Public Comments

Status: Original and derived artifacts are available for this document.

Download: pdf

Response to OCC Proposed Rulemaking
Responses by The Network Firm LLP
Stablecoin Regulation Under the GENIUS Act
Selected Question Responses — Reserve Transparency, Attestation Standards, and PCAOB Registration

Introduction
The Network Firm LLP (“TNF”) is the largest crypto-focused CPA firm in the United States,
specializing in Proof of Reserves attestation services, financial statement audits, and regulatory
compliance services for cryptocurrency exchanges, stablecoin issuers, custodians, and digital
asset companies. TNF co-authored the Digital Chamber’s Practitioner’s Guide to Proof of
Reserves, actively contributes to the AICPA’s Digital Asset Attestation Working Group, and was
the first firm to provide “real-time” attestation reporting and post reserve data on-chain for
stablecoin issuers. TNF’s attestation services cover billions of dollars in reserve assets across
stablecoins, exchange-traded products, and tokenized real-world assets. The team at TNF has
been serving U.S. domiciled stablecoin issuers in an attestation and audit capacity since 2020.
TNF currently serves as the independent accountant for several USD-denominated stablecoin
issuers that anticipate operating directly under the GENIUS Act framework, as state-sovereign
issuers, or in international domiciles that seek to achieve reciprocity.
We appreciate the opportunity to respond to the OCC’s proposed rulemaking under the GENIUS
Act. The responses below address selected questions where TNF’s practical experience as a
long-standing attestation provider in the digital asset industry offers directly relevant perspective
for the OCC’s consideration. Following the question responses, we also raise several additional
considerations that we believe warrant the OCC’s attention in finalizing this rulemaking.

Question 91: Disclosure of Depository Institutions Holding Reserve Assets
OCC Question 91: For the composition report, should the permitted payment stablecoin issuer
be required to disclose the depository institutions where the reserves are held?

Position: Stablecoin issuers should not be required to disclose the specific names of depository
institutions holding reserve assets. However, issuers should be required to disclose key
characteristics of those institutions.
Requiring disclosure of specific institution names creates legitimate competitive concerns for
issuers and may also expose confidential banking relationships that competitors could exploit.
However, users of stablecoin attestation reports and regulators do have a legitimate interest in
understanding the general risk profile of where reserve assets are held. This interest can be
satisfied by requiring disclosure of the following key characteristics of each depository
institution:
•

FDIC insurance status — whether deposits at the institution are insured by the Federal
Deposit Insurance Corporation, and to what extent those deposits are covered (i.e.
$250,000 limits);

•
•
•

Institution type — whether the institution is a national bank, state-chartered bank, trust
company, or other type of regulated depository institution;
Jurisdiction — the state or federal regulatory jurisdiction under which the institution
operates; and
Size tier — a general categorization of the institution’s size (e.g., community bank,
regional bank, systemically important financial institution) to provide context for
counterparty risk assessment.

This approach balances the need for transparency with the legitimate commercial interests of the
issuer, while still providing users and regulators with sufficient information to assess the risk
profile of the reserve asset custody arrangements.
It is worth noting that not all bank deposits carry equivalent risk profiles. Deposit liabilities at a
systemically important financial institution may present a materially different counterparty risk
than deposits at a community bank. In practice, however, stablecoin issuers have generally
sought to minimize the proportion of reserve assets held as bank deposits in order to optimize
yield, which means the deposit portion of reserves tends to be a small portion of total reserves
(<5%).
Given this dynamic, the OCC may wish to consider recommending that permitted payment
stablecoin issuers maintain sufficient loss-absorbing capacity, whether through FDIC deposit
insurance coverage, the issuer's own equity capital, excess reserves, or other risk mitigation
mechanisms, to make the bank deposit portion of reserves whole in the event of a failure at an
underlying depository institution. This would ensure that the 1:1 redemption promise is not
impaired by counterparty risk in the deposit portion of the reserve portfolio, regardless of the size
or risk profile of the institutions where those deposits are held.

