Wall Street Builds Crypto Standards While Congress Delays Federal Rules

Table of Contents

• You might want to know


• Main Topic


• Key Insights Table


• Expert Guidance for Advisors


• Afterwards...

You might want to know

• What are financial firms doing to manage crypto-related risks while the United States lacks a comprehensive federal framework?


• How can financial advisors assess tokenized platforms when rules and investor protections are still developing?

Main Topic

When lawmakers do not provide a comprehensive framework for digital assets, financial institutions still have to decide how to operate. Firms cannot simply pause decisions about compliance, custody, security, and settlement until legislation is complete. Instead, many are building procedures and technology for the regulatory environment that exists today. The result is an emerging set of industry practices shaped by existing federal and state requirements, regulatory actions, and practical needs.

The delay has been especially visible in the debate over the CLARITY Act. After the U.S. Senate failed to advance the legislation on Sept. 15, the country remained without a broad federal framework for digital assets. Regulators took steps in areas where they could act: two days later, the SEC issued an “innovation exemption” that allows certain venues to trade tokenized U.S.-listed stocks onchain. The move created a possible route for specific activity, but it did not settle the larger question of how digital assets should be governed.

An exemption is different from a law. It may be narrowed, changed, or withdrawn, so firms that build around it must consider how their systems would function if the permission changes. This creates a planning challenge: institutions want to develop useful services, but they also need to avoid relying on a regulatory arrangement that may not last. Temporary regulatory permission can enable experimentation, but it is not a substitute for durable rules or careful contingency planning.

At a recent Crain’s New York Business event, discussions of tokenization, compliance, and cybersecurity reflected this practical approach. The participants focused less on waiting for a final policy settlement and more on building systems that can operate amid uncertainty. For financial advisors, this matters because the quality of a platform’s controls and operating model can affect the reliability of services offered to clients.

Adam Schumann, vice president of legal at OKX, described the fragmented regulatory landscape. U.S. firms face federal statutes and agencies alongside state laws and regulators. These authorities do not necessarily move at the same pace or provide identical guidance. Schumann said firms may seek broad consistency, but complete uniformity is unlikely. Businesses therefore have to work through differences from state to state and country to country while regulators address immediate gaps.

This patchwork has direct operational consequences. Aravind Raju, CFO of Uphold, said compliance has become one of the company’s largest departments because the firm develops solutions tailored to individual state requirements. If rules become clearer and more aligned, some of those resources could potentially be redirected. Until then, the effort involved in meeting varying requirements remains part of the cost of doing business.

Advisors assessing digital-asset providers should treat compliance as a meaningful operating capability rather than a box to check. A firm’s ability to understand applicable obligations, maintain records, and adapt to jurisdiction-specific requirements can influence its resilience. Firms that manage this complexity effectively may be better positioned than those that treat compliance as an afterthought. That does not eliminate other risks, but it is an important part of evaluating an institution’s preparedness.

One might expect the expense of building separate solutions to encourage institutions to share common infrastructure. In practice, many firms have instead introduced private, closed networks for tokenized assets, stablecoins, and securities ledgers. These networks can be difficult to connect. Lewis Tuff, CEO of Twilight, a company that builds clearing and settlement technology, noted that institutions can end up rebuilding similar connections independently.

Separate networks can give institutions greater control over their systems and operations, but they also create fragmentation. Assets and information may not move easily between platforms, and connections can introduce technical, operational, and compliance questions. A network that works well in isolation may be less useful if it cannot interact safely with other systems. This makes interoperability a continuing challenge for the industry.

At the same time, the structure of crypto-related services is shifting toward greater separation of functions. Early crypto businesses sometimes combined trading, custody, and clearing within a single organization. Today, traditional custodians may hold digital assets while trading venues operate separately from the organizations responsible for safeguarding them. Separating these responsibilities can reduce the concentration of risk and make it less likely that one organization controls every critical function.

Separation does not, by itself, guarantee security. It does, however, make the allocation of duties and responsibilities especially important. Advisors should understand which entity executes transactions, which holds assets, and what arrangements apply if one provider experiences operational or financial trouble. Clear role definitions can help clients and institutions assess where risks sit and what remedies may be available.

