Stable is a claim: what TerraUSD asked of bank front lines

The week

For many ordinary investors, the word that mattered was “stable.” Over the weekend of May 7, 2022, and into the following week, they learned how much weight that word could bear.

TerraUSD, known by its ticker UST, was a stablecoin. A stablecoin is a digital token, traded on blockchain networks and crypto exchanges, that is designed to hold a steady value, usually one US dollar. The idea is to combine the speed and reach of crypto with the predictability of cash. Many stablecoins try to achieve that by holding reserves, actual cash and short-term securities, so that every token is backed by something a holder could redeem.

UST worked differently. It was an algorithmic stablecoin: it aimed to hold one dollar through a mint-and-burn relationship with a sister token, LUNA, rather than through reserves of cash and securities. The system let people swap one dollar’s worth of LUNA for one UST, or the reverse, with software creating new tokens of one kind and destroying tokens of the other. As long as people trusted the arrangement, traders kept UST close to a dollar by profiting from small deviations.

Demand for UST came largely from yield. A lending protocol in the Terra ecosystem, called Anchor, paid close to 20 percent a year on UST deposits, far above anything a bank account offered. Retail investors reached it directly or through apps that wrapped the token in a friendlier interface and a savings-like label. A foundation associated with the project had also built up reserves of bitcoin and other assets, meant to defend the peg in a crisis. When the crisis came, it spent them without restoring the peg.

That weekend, UST lost its peg to the dollar, meaning it slipped below its one-dollar target and stayed there. As holders rushed to exit, the mechanism minted vast amounts of LUNA to absorb the redemptions. Flooding the market with new LUNA pushed its price down, which made UST look even less secure, which drove more redemptions. Both tokens collapsed within days, erasing tens of billions of dollars of market value.

The loop deserves spelling out, because it is the mechanism that separates an algorithmic design from a reserve-backed one. Each UST redeemed created a dollar’s worth of new LUNA at the current price. As LUNA’s price fell, each redemption created more LUNA tokens, which fell further when sold. Nothing outside the system stood behind either token. Once enough holders wanted out at once, the arithmetic guaranteed that the exit door narrowed with every person who went through it.

Washington noticed. On May 10, testifying to the Senate Banking Committee on the Financial Stability Oversight Council’s annual report, Treasury Secretary Janet Yellen urged a federal prudential framework for payment stablecoins. A prudential framework is the kind of rulebook that governs banks: requirements about what assets an issuer holds, how it is supervised and how it protects the people who rely on it.

The recommendation was not new. In November 2021, the President’s Working Group on Financial Markets, joined by the FDIC and the OCC, had published a report on stablecoins. It urged Congress to require that issuers of payment stablecoins be insured depository institutions, subject to bank-like supervision. The UST collapse gave that recommendation a vivid example, though the report had been written with reserve-backed tokens in mind.

Also on May 10, a very different kind of disclosure drew attention. Coinbase, the largest US crypto exchange and a public company, filed its quarterly report with a new risk factor. It warned that in a bankruptcy, crypto assets it held for customers could be treated as part of the company’s estate, which could leave customers as general unsecured creditors. The point was technical, but it went to the heart of what customers thought they owned.

A week later, on May 17, the FDIC issued a final rule on false advertising, misrepresentation of insured status and misuse of its name or logo. The rule had been in the works before the collapse and was not aimed at any one firm. Its timing still mattered. It gave the agency clearer tools against companies that implied uninsured products carried deposit insurance, the very confusion the collapse was about to expose.

The collapse did not stay contained. The stress that began here ran into the crypto lender failures of the summer, as firms that had promised high yields on deposited tokens found they could not honor withdrawals. Celsius paused withdrawals in June and filed for bankruptcy in July. Voyager Digital filed the same month. For customers of those platforms, the question of what was protected stopped being abstract.

Most banks and credit unions had no direct exposure to UST. Their exposure to the collapse came through the people who bank with them.

Retail investors had bought tokens marketed as stable, often through apps that offered high yields for depositing them. When the value disappeared, those customers did what people do when money goes missing. They called their bank. They walked into the branch. They asked the teller, the call center agent and the branch manager what had happened to their money and what the bank was going to do about it.

