The CLARITY Act Is Close - Here's What Decision Makers Need to Know Before the Ink Dries
From the outside the legislative fight may seem largely over - but the realities of operational questions are just starting.
Where We Are
On May 14, 2026, the Senate Banking Committee advanced the Digital Asset Market CLARITY Act in a 15-9 vote. All 13 Republicans voted yes. Two Democrats, Senator Ruben Gallego of Arizona and Senator Angela Alsobrooks of Maryland, crossed the aisle to give the bill its bipartisan margin.[1] Before reaching the floor, the committee text must be reconciled with a parallel CFTC jurisdiction framework, a process expected to take several weeks.[11]
Getting to 60 votes requires at least seven Democrats who did not vote yes in committee to cross over. The Van Hollen ethics amendment, which would have barred senior government officials from holding certain crypto business interests, failed 11-13 and remains the live issue heading into floor negotiations.[1] Digital Chamber CEO Cody Carbone told reporters that resolving it is likely what gets the bill past the threshold:
“I imagine the deal will be completed before this goes to the floor, because they’ll want to only bring it to the floor if they feel confident they’ve got 60.”
Galaxy Research raised its passage probability to 75% following the committee vote, with head of research Alex Thorn estimating a signing during the week of August 3 if Congress maintains its current pace, a more conservative timeline than the White House’s July 4 target.[11] Large financial services institutions have been building in anticipation of passage since at least Q1. The distance between a presidential signature and a functioning regulatory market is the part that hasn’t been fully priced in.
What Passage Actually Produces
Jurisdictional certainty is the primary output, and it is not a small thing. For years, the SEC and the CFTC both claimed authority over digital assets, leaving the industry with two regulators and no clear rules. Courts made it worse: a 2023 decision in the Ripple case held that institutional XRP sales were securities transactions while programmatic sales on exchanges were not, and a separate ruling in the Terraform case reached the opposite conclusion weeks later.[3]
The CLARITY Act ends the scuttlebutt between the CFTC and the SEC. The SEC retains authority over investment contract assets and fundraising. The CFTC takes primary oversight of spot digital commodity markets. Two agencies, defined lanes, written into law.
White House crypto advisor Patrick Witt, who serves as the Executive Director of the President's Council of Advisors for Digital Assets and Deputy Director of the White House Council on Digital Assets, clearly articulated the administration’s stance on scope at Consensus Miami.
“CLARITY Act passage would give the crypto industry roughly 90% of what it needs.”
The remaining 10% sits in places the bill was never designed to reach.[11]
The bill includes a decentralization test that determines which regulatory lane a digital asset falls into. Once a blockchain network meets certain criteria, including no single party controlling more than 20% of it, tokens issued on that network can be reclassified from securities to commodities for secondary market purposes.[3] For founders and token issuers who have spent years not knowing which regulator applies to them, that reclassification pathway is the most practically significant thing in the bill. Registration categories are established for exchanges, brokers, dealers, and custodians, creating legal pathways to operate that have not previously existed. Developers who build software or run infrastructure but don’t control user funds get specific protections under the bill, exempting them from registration requirements under certain conditions that will be defined through rulemaking.[3]
On stablecoin yield, the Tillis-Alsobrooks compromise restricts passive, deposit-like yield on payment stablecoins while permitting activity-based rewards under tighter oversight. That distinction drove more than 8,000 letters from American Bankers Association members to Senate offices in the five days before the committee vote[1] and stalled the bill for four months.
The definitions now exist. The rules that make them operational do not.
What Does a Signature on CLARITY Not Close?
