🇺🇸US Financial and Crypto Licenses: Three Axes of Choice — Which Door You Need

Three Axes, Not One

"Getting a US license" means nothing until three coordinates are fixed. Most people hold one axis in mind — federal versus state. In practice a regime sits at the intersection of three. First, who grants the permission: a federal agency (OCC, FDIC, the Federal Reserve, FinCEN, SEC, CFTC) or a state authority, of which there are more than fifty once territories are counted. Second, deposit status: may the institution take deposits, and are they FDIC-insured. Third, access to Federal Reserve settlement: does it hold an account at a Reserve Bank, or do its dollars travel through a correspondent.

The third axis long looked like plumbing. By 2026 it is the single biggest driver of a product's economics. An institution with a Fed account settles in central bank money and does not depend on whether a sponsor's compliance department still likes it. An institution without one rents access, pays the spread and lives with the risk of an abrupt exit. This axis separates a real license from a nameplate: a charter that does not open the settlement door delivers a sign above the shop, not a business model.

The map answers two questions. What actually backs the money on an account: FDIC insurance, a full reserve, segregation of client funds — or nothing beyond an intermediary's balance sheet. And which door to file at, since in the United States picking the wrong one costs years and a redrawn structure. Non-US groups are not exempt: serving US customers pulls a foreign operator into state money transmission, and from 2028 into the stablecoin perimeter.

The Regime Table

Two doors are left out deliberately: the federal savings association, a working but unpopular track for mortgage and consumer credit models constrained by an asset-composition test, and the CEBA credit card bank, a narrow deposit perimeter available only for card issuance.

The Federal Banking Doors: OCC, FDIC and the ILC Wave

For the first time in fifteen years the federal door is genuinely open. On the OCC's own numbers as of 11 August 2026, the agency received 40 de novo applications in 18 months against 48 across the previous 14 years, when some years produced none. Many decisions land within 120 days of a complete filing, and for the first time in five years a full-service national bank received final approval and opened.

The structural shift is the trust charter without deposits. On 12 December 2025 the OCC conditionally approved five applications at once: First National Digital Currency Bank (Circle), Ripple National Trust Bank, BitGo Bank & Trust, Fidelity Digital Assets and Paxos Trust Company, joining roughly 60 existing national trust banks. Tier 1 capital ranged from $6.05m to $25m, and permitted activities span custody, settlement, staking and stablecoin issuance; individual conditions are non-public, known only through law firm analysis. Earlier, on 15 October 2025, Erebor Bank took a preliminary conditional approval. Among 2026 decisions Coinbase's is primary-source confirmed: Corporate Decision No. 1370 permits institutional custody only, no retail deposits and no lending.

One caveat: the full 2026 approval list diverges across sources, with trade summaries and law firm trackers classifying Bridge, Laser Digital and Morgan Stanley Digital Trust as either conditionally approved or still pending. Check any name against the OCC Weekly Bulletin and Corporate Applications Search; only press-release and corporate-decision confirmations are stated as fact here.

Conditional approval has stopped being a nod. The OCC moved the operational examination of a bank's architecture to the stage after it: organisers have 18 months to reach "no supervisory objection", and the capital fixed at approval can be revised upward, particularly for digital-asset banks where off-balance-sheet assets make conventional ratios uninformative. Hence the gap in the statistics — approvals are plentiful, yet for a long stretch the only fully operational digital-asset national trust bank was Anchorage Digital.

Denials have become specific. On 21 July 2026 the OCC rejected Wise's application for Wise National Trust on four grounds, none about the product: a July 2025 Multistate Consent Order for BSA/AML failings, organisers with insufficient knowledge of banking law, a board and management short on fiduciary competence, and no experience under 12 CFR 9. The OCC screens on people and compliance history, not business model; the denial does not bar a fresh application.

The legal frame moved too. The final chartering rule, adopted 27 February 2026 and effective 1 April, replaced "fiduciary activities" in 12 CFR 5.20 with "the operations of a trust company and activities related thereto", aligning with 12 U.S.C. § 27(a). The OCC maintains powers are neither expanded nor narrowed; the CSBS calls it a back door to full banking without insurance, the ABA wants new trust charters barred from the word "bank", and the BPI weighed litigation. Whether payments and money transmission sit inside "the operations of a trust company" is exactly what the rule does not answer, and exactly why many applicants are there: the regulatory risk falls after the charter, not before. The regime in full is covered separately.

