The Rulebook Now Arrives in Drafts

On Sept. 15, the Senate voted 49 to 50 on whether to open debate on the Digital Asset Market Clarity Act, known as CLARITY. The bill needed 60. It failed to win even a simple majority. Its best remaining chance is a long shot in the weeks after the Nov. 3 midterms.

The next morning, Michael Saylor posted that he expected the SEC, the CFTC and Treasury to advance rules under existing law. "Progress need not wait for Congress," he wrote.

Over the next nine days, the agencies did just that. On Sept. 17, the SEC granted a temporary, conditional exemption for venues trading tokenized stocks. The same day, the CFTC sent two proposed crypto market rules to the White House for review. On Sept. 24, the Federal Reserve proposed two rules to carry out its share of the GENIUS Act. The same day, CFTC staff updated a set of FAQs to say firms it regulates can invest customer funds in tokenized versions of permitted assets and keep required records on a distributed ledger.

For a finance team, the good news comes with conditions. The agencies printed them in the same documents.

The agencies picked up the pen

Saylor's read holds up on direction. The work did not stop when the vote failed. The GENIUS Act has been law since July 2025. The agencies charged with implementing it are still writing the rules. They are already past the law's July 2026 deadline.

The SEC and CFTC have moved faster still. Both chairs have made digital assets a priority. Neither agency needs a vote in Congress to issue guidance, grant exemptions or propose rules. A company that planned to wait for a statute before building is now waiting on a lame-duck long shot or a new Congress in 2027.

The practical question for a CFO or treasurer is how much weight each of those rules can bear.

Each permission carries its own caveat

Start with the CFTC's Sept. 24 update. In the FAQ, staff said they would not object if a regulated firm used distributed ledger technology to create and maintain its required records. For anyone building treasury or collateral workflows around tokenized assets, that answer matters.

In the second footnote, staff limited that answer. They wrote that the answers represent only the views of three staff divisions. They may not be relied on to create any rights. They do not necessarily represent the views of the Commission.

The SEC chair has said the same about his own agency's work. In his Aug. 18 statement on Regulation Crypto Assets, Paul Atkins wrote that "legislation remains indispensable to enacting 'future-proofed' rules of the road that are durable enough to protect the work we are undertaking today from being unwound by a future rogue regulator."

Together, these documents make up a rulebook built from pieces with different weights. The GENIUS Act is statute. The Fed's proposals are open for comment and can change before they are final. The CFTC's answers are staff views. The SEC's exemption is temporary, with a five-year term and a request for comment attached. Each can be revised on its own schedule.

The conditions are written for the examiner

The CFTC's recordkeeping answer applies only if the firm can fully satisfy the existing rule, which requires systems and controls that ensure electronic records are authentic and reliable. For records kept on a public network, staff expect the firm to produce them for inspection even if the network goes down.

That's a sensible standard. In setting it, staff put the burden on the firm. A regulator granting a permission is asking a firm to prove, on request, what happened and why it was allowed. The permission is only as useful as the firm's ability to answer that request months later, under whatever version of the guidance is in force by then.

Agents act on whichever version is live

That request gets harder to answer as agents take over more of the treasury workflow. An agent that sweeps idle cash into a tokenized money market fund, posts collateral or pays a supplier in stablecoins may do so hundreds of times a day. It executes under the guidance in force that day. If staff revise an FAQ in March, February's movements sit under the old text and March's sit under the new one.

A human-run process usually catches a rule change at the next policy review. An agent keeps moving money at machine speed until someone updates its instructions. Agents are moving money faster than enterprises can follow. When the rulebook changes by staff memo, the exposure sits in the gap between the new rule and the agent's last update.

The examiner's question is narrow. For this movement, on this date, which policy governed it, and can the firm show the check was run? A system that records only what moved can answer the first half of that question. The second half needs a record of the rule the movement was checked against at the moment it happened.

The record is the part a finance leader can own

The CLARITY Act's timing and the pace of agency rulemaking are out of any company's hands. What a finance leader can own is a record written at the moment money moves, showing what moved and which version of which policy it cleared.

A finance leader can rely on that record however the rules change, because it covers what already happened. A February payment checked against February's guidance stays defensible after the guidance is rewritten, as long as the firm can show which text applied. W3.io builds agent-powered financial workflows on that principle, so the enterprise stays in control while the rules keep moving.

What changed on Monday

Start with an inventory. List every workflow that touches stablecoins, tokenized funds or digital-asset collateral, and next to each one write the document that permits it and what kind of document it is: statute, final rule, proposed rule, exemption or staff guidance.

Then look at the rows that rest on guidance. For each, confirm the system running the workflow logs which version of the rule was in force each time it ran. Then name the person who updates the workflow when that version changes.

The newest document on most of those lists will be the CFTC's Sept. 24 FAQ. In its second footnote, staff wrote that it can't be relied on to create any rights.