What happened next depended on three front-line capabilities that are easy to overlook in a crypto strategy discussion: recognizing the fraud that follows a crash, handling disputes over transfers the customer had authorized, and keeping clear in the customer’s mind which products carry which protections. They are unglamorous, and they decide whether a distressed customer leaves feeling helped or abandoned, and whether a regulator later sees a well-run institution or a careless one.

Those capabilities look different across institutions. A community bank meets distressed customers mostly in branches and by phone. A credit union often knows members personally and runs a smaller fraud team. A large bank sees the pattern in data across millions of accounts. A broker-dealer or wealth manager faces customers who may have moved investment money, with different rules on holds and trusted contacts. The three capabilities apply to all of them, but the people, rules and tools that carry them differ.

A short guide to the vocabulary

Bank leaders do not need to become crypto experts to manage this risk, but a few terms recur.

Peg. The fixed value a stablecoin aims to hold, usually one dollar. “Losing the peg” means the market price falls away from that target and does not come back.

Reserve-backed versus algorithmic. A reserve-backed stablecoin claims to hold cash or safe securities equal to the tokens in circulation. An algorithmic stablecoin, like UST, relies instead on market incentives and a linked token to keep the price steady. When confidence holds, the two can look identical. Under stress, the difference is everything.

Crypto platform or exchange. A company where people buy, sell and hold tokens. Customers usually fund an account by wire, card or bank transfer from their regular bank, which is how bank payment rails become part of a crypto story.

Yield. The return an app promised for depositing tokens with it. In banking, interest on a deposit comes with federal insurance and supervision. In the crypto apps of 2022, “yield” could mean the platform was lending customers’ tokens to others or putting them into riskier strategies, with no comparable protection.

Authorized push payment. A payment the customer personally instructs the bank to make, even if they were tricked into it. This is the category that makes crypto losses so difficult for banks: the customer pressed the button.

Recovery scam. A fraud aimed at people who have already lost money, offering to get it back for a fee. The fee is the theft. Recovery scammers often pose as lawyers, investigators, exchanges or government agencies.

Pass-through deposit insurance. When a fintech app holds customer money at a partner bank, deposit insurance can extend to each customer, but only if the bank’s records and the account structure meet specific requirements. Even then it covers the failure of the bank, not the failure of the app or a loss on anything the app sold.

The fraud that follows a crash

Market collapses produce victims, and victims attract a second wave of fraud. After the UST collapse, recovery scams spread across social media and messaging apps: offers to retrieve lost funds for an upfront fee, impersonation of exchanges and investigators, and fake legal claims processes. Investment pitches built on the word stable, some of them outright fraud from the start, also ended at this moment, leaving victims who had sent money by wire or card.

The cruelty of the recovery scam is that it targets people at their most desperate. Someone who has just lost a large share of their savings is primed to believe that a firm can get it back, and to pay a fee for the chance. A message that claims to come from an exchange’s “recovery department” or a law firm running a class action can look official enough to persuade.

How the second wave works

Recovery scams follow a recognizable script. Contact usually starts with the scammer, through social media, a messaging app or a cold call, often after the victim posted about the loss in a public forum. The scammer claims special access: a contact at the exchange, a blockchain tracing tool, a court-appointed role. Then come fees, framed as taxes, legal costs or unlocking charges, each one followed by another. Victims are often told to keep the process secret, from family and from their bank, supposedly to avoid alerting the wrongdoers.

Alongside them run investment scams that predate the crash but harvest its confusion. A stranger builds a relationship over weeks, then introduces a trading platform that shows steady gains. The platform is fake, and the gains are numbers on a screen. A market collapse gives these schemes a ready story when withdrawals fail, and a fresh pool of people looking for a way to make back what they lost.

Bank fraud teams were often the first institutional observers of this wave. They saw elderly customers sending repeated wires to new crypto platforms, customers moving savings to an exchange after a phone call from a stranger, and sudden requests to raise transfer limits. Those patterns are detectable. They needed rules tuned to them. One example is an alert on a first-time transfer to a crypto platform above a set amount, for a customer with no prior activity. Another is a short script that lets staff ask a few direct questions before releasing the payment.

Take a community bank. A seventy-eight-year-old customer who has never sent a wire comes in asking to send a large sum to a company she heard about on a phone call that morning. The company says it can recover the money her grandson lost in crypto, for a fee. A teller who has been trained asks three plain questions: who contacted whom first, whether she has met these people, and whether anyone told her to keep this from the bank or her family. The answers often reveal the scam on the spot. A teller without that training processes the wire.

