Stablecoin rules in five major markets differ sharply over who may issue tokens and which businesses issuers may conduct, while all five frameworks stop key activity restrictions at the issuing entity rather than extending them across its corporate group, according to a new Financial Stability Institute brief.
The August 27 study compares the European Union, Hong Kong, Singapore, the United Kingdom and the United States using information available as of July 2026. Its authors stress that some of the frameworks are still being implemented or refined. The comparison therefore describes the current regulatory architecture, not a settled global standard.
For payment companies, the most consequential finding is not simply that rules vary by jurisdiction. It is that a licensed issuer can sit inside a wider non-bank group whose affiliates perform lending, staking, proprietary trading or third-party crypto custody even when the issuer itself cannot. The FSI authors say this creates a potential route for conflicts, operational problems or reputational stress elsewhere in the group to reach the stablecoin business.
Two models for non-core activities
The brief divides approaches for non-bank issuers into two broad models. Singapore and the United States use relatively restrictive perimeters. Singapore explicitly prohibits specified activities for non-bank issuers regulated under its stablecoin framework, while the US GENIUS Act uses a closed list of permissible activities that leaves lending, staking, proprietary trading and custody of third-party cryptoassets outside the issuer’s normal authority. The study notes a narrow US exception for separately authorised digital-asset services that meet statutory conditions.
Hong Kong, the UK and the EU generally use a more conditional model. Additional activities can be possible with separate authorisation, supervisory consent or compliance with another sectoral regime. The mechanics vary: Hong Kong requires non-bank licensees to obtain consent for business beyond stablecoin operations, while the UK treats several adjacent crypto services as separately regulated activities. In the EU, the answer can depend on whether the issuer is a bank or an electronic money institution.
That bank-versus-non-bank distinction runs throughout the comparison. Banks may have broader authority because consolidated prudential supervision, intragroup exposure limits and operational-resilience requirements already apply to the banking group. Bespoke stablecoin regimes generally impose narrower limits on non-bank issuers that do not have the same group-wide framework.
The issuer perimeter does not cover the full group
Despite their differences, all five frameworks apply the reviewed non-core activity restrictions to the issuer rather than every affiliate in its corporate group. The authors do not claim that issuers are currently evading rules or that every affiliate activity threatens redemption. Their concern is structural: a prohibited activity can legally sit in a sister company, while stress or conflicts generated there may still affect confidence in the issuer.
The brief says the asymmetry is most significant for large non-bank groups. It suggests that stablecoin or related prudential regimes may need some form of group-wide oversight unless other proportionate safeguards address conflicts of interest, contagion and the protection of holders. That is a policy recommendation from the paper’s authors, not a binding BIS rule; the publication also states that their views do not necessarily represent the BIS or its member central banks.
Core payment obligations also diverge
The five frameworks broadly agree that issuance, redemption and reserve management are core functions, but important operating details differ. The study identifies variation in who may custody reserve assets, whether redemption fees are allowed and whether minimum redemption amounts may be imposed.
It also records different redemption timelines. Hong Kong and non-systemic UK issuers generally face a next-business-day standard, the US proposal interprets timely redemption as two business days, Singapore allows up to five business days, and the EU requires redemption to be available at any time. These are regulatory requirements and proposals, not measurements of how quickly every issuer processes a real customer request.
For processors, wallets, exchanges and merchant platforms, those differences affect product design. A token carrying the same currency reference can expose customers to different direct-redemption rights, fee rules, custodial arrangements and supervisory structures depending on the issuer and jurisdiction. Distribution partners therefore need to assess the legal entity that owes redemption, not only the token symbol or reserve headline.
What payments firms should test
The paper’s group-level finding points to a practical due-diligence agenda. Payment firms integrating stablecoins should map the issuer’s affiliates, identify which entity controls reserves and redemption, review intragroup service dependencies and understand whether liquidity, custody, compliance or technology functions are shared with businesses outside the stablecoin perimeter.
Contracts and continuity plans should also address what happens if an affiliate experiences a trading loss, cyber incident, sanctions problem or insolvency while the issuer remains solvent. That does not mean such an event would automatically impair reserves. It means operational separation and legal ring-fencing should be verified rather than inferred from the issuer’s licence alone.
The FSI brief does not conclude that one jurisdiction has solved every risk, and it does not provide evidence that stablecoin payments already operate at mass-market scale. Its sharper contribution is to show that apparently similar issuer regimes can place materially different activities, legal entities and group risks inside or outside the supervisory boundary.