroller of the Currency has the most advanced single component, having moved its final-rule target for stablecoin-issuer licensing and prudential requirements forward to the end of October 2026. Separately, the US Department of the Treasury's proposed rule implementing GENIUS Act Section 3, covering stablecoin issuance, offer and sale, closed for public comment on 19 October 2026; this was a comment-deadline event rather than an effective date, and the proposal as drafted sets no reserve, redemption-right or deposit-insurance-disclosure requirements, leaving those elements to be addressed either in the final Section 3 rule or elsewhere in the implementing framework.

The overall picture is one of a compliance stack assembling itself in pieces across OCC, Treasury and other implementing bodies rather than arriving as a single completed regime. This sequencing matters for market participants: an issuer evaluating readiness for the January 2027 statutory deadline cannot rely on any single regulator's timetable as a proxy for the whole framework's completion, since the OCC's prudential and licensing rule, even if finalized on schedule, would not itself resolve the reserve, redemption and disclosure questions that sit within Treasury's separate rulemaking.

Taken together with the licensing-track developments addressed elsewhere this cycle, the stablecoin regime's defining characteristic at this stage remains its incompleteness relative to the fixed statutory deadline. The regulatory direction is unambiguously toward implementation, with no indication of delay to the statutory effective date itself, but the detailed compliance content that issuers will need to operate against remains only partially settled.

Outlook

The key near-term markers are the OCC's end-of-October 2026 final-rule target, as scheduled, and whether Treasury's Section 3 rule, following its 19 October 2026 comment-period close, proceeds to a final rule that addresses reserve, redemption-right and deposit-insurance-disclosure requirements left open in the proposal. Both tracks remain subordinate to the fixed outer statutory deadline of no later than 18 January 2027, which has not moved.

Stablecoins & Digital Money

Florida's payment-stablecoin issuer regime under Fla. Stat. 658.997 took effect on 1 October 2026. The statute provides that a trust company may not engage in the activity of a qualified payment stablecoin issuer in Florida unless it obtains a certificate of approval or is exempted from that certificate requirement under the section. Beyond the licensing gate itself, the regime imposes a reserve-backing requirement across Chapter 658: a qualified payment stablecoin issuer must maintain identifiable reserves backing its outstanding payment stablecoins on at least a one-to-one basis. The regime further requires monthly disclosure of reserve composition and monthly CPA examination of those reserves, giving the state a recurring verification mechanism rather than a one-off licensing check.

The statute also sets a scale-based transition mechanism: once a qualified issuer's consolidated payment-stablecoin issuance reaches $10 billion, the issuer must transition to federal oversight within 360 days, absent a waiver. On current information this trigger is not expected to activate before the 2027 fourth quarter, but the mechanism itself - a state regime explicitly designed to hand off to federal oversight once an issuer crosses a defined scale threshold - is a structural feature worth tracking independent of when any single issuer actually crosses it.

Outlook

Florida's reserve, disclosure and examination requirements are now in force and apply to any trust company conducting qualified payment stablecoin issuance in the state. The federal-oversight transition trigger introduces a multi-year horizon item: watch issuance volumes against the $10 billion consolidated threshold, and watch whether other states adopt Florida's certificate-plus-reserve-backing structure as a template for their own stablecoin issuer regimes.

Stablecoins & Digital Money

The GENIUS Act (S.1582), enacted July 18, 2025, is the first US federal framework for payment stablecoins and now functions as the operative digital-money instrument for the US payments system. The Act generally prohibits stablecoin issuance by anyone other than a permitted payment stablecoin issuer (PPSI), and establishes a dual federal/state track: issuers below a $10bn threshold may opt into a state regime certified as 'substantially similar' to the federal standard, while issuers that grow beyond the cap must transition to the federal regime within 360 days or secure a waiver. The Act's effective date is fixed as the earlier of eighteen months after the July 18, 2025 enactment date or 120 days after final implementing regulations are issued — meaning the actual compliance start date depends on how quickly OCC, FDIC, Treasury and OFAC complete their rulemaking. Under the Act, PPSIs are treated as Bank Secrecy Act financial institutions, carrying block, freeze and reject capability and an obligation to comply with lawful orders — obligations with direct AML/sanctions compliance implications for product design.

