The Stablecoin Issuance Stack

Prerequisite: Tokenized Finance

Your company wants to issue a dollar-backed stablecoin. You have the banking relationship, the compliance programme, and the demand. You do not have a mint authority architecture, a reserve custody framework, a distribution network, or a sanctions-screening layer that operates at blockchain speed. Building each of these from scratch takes 18–24 months and requires expertise that does not overlap. The issuance stack exists because no single team owns every layer, and getting any layer wrong — unbacked mints, unscreened transfers, missing attestations — creates regulatory exposure measured in licence revocations and enforcement actions, not bug tickets.

Four Layers, Four Owners

A stablecoin issuance stack has four layers. Each layer can be built in-house, licensed from a vendor, or delegated to a partner. The architectural decision is not which technology to use at each layer — it is which entity owns each layer and bears the liability when it fails.

Layer	Function	Failure mode
Reserve management	Hold and invest backing assets	Unbacked tokens in circulation
Mint/burn contracts	Create and destroy token supply	Unauthorized minting, supply/reserve divergence
Distribution	Move tokens to end users	Liquidity fragmentation, poor on/off-ramp coverage
Compliance wrapper	Screen and restrict transfers	Sanctioned party receives tokens, regulatory action

The layers are ordered by trust dependency. Distribution depends on compliance (you cannot distribute tokens to screened-out addresses). Mint/burn depends on reserve management (you cannot mint without verified backing). Every layer above trusts every layer below.

Layer 1: Reserve Management

The reserve layer holds the dollars that back each token in circulation. Every token that exists on-chain must correspond to dollars held in custody. The reserve composition determines the stablecoin’s risk profile, yield potential, and regulatory treatment.

Asset class	Yield (approx.)	Liquidity	Regulatory treatment
Cash at FDIC-insured banks	4.5–5.0% (fed funds rate)	Immediate	Most conservative; FDIC coverage up to $250K per bank
US Treasury bills (< 90 days)	4.3–4.8%	T+1 settlement	Accepted by most regulators; Circle holds ~75% in T-bills
Overnight reverse repo	4.5–5.0%	Overnight	Used by Circle via BlackRock-managed fund
Money market funds	4.3–5.0%	T+0 to T+1	BlackRock’s BUIDL fund tokenizes this layer directly

Circle’s reserve portfolio, disclosed in its S-1 filing, holds approximately $28B in US Treasury securities managed by BlackRock and $8B in cash at regulated financial institutions. The reserve composition is not a technical decision — it is a regulatory and yield optimization decision that determines how much revenue the issuance operation generates.

Custody arrangements matter. The reserve custodian is typically a qualified custodian — a bank or trust company regulated by a federal or state banking authority. BNY Mellon custodies for Circle. The custodian provides segregation (reserves are not commingled with the issuer’s operating funds), attestation support (the custodian confirms balances to the attestation firm), and bankruptcy remoteness (reserves are not part of the issuer’s estate if the issuer fails).

If the issuer’s reserves are commingled with operating capital, a bankruptcy filing freezes both. Segregation at the custodian level is not optional — it is the structural guarantee that token holders can redeem regardless of the issuer’s financial condition.

Layer 2: Mint/Burn Contracts

The mint/burn layer creates new tokens when reserves are deposited and destroys tokens when reserves are withdrawn. The contract enforces supply constraints — who can mint, how much, and under what conditions.

The authorization hierarchy follows a three-tier pattern established by Circle’s FiatTokenV2:

// Simplified authorization hierarchy
contract MintAuthority {
    address public admin;           // can add/remove controllers
    mapping(address => address) public controllers; // controller → minter
    mapping(address => uint256) public minterAllowance;

    function mint(address to, uint256 amount) external {
        require(minterAllowance[msg.sender] >= amount);
        minterAllowance[msg.sender] -= amount;
        _mint(to, amount);
    }
}

The admin controls which controllers exist. Controllers control which minters exist and set their allowances. Minters execute mints up to their allowance. Compromising a minter yields access up to its allowance ceiling. Compromising the admin yields control of the entire supply.