Question 92: Reserves in Tokenized Form
OCC Question 92: For purposes of the composition report and reserves in tokenized form,
should the permitted payment stablecoin issuer be required to disclose the location of custody of
both the reserve instrument in tokenized form on a ledger and any real-world asset that the
reserve in tokenized form represents? What related reporting requirements would be
appropriate?

Position: Where a tokenized reserve instrument is a registered product with a recognized
securities identifier, such as a CUSIP or ISIN, the stablecoin issuer should be required to disclose
that identifier within the composition report. In these cases, the underlying fund details, custody
arrangements, and regulatory filings are already publicly accessible through the securities
identifier, making additional disclosure of the specific blockchain, ledger, or custodian within the
attestation report redundant. For example, a tokenized money market fund such as USTB that
carries a CUSIP allows any user or regulator to independently verify the fund's holdings,
custodian, and structure through existing securities databases and regulatory filings.
For tokenized reserve instruments that are not registered products and do not carry a recognized
securities identifier, the stablecoin issuer should be required to disclose the blockchain or ledger
on which the tokenized instrument resides and the custodian or custody arrangement for the

underlying real-world asset. This ensures that users and regulators have visibility into the full
custody chain for instruments that cannot be independently verified through standard securities
infrastructure.

Disclosure of Custody Location and Issuer of Tokenized Instrument
The stablecoin issuer should be required to disclose, within the composition report, the
blockchain or ledger on which the tokenized reserve instrument resides and the custodian or
custody arrangement for the underlying real-world asset that the tokenized instrument represents.
This gives users and regulators visibility into the full custody chain — from the stablecoin, to the
tokenized reserve instrument, to the underlying real-world asset.

Attestation Over the Tokenized Reserve Asset Should Be Separate
The critical point is that the underlying custodians and instruments backing a tokenized reserve
asset are already (or should be) regulated in their own right. A tokenized U.S. Treasury bill, for
example, is backed by a U.S. Treasury security held at a regulated custodian, administered by a
regulated fund or trust. These underlying tokenized instruments and custodians should be subject
to their own regulatory and reporting frameworks.
It follows that the tokenized asset issuer — the entity that mints the tokenized representation of
the underlying real-world asset — should be responsible for maintaining its own independent
attestation reporting. This reporting should provide assurance that:
•
•
•

The tokenized instrument is backed 1:1 by the underlying real-world asset it purports to
represent;
The underlying real-world asset is held at a regulated custodian with appropriate custody
arrangements; and
The tokenized form is substantially equivalent to, and redeemable for, the underlying
asset.

This separate attestation by the tokenized asset issuer serves as the foundation of trust for the
entire chain. The stablecoin issuer’s attestation engagement can then consider the underlying
tokenized asset issuer’s reporting as evidence supporting the reserve composition, without the
stablecoin auditor needing to “look through” the tokenized instrument to independently verify
the underlying real-world asset and custodian.

Why This Structure Is Appropriate
Requiring the stablecoin issuer’s independent accountant to perform examination procedures
over both the stablecoin reserves and the underlying real-world assets behind each tokenized
reserve instrument would be impractical, duplicative, and misaligned with the chain of
responsibility. The tokenized asset issuer is the entity with custody relationships, legal claims,
and operational control over the underlying asset — not the stablecoin issuer. The stablecoin
issuer’s auditor does not have the access, contractual standing, or expertise to audit the custody
arrangements of a separate regulated entity.
The appropriate framework creates a layered assurance model:

•
•

Layer 1: Tokenized asset issuer attests that the tokenized instrument is fully backed by
and redeemable for the underlying real-world asset;
Layer 2: Stablecoin issuer attests that its reserves — including any tokenized reserve
instruments — are sufficient to cover outstanding tokens, relying on the tokenized asset
issuer’s reporting as supporting evidence for the composition and value of those
tokenized holdings.