Compliance and security practices are also moving from periodic review toward ongoing monitoring. Instead of relying solely on annual attestations or occasional assessments, firms are increasingly seeking checks that operate continuously and cover each transaction. Such systems may help identify suspicious activity or control failures sooner, though their effectiveness depends on the quality of the data, processes, and oversight behind them.

These developments have not depended on Congress passing a comprehensive statute. Firms are converging on operational principles that future legislation may need to take into account: verified counterparties, clearer separation between trading and custody, and compliance processes that continue rather than stop after a periodic review. Whether these practices will support future legislation or become a partial substitute for it remains unresolved. They nevertheless influence how digital-asset infrastructure is being built now.

Raju predicted that within three years, the industry may stop using the word “crypto” as tokenized Treasuries and money funds become routine. The prediction points to a possible change in how digital-asset technology is understood: some applications may become ordinary components of financial markets rather than being treated as a separate category. Whether that shift occurs will depend on regulation, user confidence, technical reliability, and the ability of platforms to support familiar financial protections.

For advisors, the central issue is not simply whether the policy debate has been resolved. It is whether a particular platform can explain its legal structure, safeguards, and procedures in clear terms. An advisor should be able to identify what a client owns, where the assets are held, how their value is verified, and what happens if a provider fails. These are practical questions that remain relevant regardless of how the regulatory landscape evolves.

Key Insights Table

Expert Guidance for Advisors

Diego Grassano, commercial director at Shyft and chief product officer at Lumia, offered a set of practical considerations for institutions and advisors. His guidance centers on understanding the legal and operational details behind a tokenized product, rather than relying on its technology or marketing description alone.

Assess dependence on temporary permissions. Institutions investing in infrastructure that relies on an exemption or a state-level workaround should consider what would happen if the permission changed or expired. A credible contingency plan should address ownership rights, segregated custody, and a tested way for investors to recover their assets. The point is not that temporary permissions cannot be useful, but that a long-term investment should account for the possibility that the regulatory basis changes.

Examine how networks connect. Bridges between private blockchains may improve the movement of assets, but they also carry security and operational risks. Institutions should preserve control over ownership, compliance, and privacy when connecting systems. While regulatory standards remain fragmented, one approach is to keep the legally recognized ownership record on the original chain while allowing backed, redeemable representations to circulate on other networks. Eligibility rules and transfer restrictions would need to be enforced across both networks.

Ask what the client owns and how funds can be recovered. These questions provide a starting point for platform review. Advisors should identify who holds the assets, who independently verifies relevant figures, and what procedures apply if the platform fails. They should also review fees, conflicts of interest, and restrictions on withdrawals. If the ownership arrangement, risks, or recovery process cannot be explained clearly to a client, due diligence is incomplete.

These checks can help advisors distinguish between a product’s technical features and the protections that support it. Tokenization may change the way an asset is recorded or transferred, but it does not remove the need to understand legal rights, custody arrangements, and possible failure scenarios. A clear explanation of these factors is essential to a balanced discussion with clients.

Afterwards...

The development of digital-asset markets will depend not only on legislation, but also on whether the underlying systems can deliver dependable ownership records, resilient custody, secure connections, and transparent procedures. Continued work on interoperability may help reduce the duplication created by isolated networks. Stronger standards for identity, transaction monitoring, and independent verification could also help institutions connect systems without weakening privacy or regulatory controls.

Further research should examine how tokenized financial products behave during operational disruptions, disputes, and platform failures. It should also explore how investors can exercise legal rights across different networks and jurisdictions. These questions require collaboration among regulators, financial institutions, technologists, and market participants. The most durable progress will come from infrastructure that remains understandable, auditable, and recoverable even as rules change.

For now, advisors can focus on transparent due diligence rather than assumptions about how policy will eventually settle. Understanding the client’s rights, the provider’s responsibilities, and the route to recovery offers a practical foundation while public rules and industry standards continue to develop.