The Payments Pulse: The Rules Are Stalling. The Rails Aren’t.

Congress failed to pass crypto market structure. US regulators are still behind on stablecoin rules. The Supreme Court hasn’t decided whether it will hear the prediction-market case. And none of it slowed the market: Week 1 of the NFL season pushed prediction-market volume past $3 billion, 21 banks kept building their own stablecoin, and processors are still named in Florida’s lawsuits. This week’s five stories are about what happens to payments when the rules stall and the rails keep going.

Two weeks ago we argued that regulation is moving from the merchant to the rail. This week showed the other side of that shift. The people who write the rules are slowing down. The people who build the rails are not. The result is a growing gap between what payments infrastructure already does and what the law says it’s allowed to do, and processors, PSPs and orchestration platforms are the ones standing in that gap.

1. The Market Moved on Prediction Markets Before the Court Did

New Jersey’s petition asking the Supreme Court to settle the split between the Third and Ninth Circuits is still pending. Michigan’s injunction against Kalshi is still in force, with its $500,000-per-day penalty for non-compliance. Legally, nothing is settled.

Commercially, it looks settled already. NFL prediction-market volume passed $3 billion in Week 1, according to Aldrin Research data reported by Covers. Kalshi took about 76% of reported NFL Sunday volume, and DraftKings Predictions had its own record $139.8 million Sunday. Over the wider season so far, prediction markets account for roughly 21% of NFL-related wagering activity (about $8.4 billion), while regulated sportsbooks still hold around 79% (CNBC).

Some early signs of substitution are showing up in the regulated numbers. Michigan’s August report showed online sports betting adjusted gross receipts down 29.3% year over year, while iGaming was up 17.6% (Michigan Gaming Control Board). One state and one month don’t prove cannibalisation, but the market is clearly pricing it in: DraftKings shares are down close to 40% since the start of the year (Invezz).

Why it matters: Billions of dollars in volume are now running on a rail whose legal status can change at a state border, and it could stay that way until the 2026–27 Supreme Court term. Acquirers are underwriting that exposure today, so MCC coding, geolocation and state-level routing rules can’t wait for the court.

We first laid out the split-circuit problem, and why it makes transaction classification a state-level decision, in our September 7 edition.Read: The Payments Pulse: Regulation Is Moving From the Merchant to the Rail

2. Washington Stalled Again. The Banks Didn’t Wait.

On September 15, the CLARITY Act failed a Senate cloture vote 49–50, well short of the 60 votes it needed (CoinDesk). Negotiators had agreed more than 600 pages of compromise, but disagreements over ethics provisions and pressure from the November 3 midterms stopped the bill. Many in the industry now expect nothing to pass this year.

The stablecoin rulebook is behind schedule too. Regulators missed the GENIUS Act’s one-year rulemaking deadline. The OCC is now aiming for November, with a statutory fallback of January 18, 2027. The SEC’s proposed Regulation Crypto Assets is moving forward, but SEC Chair Paul Atkins has said himself that rules and exemptions won’t be durable without a law behind them.

None of this has slowed the institutions building the rails. The 21-bank dollar stablecoin venture, including Bank of America, Citi, Goldman Sachs, Santander, Deutsche Bank, UBS and MUFG, is still targeting H1 2027 and is being designed to comply with both GENIUS and MiCA. Mastercard has closed its roughly $1.8 billion acquisition of BVNK and now runs a Crypto Partner Program with more than 100 participants and stablecoin settlement across eight blockchains (The Block).

Why it matters: With no statute, the standards for stablecoin payments are being set by the issuers themselves. A bank-issued coin will come with bank-grade KYC, transaction monitoring and merchant-category screening built in. For merchants who used stablecoins to sit outside card-network monitoring, that workaround is closing, and the closure is coming from the product design rather than from Congress.

This is the pattern we flagged when the SEC started moving while Congress stalled. The agency writing the rules is moving first, and the infrastructure is moving faster than either.Read: The Payments Pulse: Every Rail Just Became a Liability SurfaceRead: The Payments Pulse: Infrastructure Is Moving Faster Than the Rules Meant to Govern It

3. London and Brussels Are Opening the Gates, and They Want Evidence

While the US stalls, the UK has a date. The FCA’s cryptoasset authorisation gateway opens on September 30. Firms relying on transitional provisions have until February 28, 2027 to apply, and the full regime goes live on October 25, 2027 (PaymentExpert). Policy Statement PS26/18 covers five activities, including issuing qualifying stablecoins and operating trading platforms. Existing registrations won’t convert automatically.

Two parts of the FCA’s guidance matter most for payments. Stablecoin-based payments must show “a clear benefit over more traditional payment methods”, particularly in settlement. And firms must show that their controls are embedded in day-to-day operations, with reliable evidence that they work. In the EU, DORA’s enforcement phase is underway, with supervisors in France and Spain already running IT examinations of payment and crypto firms (Mondaq).

