Stablecoin clawback: a US bank just shipped a dollar it can take back

What U.S. Bank announced on September 9, 2026

The facts, as published by U.S. Bank and covered the same week by crypto.news. U.S. Bank — the fifth-largest commercial bank in the United States — completed a live pilot payment using USBDC, a proprietary US dollar-backed stablecoin it describes as "one of the first bank-issued stablecoins deployed on a public blockchain." Real value moved between U.S. Bank entities in North America and Europe. The bank published the issuer address it used.

Two details are worth slowing down on.

The first is the venue. The bank did not spin up a permissioned chain for this. It used public Stellar, citing global reach, near-instant settlement and transaction costs under a cent. That is a meaningful choice from an institution whose default instinct for two decades has been to build a walled garden. Stellar Development Foundation CEO Denelle Dixon framed it as a regulated institution using open architecture for compliant cross-border settlement, which is exactly the trade being made: public rails, private controls.

The second is the test list. The pilot evaluated "minting, payment redemption, freezing and clawback capabilities," all routed through the bank's internally developed Digital Asset Platform, which the bank says "serves as the foundation for issuing, managing and moving tokenized assets and enables seamless interaction between traditional banking infrastructure and blockchain networks." CEO Gunjan Kedia's line was about speed — "this live pilot demonstrates our ability to accelerate global cash management and money movement capabilities." Jamie Walker, who runs Digital Assets and Money Movement, framed the goal as "solving real client challenges while maintaining the safety, security and reliability that clients expect from U.S. Bank."

Read those two quotes next to the test list and the product thesis is legible. The bank wants the speed of a public chain and the reversibility of a bank ledger, in the same asset. Minting and redemption are the plumbing. Freeze and clawback are the reason a bank's risk committee signed off.

The caveats are real and the bank states them. USBDC is an internal pilot, not a public stablecoin. It is aimed at internal settlement and treasury operations, not retail customers. There is no announced commercial launch date, no circulation target, and no published comparison of cost or speed against the bank's existing cross-border systems. Nobody is going to pay for coffee in USBDC this year. That is not what makes it worth writing about.

What clawback actually does on-chain

"Clawback" sounds like a legal process. On Stellar it is a single operation, and the mechanics matter more than the word.

The capability arrived in protocol 17 through CAP-0035, Asset Clawback. It gives an asset issuer the ability to burn a specified amount of a clawback-enabled asset directly from a holder's trustline, or from a claimable balance. The tokens are destroyed rather than transferred, and the issuer is free to reissue the same value to a different account afterward — which, from the perspective of whoever lost the balance, is a transfer with extra steps.

The setup has a shape worth understanding, because it determines who is exposed:

• The issuer sets AUTH_CLAWBACK_ENABLED_FLAG on its own account. It must also set AUTH_REVOCABLE_FLAG — the two go together, so the issuer can pull a balance out of open offers before clawing it back.
• The flag has to be set before a holder's trustline is created. Every trustline opened after that inherits TRUSTLINE_CLAWBACK_ENABLED_FLAG. Claimable balances inherit it from the creating account.
• The issuer then calls ClawbackOp or ClawbackClaimableBalanceOp. The holder does not sign. The holder is not asked.
• Only the issuer can waive it, by clearing the flag on a specific trustline. It is not a setting the person holding the money can turn off.

The design intent is documented and legitimate: CAP-35 was co-authored with securities tokenization in mind, because many jurisdictions require an issuer or transfer agent to be able to revoke an asset after a mistaken or fraudulent transfer — explicitly "with or without the affected person's permission." It also cleanly beats the older workaround of freezing a trustline, which leaves the tokens in circulation and wrecks the issuer's accounting.

That is a good feature for a tokenized bond. It is a different proposition when the asset is a dollar you accepted in exchange for goods you already handed over.

Freeze and clawback are not the same thing — and USDC and USDT are not innocent

It would be easy, and wrong, to draw this as bank dollars bad, crypto dollars pure. Both major stablecoins ship with issuer controls, and merchants should know that before anyone sells them a fantasy.

Circle can blacklist USDC addresses. Tether can freeze USDT addresses. Both have done it, usually at the request of law enforcement or a court, usually against sanctioned entities or stolen funds. Tether's original Ethereum contract goes further and pairs its blacklist with a function that destroys blacklisted balances outright. Anyone telling you a mainstream fiat-backed stablecoin is censorship-proof is selling something.

