The SEC issued "Regulation Crypto Assets" on Tuesday — the first permanent digital-asset rule proposal from Chairman Paul Atkins' commission. It arrived as a surprise, four days after the agency abruptly cancelled the August 14 meeting that was supposed to vote on it, citing an "unforeseen scheduling issue."

The proposal creates two exemption tracks for token offerings. The first is a one-time startup raise of up to $5 million over four years, requiring public filings at the beginning and end of the window. The second allows up to $75 million per year but demands offering materials, financial statements, and ongoing reporting closer to investment-contract rules. Both fall under securities anti-fraud and anti-manipulation provisions.

The more consequential piece is the safe harbor: once an issuer completes or permanently abandons the essential managerial efforts it promised, the asset stops being treated as an investment contract. That is the "sufficiently decentralized" question, answered in regulation rather than litigation.

Comments run 60 days. Atkins was blunt that this is not a substitute for Congress — legislation, he said, is what protects the framework from a future "rogue regulator." The Senate has roughly three weeks of floor time in September to move the CLARITY Act before a recess that runs to the midterms.

Citi Investor Services launched Custody+ on Tuesday and confirmed that digital-asset custody goes live later this year, starting with bitcoin. Institutional clients will access traditional securities and crypto through the same framework rather than bolting on a separate crypto custodian.

The distribution footprint is the story. Citi's custody business serves clients in more than 100 markets, 62 of them proprietary, overseeing roughly $30 trillion in client assets. The bank says over 80% of asset-servicing event volumenow processes in real time, and its Single Event Processing rollout cut voluntary corporate-action processing times by up to 92%. Citi spends more than $2 billion a year on platform strategy.

No launch date, no fee schedule, no disclosure on whether Citi holds keys directly. But the strategic logic is clear: Citi Token Services already moves tokenized deposits 24/7 in select markets, and custody closes the loop between always-on trading and bank-money settlement.

The competitive field is filling fast — BNY, Fidelity Digital Assets, Coinbase and Anchorage are incumbents, Deutsche Bank launches this year with Bitpanda, and Jamie Dimon has said JPMorgan will let clients buy crypto but won't hold it. Citi just picked the other side of that bet.

The Financial Accounting Standards Board proposed on Tuesday that certain stablecoins qualify as cash equivalentsunder GAAP. The condition: liquid reserves at least equal to tokens in circulation, disclosed annually, redeemable for dollars on demand.

This is quieter than an SEC rulemaking and arguably more consequential for corporate adoption. Cash-equivalent status would place qualifying stablecoins alongside Treasuries, commercial paper and money market funds on the balance sheet. A treasurer holding USDC currently faces genuine ambiguity about classification; that ambiguity is a real deterrent to operational use.

FASB has been building crypto-specific standards since 2023, when it required crypto assets be marked at current values. The proposal explicitly responds to an ongoing dispute over stablecoin treatment that risked producing inconsistent accounting depending on the issuer.

Public comment runs to November 19. Read it alongside the Treasury Department's GENIUS Act stablecoin rule proposed on Monday — the regulatory, accounting and payments layers of the stablecoin stack are all being written in the same month. If you own anything with stablecoin float exposure, that convergence matters more than this week's price action.

Long-dated sovereign yields hit multi-decade highs on Tuesday. The US 30-year reached 5.33%, its highest since 2007. UK gilts approached 6%, French borrowing costs hit their highest since 2008, German Bunds since 2011, and Japan's 10-year touched 2.945% — a level last seen in 1996. TLT, the long-duration Treasury ETF, printed an all-time low of $81.35 on Monday.

The interesting detail is what isn't driving it. Five- and ten-year inflation expectations have been stable near 2.25% and 2.28%. This is a supply and credibility story, not an inflation story: US debt approaching $40 trillion, plus hyperscalers who have issued $159 billion of bonds in 2026, up 47% year over year, with Goldman expecting $400 billion for the full year.

Here is the uncomfortable part. Gold is up roughly 10% this month. Bitcoin has been flat just above $64,000 and has underperformed for nine months. If the bond selloff reflects eroding confidence in sovereign fiscal credibility, bitcoin should be capturing that flow. It isn't — gold is. Fundstrat's Sean Farrell notes the median absolute 60-day move following volatility this compressed has historically been about 30%. Direction unspecified.

Cross-chain liquidity protocol Maya Protocol was exploited at roughly 17:30 UTC on Tuesday — its first significant loss since the THORChain fork launched mainnet in April 2023.

The mechanics are worth understanding. A preliminary post-mortem attributes the attack to six chained bugs across trade accounts, outbound transaction handling and liquidity-pool math. The attacker used a single transaction containing 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool, and withdraw 48.87 million CACAOfrom the Asgard module — tokens the protocol credited but never properly funded.

Roughly $1.36 million left for external chains, largely 20.83 BTC to a single address, with about $291,000 retained on-chain. Total attacker value approaches $1.7 million; CoinDesk pegged the pool value drop nearer $11 million. CACAO fell 88.7%, from about $0.115 to $0.013, before recovering toward $0.03.

The protocol's automatic solvency check triggered a global halt within roughly an hour, and co-founder Aaluxx has offered a white-hat bounty for disclosure and return of funds. Note the pattern: THORChain itself lost about $10.8 million in May, later revised to $7.4 million. The Bifrost architecture both protocols inherited keeps producing the same class of failure.

DISCLAIMER: None of this is financial advice. This newsletter is strictly educational and is not investment advice or a solicitation to buy or sell any assets or to make any financial decisions. Please be careful and do your own research.