The Rulemaking Gap
Here is the sequence once the bill is signed. The CFTC must establish a provisional registration process before firms can register. The House-passed version of the bill requires that process to open within 180 days of enactment; the Senate Banking Committee version sets the floor at 270 days. The final timeline will emerge from reconciliation between the two chambers, but the direction is the same either way: a registration window opens, and from the day it does, exchanges, brokers, and dealers have 90 days to register. [ 4 ] [ 23 ]
The moment a firm registers, compliance obligations go live. Customer asset protection requirements, books-and-records standards, and BSA program obligations apply during provisional status. Firms in provisional registration can continue listing the digital assets they currently list until the joint rulemaking on definitions is complete, but they operate as regulated entities from day one of registration, not from the date the rulemaking concludes. [ 4 ]
The rulemaking itself runs on a longer clock. The SEC and CFTC are required to jointly issue rules before the bill’s definitions become fully binding, a process that includes mandatory public comment periods and revision rounds built into federal law. A realistic read puts a fully operational regulatory regime no earlier than late 2027, with many provisions extending into 2028. [ 3 ]
Many firms are treating the rulemaking calendar as their deadline. The actual deadline is registration day, which arrives well before rulemaking concludes, and the gap between those two dates is where compliance programs either exist or don’t.
The CFTC Capacity Constraint
Congress has handed the CFTC primary oversight of a spot digital commodity market measured in trillions of dollars. The agency’s FY2027 budget request leaves enforcement staffing below FY2025 actual levels, meaning the mandate grows while the headcount shrinks.[5] The CFTC’s own Inspector General flagged digital-asset legislation and human-capital management as its top challenges for FY2026 before the committee even voted.[5] House Financial Services Committee leaders made the gap explicit in a May 15 letter to President Trump, noting that a full five-member commission would produce better and more durable rules.[5] As of the committee vote, the CFTC had one confirmed chairman.
How quickly registration pathways open, how consistently examination standards are applied, and how much runway exists between registration and enforcement all depend on an agency that is being asked to do significantly more with what it already has. That runway will not extend past 2027.
TEFRA is Still in a Separate Lane
There is a 1982 tax law called TEFRA, the Tax Equity and Fiscal Responsibility Act, that was written long before blockchain existed and was never intended to touch it. The problem is that when you transfer a tokenized bond between self-custodial wallets on a permissionless blockchain, the mechanism looks, under TEFRA’s language, like the transfer of a bearer instrument: a physical certificate with no registered owner that the law was specifically designed to prevent. The penalties are significant: interest deductions denied, excise taxes at issuance, capital gains reclassified as ordinary income, and 30% withholding on interest payments, regardless of the investor’s location. None of that is resolved by the CLARITY Act, and no active legislative vehicle addresses it. I covered the full constraint in an earlier piece, linked below.[10]
For anyone building a fixed-income tokenization program that routes transfers through self-custodial wallets on a permissionless chain: your tax counsel and your securities counsel need to be in the same conversation, because they are working from different frameworks and the gap between them is TEFRA.
The Decision Window
The 12 to 18 months between a signature and an enforceable rule set is the build period, and it is not arriving on a clean slate.
A 2024 Bank Policy Institute survey of 20 financial institutions, including global systemically important banks and major regionals, found that between 2016 and 2023, employee hours dedicated to compliance grew by 61%, while total employee hours grew by 20%.[6] Compliance is growing at three times the rate of the financial services institutions themselves. C-suite time devoted to regulatory compliance went from 24% in 2016 to 42% in 2023. Board time from 27% to 43%. The BPI survey put it directly:
“The amount of employee time spent complying with financial regulations and responding to examiner mandates is growing, not shrinking.”
The burden is distributed unevenly by size. U.S. financial services institutions spent an estimated $59 billion on BSA/AML compliance in 2023.[7] Mid-size banks carry compliance costs of approximately 2.9% of non-interest expenses; institutions below $100 million face costs as high as 8.7%.[7] CSBS researchers, drawing on ten years of community bank data, put it plainly:
“Regulatory costs behave more like a fixed overhead cost than a variable one, meaning they do not scale down gracefully. The smaller the bank, the bigger the bite.”
The compliance teams now fielding CLARITY Act implementation questions at mid-size digital asset firms are, in many cases, the same people who spent the last three years building AML programs for a regulatory environment that kept moving before they could finish. The bill text is finally stable enough to build against. Large institutions are already doing so.
Mid-size and smaller institutions waiting on final rules are falling behind in vendor evaluation, systems architecture, and counterparty relationship cycles that run 12 to 18 months regardless of when rules finalize. The decisions hardest to reverse once final rules publish are being made right now.[8]
What This Means by Audience
The pressures created by the passage of the CLARITY Act are not uniform. A DeFi founder building toward institutional integration faces a fundamentally different set of decisions than a compliance officer at a registered broker-dealer, a custodian positioning for the post-rulemaking landscape, or an RIA trying to figure out what digital asset exposure actually means for their client accounts right now. Each section below goes deep on a specific role. Jump to what applies to you, or read through — the dynamics interconnect more than they appear to from any single vantage point.