Controls built for payments the customer wants to make

Most fraud controls in 2022 were designed to stop someone else using the customer’s account. The UST aftermath called for controls on payments the customer was determined to make. Those work differently. The useful ones add friction at the right moment rather than blocking outright:

• A short hold and a call-back on a first wire or large transfer to a recipient the customer has never paid before.
• A maintained list of crypto exchanges and payment processors, so transfers to them can be recognized and counted.
• Interdiction scripts for branch and contact center staff, with escalation to a fraud specialist when the answers raise concern.
• Out-of-band warnings, such as a text or app message that names common scams just before a payment is released.

Each carries a cost. False positives annoy legitimate customers, many of whom were entitled to buy crypto and did not appreciate being questioned. Holds generate complaints of their own. Rules that single out older customers by age alone can treat people unfairly and miss younger victims. The better approach targets behavior, such as a first-time payee, a sudden change in pattern or a secrecy instruction, and documents why each intervention happened.

Capability varies with size. A large bank can build its own models on payment data and test new rules within days. A community bank or credit union usually relies on the fraud tools that come with its core processor or card program, and may not be able to write a custom rule quickly. For smaller institutions, the practical levers are often people and process: a teller script, a call-back policy for first-time wires above a set amount, and a direct line from the branch to whoever handles fraud. Those cost little and can be in place within a week.

Elder exploitation rules differ by institution

Elder financial exploitation programs deserved particular attention. Many states allow or require financial institutions to report suspected exploitation of older adults and, in some cases, to delay a disbursement. Staff need to know those procedures exist and how to use them. Where appropriate, suspicious activity reports, the confidential filings banks make to federal authorities when they see possible financial crime, also feed the investigations that eventually reach organized scam operations.

The federal Senior Safe Act of 2018 gives banks, credit unions, broker-dealers and investment advisers immunity from liability for reporting suspected exploitation in good faith. The immunity depends on the employees involved having received the training the law describes. That condition turns training from a courtesy into a legal protection. An institution that has not trained its front line may lose the immunity exactly when it needs it.

Broker-dealers operate under extra rules. FINRA rules require firms to make reasonable efforts to obtain a trusted contact person for customer accounts. They also allow a temporary hold on disbursements when a firm reasonably believes an older or vulnerable customer is being exploited. Banks and credit unions have no single equivalent, and their authority to delay depends largely on state law. Institutions that operate across states, or that include both a bank and a brokerage, need to know which rule applies to which account.

In June 2022, weeks after the collapse, FinCEN issued an updated advisory on elder financial exploitation, its first since 2011. It described new typologies and red flags and asked institutions to file reports and refer victims to the Justice Department’s national elder fraud hotline. FinCEN noted that institutions had filed about 72,000 suspicious activity reports related to elder exploitation in 2021. The advisory gave fraud teams an authoritative reference for exactly the patterns this section describes.

Reporting has its own discipline. A bank generally has 30 calendar days from first detecting facts that may justify a suspicious activity report to file it. A wave of similar cases can strain an investigations team that is sized for ordinary volumes. Grouping related cases, using consistent narratives and recording the typology in each report helps law enforcement connect them. It also helps the bank show that the surge did not cause it to miss its filing deadlines.

Disputes over transfers the customer authorized

The second capability is dispute handling. A customer who lost money on a token usually wants it back from someone, and the bank is the institution they can reach. Some disputes have a basis: unauthorized transfers, errors, or card transactions where network rules may apply. Many do not, because the customer authorized the transfer and the loss came from the investment itself.

That distinction is clear in the rules and painful at the counter. Regulation E is the federal rule that governs electronic transfers from consumer accounts. It protects consumers against unauthorized electronic fund transfers and errors, but it does not cover losses on an investment the consumer chose to make. Card network dispute rights depend on the type of transaction and how it was coded. Wires are generally final. A customer told only no will often escalate, to a complaint portal, a regulator or social media.

What the rules provide, and what they do not

Regulation E’s error resolution process is specific. A consumer generally has 60 days after the statement showing a problem to report it. The institution must investigate, usually within 10 business days, or within 45 days if it provisionally credits the account. Liability for unauthorized transfers is capped at modest amounts when the consumer reports promptly. Those protections are valuable, and staff should apply them fully where they fit.