Why it matters: European regulators aren’t asking whether a firm has a compliance policy. They’re asking for proof that the policy runs in production. Operational resilience, audit trails and routing logic are becoming things a firm has to show an examiner, not just describe in a document.

We have argued before that compliance is no longer a layer on top of the payments stack. It is becoming part of the stack. The FCA’s evidence standard is that argument written into regulation.Read: The Payments Pulse: Compliance Is Becoming the Infrastructure

4. Processor Liability Now Comes With Deadlines

Florida’s lawsuits against sweepstakes operators Stake.us and VGW still name Worldpay, Trustly, Praxis and Breeze Labs as defendants, and seek injunctions, disgorgement, restitution and civil penalties. Now a second state has set a date. Oklahoma’s SB 1589, passed after lawmakers overrode the governor’s veto, requires sweepstakes casino platforms to leave the state by November 1 (Gambling.com). In the UK, the Gambling Commission’s Section 116 reviews of BresBet and Bet St George continue, after both licences were suspended over suspected anti-money laundering and social responsibility failings.

The capital response points the same way. TabaPay’s $155 million raise is going towards buying Transact Bank NA, a federally chartered, FDIC-insured bank that will be renamed TabaBank NA when the deal closes in Q4. OpenPayd’s merger with MSB USA gives it 43 state money-transmitter licences ahead of its planned Nasdaq listing.

Why it matters: Processor liability is no longer a theoretical legal risk. It now comes with specific dates for offboarding merchants, geofencing states and reviewing portfolios. Companies that own a charter or a licence set will decide which high-risk merchants stay on the books. Everyone else has to prove, merchant by merchant and state by state, that they aren’t the next defendant.

For the background on how Florida’s case put processors in the caption, and why capital keeps concentrating around whoever owns the rails, see our earlier coverage.Read: The Payments Pulse: The Processor Is Now the DefendantRead: The Payments Pulse: Infrastructure Is Consolidating Around Whoever Owns the Rails

5. AI Is Mass-Producing Fake Identities. Fraud Defence Is Shifting to Signals and Agents.

On September 17, SEON expanded its signal library from more than 900 to more than 1,100 proprietary data signals, including address intelligence across 240+ countries, session behaviour, carrier data and device signals. It also connected its “AI Command Centre” to investigators’ AI tools through the Model Context Protocol (FinTech Global). The reason is simple. Generative AI can now create a convincing synthetic identity, complete with a consistent device history, in minutes. Each layer can look legitimate on its own, and the fraud only shows up when the layers are checked against each other. ACAMS research cited in the announcement found that three-quarters of anti-financial-crime professionals have named generative-AI misuse as their top emerging risk for three years in a row.

The cost is growing quickly. Deloitte projects generative-AI-enabled fraud losses in the US could reach $40 billion by 2027, up from $12.3 billion in 2023 (American Banker). Adoption is behind: only about 19% of finance teams use AI for audit, risk, compliance or fraud work (PaymentExpert). At the same time, legitimate AI agents are starting to pay. NPCI’s planned Unified Agent Protocol for UPI and Visa’s Agent Score both treat agent identity as something to verify, score and tokenise.

Why it matters: To a fraud model, a synthetic identity and an unregistered AI agent look much the same: activity that seems legitimate without a verified human behind it. Agent provenance and cross-layer identity signals are becoming routing inputs alongside BIN, geography and MCC. Platforms that can use those signals in real time will approve more good transactions and let fewer bad ones through.

We’ve tracked agentic commerce since it went live, and argued that trust itself is becoming a payments rail. This week’s signal-and-agent race continues that story.Read: The Payments Pulse: Agentic Commerce Is Live. Regulation Has a Deadline. Fraud Isn’t Waiting.Read: The Payments Pulse: Trust Is Becoming the Rail

The Bottom Line

Every story this week has the same shape. The rule-makers are late: the Supreme Court hasn’t acted, the CLARITY Act has failed, and GENIUS rules are overdue. The builders are on time: over $3 billion in Week 1 prediction-market volume, a 21-bank stablecoin, a bank charter bought outright, and 1,100 fraud signals. Where regulators have set dates, such as Oklahoma’s November 1 exit deadline and the FCA’s September 30 gateway, they are asking for evidence, not intentions.

For PSPs, acquirers and high-risk operators, this gap is where the risk is now. Waiting for legal clarity isn’t a strategy, because by the time it arrives the volume, the liability and the standards will already be set. The platforms that do well will be the ones that can prove, per transaction and per jurisdiction, that the rail they chose was the right one. That means treating regulatory status, agent identity, behavioural risk scores and enforcement deadlines as live routing inputs, not a quarterly review.

Want routing that keeps up with the rules, even when the rules don’t keep up with the market? Talk to Techtiq.