SEC vs CFTC vs OCC: Who Regulates Stablecoins in 2026?

Why the stablecoin turf war matters more than it looks

Stablecoins sit at an awkward intersection of three legal worlds. To a payments lawyer they look like money transmitter balances. To a securities lawyer they look like investment contracts because holders expect the issuer to preserve value through reserve management. To a derivatives lawyer they look like settlement assets and collateral, which puts them inside the commodities regulator's territory.

That ambiguity was tolerable in 2019 when the largest stablecoin issuers together held under five billion dollars. It is not tolerable in 2026 when USDC, USDT, PYUSD, and RLUSD together hold well over two hundred billion dollars in circulation and a meaningful share of all on-chain value transfer depends on them. When something breaks, somebody has to be the supervisor on the ground, with staff, subpoena power, and a rulebook already drafted.

The GENIUS Act, passed in 2025, was the first serious attempt to draw those lines in statute rather than letting them be fought out case by case. It does answer the largest question, which is who supervises the issuer of a payment stablecoin. It also leaves at least two big questions open, and those open questions are exactly where the next round of enforcement, litigation, and rulemaking will land.

The GENIUS Act framework: three lanes, not one

Before the bill, a stablecoin issuer in the United States was effectively regulated as a money services business under FinCEN rules, plus a patchwork of state money transmitter licenses, plus whatever a futures or securities regulator could claim on the side. The GENIUS Act replaced that with three explicit lanes.

The first lane is the OCC federal charter. A qualified payment stablecoin issuer can apply to the Office of the Comptroller of the Currency for a federal license, which subjects it to capital, liquidity, reserve composition, redemption, disclosure, and examination standards written directly into the statute. Circle's USDC and Ripple's RLUSD have already moved in this direction, and the OCC has signaled it expects this to become the default path for large issuers.

The second lane is the state pathway. An issuer below a statutory size threshold, currently set at ten billion dollars of circulation, can operate under a qualifying state banking department's regime, provided that regime is at least as strict as the federal one. New York, Texas, and a handful of others have standing regimes; smaller states are racing to either build one or risk seeing their issuers migrate to a friendier jurisdiction or to the OCC.

The third lane, the residual one, is where everything that does not fit into the first two lives. Anti-money-laundering enforcement stays at FinCEN. Sanctions enforcement stays at OFAC. And two agencies that are not the primary supervisor keep residual claims: the CFTC for derivatives and the SEC for anything that smells like an investment contract.

What the OCC actually gets, and what it does not

Once an issuer is federally chartered under GENIUS, the OCC owns the day-to-day supervisory relationship. That means examinations, capital remediation plans, enforcement actions for unsafe or unsound practices, and the power to put an issuer into receivership if reserves are misused or redemptions break. It also means the OCC owns the rulebook for redemption at par, reserve asset composition, attestation cadence, and disclosure.

The OCC's authority is, however, deliberately narrow. The statute defines a payment stablecoin as a digital asset used as a means of payment or settlement, pegged to a fixed value, and backed by eligible reserves. The moment a token starts paying interest to holders, distributing yield, or operating in a way that holders reasonably expect appreciation from issuer activity, the OCC's clean fit starts to fray. The statute carves those tokens out of the OCC's exclusive lane, which is exactly the gap the SEC is trying to walk through.

This is also why RLUSD's design choices matter. RLUSD has been positioned from launch as a pure payment stablecoin with no yield feature and no governance token attached, which keeps it comfortably inside OCC jurisdiction. PYUSD, issued by Paxos under a New York state charter plus OCC trust charter overlap, is similarly structured. USDC's Circle Reserve yield product, which had been a sore point with regulators, was wound down before the bill passed.

The CFTC's residual role over derivatives

The CFTC did not get primary stablecoin authority and did not ask for it. What it kept, and in some cases gained, is residual jurisdiction over derivatives that reference stablecoins or settle in stablecoins. Perpetual futures on a centralized exchange, where the margin and the settlement currency are stablecoins, fall inside CFTC jurisdiction because the underlying swap contract is a commodity interest.

The CFTC also retained, and the GENIUS Act explicitly preserved, its anti-fraud and anti-manipulation authority over retail commodity transactions involving stablecoins. That phrasing matters because it lets the CFTC pursue a fraud case against a stablecoin issuer or a DeFi protocol even when the issuer itself is OCC-supervised and the protocol itself is not a derivatives venue.

In practice the CFTC's lane shows up in three places. First, perp and futures markets on offshore exchanges that solicit to US persons, where the CFTC has long claimed jurisdiction over the swap itself regardless of where the venue sits. Second, retail-facing tokenized commodity products that bundle stablecoin exposure with leverage, which the CFTC has consistently treated as falling outside the payment-stablecoin safe harbor. Third, the as-yet-unresolved question of whether tokenized US Treasury funds used as stablecoin reserves, the structure RLUSD and several others have adopted, count as securities for the reserve holder even though the stablecoin itself does not.