The boundary is authorization. Federal guidance has treated a transfer started by a fraudster who tricked the consumer into revealing account credentials as unauthorized, so Regulation E protections apply. A transfer the consumer made personally, even under false pretenses, is generally treated as authorized. Wire transfers sit outside Regulation E altogether, under state commercial law, apart from consumer remittances abroad. Card purchases depend on network rules and on how the merchant coded the transaction. Getting each case into the right box is skilled work, which is one reason front-line staff should not decide them alone.

An everyday comparison helps explain this to non-specialists. If someone steals your checkbook and writes a check, the bank has a duty to look into it. If you write a check yourself to buy shares in a company that later goes bankrupt, the bank processed your instruction correctly; the loss belongs to the investment. Most UST losses looked like the second case, even when they felt like the first.

Card disputes follow the same logic. Network rules give cardholders rights when goods or services are not delivered, when a charge is processed in error or when the card was used without permission. They generally do not cover a purchase that was delivered as described and later fell in value. A customer who bought UST on an exchange with a debit card received the tokens. The tokens’ collapse, however painful, is not a processing error.

Banks that handled this well separated the analysis from the conversation. Dispute teams applied the rules carefully and documented each decision. Front-line staff were trained to explain, calmly and accurately, what the bank could investigate and what it could not reverse. They could also point customers elsewhere, such as a report to law enforcement or the relevant state regulator. Complaint codes specific to crypto losses let compliance teams see the volume and spot cases where the customer had actually been defrauded through the bank’s own channels.

There is a cost trade-off here. Generous goodwill credits calm individual customers but can teach scammers which institutions pay, and they create inconsistent treatment that examiners notice. A written policy on when the bank will make an exception, approved by compliance and applied the same way across branches and the contact center, is fairer and easier to defend. It also gives managers something firmer than discretion when a distressed customer asks to speak to someone senior.

A dispute file an examiner can follow

Each crypto-related dispute should leave a file that a reviewer can follow without asking anyone. It should show the date the customer raised the issue and the channel. It should identify the transaction, the payment type and the rule that governs it. It should record the facts the team gathered, including whether the customer initiated the transfer and whether credentials were compromised. It should state the decision and the reason, the date of the letter sent to the customer, and any referral made to law enforcement or a regulator. Where the bank made an exception, the file should cite the policy provision that allowed it.

Files like that serve several audiences. Examiners testing Regulation E compliance can see that the rules were applied. Internal audit can sample them. And if a customer later complains to a regulator, the bank can answer from the record rather than from recollection.

The case for reimbursing anyway

There is a serious argument that banks should bear more of these losses. Banks see payment patterns customers cannot. They design the channels scammers exploit. Making them pay creates an incentive to invest in prevention. The United Kingdom moved in that direction, and from October 2024 its payment regulator required reimbursement for most victims of authorized push payment fraud on its faster payments system, up to a cap.

The counter-argument is also real. Reimbursement can reduce customers’ own caution, and it does nothing to distinguish fraud from a bad investment. UST holders who bought a token that collapsed were not defrauded by a stranger. Most lost money because the investment failed. No reimbursement regime in any major market covered that kind of loss. The policy debate is about scams. For the bulk of UST losses, the bank’s job was to explain clearly, protect the customer from the second wave and record the pattern.

Which products carry which protections

The third capability concerns what customers believe. Words like stable, savings, interest and yield carry meaning in banking because deposits carry federal deposit insurance and are held by supervised institutions. Some crypto products borrowed that vocabulary. A customer who saw a stable token paying a high rate in an app that also showed their bank account could reasonably assume the two were alike.

Deposit insurance is the government guarantee that, if an insured bank fails, depositors get their money back up to a set limit. It is one of the foundations of trust in banking, and most customers understand it only vaguely. That vagueness is exactly what makes borrowed vocabulary so powerful. If a screen says “savings” and “stable” and shows a number next to your checking balance, it feels like a bank product.

Banks control part of this. Where a bank or its fintech partner presents crypto features near deposit accounts, design choices matter: visible labels that a token is not a deposit and not insured, separate screens for insured and uninsured balances, and no use of deposit vocabulary for products that do not qualify. Marketing review should apply the same standard to partner materials that carry the bank’s name. Exactly what the deposit insurance representation rules and advertising requirements demand of a partner product is a question for the bank’s lawyers.

