By Monday (Nov. 2), Federal Reserve and Office of the Comptroller of the Currency supervisors were asking banks in the United States whether they had seen unusual activity or interruptions of their own. One bank said its services had continued without disruption, PYMNTS reported Thursday (Nov. 5), citing Reuters.
Binance’s account of the breach said attackers had spent months getting into its systems before taking control of wallets connected to the internet, PYMNTS reported Tuesday (Nov. 3).
A bank’s own systems could remain available while a service it uses to move money is down, which remains among the risks as lenders begin to use stablecoins issued by other institutions. An issuer handles redemption, a custodian safeguards assets and a platform gives the bank a way to submit payment instructions. Depending on how these jobs are divided, an interruption at one provider could affect a bank’s ability to send a payment, confirm where it went or turn the tokens back into dollars.
The division of work is visible in one interbank settlement program, PYMNTS reported Tuesday. In North Dakota, VersaBank USA handles issuance and custody for Roughrider Coin, and Fiserv provides the platform and banking integration. Participating lenders access the stablecoin through the same commercial banking system they already use for conventional interbank transfers, according to Fiserv’s launch announcement.
What the Contract Says About an Outage
The federal banking agencies’ existing third-party risk guidance discusses provisions that spell out when a provider alerts a bank to a breach, what recovery targets apply and whether the two parties test their plans together. It also discusses a bank’s ability to move its data or activities to another provider after a service interruption. For a payments team, one immediate issue is whether it has the records to tell which transfers went through before it sends any of them again.
Comments on the agencies’ proposed revision to that guidance close Nov. 16. The September proposal would have institutions calibrate their oversight to the likelihood and severity of harm from each provider relationship. The OCC’s final GENIUS Act rule takes effect Jan. 18, 2027, and sets standards for reserves, redemption, risk management and certain custody activities under the agency’s jurisdiction. For a lender using another institution’s coin, the provider contract is where to look for the procedures staff would follow during an outage.
In a September study, “Credit Unions Build for Digital Money’s Next Chapter,” based on responses from 500 U.S. credit union executives, PYMNTS Intelligence found that 34% of institutions classified as quick followers said they were operationally prepared to support stablecoins, while 9% were actively engaged. Across the survey, cybersecurity and fraud risk was the most cited barrier to cryptocurrency engagement, at 52%, ahead of member demand at 44%.
As more institutions consider live settlement, the evidence to look for is specific to the service. Have the bank and its providers tested recovery together? What were staff able to verify while the service was down? How long did it take to resume payments?
A bank’s backup plan also depends on who does the work behind each provider. Federal guidance flags subcontracting because banks have less direct control over these firms. If two payment providers depend on the same service to complete a transfer, switching between them would leave the bank exposed to an outage at that service.