The SEC's claim over yield-bearing stablecoins

The SEC lost the central fight when the GENIUS Act passed, because Congress wrote into statute that a properly structured payment stablecoin is not a security. The SEC did not, however, give up the parts of the field it thinks it can still hold. Its position, stated publicly by the Chair and reflected in ongoing enforcement, is that yield-bearing stablecoins and reserve-management products are investment contracts under the Howey test and therefore fall under the Securities Act and the Securities Exchange Act.

The two products at the center of that claim are Ethena's USDe and the Sky Savings Rate, formerly the Dai Savings Rate, that runs on the Sky/MakerDAO protocol. Both use stablecoins as a base asset and generate yield for holders through a combination of perp funding, basis trades, tokenized Treasury holdings, and protocol-level incentive mechanisms. The SEC's view is that when a holder deposits USDC into a contract and receives a token that appreciates or pays out yield, the holder is participating in a common enterprise with the expectation of profit from the efforts of others.

Issuers and protocol teams push back on three grounds. First, the yield in many of these products comes from on-chain market activity rather than from issuer entrepreneurial effort, which they argue cuts against the third prong of Howey. Second, the products are structured so that yield passes through to holders automatically rather than being pooled and managed. Third, several of them are governed by DAOs, which raises a separate question about who the promoter even is for purposes of Section 5.

None of those defenses has been tested to judgment. The SEC has settled or administratively resolved several adjacent cases, including actions against certain yield-bearing wrapped products, but it has not yet taken USDe or Sky to a contested merits ruling. The threat of that case is doing real work in the meantime, because protocols are structuring new products to look less like securities without being sure that the SEC will agree.

State attorneys general and the consumer-protection gap

GENIUS expressly preserved state law in two places. It preserved state money transmitter regimes for any issuer that does not choose the federal or qualifying state pathway. And it preserved state consumer-protection and unfair-trade-practices law for everyone, including federally chartered issuers, except where the state law directly conflicts with the federal framework.

That preservation is why several state attorneys general have already filed suits targeting yield features on stablecoins marketed to residents of their states. The theory of these cases is straightforward: if a consumer in California buys what looks like a stablecoin and is told it will earn yield, and that product later fails or is alleged to be an unregistered security, the state can sue under its own UDAP statute even if the issuer is OCC-supervised at the federal level.

This is also why the New York Department of Financial Services, which runs the state's BitLicense regime and has historically been the most aggressive state supervisor of crypto firms, has been vocal about yield features being incompatible with its trust charter rules. NYDFS can deny or revoke a trust charter and can levy fines; it does not need the SEC to act first.

The interaction between federal preemption, which is partial, and state enforcement, which is preserved, is the part of the framework most likely to be litigated over the next two years. Issuers want one rulebook. States want to keep their consumer-protection toolkit. Both have statutory arguments.

How this changes the practical picture for issuers and users

For issuers of plain payment stablecoins, the picture is the clearest it has ever been in the United States. A USDC, USDT, PYUSD, or RLUSD issuer can pick the OCC federal lane or a qualifying state lane, comply with the relevant reserve and redemption rules, and operate with a defined supervisor and a defined rulebook. USDT remains the awkward case because Tether has not pursued a US license and instead relies on its international structure, which means US persons access USDT through offshore venues where GENIUS does not apply.

For issuers of yield-bearing or yield-adjacent products, the picture is genuinely unsettled. The same product can be marketed as a payment stablecoin by its issuer and as an investment contract by the SEC. A state attorney general can sue under state law while a federal supervisor stands aside. The only safe assumption is that the more a product promises yield to holders, the more legal tail risk it carries, regardless of how cleanly the smart contract is written.

For users, the practical implication is that the label on the token matters less than the legal wrapper around it. A USDC balance held on a regulated exchange with an OCC-supervised issuer is in a meaningfully different legal posture from a yield-bearing receipt token from an offshore protocol, even if both display the same dollar balance in a wallet interface. The legal recovery paths if either fails are different, the supervisors who can act are different, and the statutes that protect the user are different.

How to follow stablecoin regulation the smart way

Stablecoin regulation moves fast because three federal agencies, dozens of state supervisors, and several active court cases all touch it at once. Tracking which agency actually said what, and which case actually moved, by hand is a losing game. Zippfeed surfaces stablecoin headlines with sentiment scoring (bullish, neutral, or bearish) and an importance rating, so you can see at a glance whether a new filing is a procedural footnote or a real shift in the map between the SEC, the CFTC, and the OCC.