Implementation is now visibly in train at the federal banking agencies. The OCC's Bulletin 2026-3 sets out a notice of proposed rulemaking for the GENIUS Act regulations. The FDIC followed in December 2025 with its own notice of proposed rulemaking, adding 12 CFR §303.252 to establish application procedures under which FDIC-supervised state nonmember banks and savings associations can issue payment stablecoins through a subsidiary, pursuant to GENIUS Act section 5 — opening a bank-subsidiary route to stablecoin issuance specifically for FDIC-supervised institutions. Taken together with FinCEN and OFAC's April 2026 joint proposal mandating effective sanctions-compliance programs for PPSIs (the first time such a requirement has been legally mandated for stablecoin issuers), the picture is one of an actively escalating implementation architecture around a framework that is already in force in statute.

Notably, no US retail central bank digital currency is being pursued; the GENIUS Act framework — private, regulated stablecoin issuance operating under a federal/state dual track — is the model the United States has chosen for digital public money, positioning stablecoin issuance rather than a sovereign digital dollar as the operative vehicle for dollar-denominated digital money.

Outlook

The effective-date mechanics mean the practical compliance deadline is likely to fall around early 2027 (eighteen months after July 2025 enactment), though a faster 120-day-after-final-rules trigger remains possible if OCC/FDIC/Treasury/OFAC rulemaking concludes early. Through the remainder of 2026, expect continued rulemaking activity across all four agencies, further clarity on which state regimes will secure 'substantially similar' certification for issuers under the $10bn cap, and the finalisation of the FinCEN/OFAC sanctions-compliance requirements for PPSIs.

Product Innovation & Market Development

The Commodity Futures Trading Commission's October 9, 2026 actions represent the defining product-access development for event-contract and prediction-market platforms this cycle. The interim final rule, effective immediately, excludes sportsbook and casino-style wagers from the Commodity Exchange Act's definition of a "swap." The companion notice of proposed rulemaking, issued the same day, proposes bringing sports, political, cultural and weather event contracts within that same swap definition, which would place these products under exclusive CFTC jurisdiction as federally regulated derivatives rather than leaving them to state-by-state gambling regulation.

For payment-service providers, acquirers and banking partners serving event-contract trading platforms, this regulatory action directly affects how these products should be classified, underwritten and risk-rated. A platform operating under the assumption that its event contracts are not swaps, and are therefore subject to state gambling law, faces a live possibility that the CFTC's rulemaking — if finalized as proposed — would reclassify its products as federally regulated derivatives, changing which licensing, registration and compliance framework applies to payment flows supporting the platform. This uncertainty sits on top of an unresolved circuit split regarding whether such contracts are subject to federal preemption, meaning payment providers currently face differing legal treatment of the same product category depending on which jurisdiction's law applies.

Outlook

The CFTC's NPRM process, together with the ongoing circuit-level litigation over federal preemption of state gambling law for event contracts, is the key development to watch for product-access and payment-classification purposes. Finalization of the NPRM, in either direction, would materially change the compliance framework payment providers and acquirers must apply to event-contract and prediction-market platforms.

Product Innovation & Market Development

The US instant-payments landscape comprises two competing, non-interoperable rails. FedNow, launched by the Federal Reserve in July 2023, settles in central-bank money, while RTP, launched by The Clearing House in 2017, operates on a bank-owned model; both operate 24/7/365 with irrevocable settlement. Neither rail carries an adoption mandate, and the absence of FedNow-RTP interoperability continues to impede growth of the instant-payments ecosystem as a whole, even though more than 1,500 financial institutions had joined FedNow by early 2026, FedNow processed approximately 8.4 million transactions worth $853.4bn in 2025, and RTP surpassed $1.3 trillion in transaction value in 2025 — up 428% from $246bn in 2024. A majority of US banks (58%) now use both rails, reflecting a pragmatic multi-rail adoption strategy rather than a resolution of the interoperability gap. FedNow is distinct from a central bank digital currency; no US retail CBDC is being pursued.