The deposit side was rebuilt too. On 10 August 2026 the FDIC introduced a two-phase process: contingent authorization within 120 days of filing, then full approval over the following 12 months, giving founders certainty before they raise capital and hire. In parallel the ILC came back to life: a Utah or Nevada charter plus FDIC insurance delivers full banking functionality without bank holding company status for the parent — which is what lets a commercial company own a bank. Approvals in 2026 went to Ford Credit Bank and GM Financial Bank (23 January), Edward Jones Bank (February) and Stellantis Bank USA (15 May). The toll is regulatory capital two to three times the normal level: $1.5bn from Ford, $667m from GM, at least $150m from Stellantis, all with minimum 15% tier 1 leverage and dividends requiring FDIC consent for three years. Nissan, PayPal and Affirm are pending, opposed by the BPI and ICBA. The wave is mapped in the piece on industrial banks.

The Third Axis: Access to Fed Settlement

The rules come from the Federal Reserve's Guidelines of 15 August 2022: three tiers of review — Tier 1 for federally insured institutions, Tier 2 for uninsured institutions under federal prudential supervision, Tier 3 for everyone else. The outcome is documented: per CRS, between December 2022 and May 2026 only three Tier 3 applicants obtained a master account, while roughly half of the tier's applications were withdrawn or denied.

Two cases show the fork does not run along charter type. Custodia, a Wyoming SPDI, was denied Fed membership by the Board on 27 January 2023 and refused a master account by the Kansas City Fed the same day, on the reasoning that its model was novel and crypto-focused; a district court ruled against it in March 2024, rejecting the argument that the Monetary Control Act of 1980 guarantees access, and secondary sources agree the appeal was lost too, though that ruling's date is not primary-source confirmed. Three years later the same Reserve Bank granted a master account to Kraken Financial, a Wyoming SPDI with a comparable model: 4 March 2026 was the first direct access by a digital bank to Fed payment rails. Conditions are strict — full reserve, at least 100% liquid assets against client fiat deposits, a phased institutional launch. The BPI notes the account is capped at one year, that Vice Chair Bowman called it a pilot, and that the decision "front-runs the Board's public comment process". What separates Custodia from Kraken is timing and negotiating position, not charter; both are examined separately.

The door is now being institutionalised. On 20 May 2026 the Fed formally proposed a "payment account": a stripped-down account reaching Fedwire Funds, FedNow, NSS and Fedwire Securities on a transfer-only basis, with no FedACH, checks, FedCash or correspondent relationships, and no interest, intraday credit or discount window. Balance ceilings are individual under a hard $1bn cap; review runs 45 days for Tier 1 and 90 for Tiers 2 and 3; Reserve Banks were advised to pause Tier 3 decisions until 31 December 2026. Companion changes to the PSR Policy, Regulation D and Regulation A appeared on 26 May, comments closing 27 July 2026. A day earlier an executive order of 19 May gave the Board 120 days to assess its authority to extend payment access to uninsured depository institutions and nonbank financial companies.

What matters most is the omission: the pool of legally eligible applicants does not widen, and remains depository institutions. A fintech without a depository charter still cannot open the door; the real beneficiaries are state SPDIs, uninsured national trust banks and bank stablecoin issuers. The absence of FedACH hollows the product out for payroll and B2B flows — a point pressed by crypto firms demanding broader scope and by community banks objecting to the concept entirely. Parameters and positions are in the piece on payment accounts.

Stablecoins: the GENIUS Act and Three Doors

The GENIUS Act, Public Law 119-27, was signed on 18 July 2025 after votes of 68–30 in the Senate and 308–122 in the House. It creates the status of permitted payment stablecoin issuer and three doors into it: a subsidiary of an insured depository institution; a federal qualified nonbank issuer approved by the OCC; and a state qualified issuer under state law, available only while outstanding issuance stays below $10bn.

Everything turns on 18 January 2027. The Act commences on the earlier of two triggers: 18 months from enactment, or 120 days after final rules. Not one final rule exists out of roughly twenty-five required, and every agency missed the statutory deadline of 18 July 2026 — so the hard calendar date governs. The paradox is that delay pulled the deadline closer rather than pushing it away: the later the final texts arrive, the less time remains to comply, and issuers will build against unadopted drafts.