Founders and Builders
The 180-day provisional registration window is the hard constraint on your planning timeline, not the rulemaking calendar. For DeFi founders building toward institutional environments, registration is not the first problem. It is the third or fourth.
Data
DeFi founders tend to walk into early institutional conversations with a reasonable assumption: their protocol is on-chain, the data is public, and that transparency is an asset. Institutions see it differently. Transparency means the ledger is readable. Verification means you can prove who initiated a transaction, who received it, whether either party appears on a sanctions list, and whether the ownership chain is traceable to a real person at every step. Those are different questions, and regulated institutions ask the second set.
A DeFi founder’s first institutional due diligence meeting tends to follow a recognizable arc. The protocol gets demonstrated, the public ledger gets pointed to, and the argument is made that everything is visible and verifiable on-chain. The compliance team listens and then asks for something specific: originator and beneficiary information for a defined set of transactions, formatted for their AML system, with sanctions screening documented at each wallet hop. The protocol doesn’t produce that output. The founder explains the data is all there; it just needs to be extracted. The compliance team asks who does the extraction, how the output gets verified, and whether the format meets their internal requirements. The meeting ends without a clear answer. Before any institutional conversation, founders need to stress-test exactly this scenario against their own stack, because the compliance team will
The Travel Rule
The Travel Rule compounds this. Think of it as the financial system’s requirement that identifying information about a sender and recipient must travel alongside a transfer, the way a wire transfer carries account holder details. FATF’s 2025 Targeted Update confirmed that 73% of responding jurisdictions have now passed legislation requiring exactly this for crypto transfers.[17] In the US, the threshold is $3,000; stablecoins are covered under the same framework.[18] When a DeFi protocol operates as a regulated intermediary, that information infrastructure needs to exist at the protocol layer. The CFTC had already drawn this line before the passage of the CLARITY Act: enforcement actions against Opyn, Deridex, ZeroEx, and Polymarket each found that DeFi platforms operating like trading venues must implement KYC and AML programs regardless of how their underlying architecture is described.[19] CLARITY Act passage gives that enforcement posture a statutory foundation it previously lacked. Building data infrastructure as an afterthought to product architecture is the sequencing error that stops protocols at the institutional due diligence stage rather than the regulatory one.
Vendor Readiness
This problem lives inside your counterparties’ timelines rather than your own. Institutional due diligence for DeFi integration now explicitly evaluates current capabilities in KYC, payments, banking APIs, and identity systems, rather than relying on announced roadmaps.[20] Some vendors have genuine connectivity. Many are promising capabilities that are 12 to 18 months from delivery. Signing an integration agreement with a vendor whose DeFi-specific features are still in development means absorbing their build schedule into yours, without contractual protection unless you negotiated it before signing. Get current capabilities confirmed in writing, understand where DeFi-specific features sit in their development cycle, and build your integration timeline around what they can deliver now.
Contractual Obligations
Most founders underestimate this one because their mental model of how systems connect is shaped by open protocols rather than legal agreements. Every integration point between a DeFi protocol and a regulated entity requires a corresponding legal layer: indemnification for when a smart contract executes correctly according to its code but produces an outcome a counterparty didn’t anticipate; SLA obligations on uptime and settlement finality that validator dynamics may not be able to guarantee; audit rights as a precondition of integration rather than a request that comes later; data processing agreements for users in jurisdictions with privacy law requirements; and IP licensing questions that open-source licenses do not resolve once third-party protocol components are embedded in a regulated commercial product.
The developer exemption in the bill is meaningful and conditional. Centralized front-ends and application layers may carry AML and KYC obligations even where the underlying smart contracts qualify. Building as though the exemption is unconditional is the most common structural mistake being made right now. The founders who arrive at the registration window with their data architecture, vendor agreements, and legal framework already in place are in the only period when institutional counterparties are still selecting integration partners rather than managing a full onboarding queue.