This approach is consistent with how the accounting profession handles layered assurance in
other contexts, such as fund-of-funds structures or insurance company portfolios that hold
interests in separately managed vehicles. Each entity in the chain is responsible for its own
assertions, and the auditor at each level relies on reporting from the level below without
duplicating that work.
The OCC should therefore require disclosure of the security identifiers, issuer, and blockchain of
record for tokenized reserves within the stablecoin issuer’s composition report, while separately
requiring — or encouraging other regulators to require — that tokenized asset issuers maintain
their own independent attestation reporting over the backing and redeemability of their tokenized
instruments.

Question 93: Reporting Frequency
OCC Question 93: What is the appropriate frequency for public reporting of reserve
composition?

Position: The OCC should establish month-end attestation reporting as the minimum baseline,
published on the issuer’s website, with a strong push toward real-time attestation reporting where
feasible.

Minimum Baseline: Monthly Reporting
At a minimum, issuers should be required to publish attestation reports covering reserve assets as
of each month-end date, made publicly available on the issuer’s website within a reasonable
timeframe following each period. Monthly reporting establishes a consistent, verifiable cadence
of accountability and is consistent with the reporting frameworks currently required by state
regulators such as the New York Department of Financial Services (NYDFS) for licensed
stablecoin issuers.

Industry Direction: Real-Time Attestation
However, the OCC should recognize that the technology and professional infrastructure to
support real-time and daily attestation reporting already exists and is operational today. TNF
built the first real-time attestation reporting system in 2019 and today provides continuous CPAattested transparency covering billions of dollars in reserve assets. TNF’s system has a as
frequent as a 30-second heartbeat, calling APIs from bank accounts, custodians, and blockchain
sources on that cadence to produce near-continuous attestation reports under standards
promulgated by the AICPA.

As a concrete public example, TNF currently provides daily attestation reporting for Bitwise’s
BITB Bitcoin ETF (available at bitbetf.com and via LedgerLens). The daily cadence for this
engagement reflects the practical reality that while on-chain data is available in real-time, offchain data from underlying financial institutions is subject to settlement timing, bank API
availability, and counterparty ledger reconciliation. The reporting interval for any real-time
engagement is therefore determined by the least available data source.
The OCC should encourage issuers and attestation providers to move toward real-time attestation
reporting and should frame its regulations in a manner that does not inadvertently cap reporting
frequency at a monthly or quarterly interval. The OCC’s framework should contemplate that
real-time attestation is not only technically feasible but is already being performed by
independent accountants under AICPA standards. For additional detail on TNF’s real-time
reserves capabilities, see TNF Real-Time Reserves.

Question 96: Examination Standards
OCC Question 96: Does the proposed rule imply examination-level standards for the
independent public accounting firm’s attestation of the stablecoin issuer’s reserves?

Position: Yes. The OCC’s framework appropriately implies examination-level standards, which
are already widely used for stablecoin attestation today.
The examination standard referenced by the OCC is consistent with AT-C Section 205,
Examination Engagements, as promulgated by the AICPA’s Auditing Standards Board. An
examination engagement requires the independent accountant to obtain reasonable assurance
about whether management’s assertions are fairly stated, in all material respects, which
represents the highest level of assurance available under AICPA attestation standards.
AT-C 205 examination engagements are already the standard required by some state regulators
for stablecoin issuers. The New York Department of Financial Services requires NYDFSlicensed stablecoin issuers to provide examination-level attestation reports over their reserve
assets and, separately, an examination over the design and operating effectiveness of controls
related to reserve asset management.
The adoption of AT-C 205 examination standards by the OCC would create consistency with
existing state regulatory frameworks, avoid imposing duplicative or conflicting requirements on
issuers already subject to state-level attestation mandates, and leverage the substantial body of
practitioner experience that has developed around stablecoin examination engagements. TNF has
performed hundreds of stablecoin attestation engagements under AT-C 205, including both
reserve asset examinations and controls examinations, for issuers regulated by NYDFS and other
state authorities. The standard is well-understood, operationally mature, and appropriate for the
assurance objectives contemplated by the GENIUS Act.