Who promised what

The protections customers mix up are distinct, and each covers a specific failure:

• Deposit insurance from the FDIC, or share insurance from the NCUA for credit unions, protects depositors if the insured institution fails, up to the limit. It does not cover investment losses, crypto or the failure of a fintech that is not a bank.
• SIPC protection at a broker-dealer restores customer securities and cash if the firm fails and they are missing. It does not cover market losses, and it generally does not extend to crypto assets that are not securities.
• Regulation E protects consumers against unauthorized electronic transfers and errors, not against investments that go wrong.
• A crypto platform’s own promises are contractual. In a bankruptcy, customers may find themselves as creditors of the platform rather than owners of the assets, as the Coinbase disclosure warned that week.

The FDIC’s May 2022 rule on misrepresentation of insured status gave the agency a clearer basis to act against firms that blurred these lines. Banks partnering with fintechs had their own reason to care. A partner app that described an uninsured product in insured terms, beside the bank’s name, put the bank’s credibility on the line along with the partner’s.

Credit unions had a particular version of the problem. Their members trust the institution closely, and some credit unions were exploring partnerships to let members buy crypto through online banking. In that setting, a single screen could show insured shares and uninsured crypto side by side. Design and disclosure had to work harder to keep them apart.

Broker-dealers and wealth managers met the question from another angle. Their clients were used to investment risk, but some had moved money out of managed accounts into crypto apps, then asked their adviser what had happened. Firms needed a clear position on whether advisers would discuss assets the firm did not hold or supervise, and a record of what was said. An adviser’s casual reassurance about a product outside the firm can create its own problems later.

Disclosures customers actually notice

Banks already had a model. Interagency guidance issued in 1994 covered bank sales of nondeposit investment products, such as mutual funds and annuities. It expected banks to tell customers clearly that those products are not deposits, are not insured and may lose value. The guidance also called for keeping sales physically separate from deposit-taking where possible. The same discipline translates to screens. A crypto feature can carry those three plain statements at the point of first purchase, appear on a separate tab from insured balances and use its own visual design.

Testing matters more than wording. A disclosure that appears in grey type below the fold will not be read. Institutions can check comprehension directly by asking a sample of customers what is protected after they use the feature, then revising the design until the answers are right. That kind of evidence also shows an examiner that the institution took the question seriously.

Staff need a plain answer to the question customers asked most often that month: was my money protected. A short, accurate script, reviewed by compliance, prevents both false reassurance and needless alarm. It also protects the institution if regulators later review how complaints were handled.

How the three capabilities connect in practice

Inside a bank, these three capabilities usually sit with different teams: fraud operations, disputes and complaints, and product or marketing compliance. The UST collapse showed why they need to work as one system during a market shock.

Follow a single hypothetical customer through a credit union. In April he moves part of his savings to a crypto app that advertises a high yield on a “stable” token. The app shows his credit union checking balance on the same screen, because he linked the accounts. In May the token collapses. He calls the credit union, convinced something has gone wrong with his account.

The first person he reaches is a contact center agent. If she has an accurate script, she can explain that his deposits at the credit union are unaffected. She can add that the token was not a deposit and was not insured, and that he authorized the April transfer himself. She logs the call under a crypto-loss complaint code. If he insists on a dispute, she routes it to the specialist team rather than promising anything herself.

The dispute team reviews the April transfer, confirms it was authorized, documents the decision and sends a clear letter explaining why the credit union cannot reverse it and where he might report the loss. Meanwhile the compliance team, watching the complaint code, notices that many such callers mention the same app and its “stable” marketing. It asks whether any of the credit union’s own materials or partner screens used similar language.

A week later, the same customer receives a message offering to recover his losses for a fee. He asks the credit union to wire the fee. Because the fraud team has a rule for first-time transfers to unfamiliar recipients, and because the branch staff know the warning signs of a recovery scam, someone asks the right questions. The wire does not go out.

Each step is modest. Together they turn a confused, angry customer into one who lost money on an investment but was protected from losing more, treated consistently, and given straight answers. Where any one link is missing, the story ends worse for both the customer and the institution.

Volume is the other test. A market shock arrives without warning, often over a weekend, as UST’s did. Contact centers sized for normal Mondays can find hold times multiplying. Institutions that coped best had a surge plan: a short approved message for the website and phone menu, a set of trained staff who could be moved onto the queue, and a way to route crypto-related calls to people with the script. Those plans cost little to write and are hard to improvise once the phones are ringing.

