Does the GENIUS Act Protect DeFi Lenders?

In brief: The GENIUS Act, signed into law in July 2025, requires permitted payment stablecoin issuers to hold full reserves and submit to federal or state supervision, but those protections attach to the stablecoin itself, not to what holders do with it afterward. When an institution lends a compliant stablecoin into a decentralized protocol to earn a return, it leaves the perimeter of the law and takes on smart-contract, liquidation, and counterparty risk with no statutory recourse. The guarantee covers the instrument, not the yield strategy built on top of it.

The GENIUS Act (Public Law 119-27) is the first comprehensive federal framework for payment stablecoins in the United States, and it draws a sharp line that institutions are only beginning to internalize. The law governs how a payment stablecoin is issued, reserved, and redeemed. It says almost nothing about the lending markets that have grown up around those instruments. A payment stablecoin is a digital asset issued for payment or settlement and redeemable at a predetermined fixed amount, and the Act's protections are engineered around that definition. Move the asset into a decentralized lending venue and the protections do not travel with it.

That distinction matters because the two activities are easy to conflate. A treasurer holding a reserve-backed, federally supervised stablecoin may reasonably assume a baseline of safety. Deploy the same balance into a lending protocol for a few extra basis points, and the legal character of the position changes entirely.

What does the GENIUS Act actually guarantee?

The Act's core protection is reserve integrity. It requires every permitted payment stablecoin issuer to back outstanding tokens with reserves valued at no less than 100 percent of the stablecoins in circulation. Those reserves must sit in a narrow set of high-quality assets: cash, insured bank deposits, short-dated Treasury bills, overnight Treasury repos, government money market funds, or balances at the Federal Reserve. The statute prohibits riskier reserve assets such as corporate debt or equities, and layers on diversification, capital, liquidity, and risk management requirements.

Supervision is the second pillar. Federally licensed nonbank issuers fall under the Office of the Comptroller of the Currency, which finalized its implementing framework in late 2026, while smaller issuers with under 10 billion dollars outstanding may opt into state supervision under regimes certified as substantially similar. Issuers must publish monthly reserve attestations certified by executives. The combined effect is that a compliant payment stablecoin is a redeemable claim against a transparent, conservatively held reserve pool, overseen by a banking regulator.

The Act also removes a layer of ambiguity by excluding compliant payment stablecoins from the definition of a security and a commodity, which keeps them outside SEC and CFTC jurisdiction. That is a clarifying move for issuers. It is not a consumer guarantee, and it is worth reading carefully, because it defines the edge of the regulated zone rather than extending it.

Where does the protection stop?

The protection stops at the token. The GENIUS Act regulates issuance and redemption; it does not regulate secondary markets, lending venues, or yield products built on stablecoins. When an institution supplies a stablecoin to a decentralized lending protocol, it is no longer holding a redeemable claim against a supervised reserve pool. It is holding a position in a smart contract whose solvency depends on collateral quality, liquidation mechanics, oracle accuracy, and code that no regulator has examined.

This is not a gray area the law forgot to address. It is a deliberate boundary. The statute is also notably quiet on yield at the issuer level: a permitted issuer generally cannot pay interest or yield directly on a payment stablecoin. That prohibition has, somewhat perversely, pushed yield-seeking activity outward into decentralized and third-party venues that the Act does not reach, a dynamic that analysts have tracked closely since the law took effect. The regulated core produces a safe, inert instrument; the return has to be manufactured somewhere else, and that somewhere else is unregulated.

Decentralized lending carries risks that have nothing to do with reserve quality. Over the past five years, DeFi exploits have erased roughly 59 billion dollars in value, and the losses keep coming. The stablecoin lending protocol Resupply lost more than 9 million dollars to a price-manipulation exploit in 2025, a reminder that depositing a sound asset into an unsound venue does not make the venue sound. Liquidation cascades, oracle failures, and contract bugs can impair a lender's position even when the underlying stablecoin holds its peg perfectly.

What recourse does a lender have if something goes wrong?

Very little, and this is where the institutional reading gets uncomfortable. Even at the issuer level, the GENIUS Act's protections are thinner than the headlines suggest. Legal commentators have noted that, under the Act's interaction with existing bankruptcy law, stablecoin holders may find themselves with only a fifth-priority claim in an issuer insolvency, behind several classes of administrative and secured creditors. The reserve requirement reduces the probability of a shortfall; it does not make holders senior in every scenario.

That is the recourse at the regulated layer. In a decentralized lending protocol, there is typically no issuer to pursue, no deposit insurance, no supervisory authority to petition, and often no identifiable counterparty at all. A protocol exploit or a bad-debt event resolves according to the protocol's own code and governance, not according to a statutory claims waterfall. Stablecoin balances carry no deposit insurance to begin with, and that absence becomes acute once the asset is committed to a lending market where the only backstop is the protocol's collateralization and the diligence of whoever designed it.

The practical lesson is that compliance and composability describe different things. A stablecoin can be fully GENIUS-compliant and still be deployed into an entirely uninsured, unexamined strategy the next block. The compliance attaches to the instrument's issuance; the composability is what the holder does next, and the law does not follow it there.

How should institutions read the line?

The cleanest way to think about it is that the GENIUS Act regulates the manufacture of a monetary instrument, not the investment decisions made with it. An institution evaluating a stablecoin for treasury, settlement, or collateral purposes gets real value from the Act: reserve transparency, a defined redemption right, and federal or state oversight of the issuer. An institution reaching for yield by lending that stablecoin into a decentralized protocol is making a separate decision that the Act neither blesses nor protects, and it should be underwritten as such, with its own due diligence on contract audits, collateral parameters, liquidation design, and counterparty structure.

That separation is not a flaw in the framework so much as a feature of how programmable assets work. The same qualities that make a compliant stablecoin useful, its auditability and its composability, also make it trivially easy to carry out of the regulated perimeter. The discipline, then, belongs to the holder. For institutions building on programmable, composable, and auditable assets, the forward question is less whether a given stablecoin is compliant and more whether the strategy wrapped around it preserves the auditability and recourse that made the instrument attractive in the first place. The GENIUS Act drew a firm line at the token. Knowing exactly where that line sits is now part of the fiduciary job.