Question 133: Random-Day Reporting Requirement
OCC Question 133: Should the OCC require a random-day attestation during the month in
addition to the regular reporting schedule?

Position: Maybe. The OCC should potentially require a random-day attestation during the
month. However, a random-day requirement will become obsolete as the industry moves toward
real-time transparency.
As described in our response to Question 93, “real-time” (or more frequent) attestation reporting
is already operational today. In a “real-time” reporting environment, there is no distinction
between “scheduled” and “unscheduled” reporting dates — every moment is a reporting date.
The concern that an issuer might temporarily inflate reserves for a known snapshot date is
eliminated entirely when reserves are being attested continuously (or even on a daily or 3-day
cadence). The incentive to “window-dress” becomes so costly operationally that it becomes
infeasible to attempt.
Even for issuers not yet on a real-time reporting cadence, a random-day requirement would
impose significant operational burden on both issuers and independent accountants without a
commensurate benefit. The attestation engagement requires coordination with custodians, banks,
and other data sources that do not operate on an ad hoc basis. Introducing unpredictable reporting
dates would increase cost, reduce quality, and create logistical friction that would be better
addressed by simply increasing reporting frequency toward real-time.
Rather than mandating random-day snapshots, the OCC should encourage — and ultimately
require — increasing reporting frequency. The trajectory from monthly to daily to real-time
reporting will render random-day requirements obsolete within the coming years. The OCC’s
framework should be forward-looking and should avoid codifying a mechanism that addresses a
transitional concern already being solved by technology.
──────────────────────────────────────────────────

Additional Considerations
In addition to our responses to the specific questions above, TNF respectfully raises the
following considerations that we believe are relevant to the OCC’s rulemaking and warrant
attention in the final rule or in subsequent guidance.

Additional Consideration #1: PCAOB Registration Should Not Be Required
Position: The OCC should not require stablecoin attestation practitioners to be registered with
the Public Company Accounting Oversight Board (PCAOB). AICPA professional standards,
enforced through state boards of accountancy and peer review, provide an appropriate and wellestablished oversight framework for these engagements.

PCAOB’s Mandate Is Limited to Public Company and Broker-Dealer Audits
The PCAOB was created by the Sarbanes-Oxley Act of 2002 specifically to oversee audits of
U.S.-listed public companies and, following the Dodd-Frank Act, audits of SEC-registered
broker-dealers. PCAOB registration is required for firms that issue audit reports for public
companies or broker-dealers, or that play a substantial role in those audits. Stablecoin attestation

engagements are not audits of public companies or broker-dealers. They are attestation
engagements performed under AICPA standards (AT-C 205) over management’s assertions
about reserve assets. Extending the PCAOB’s registration requirement to these engagements
would be a significant expansion of the PCAOB’s jurisdiction beyond its statutory mandate.

Federal Precedent: CPA Assurance Without PCAOB Registration
Numerous federal statutes and regulatory frameworks require independent CPA assurance
services without mandating PCAOB registration. These precedents demonstrate that Congress
and federal agencies have consistently recognized AICPA professional standards as sufficient for
non-public-company assurance engagements:
•

Single Audit Act (31 U.S.C. § 7501 et seq.): Requires independent audits of state and
local governments and non-profit organizations that expend $750,000 or more in federal
awards annually. These audits are performed under AICPA auditing standards (generally
accepted government auditing standards, or GAGAS) and do not require PCAOB
registration.

•

Federal Deposit Insurance Act (FDIA): Requires FDIC-insured depository institutions
to obtain annual audits of their financial statements by independent public accountants.
For institutions that are not SEC registrants, these audits are performed under AICPA
auditing standards without PCAOB registration.