The drafts are already substantive. The OCC's NPRM, published in the Federal Register on 2 March 2026, creates a new 12 CFR 15 and puts 211 questions to the market. Per Sullivan & Cromwell, capital is set case by case rather than as a single minimum: a $5m floor for de novo issuers plus an operating backstop of 12 months of expenses in high-quality liquid assets. Reserves run 1:1 in short-duration instruments; redemption settles in two business days, extending automatically to seven calendar days where redemptions spike above 10% in 24 hours; issuers above $25bn hold half a percent of reserves, capped at $500m, in fully insured deposits; interest or yield is prohibited, including indirect payment through affiliates. The OCC has 30 days to deem an application complete, with automatic approval after 120 days absent a denial. Forms PS-01 and PS-02 add weekly confidential and quarterly public reporting on top of monthly audited reserve reports.

The state door exists on paper only. Eligibility depends on the state regime being recognised as substantially similar; Treasury only proposed the assessment principles on 1 April 2026, the decision rests with the Stablecoin Certification Review Committee — Treasury Secretary, Fed Chair and FDIC Chair, unanimously — and the expedited review procedure has been overdue since 14 January 2026. No state is certified. The $10bn threshold is measured on consolidated issuance, and breaching it forces migration to federal supervision within 360 days, so "start in a state and decide later" writes a change of regulator into the business plan. Foreign issuers have their own route: OCC registration after a Treasury comparability determination, default approval at 30 days, and a hard stop of 18 July 2028 for access to US digital asset service providers. How the legal forms of a dollar token relate is set out in the pieces on the digital dollar and stablecoins, the statute in GENIUS Act, and the first token from a US national bank in the SoFi case.

The States: Money, Crypto and Fifty Filings

The nonbank route begins with something that is not a license. FinCEN MSB registration on Form 107 is filed within 180 days of formation and renewed every two years; it authorises nothing and merely fixes BSA obligations — an AML program, reporting, a five-year agent list. Sanctions are out of proportion to the paperwork: up to $5,000 per violation with each day counting separately, plus criminal exposure of up to five years. The regime is unpacked in the MSB piece.

Authorisation comes from the states. Money transmitter licenses are issued by 49 states, the District of Columbia and the territories through NMLS, and the economics of full coverage are sobering: on industry consultants' figures, application fees alone across 50 states and DC total roughly $115,400 — from nothing in Montana and $100 in Idaho to $10,000 in Texas and Hawaii. On top come surety bonds of $25,000 to $500,000+ per state at premiums of 1–3% a year. Year one lands at $250,000–350,000, ongoing maintenance at $225,000–280,000 and up, with California alone consuming about 13% of the annual bill. Timelines run two to eighteen-plus months per state. The CSBS model law has been adopted in whole or in part in roughly thirty-odd states, reducing divergence without removing the need for fifty filings. Practice is covered separately.

Two states layer their own crypto regimes on top. New York runs the BitLicense under 23 NYCRR Part 200, live since June 2015, with a customer protection bond from $500,000 and more than forty licensees; the alternative is a limited purpose trust company under state banking law, adding fiduciary powers and removing the separate MTL. The choice is examined in the BitLicense piece. California's DFAL regime became operative on 1 July 2026 after a one-year delay; DFPI has accepted filings through NMLS since 9 March 2026, and from that date serving Californians requires a license or a submitted application. Cybersecurity is assessed against NIST CSF 2.0, and a DFAL license does not exempt the holder from money transmission licensing. The third track is the Wyoming SPDI: a depository institution at 100% reserve, barred from lending out client fiat deposits. Four charters exist; Kraken Financial, Custodia and Commercium are the publicly identified holders.

Adjacent Doors: Securities and Derivatives

Where the product is an instrument rather than money, the perimeter changes entirely. Securities dealing and brokerage require broker-dealer status with FINRA membership and net capital under Rule 15c3-1; a secondary venue for tokenised securities requires ATS registration; registry maintenance requires transfer agent status on Form TA-1, or 12 CFR Part 341 for banks. Asset management splits by threshold: below $25m the state registers, $25–100m is also state except in New York and Wyoming, from $110m RAUM the SEC is mandatory, and withdrawal is available below $90m; private funds and venture managers use the lighter exempt reporting adviser status. Derivatives and leveraged spot fall to the CFTC — DCM, FCM, DCO — and since the initiative of 4 August 2025 a listed spot market has been built on existing CEA authority, joined by perpetuals in 2026.