Institutions, Banks, and Custodians
Institutions
For institutions building tokenized products, the question of sequence matters most right now. Beneficial ownership chain disclosure is not something you layer on after a product is built. It has to be part of how the product is structured at the smart contract and wallet transfer levels, because ownership chains need to be traceable at the protocol layer, not reconstructed from records kept elsewhere after the fact. Getting that wrong means rebuilding the product, not amending a report.
The CLARITY Act also confirms something worth stating plainly for anyone building tokenized products: tokenization is a delivery method, not a new asset class.[12] A tokenized bond is still a bond. A tokenized fund interest is still a fund interest. The off-chain rules governing registration, reporting, and transfer restrictions follow the underlying asset onto the chain, and any digital commodity trading associated with a tokenized structure, including stablecoin settlement, may trigger CFTC oversight in addition to existing SEC obligations. Running a tokenized product can mean operating under two regulators simultaneously, and the product architecture needs to be designed with that in mind from day one.
Custodians
For custodians specifically, the CLARITY Act creates both the most significant opportunity and the most significant build requirement of any institution type. Registration requirements establish a defined landscape for the first time. The operational standards inside that landscape are still being written through rulemaking. Anchorage Digital, Coinbase Custody, Fidelity Digital Assets, and BitGo are currently positioning for that environment, each differentiated by asset coverage, insurance and indemnification structures, and whether prime brokerage is offered alongside custody. The custodians that use the provisional period to build their operational infrastructure now, before examination standards are finalized and before large institutions have locked in their relationships, are the ones who will shape what qualified custody looks like in practice rather than having it defined for them.
RIAs and Wealth Managers
Most Registered Investment Advisors (RIAs), advising on digital asset exposure right now are operating on interim guidance that was never designed to be permanent. The SEC’s proposed Safeguarding Rule, which would have extended custody requirements to cover all client assets including crypto regardless of whether they were classified as securities, was withdrawn on June 12, 2025, before it was ever adopted.[13] What replaced it is a single October 2025 no-action letter allowing RIAs to treat certain state-chartered trust companies as qualified custodians for crypto assets, provided those custodians maintain a specific type of independent audit report covering their custody controls.[13] Not a rule. Not a finalized framework - simply a staff letter with conditions attached.
The CLARITY Act’s decentralization test creates a specific problem on top of that. When a token reclassifies from a security to a commodity, it moves from SEC to CFTC jurisdiction. For an RIA currently holding that token as a security in a client account, the reclassification means the asset may fall outside the existing custody rules, which apply only to client funds and securities, until any replacement rules from CLARITY Act rulemaking are in place to cover it.[14] The client’s asset doesn’t change. The rules governing how it must be held do, and the gap between those two moments is the period during which your compliance program needs a documented position.
For FINRA-licensed broker-dealers, the exposure is more direct. There is a rule called Regulation Best Interest that requires broker-dealers to act in a client’s best interest when recommending securities.[15] The operative word is securities. Once a token is reclassified as a commodity, Reg BI no longer governs recommendations about that position. There is no equivalent consumer protection rule at the CFTC for spot commodity recommendations to retail clients, meaning the protection that existed on the way in doesn’t exist on the way out. FINRA has issued no guidance on how member firms should manage that transition for existing client positions. The absence of guidance is not a safe harbor. It is a risk condition your compliance documentation needs to address before reclassification occurs, not after.
Legal, Risk, Compliance & Oversight Professionals
The transition period is the risk period, and the most under-appreciated risk is documentation. Provisional registration means operating under current rules while new ones are written. The gap between what was permissible before and what final rules will require is where enforcement exposure concentrates. The firms best positioned to defend decisions made during that gap are the ones whose compliance records reflect deliberate judgment rather than ambiguity. Build the documented rationale for every material decision made between registration day and final rules now, while the reasoning is current.
The CFTC capacity constraint shapes how that exposure plays out. An agency that cannot fully supervise a newly expanded mandate in its first 18 months creates both risk and some operational runway. That runway is not uniformly distributed; larger, more visible registrants will be examined first. Understanding where you sit in the examination queue is relevant context for how aggressively you build during the provisional period.