•

Bank Secrecy Act / FinCEN: Requires independent testing of anti-money laundering
(AML) compliance programs by qualified independent parties, including CPAs. These
engagements are performed under AICPA standards without PCAOB registration.

•

Small Business Administration (SBA) Lending: Requires independent audits of SBAapproved lenders under AICPA standards without PCAOB registration.

•

U.S. Department of Housing and Urban Development (HUD): Requires independent
audits of FHA-approved lenders, mortgagees, and housing authorities under AICPA
standards without PCAOB registration.

Existing Oversight Is Sufficient
CPA firms performing stablecoin attestation engagements are already subject to comprehensive
professional oversight:
•

State boards of accountancy license and oversee CPAs and have enforcement authority
over professional conduct, including the authority to revoke licenses;

•

AICPA peer review requires enrolled firms to undergo periodic inspection of their
attestation practice by independent reviewers, ensuring compliance with professional
standards; and

•

AICPA professional standards (including AT-C 205, the Code of Professional Conduct,
and quality management standards) establish the substantive requirements for attestation
engagements and are enforceable through both peer review and state board disciplinary
processes.

Adding a PCAOB registration requirement for stablecoin attestation would not materially
enhance audit quality. It would, however, significantly reduce the pool of qualified firms capable
of performing these engagements — concentrating the market in a small number of large firms
that may lack the specialized digital asset expertise required for this work. The firms most
experienced in stablecoin attestation today are specialized digital asset-focused CPA firms or
firms that have specialized digital asset practices, some of which are not PCAOB-registered
because their client base does not include public companies or broker-dealers. A PCAOB
registration mandate would effectively disqualify some of the most experienced practitioners in
the industry from performing the very work they pioneered.
The OCC should follow the well-established federal precedent of requiring independent CPA
assurance under AICPA professional standards, with oversight through state boards of
accountancy and peer review, without imposing a PCAOB registration requirement that is
neither necessary nor appropriate for non-public-company attestation engagements.

Additional Consideration #2: Affiliated Depository Institution Risk
Position: The OCC should directly address the structural risk that arises when a bank subsidiary
permitted payment stablecoin issuer holds reserve assets as deposit liabilities at its parent or
affiliated depository institution. The current statutory framework and proposed rule do not
adequately mitigate the circular credit risk this arrangement creates.

The Risk
Under the GENIUS Act, a subsidiary of an insured depository institution (IDI) may be approved
as a permitted payment stablecoin issuer. One of the six categories of permissible reserve assets
is demand deposits at insured depository institutions. The Act further provides that payment
stablecoin reserves held in the form of cash as a deposit liability at a depository institution are
not required to be separated from the cash or property of that depository institution.
This creates a scenario in which a bank subsidiary issues a stablecoin, and the reserves backing
that stablecoin are held as deposits at the parent bank. Those deposits are general liabilities of the
parent institution — they sit on the parent bank’s balance sheet alongside all of its other deposit
and non-deposit liabilities, subject to the full credit risk of the parent’s lending portfolio,
investment activities, operational risk, and overall financial condition.
The result is a circular risk structure:
•
•
•
•

The stablecoin holder has a claim on the subsidiary issuer;
The subsidiary issuer’s reserves consist of deposits at the parent bank;
The parent bank’s ability to honor those deposits depends on the parent bank’s overall
financial health; and
FDIC deposit insurance covers only $250,000 per depositor per institution — a threshold
that stablecoin reserve balances would exceed by orders of magnitude.

In this arrangement, the stablecoin holder’s reserves are effectively backed by the
creditworthiness of a single affiliated financial institution. If the parent bank experiences

financial distress or fails, the reserves above FDIC insurance limits are at risk — the very
reserves that are supposed to guarantee 1:1 redemption of the stablecoin. The subsidiary issuer’s
solvency is inextricably linked to the parent’s solvency, despite being structured as a separate
legal entity.