So the distinction is not "controls versus no controls." It is what kind of control, exercised by whom, under what standard:

• A freeze stops a specific address from moving a token. The balance stays where it is. It is visible, it is a blunt instrument, and it is normally reserved for addresses tied to crime or sanctions.
• A clawback reduces the balance to zero and lets the issuer put that value somewhere else. It is designed to be routine — a correction tool, not an emergency one. U.S. Bank's own framing includes reversing a transfer sent to an incorrect address.

That last sentence is the whole story for a business. A correction tool that can be used for a mistyped address is, structurally, a tool that can be used for a disputed one. The card industry has a name for a routine, issuer-initiated reversal of a settled payment. It is called a chargeback, and the reason merchants have spent fifteen years looking for an alternative is not that reversals are evil — it is that the merchant does not get a vote.

Why a treasury pilot matters to a business that sells things

USBDC is internal today. The reason to pay attention is that it is a template, and the templates being drawn right now are the ones retail stablecoins will be built from.

Look at what else is on the calendar. A consortium of 21 of the world's largest banks — Bank of America, Citi, Goldman Sachs, UBS among them — plans a dollar stablecoin for the first half of 2027, with other G7 currencies to follow. Thirty-nine US state banking associations announced a shared blockchain for bank-issued tokens targeting 2027. Coinbase and Moov are wiring stablecoin acceptance into more than a thousand community banks. The banking system is not deciding whether to issue digital dollars. It is deciding what they will be able to do.

Every one of those issuers faces the same risk committee that U.S. Bank faced, and will reach for the same answer. Freeze and clawback are not exotic; they are the price of a compliance sign-off. Expect them in most bank-issued tokens, on whichever chain supports them.

Which means the merchant question changes shape. For the last few years, "are stablecoin payments final?" had a clean answer: yes, because on-chain settlement is final and nobody can reverse it after the fact. In a world of many issuers with many control surfaces, finality stops being a property of crypto and becomes a property of which dollar you took. That is a worse world to operate in, and pretending otherwise does nobody any favors.

The good news is that it is still a far better position than card rails, and the reason is arithmetic. On card rails, reversibility is universal, automatic and adversarial: any settled sale can be pulled back for roughly 120 days, by a process you do not control, on evidence you usually cannot see. Under an issuer-control regime, a reversal requires a specific issuer to take a specific, public, on-chain action against a specific address, under a policy it has to defend. Those are not the same risk. One is a cost of doing business. The other is an exception.

The two questions worth asking about any dollar you accept

Strip the news down and a merchant has exactly two levers. Everything else is noise.

Question one: what is the token? Who issues it, what backs it, how many redemption hops sit between the token and bank money, and what controls the issuer holds. A token whose issuer has a documented, narrow, law-enforcement-driven freeze policy is a different asset from a token whose issuer wrote clawback into the contract as a routine correction tool. You do not need a legal opinion to make this call. You need a policy: a short list of dollars you accept, and a default you convert into.

Question two: who holds the money between your customer and you? This is the one almost everybody skips, and it is the bigger exposure. A custodial processor takes the customer's payment into its account, holds a balance in your name, and pays you out later on its schedule. In that model the token's properties barely matter, because a second party with full discretion now sits on top of them. It can hold funds for review. It can impose a rolling reserve. It can freeze your account for a policy change you were not consulted about. No clawback required.

Nobody can hand you a dollar that no issuer on earth can ever touch. But the second risk is entirely removable, and removing it is a decision you can make this week.

How Payzum answers the second question

Payzum is a non-custodial, crypto-only payment processor. The distinction is not marketing; it is the architecture. When a customer pays, the funds go directly to a wallet you control. Payzum never takes custody, never pools merchant funds, never holds a balance in your name. There is no Payzum account containing your money, because there is no point in the flow where your money is ours. The settlement is the payment.