Open banking remains in regulatory limbo. The CFPB's October 2024 Section 1033 Personal Financial Data Rights final rule was challenged by banks in litigation, and during 2025 the CFPB itself moved to vacate its own rule and reopened rulemaking via an August 2025 advance notice of proposed rulemaking. A planned December 2025 'interim' final rule may, for the first time, permit data-access fees — a potential reversal of the free-access presumption embedded in the original rule.

Outlook

The interim final rule on Section 1033, if and when issued, will be the pivotal event determining whether data-access fees become a permanent feature of US open banking; on instant payments, continued dual-rail growth without interoperability resolution is likely to remain the near-term pattern, with multi-rail bank adoption serving as the market's practical workaround.

Commercial Intelligence & Fintech

Three distinct commercial events mark this cycle's US payments-adjacent dealflow. OKX completed an undisclosed-size funding round at a reported $25 billion valuation, announced October 6, 2026, with participation from Ripple Labs, Circle Internet Group, Standard Chartered's SC Ventures and QRT. The amount raised was not publicly disclosed, and the valuation figure traces to secondary reporting citing Bloomberg and Reuters rather than a primary filing, though the named-participant list spans both crypto-native and traditional-finance investors.

Anchorage Digital, a digital-asset custodian, announced on October 9, 2026 its acquisition of payments company Routable, embedding payout capabilities directly into its infrastructure. The amount of this transaction was not publicly disclosed. This acquisition follows a broader pattern of custody and exchange infrastructure providers building or acquiring payments capability rather than relying solely on third-party rails.

Separately, Samsung Wallet announced support for USDC-on-Solana targeting US cross-border transfers, with the product feature beginning rollout in October 2026. This product launch extends stablecoin-rail availability directly into a major consumer-facing wallet, representing a distinct retail cross-border payments use case from the institutional and exchange-infrastructure focus of the OKX and Anchorage Digital developments.

Outlook

Continued convergence between crypto-native infrastructure providers and traditional payments capability, illustrated by the Anchorage Digital/Routable acquisition and the OKX funding round, should be watched alongside the extension of stablecoin rails into consumer-facing products such as Samsung Wallet's USDC-on-Solana integration, as an indicator of broader stablecoin adoption into retail cross-border payment use cases.

Commercial Intelligence (M&A, Investment & Product)

The largest commercial event of the trailing-twelve-month window is Global Payments' completed acquisition of Worldpay, which closed January 9, 2026 after being announced April 17, 2025. The deal carried a Worldpay net purchase price of $22.7bn and $24.25bn in total transaction value, and was executed alongside a simultaneous divestiture of Issuer Solutions to FIS for $13.5bn — together repositioning Global Payments as a pure-play merchant solutions provider. Two further M&A events add to the consolidation wave: Capital One announced in February 2025 its plan to acquire Discover Financial Services for $35.5bn, explicitly framed as a means of challenging Visa/Mastercard network dominance by building a competing network; and Shift4 Payments agreed in February 2025 to acquire Global Blue for $2.5bn, adding more than 400,000 luxury retail locations and tax-free shopping capability to its portfolio.

On product releases, Global Payments launched its next-generation Genius point-of-sale platform in Q2 2025, reporting strong commercial traction and significantly increased monthly sales following launch. And in a partnership-restructuring event with implications for the commercial direction of US open banking, JPMorgan Chase and Plaid announced a data-transfer agreement in September 2025 built around a pricing structure whose specific terms were not publicly disclosed, signalling the shift toward fee-bearing data access ahead of the CFPB's Section 1033 rulemaking outcome.

Outlook

The Global Payments-Worldpay integration, the progress of the announced Capital One-Discover and Shift4-Global Blue deals toward closing, and the commercial terms eventually disclosed (or not) around the JPMorgan-Plaid data-access arrangement are the key W13 items to track through 2026.