The Gap in Current Law and Proposed Rules
The GENIUS Act acknowledges deposit concentration as a risk category. Section 4 of the Act
directs the primary federal payment stablecoin regulators to issue “reserve asset diversification,
including deposit concentration at banking institutions, and interest rate risk management
standards.” However, the statute does not specifically address the heightened concentration risk
that exists when the depository institution holding the reserves is the parent or an affiliate of the
issuer itself.
Critically, there is no analog to Sections 23A and 23B of the Federal Reserve Act — which
govern transactions between banks and their affiliates — applied to the stablecoin issuer-parent
relationship in this context. The existing affiliated-transaction framework in banking law is
designed to prevent exactly this type of circular risk between a bank and its affiliated entities, but
the GENIUS Act does not appear to extend those protections to stablecoin reserve deposits held
at a parent institution.
The OCC’s proposed rule focuses on application procedures and the broad framework. The
deposit concentration and diversification standards — which is where this risk should be
addressed — are contemplated but have not yet been proposed. This represents a significant gap,
particularly given that bank subsidiaries are one of the three primary issuer pathways under the
Act and may represent a substantial share of stablecoin issuance once the framework is
operational.

Recommendations
TNF recommends that the OCC address this risk directly in its forthcoming deposit
concentration and diversification standards through the following measures:
•

Affiliated deposit concentration limits. The OCC should impose explicit limits on the
percentage of reserve assets that a bank subsidiary issuer may hold as deposits at its
parent institution or any affiliated depository institution. These limits should be
substantially lower than the general deposit concentration thresholds applied to
unaffiliated institutions, reflecting the elevated risk of circular exposure.

•

Mandatory disclosure of affiliated holdings. The composition report should require
explicit disclosure when reserve assets are held at a parent or affiliated institution,
including the percentage of total reserves held at affiliated entities, so that users and
regulators can assess the concentration risk.

•

Enhanced capital buffers for affiliated concentration. If the OCC permits any material
level of affiliated deposit concentration, the issuer should be required to maintain
enhanced capital buffers calibrated to the uninsured deposit exposure at the affiliated
institution, consistent with the GENIUS Act’s authorization for regulators to impose
capital buffers “tailored to the business model and risk profile” of the issuer.

•

Attestation procedures addressing affiliated counterparty risk. The OCC should
require that the independent accountant’s examination engagement include specific
procedures to evaluate affiliated deposit concentration as a risk factor, including
assessment of the parent institution’s financial condition to the extent it bears on the
recoverability of the reserve deposits. This does not require the stablecoin auditor to audit
the parent bank, but it does require the auditor to consider the parent’s financial condition
as relevant evidence when evaluating whether the reserves are sufficient and available to
support 1:1 redemption.

Why This Matters
The fundamental promise of a payment stablecoin is that the holder can redeem it for one U.S.
dollar at any time. If the reserves backing that stablecoin are concentrated in uninsured deposits
at a single affiliated institution, the redemption promise depends not on the quality and diversity
of the reserves, but on the financial health of one bank. This transforms the stablecoin from a
diversified, reserve-backed instrument into what is effectively an uninsured bank deposit with
extra steps.
The 2023 bank failures demonstrated that even regulated, insured depository institutions can
experience rapid and unexpected failure. Stablecoin reserves concentrated at a parent institution
that fails would leave the subsidiary issuer unable to meet redemption demands, with stablecoin
holders having no direct claim on the parent bank and limited recourse beyond FDIC insurance
limits that are inadequate for institutional-scale reserve balances.
The OCC has both the statutory authority and the practical imperative to address this risk in its
rulemaking. The GENIUS Act’s mandate for deposit concentration standards should be
interpreted to encompass — and prioritize — the affiliated institution concentration risk as a
first-order concern. Without explicit limits, a significant share of stablecoin reserves could end
up concentrated in affiliated bank deposits, creating precisely the type of interconnected risk that
undermines the stability and trustworthiness of the stablecoin framework the GENIUS Act seeks
to establish.