Making the links work requires a shared data point. When fraud, disputes and complaints all use the same code for crypto-related contacts, each team can see the others’ cases. A weekly huddle during a market shock, with someone from each function and a compliance officer, turns three queues into one picture. After the shock passes, a short review of what the codes showed, which scripts worked and where customers fell through gaps gives the institution a better playbook for the next event.

Where the costs land for a bank that held no UST

Holding no UST did not keep a bank clear of the event’s costs. They landed in several places at once.

Direct losses. Every recovery scam wire that leaves the bank is money a customer will not see again, and some of those customers will argue the bank should have stopped it. Even where the bank has no legal liability, the relationship may not survive.

Operating costs. A surge in calls, branch visits and disputes consumes staff time. Poorly prepared teams take longer, escalate more and make inconsistent decisions that later need review.

Regulatory exposure. Examiners look at complaint handling, elder exploitation procedures, fraud controls and the accuracy of what staff tell customers. Inconsistent goodwill credits or misleading reassurances about protection are the sort of findings that can follow an event like this.

Reputation and trust. Customers remember how they were treated on a bad day. A teller who stopped a scam, or an agent who explained a hard truth kindly, builds loyalty. A brush-off can become a public complaint or a social media post.

Measurement. Institutions that wanted to know what the shock cost them could count it. Contacts coded to crypto losses, staff hours spent on them, disputes opened and their outcomes, scam payments stopped and their value, and complaints escalated outside the bank. A short report on those figures after the event shows leadership where preparation paid off and where it was missing.

Partner risk. For banks with fintech partners that put crypto features near deposit accounts, the question of what customers believed is not hypothetical. The bank’s name sits on that screen.

Why blocking crypto payments falls short

Some institutions concluded the cleanest answer was to stop customers sending money to crypto platforms. Several large US card issuers had stopped allowing credit card purchases of crypto back in 2018. Blocking reduces scam losses through that channel and spares staff difficult conversations.

It also has costs. Customers who want to buy crypto legally will move their banking elsewhere, often to institutions with weaker protections. Blocks push scam payments into channels that are harder to see, such as cash, gift cards or crypto ATMs. And a blanket block tells the institution nothing about which customers are at risk. Targeted friction, good scripts and visible protection usually serve customers better than a ban, though each institution has to weigh its own risk appetite and customer base.

Two banks, one bad week

Consider two regional banks in the week after the collapse.

At the first, the fraud team had already added rules for first-time crypto platform transfers months earlier. When call volumes rose, the contact center had a one-page guide: what Regulation E covers, what it does not, where to refer customers, and an approved answer to “was my money insured?” Disputes went to a specialist team that documented each decision. A new complaint code for crypto losses gave the compliance officer a daily count. By the end of the week she could show the executive committee how many cases had a genuine bank-side error and how many did not.

At the second, each branch improvised. Some managers issued goodwill credits; others refused flatly. One agent told a customer that “all our accounts are insured,” which was true of deposits and dangerously misleading about the crypto feature in the partner app. Complaints were coded as “other,” so nobody could see the pattern until a regulator asked.

The difference showed weeks later. The first bank could tell its examiners how many customers had called, how many disputes it had reviewed and on what basis it had decided them, and how many scam payments staff had stopped. The second could only reconstruct events from memory and scattered notes. Both banks had faced the same shock with no UST on their books. Only one could show it had handled it.

Most of the failures that week fell into a few patterns:

• Assuming no balance-sheet exposure means no customer exposure.
• Fraud rules built for card theft and account takeover, with nothing tuned for customers voluntarily sending money to new crypto platforms.
• Front-line staff who do not know the institution’s elder exploitation procedures, or do not know they can escalate.
• Ad hoc goodwill credits that vary by branch and by how loudly a customer complains.
• Crypto features presented in banking language, beside insured balances, with labels customers do not notice.
• Complaint coding too coarse to show a new pattern until it is large.

The three capabilities need no view on whether crypto belongs in a bank. They need recognizing that customers will bring crypto losses to the institution they trust, and preparing the people who answer.