What follows are four specific things for legal, risk, compliance, and oversight functions to track in the weeks and months after signing.
The BSA Designation
Section 110 of the CLARITY Act is the provision most compliance teams aren’t tracking closely enough. It designates digital commodity brokers, dealers, and exchanges as financial institutions under the Bank Secrecy Act, which means SAR filing obligations, AML program requirements, and FinCEN reporting go live at registration, for firms that in many cases have never carried these obligations before.[4] If your firm falls into any of these categories and your AML program was built for something lighter, registration day is the hard deadline to upgrade it. There is no grace period built into the BSA designation.
The March 2026 Joint Guidance
Before the CLARITY Act is signed, the SEC and CFTC have already done meaningful preparatory work. In March 2026, the agencies signed a Memorandum of Understanding on regulatory harmonization and jointly classified 16 digital assets, including Bitcoin, Ethereum, XRP, and Solana, as digital commodities.[4] The agencies cannot publish formal rulemaking proposals until the Act becomes law, but the March guidance is the clearest available signal of how they will approach classification under formal rulemaking.[21] Legal and compliance teams can build against it now rather than waiting for the first proposed rule.
The Ethics Provision
The Van Hollen amendment’s fate on the Senate floor will determine whether covered officials, senior government employees across agencies, face disclosure or divestiture obligations tied to digital asset holdings. How that provision gets resolved before the floor vote, whether it passes in some form, gets modified, or gets stripped entirely, has direct compliance implications for any firm whose personnel include covered officials or whose counterparties do.[1] Watch the floor negotiation closely before finalizing any compliance program design that touches this question.
The GENIUS Act Parallel Track
Firms with stablecoin exposure are already running on a separate compliance calendar that doesn’t wait for CLARITY Act rulemaking. The GENIUS Act, signed into law on July 18, 2025, required federal regulators to issue implementing regulations by July 2026, and the law itself takes effect on the earlier of January 18, 2027, or 120 days after final rules are issued.[22] Compliance programs that treat stablecoin obligations and CLARITY Act obligations as a single workstream will miss the GENIUS Act deadlines. They are different timelines, different regulators, and different program requirements, and the stablecoin clock is already running.
Where Will You Be By the Time the Ink Dries?
Congressional approval and presidential signature of the CLARITY Act will settle the jurisdictional argument. It will not answer the operational one. Rulemaking, CFTC capacity, TEFRA, and the GENIUS Act’s separate stablecoin timeline will decide who can actually use the new architecture and how fast.
The clock on that window does not start when CLARITY passes. It starts now. Registration comes 180 days after enactment. If your plan assumes you can begin then, you are already building on a deadline you do not control.
By the time the first final rules publish, the critical decisions - data design, custody model, Travel Rule implementation, vendor stack, and counterparty selection - will already be locked in at the largest institutions. That is what the 12–18 month “build window” really is: the period when you still have room to choose your role in the market that follows.
Sources
Committee vote, Democratic crossover votes, Van Hollen amendment outcome, ABA letter volume, Cody Carbone quote on 60-vote floor strategy.
[2] DeFiRate, CLARITY Act Fact Sheet
Polymarket passage odds and Kennedy fiduciary duty amendment context.
[3] crypto.news, “What the CLARITY Act Actually Says: A Reader’s Guide,” May 2026
Rulemaking timeline, decentralization and 20% control threshold, developer exemption provisions, Ripple/Terraform conflicting rulings.
[4] Unit21, “What the CLARITY Act Means for Your Fintech’s AML Program,” May 2026
180-day provisional registration window, 90-day firm registration deadline, compliance obligations live at registration.
[5] KuCoin / CryptoSlate, “CLARITY Act Advances in Senate, Posing CFTC Capacity Challenges,” May 2026
FY2027 enforcement staffing below FY2025 actuals, CFTC OIG top challenges, House Financial Services Committee May 15 letter to President Trump.
[6] Bank Policy Institute, “Survey Finds Compliance Is Growing Demand on Bank Resources,” October 2024
61% compliance hour growth 2016-2023, C-suite and board time figures, IT budget share increase, direct quote.
$59 billion BSA/AML industry spend, 2.9% vs. 8.7% non-interest expense differential by institution size.