Circle operates approximately 10 minter addresses across chains, each with per-transaction and daily aggregate limits. No single minter can create more than its allowance in a 24-hour period. The aggregate of all minter allowances is bounded by the reserve verification pipeline — minting cannot proceed without confirmed reserve receipt.

The burn path is the reverse. A token holder sends tokens to the issuer’s burn address or calls a burn function. The contract destroys the tokens and emits an event. A separate off-chain process initiates the reserve release — wire transfer, ACH, or bank transfer to the redeemer. The gap between on-chain burn and off-chain reserve release is typically 1–3 business days for Circle, driven by banking settlement times.

See Mint/Burn Infrastructure. The grimoire’s smart contract chapter covers the engineering of the mint/burn contracts in depth — authorization patterns, rate limiting, supply accounting, and upgrade mechanisms.

Layer 3: Distribution

The distribution layer moves tokens from the issuer to end users. This is not a single channel — it is a network of exchanges, wallets, on/off-ramps, and market makers that provide liquidity across chains and geographies.

Channel	Function	Volume share (USDC, approx.)
Centralized exchanges	Fiat-to-stablecoin conversion, trading pairs	40–50%
DeFi protocols	Lending, liquidity pools, yield	25–35%
OTC desks	Large-block minting/redemption for institutions	10–15%
On/off-ramps	Embedded fiat conversion in apps (MoonPay, Transak)	5–10%
Direct mint/redeem	API access for qualified partners	5–10%

Direct mint/redeem access is reserved for a small number of verified partners. Circle’s Circle Mint platform requires onboarding, KYC/KYB verification, and minimum transaction sizes (typically $100K+). Partners submit a mint request, wire dollars to Circle’s reserve account, and receive USDC once the wire settles. The process takes hours to days, not seconds.

The distribution challenge is multi-chain liquidity. USDC exists on Ethereum, Solana, Arbitrum, Base, Polygon, Avalanche, and several other chains. Each chain has its own liquidity pool, and tokens on one chain are not fungible with tokens on another without a bridge or a burn-and-mint mechanism. Circle’s Cross-Chain Transfer Protocol (CCTP) addresses this with native burn-and-mint: burn USDC on the source chain, present the attestation on the destination chain, and mint fresh USDC. No wrapped tokens, no bridge liquidity pools.

Layer 4: Compliance Wrapper

The compliance layer enforces regulatory requirements at the token level. Every transfer can be screened, every address can be frozen, and every sanctioned entity can be blocked — on-chain, in the token contract itself.

function transfer(address to, uint256 amount) public returns (bool) {
    require(!frozen[msg.sender], "sender frozen");
    require(!frozen[to], "recipient frozen");
    require(!blacklisted[msg.sender], "sender blacklisted");
    require(!blacklisted[to], "recipient blacklisted");
    return super.transfer(to, amount);
}

Circle has frozen approximately $12M in USDC across sanctioned addresses as of mid-2025. OFAC designations trigger a freeze within hours. The compliance team receives the SDN (Specially Designated Nationals) list update, identifies on-chain addresses associated with the designated party, and calls the freeze function. The frozen tokens cannot be transferred — they are locked in the address until OFAC removes the designation or Circle receives a licence to unblock them.

The compliance layer also handles law enforcement requests, court orders, and voluntary freezes for suspected fraud. Each action leaves an on-chain record (the freeze/unfreeze events) and an off-chain audit trail (the legal basis for the action, the internal approval, the OFAC reference).

A stablecoin without a compliance wrapper is a stablecoin that cannot operate in regulated jurisdictions. The freeze and blacklist capabilities are not optional features — they are regulatory prerequisites for money transmission licences in every major market.

Vertical Integration vs Platform

Two models dominate: build the entire stack yourself, or provide the stack as infrastructure for others.