Additional Consideration #3: The OCC’s Attestation Cost Estimate Is
Materially Understated
Position: The OCC’s estimated incremental cost of $40,000 for independent attestation services
significantly understates the actual cost of examination-level attestation engagements for
stablecoin issuers. The OCC should revise this estimate to reflect market realities before
finalizing the rule, as an understated cost estimate may lead issuers to underbudget for
compliance and could create pressure on independent accountants to perform engagements at fee
levels that are inconsistent with the quality and rigor the OCC’s own framework demands.

What an Examination-Level Stablecoin Attestation Actually Costs
Based on TNF’s direct experience as one of the largest providers of stablecoin attestation
services in the United States, the OCC’s $40,000 estimate does not reflect the cost of any
reputable attestation engagement in the current market. While fees vary by firm, issuer

complexity, reserve composition, and reporting frequency, the industry baseline for a firm
performing monthly examination-level attestation reports is approximately $7,000 per report at a
minimum, for the simplest of stablecoin issuers. For a monthly reporting cadence — which the
OCC’s own proposed framework contemplates as the baseline — this translates to approximately
$84,000 per year for the reserve asset attestation reports alone.
This $84,000 figure represents the floor, not the ceiling, and covers only the periodic reserve
asset examination reports. A complete attestation program under the GENIUS Act framework
would likely include additional cost components that push the total annual engagement cost
materially higher:
•

Engagement onboarding and planning. First-year engagements require substantial
upfront work, including understanding the issuer’s technology stack, blockchain
infrastructure, custody arrangements, reserve management processes, and internal
controls. This onboarding phase typically represents a significant incremental cost above
the recurring monthly reporting fees.

•

Increased reporting frequency. If the OCC encourages or requires daily or real-time
attestation reporting, the cost of the attestation engagement increases commensurately.
Real-time reporting requires continuous monitoring infrastructure, ongoing practitioner
oversight, and technology integration that adds to the annual cost.

•

Reserve composition complexity. Issuers with reserves held across multiple custodians,
multiple asset types (including tokenized instruments), or multiple jurisdictions require
more extensive examination procedures than an issuer holding reserves in a single bank
account. The fee scales with the complexity of the reserve structure.

•

Blockchain and token structure complexity. Not all blockchains present the same level
of auditability. Some chains lack the ability to extract historical balance data efficiently,
requiring the independent accountant to develop alternative procedures to verify on-chain
holdings at a point in time. Additionally, some issuers maintain treasury wallets that hold
unbacked or non-circulating tokens, which introduces additional procedures to
distinguish between tokens in circulation that are backed by reserves and tokens held by
the issuer that are not. These factors increase the scope and cost of the examination
engagement and vary significantly from issuer to issuer.

•

Registered Firm premium. The $7,000 per report minimum reflects current pricing for
non-registered firms. If PCAOB registration or other requirements effectively channel
this work to larger firms, issuers should expect fees that are multiples of the nonregistered baseline, consistent with the fee premiums large firms charge across all
assurance services.

Why This Matters for the Rulemaking
Cost estimates in proposed rulemakings are not merely academic exercises. They inform the
public’s ability to comment on the economic impact of the rule, they shape congressional and
executive branch review of the rulemaking under the Congressional Review Act and Executive
Order 12866, and they set expectations for the regulated entities that will need to budget for
compliance. An estimate that understates the true cost by a factor of two or more undermines all
three of these functions.