11%-15.5% payroll compliance spend at smallest institutions vs. 6%-10% at largest; direct quote on fixed overhead characterization.
[9] The Coin Republic, “JPMorgan Says Clarity Act Could Trigger Major H2 2026 Recovery,” March 2026
JPMorgan analyst characterization of CLARITY Act as structural shift unlocking sidelined institutional capital.
[10] The RWA Ledger, “America’s Legislative Architecture Wasn’t Built for This,” April 3, 2026
Full TEFRA analysis, bearer instrument problem, penalty structure, $145.1 trillion global bond market context.
Galaxy Research 75% passage probability, Alex Thorn August 3 signing estimate, Patrick Witt 90% quote, committee text reconciliation step before floor vote.
[12] CBIZ, “New U.S. Rules Bring Greater Clarity to Digital Assets and Tokenization,” April 2026
Tokenization as delivery method framework, dual SEC/CFTC obligations for multi-asset platforms, stablecoin settlement CFTC trigger.
SEC Safeguarding Rule withdrawn June 12, 2025; October 2025 no-action letter allowing state-chartered trust companies as qualified custodians under SOC Type II conditions.
[14] Hunton Andrews Kurth, “Proposed SEC Custody Rules for Crypto Assets”
Existing Custody Rule coverage limited to client funds and securities; crypto assets not covered unless also securities.
[15] FINRA, Regulation Best Interest Topic Page
Reg BI governs broker-dealer recommendations of securities transactions; FINRA Rule 2111 suitability does not apply to recommendations subject to Reg BI.
[16] CoinCheckup, “ISO 20022 Compliant Crypto,” February 2026
26.4% of banks ISO 20022 compliant as of recent reports; November 2026 compliance deadline for remaining institutions.
[17] Dotfile, “Travel Rule Compliance for Crypto: Complete KYB Guide 2025”
FATF 2025 Targeted Update: 73% of responding jurisdictions have passed Travel Rule legislation; originator and beneficiary information requirements; five-year data retention obligation.
[18] Sumsub, “Travel Rule in the US: Jurisdictional Requirements for 2025”
US Travel Rule threshold of $3,000 under BSA/FinCEN; stablecoins covered under same VASP framework; self-hosted wallet transfer requirements.
CFTC enforcement actions against Opyn ($250K), Deridex ($100K), ZeroEx ($200K), and Polymarket for operating without registration and failing to implement KYC/AML programs.
[20] Fintegration, “DeFi 2026: Opportunities, Risks and Integration Strategy Guide,” April 2026
Institutional DeFi due diligence criteria including current KYC/AML compatibility, audit logging, governance mechanisms, and verified integration capability with banking APIs and identity systems.
[21] Morgan Lewis, “Crypto Clarity: SEC and CFTC Issue Comprehensive Crypto Asset Guidance,” March 2026
March 17, 2026 joint SEC-CFTC interpretive guidance on crypto asset classification; MOU on regulatory harmonization signed March 11, 2026; 16 digital assets classified as digital commodities including Bitcoin, Ethereum, XRP, and Solana; agencies cannot publish formal proposed rules until CLARITY Act is enacted.
GENIUS Act signed July 18, 2025; federal regulators required to issue implementing regulations by July 2026; law takes effect January 18, 2027 or 120 days after final rules, whichever is earlier; full compliance expected 2026-2027.
[23] Congress.gov, H.R. 3633 (119th Congress), Digital Asset Market Clarity Act of 2025, Text of Legislation https://www.congress.gov/bill/119th-congress/house-bill/3633/text
Supporting: House Financial Services Committee, Section-by-Section Analysis of the Digital Asset Market Clarity Act of 2025, July 10, 2025 https://financialservices.house.gov/uploadedfiles/2025-07-10_-_sbs_-_clarity_act_of_2025_final.pdf
Section 106: CFTC required to establish expedited registration process within 180 days of enactment; firms must register within 90 days of that process being adopted; firms in provisional status remain subject to all statutory requirements and applicable regulations; firms may continue listing assets held prior to registration until joint SEC-CFTC rulemaking on definitions is complete. Section 110: digital commodity brokers, dealers, and exchanges designated as financial institutions under the Bank Secrecy Act.