What that gives you, concretely, against the risks in this article:

• No processor-level reversal. We cannot claw back a payment because we never held it. There is no balance to freeze, no reserve to withhold, no payout schedule to slip.
• No chargebacks. An on-chain payment confirmed to your wallet is final. There is no 120-day window and no acquirer arbitration.
• You choose the dollar. Accept the stablecoins your customers actually hold, with optional auto-conversion to USDC or USDT so you end the day in the asset you decided to hold — not the one that happened to walk in.
• You choose the rails. Bitcoin, Ethereum, Solana, Polygon, Base, Arbitrum, Optimism, BNB Chain and Avalanche. Typical confirmations: Solana around 0.4 seconds, Base and Polygon around 2 seconds.
• Counterparty risk is scoped to the issuer. If a token you hold ever becomes a question, it is one question about one issuer — not a question about your processor, your acquirer and your issuer stacked on top of each other.

To be straight with you about the limit: non-custodial settlement does not override an issuer's on-chain powers. If an issuer can freeze a token, that remains true in your wallet exactly as it would in anyone's. What non-custodial settlement removes is every additional party who could have stopped, held or reversed the money on its way to you. That is the part a payment processor actually controls, and it is the part we have engineered away.

How it works, step by step

1. Connect your wallet. You bring the wallet — self-custody, hardware, multisig, whatever your treasury policy requires. Payzum settles into it. We never hold the keys.
2. Set your asset policy. Pick which networks and which stablecoins you accept, and whether incoming payments auto-convert to USDC or USDT. This is where the first question in this article gets answered once, at the account level, instead of at every checkout.
3. Turn on the way you charge. Online: hosted checkout, payment links and buttons, a drop-in plugin, invoices with expiry and overpayment detection, or recurring subscriptions. In person: POS with a fresh QR per sale, physical terminals, PIN-protected cashier accounts and per-cashier analytics. For APIs: x402, so AI agents pay USDC on Base per call.
4. Get paid and reconcile. The customer pays, the chain confirms in seconds, the funds land in your wallet. Signed webhooks and a REST API push confirmations into your systems; the audit log, 2FA and encrypted secrets cover the operational side.

Where this shows up in real businesses

Three situations where the difference between "final" and "reversible" is not academic.

• A component exporter invoicing a European buyer. Today the payment crosses a correspondent chain, arrives in two or three days minus FX, and can still be recalled. Invoiced in USDC on Base, it confirms in seconds into the exporter's own wallet, and production starts the same afternoon instead of Thursday. The finance team is not waiting on a bank to tell it the money is real.
• A high-ticket retailer taking payment across the counter. A €3,000 sale on a card carries a reversal window that outlives the warranty on some of the stock. The same sale taken by QR on a phone confirms on-chain, auto-converts to USDT, and settles to the owner's wallet before the customer leaves. No acquirer, no interchange, no dispute six weeks later on goods already carried out the door.
• An API provider selling to AI agents. Agents have no cards and no signup flow. With Payzum's x402 middleware the provider configures an existing endpoint, a bearer key and a price in a dashboard; Payzum publishes the x402 URL, returns the 402, settles through an external facilitator, and proxies the paid call through to the real endpoint. No protocol to implement, and the USDC lands in the provider's wallet per call.

Reversibility compared: bank rails, custodial processors, Payzum

Fair objections

"If USDC can be frozen too, what have I actually gained?"

You have removed every reversal path except one, and you have made the remaining one legible. Today a settled card sale can be taken back by a cardholder dispute, an issuing bank, an acquirer's risk team or a processor's compliance hold — four doors, three of which open without telling you first. Non-custodial stablecoin settlement leaves a single door, controlled by a named issuer acting on-chain in public. For the overwhelming majority of legitimate businesses, that door never opens. The other four open all the time.

"Isn't a bank-issued stablecoin safer than a crypto-native one?"

Different risks, not strictly fewer. A regulated bank issuer brings real balance-sheet strength and supervision. It also brings a control surface designed around the bank's obligations, which are not your obligations. Neither fact is disqualifying — the point of this article is that "safer" is a question you should answer per issuer, with the controls on the table, instead of inheriting whatever token your processor happens to support.

"This is a treasury pilot. Isn't it early to care?"

Caring costs you nothing today. The decisions that matter — which dollars you accept, which wallet they land in, whether a third party holds your money in between — are decisions you can make now, and they get harder to change once a processor has your volume. By the time bank-issued dollars reach consumers, the businesses already settling non-custodially will simply add or decline an issuer. Everyone else will be renegotiating a contract.