More practically, an artificially low cost estimate creates a real risk that issuers will enter the
GENIUS Act framework expecting attestation to cost $40,000 and will then face pressure to find
firms willing to perform the work at that price point. No reputable firm can perform monthly
examination-level attestation of stablecoin reserves for an incremental $40,000 per year while
maintaining the quality, independence, and professional rigor that the OCC’s framework
requires. The OCC should not inadvertently create a market dynamic in which issuers seek out
the cheapest available attestation provider rather than the most qualified one.
TNF recommends that the OCC revise its cost estimate to reflect an annual attestation cost range
of at least $84,000 to $250,000 or more for a complete attestation program, depending on the
issuer’s size, reserve complexity, reporting frequency, and whether the engagement includes a
controls examination component. This range is consistent with the actual market for
examination-level stablecoin attestation services and will ensure that issuers, policymakers, and
the public have an accurate understanding of the compliance costs associated with the GENIUS
Act framework.

Additional Consideration #4: On-Chain Transparency and Programmatic
Reserve Controls
Position: The OCC should encourage that reserve balance be published onto pertinent
blockchains. Once this reserve data is available on-chain, the OCC should further consider
encouraging issuers to implement programmatic controls within their smart contracts that verify
adequate reserves exist before new tokens can be minted.
On-Chain Publication of Reserve Data
The blockchain infrastructure to publish reserve data on-chain already exists and is operational in
the market today. Through oracle networks, CPA-attested reserve balance data can be delivered
on-chain in near real-time (or daily, where technically feasible). This represents a meaningful
complement to traditional reporting, where reserve data is available only through periodic
attestation reports published on the issuer's website. On-chain publication creates a persistent,
tamper-resistant, and independently verifiable record of reserve balances that can be consumed
programmatically.
The OCC should encourage issuers to adopt on-chain publication of CPA-attested reserve data as
a complement to the periodic attestation reports contemplated by the proposed rule.
Programmatic Minting Controls
Once reserve data is available on-chain, a natural extension is the implementation of on-chain
controls by the issuer or other blockchain-based protocols that reference the reserve data feed
before permitting the minting of new tokens or allowing deposits into their protocol. These
controls could be designed to prevent minting when reserves are insufficient to maintain 1:1
backing whether due to fraud or security breach of the underlying smart contracts. This would
create a programmatic safeguard against the issuance of unbacked tokens, reducing reliance on
manual processes and after-the-fact attestation to detect reserve shortfalls. As a recent

illustration, in October 2025, Paxos mistakenly minted approximately $300 trillion worth of
PayPal's PYUSD stablecoin due to an internal technical error. While Paxos identified and burned
the excess tokens within approximately 20 minutes, a programmatic on-chain control that
verified reserve adequacy before permitting minting would have prevented the erroneous tokens
from being minted.
The OCC should consider encouraging issuers to implement these types of on-chain controls as
part of their internal control environment. While the independent accountant's examination of
controls would still be necessary to evaluate the design and operating effectiveness of the overall
control framework, on-chain minting controls represent a technologically native safeguard that
aligns the transparency objectives of the GENIUS Act with the programmable capabilities of the
blockchain infrastructure on which stablecoins operate.

Conclusion
The Network Firm appreciates the opportunity to provide these comments to the OCC as it
develops the regulatory framework for permitted payment stablecoin issuers under the GENIUS
Act. The questions addressed in this letter reflect areas where TNF's practical experience as the
leading attestation provider in the digital asset industry offers directly relevant perspective, and
the additional considerations raised reflect issues we believe are critical to the integrity and
effectiveness of the final rule.
The stablecoin industry is at a pivotal moment. The GENIUS Act represents the first
comprehensive federal framework for stablecoin regulation in the United States, and the
decisions the OCC makes in this rulemaking will shape the transparency, accountability, and
trustworthiness of the stablecoin market for years to come. TNF is committed to supporting the
development of a framework that protects consumers, maintains the integrity of the financial
system, and leverages the unique capabilities of blockchain technology to deliver a level of
transparency that surpasses what has been achievable in traditional financial services.
We welcome the opportunity to discuss any of these comments in further detail and are available
to provide additional information or technical expertise as the OCC finalizes this rulemaking.
Respectfully submitted,

___________________________

___________________________

Jeremy Nau
Partner
The Network Firm LLP

Nick Ward
Partner
The Network Firm LLP