In forty-eight hours three things moved in the same direction, one in the opposite one. The OCC granted final approval to Ripple National Trust Bank; it then invited community banks to become stablecoin issuers; Canada opened a consultation on its own rules. In parallel Keystone admitted that its website had also leaked the key it uses to verify device authenticity.

The charter

Ripple had held conditional approval since December 2025. Now the federal trust bank can manage the reserves backing RLUSD, act as collateral trustee for holders and offer custody. RLUSD remains issued by Standard Custody & Trust, regulated by New York’s DFS: two layers of supervision over the same product, exactly what institutions were asking for. Coinbase, Crypto.com and Bridge remain at the conditional stage. The same day Aviva Investors brought the tokenized share class of its 22 billion pound Sterling Liquidity Fund onto the XRP Ledger, with 50 million invested from its own book: the firm’s second tokenized fund.

The invitation that is also a problem

The OCC wrote on X that it wants community banks in payment stablecoins, days after finalising the GENIUS rule, in force from 18 January 2027. The detail that makes the scene interesting is another one: the ICBA, the community bankers’ association, is suing the OCC precisely over the charters granted to crypto companies. The same regulator is inviting in the very people who are taking it to court.

Ottawa opts for the hard line on yield

Canada opened a 60-day consultation, running until 23 December: interest and yields banned even through intermediaries, transaction-linked rewards allowed, 1:1 reserves at Canadian institutions, redemption within three business days, fees no higher than 1%. In force at the end of 2027, with registration at the Bank of Canada. The explicit reference to the GENIUS Act tells the real reason: two jurisdictions aligning without coordinating.

The low point

Then there is Keystone. The website breach, via Shopify’s API, had exposed shipping data; on Monday the company added the piece that changes the nature of the incident: the stolen authentication key allows fake wallets to be manufactured that pass the check. Some 18,835 devices in stock will be destroyed; for devices delivered after 20 October the company no longer guarantees authenticity. The records potentially taken number 25,964, dated 2024-2026, left sitting there because of a fault in the deletion tool.

A final note on method. The viral claim that Coinbase had enabled JPMorgan, Citi and PNC to buy bitcoin inside banking apps mixes three different things: PNC does offer in-app trading, but since December 2025; Chase concerns account links, points and cards; Citi, stablecoin payments for businesses. The narrative runs faster than reality: better to go back to the press release.

Institutionalisation is real and is happening at the top, with regulators competing over the credit for having written it. The risk, as always, has moved to where nobody writes regulations: the box that arrives in the post.

Verified sources: BusinessWire, “Ripple Receives Final OCC Approval to Establish National Trust Bank” (26 October 2026); Cointelegraph on Ripple (27 October 2026); OCC Bulletin 2026-50 and 2026-51 (21 October 2026); Cointelegraph and CoinDesk on the OCC’s invitation to community banks (26 October 2026); CoinDesk, “Canada opens consultation on draft stablecoin rules” (26 October 2026) and Canada Gazette (24 October 2026); Cointelegraph on Aviva Investors (26 October 2026); Cointelegraph on Keystone (25 and 26 October 2026) and Keystone’s statements on X; Coinbase, “Coinbase and PNC Partner to Expand Direct Bitcoin Access for Clients” (9 December 2025); crypto.news on Coinbase’s banking partnerships. Corrected against the report: the Coinbase announcement about the three banks concerns different services, and the number of clients involved in the Keystone case was disclosed on 26 October, not before.