Five checks before the next shock

• Do our fraud rules flag a customer’s first large transfer to a crypto platform, and what happens when the alert fires?
• If a customer disputes a crypto loss tomorrow, who decides, using what written policy, and how is the decision documented?
• Can we count crypto-related complaints today, or are they buried under a general category?
• Where do crypto or other uninsured features appear near our deposit accounts, including in partner apps that carry our name, and how are they labeled?
• What is our approved, one-sentence answer to “was my money protected?”

Each of these can be answered in a week, and each answer tells leadership whether the bank is ready for the next time a product sold as stable is not.

Each check has a natural owner. The fraud operations lead owns the first. The head of disputes, with compliance, owns the second. The complaint management function owns the third. Product and marketing compliance, together with whoever manages fintech partnerships, owns the fourth. The fifth belongs to compliance and the contact center leader jointly, because a script nobody uses protects nobody. A credit union or community bank may have one person wearing several of these hats. The checks still apply, and they are easier to run when one person can see all of them.

With hindsight

TerraUSD was the first collapse of a difficult year. Crypto lenders froze withdrawals and failed over the summer, FTX failed in November, and in March 2023 two banks with heavy crypto-sector deposits, Silvergate and Signature, wound down or were closed. What began as a token losing its peg ended with regulated banks disappearing, a reminder that exposure travels through customers and deposits as well as through direct holdings.

Regulators turned to the protection question quickly. On July 28, 2022, the FDIC and the Federal Reserve sent Voyager a letter demanding that it stop making false or misleading statements about deposit insurance. The FDIC published a fact sheet on deposit insurance and crypto companies the next day. On August 19 the FDIC sent cease and desist letters to five more companies over crypto-related representations about deposit insurance. Bankruptcy courts then tested the custody question. In the Celsius case, the court ruled in early 2023 that assets in the platform’s yield-bearing accounts belonged to the estate, leaving those customers as creditors.

The banking agencies’ posture shifted with the political cycle. In January 2023 they issued a joint statement warning banks about crypto-asset risks, including fraud and inaccurate representations of deposit insurance. In 2025 they withdrew much of that cautionary guidance and opened the way for banks to engage in crypto activities with less prior scrutiny. The front-line questions in this article did not change with either shift.

Accountability followed. After a jury found Terraform Labs and its founder liable for fraud in a Securities and Exchange Commission case, they agreed in 2024 to pay about 4.5 billion dollars. The founder also faced criminal fraud charges in the United States. For the customers who had called their banks in May 2022, that came years too late to change what they had lost.

The policy answer arrived in July 2025. The GENIUS Act created a federal framework for payment stablecoins built on full reserves of high-quality liquid assets and redemption rights, the opposite of the algorithmic design that failed. A regulated payment stablecoin now has to hold reserves at least equal to the tokens it issues, in cash, insured deposits, short-dated Treasury bills and similar assets, and publish their composition monthly. Holders have a right to redeem, and their claims on the reserves rank ahead of other creditors if the issuer fails. That is close to the prudential framework Secretary Yellen had urged in May 2022.

Two provisions speak directly to the front-line problem described here. The law bars issuers from paying holders interest or yield, removing the feature that drew many UST buyers. It also states that payment stablecoins are not federally insured or government-guaranteed, and makes it unlawful to represent otherwise. The vocabulary confusion of May 2022 is now, in part, a matter of statute.

The law also set a clock for intermediaries. Starting three years after enactment, digital asset service providers may not offer or sell payment stablecoins to people in the United States unless a permitted issuer stands behind them. Banks that plan to issue stablecoins through subsidiaries, or to offer them to customers, will meet the same front-line questions in a new form: customers asking what they own, whether it is insured and what happens when something goes wrong.

The fraud did not go away. Investment fraud, much of it involving crypto, was the costliest category of complaints in the FBI’s Internet Crime Complaint Center report for 2024. The recovery scams and stable-sounding pitches that followed UST were a preview of a pattern that grew. Relationship investment scams that steer victims to fake crypto trading platforms became one of the most damaging categories, and they reached customers of every kind of institution.

By 2026, as banks explore stablecoins under explicit rules, the front-line questions from May 2022 still apply. Clearer rules make the products sounder, but they do not stop a stranger on the phone, settle a dispute over a payment the customer approved, or explain to a worried customer what is insured. Those remain jobs for trained people at the counter and on the phone, and leaders who prepare them before the next shock will find it far easier to meet.