The legislative frame remains unfinished. The CLARITY Act cleared the House on 17 July 2025 by 294–134 and was approved by Senate Banking on 14 May 2026, but reached no floor vote before the August recess: Republicans lack the votes for cloture, and secondary estimates of passage in 2026 have fallen to roughly one in three. If enacted it takes effect after 360 days. That logjam is why the SEC took the rulemaking route: a meeting on 14 August 2026 is set to vote on issuing Regulation Crypto, a tailored offering regime of up to roughly $75m outside full registration. The price of speed is reversibility: what one administration installs by rule, the next removes by rule.

If Your Product Is X, Then...

• Insured deposits and lending, and you are a financial company. A national bank charter: OCC, FDIC insurance, holding company status with the Fed. A decision is possible in 120 days, but 18 months in organisation and a likely upward capital revision follow.
• The same, but the parent is non-financial. An ILC in Utah or Nevada plus FDIC insurance. The door has been open since January 2026; the price is 15% tier 1 leverage and capital from $150m.
• Fiat deposits without insurance or lending, crypto business. A Wyoming SPDI at 100% reserve — the only track by which a nonbank crypto operator has actually obtained a master account, and then only as a one-year pilot.
• Custody, fiduciary services and digital asset settlement without deposits. An OCC national trust bank at $6–25m of capital, or a New York limited purpose trust company if one state is enough — it also removes the New York MTL.
• A stablecoin above $10bn. Federal only: the OCC as federal qualified nonbank issuer, or an insured bank subsidiary. Budget a $5m floor, bespoke capital, 12 months of expenses in HQLA, weekly reporting.
• A stablecoin below $10bn. State status is formally available and practically not: no regime is SCRC-certified, and breaching the threshold triggers a 360-day migration.
• Moving money or crypto without bank status. FinCEN Form 107 plus an MTL in every state of presence, with a BitLicense for New York and DFAL for California on top.
• Securities, tokenisation, derivatives. Broker-dealer and FINRA, ATS for a venue, TA-1 for a registry, RIA or ERA for management, CFTC for derivatives.
• No license of your own. A sponsor bank, appointed-agent status under a licensed transmitter, or payment facilitator on the agent-of-payee exemption — cheaper to enter, dearer to supervise.

Without Your Own License: the Sponsor Bank and Its Price

The BaaS model is alive, but more expensive and fully transparent to examiners. The interagency guidance on third-party relationships of 6 June 2023 and the joint statement on deposit products delivered through third parties of 25 July 2024 turned sponsor selection into two-way diligence. On an industry register's tally, nine of fifteen major sponsor banks have or have had published federal actions: Cross River, Sutton, Piermont, Evolve, Silvergate and a second Lineage consent order dated 24 June 2026, with the Blue Ridge and Thread orders terminated in November and December 2025.

The direction of enforcement matters more than the count: crypto deregulation is not BSA deregulation. In an OCC order from April 2026, published on 21 May, the findings against a community bank that had "significantly expanded" its processing capability relative to its size come down to not understanding its fintech partners' customer base, transaction flows and geographic exposure; the remedy runs to an independent consultant, a CDD rebuild and a SAR lookback. The economics of renting access are set out in the pieces on BaaS and sponsor banks and renting a license, the shifting perimeter in the trends overview, and one alternative route to dollar settlement in the analysis of Puerto Rico banks.

The legal character of the 2025–2026 reversal is worth holding onto: it was executed through withdrawals, not new permissions. OCC Bulletin 2025-2 of 7 March 2025 removed the supervisory non-objection requirement and restored the earlier interpretive letters; the Fed and FDIC withdrew their SR letters and joint statements on 24 April 2025; the Fed policy statement of 22 December 2025 rescinded the January 2023 presumption. The permissive base is the old one, and a future administration can reverse it with the same instruments, without full rulemaking.

The Calendar to 2028