Circle’s vertically integrated model. Circle owns every layer. It manages reserves (via BlackRock), operates the mint/burn contracts, runs Circle Mint for distribution, and enforces compliance through its own legal and compliance teams. Circle holds state money transmitter licences across the US, an EMI licence in the EU, and equivalent authorizations in other jurisdictions. Revenue comes from reserve yield — at $36B in circulation and a 4.5% blended yield, reserve income is approximately $1.6B annually.

Bridge’s platform model. Bridge (acquired by Stripe for $1.1B) provides issuance-as-a-service. A company wanting to issue a stablecoin uses Bridge’s infrastructure for the mint/burn contracts and reserve management while maintaining its own compliance programme and distribution channels. The issuer holds the regulatory licence. Bridge provides the technology. This model enables companies like Stripe to offer stablecoin-denominated products without building the issuance infrastructure from scratch.

Paxos as infrastructure. Paxos operates the reserve management and mint/burn infrastructure for PYUSD (PayPal’s stablecoin), BUSD (Binance’s former stablecoin), and its own Pax Dollar. PayPal handles distribution and compliance through its existing network of 400M+ accounts. Paxos handles reserves and minting under its New York trust charter. The split is clean: Paxos bears the reserve risk, PayPal bears the compliance and distribution risk.

M0’s protocol model. M0 takes a different approach — a decentralized issuance protocol where multiple independent minters can issue tokens against verified reserves. Each minter is separately regulated and maintains its own reserve custody. The M0 protocol coordinates supply across minters and enforces the aggregate reserve requirement. This is the most modular architecture: reserve management, minting, and compliance are all independent per minter, with the protocol providing only coordination.

Model	Reserve owner	Mint operator	Compliance	Distribution
Circle (vertical)	Circle	Circle	Circle	Circle + partners
Bridge (platform)	Issuer via Bridge	Bridge	Issuer	Issuer
Paxos (infra)	Paxos	Paxos	Brand partner	Brand partner
M0 (protocol)	Each minter	Each minter via protocol	Each minter	Protocol-level

Regulatory Ownership

The entity that holds the money transmission licence or trust charter bears the regulatory burden. This entity is responsible for reserve adequacy, SAR filing, sanctions compliance, and examination readiness. When the stack is split across entities, the regulatory boundary must be clearly defined.

In the Paxos/PayPal model, Paxos holds the New York Department of Financial Services trust charter and is the legal issuer of PYUSD. PayPal distributes PYUSD through its platform under its own money transmission licences. If the reserves are mismanaged, NYDFS examines Paxos. If a sanctioned party receives PYUSD through PayPal’s platform, both entities face regulatory scrutiny — Paxos for the token-level controls and PayPal for the distribution-level screening.

The principal-agent distinction matters for liability. If Bridge issues tokens on behalf of a client, is Bridge the principal (the issuer, bearing full regulatory responsibility) or the agent (providing technology, with the client bearing responsibility)? The answer determines licence requirements, capital requirements, and examination scope. Most platform models resolve this by requiring the client to hold their own licence and treating the platform as a technology vendor, not a financial services provider.

Economics of the Stack

Reserve yield is the dominant revenue source. A stablecoin with $10B in circulation at a 4.5% blended reserve yield generates $450M in annual revenue before operating costs. Operating costs — custody fees, compliance staff, technology infrastructure, audit and attestation — typically consume 15–25% of reserve yield for a mature issuer.

Circulation	Reserve yield (4.5%)	Operating cost (20%)	Net revenue
$1B	$45M	$9M	$36M
$10B	$450M	$90M	$360M
$36B (USDC)	$1.62B	$324M	$1.3B
$140B (USDT)	$6.3B	$1.26B	$5.0B

In platform models, revenue sharing splits the reserve yield between the infrastructure provider and the issuer. Bridge and Paxos negotiate these splits per client. A typical arrangement allocates 70–80% of reserve yield to the entity providing the reserves (or the entity bearing the regulatory burden) and 20–30% to the technology provider. As circulation grows, the technology provider’s share represents significant revenue on a marginal-cost basis — the infrastructure cost of minting the 10 billionth token is identical to the first.