The U.S. Senate failed to advance the CLARITY Act on Sept. 15, leaving the country once again without a comprehensive federal framework for digital assets — and two days later, the SEC filled part of the gap with an "innovation exemption" permitting certain venues to trade tokenized U.S.-listed stocks onchain. The contrast is the story. An exemption is not a statute, and it can be narrowed or withdrawn as easily as it was granted.

That leaves financial firms with a practical question: what do you build while you wait? For advisors, the answer matters more than who won or lost in Washington, and it ran through a Crain's New York Business event last week covering tokenization, compliance and cybersecurity. The people closest to the work are not waiting for Congress. They are building for the world as it is.

What does the patchwork actually cost?

Adam Schumann, vice president of legal at OKX, laid out the structural problem. U.S. firms answer to federal statutes, federal agencies, state laws and state regulators, and none of them move at the same speed. "You want general consistency, but you're not going to reach uniformity," he said. Firms work out the remainder state by state and country by country, while agencies patch the most immediate gaps.

That duplication carries a measurable operational weight. Aravind Raju, CFO of Uphold, said compliance is now one of the company's largest departments because it builds tailored solutions for each state's requirements. As rules become clearer and more aligned, he expects those resources can be redirected. The takeaway for advisors: compliance is a real cost of doing business on these platforms, and the firms that manage it well will hold an edge.

The expectation that such duplication would push institutions toward shared infrastructure has not held. Many launched private, closed networks this year for tokenized assets, stablecoins and securities ledgers — and those networks cannot easily talk to one another. Lewis Tuff, CEO of Twilight, which builds clearing and settlement technology, said the result is that every firm ends up rebuilding the same connections.

How is market structure shifting underneath?

Risk is moving in the opposite direction, toward separation. Early crypto firms bundled trading, custody and clearing under one roof. Today, traditional custodians hold digital assets, and the venues that execute trades are increasingly separate from the ones that safeguard them. No single entity has to hold every key function or become a single point of failure.

Compliance and security are shifting in parallel — from annual attestations and periodic reviews to checks that run continuously, with every transaction. None of this required Congress, and that is the point. Without a comprehensive framework, the industry is converging on practices any future law would find hard to ignore: verified counterparties, clear lines between trading and custody, and compliance that never stops running.

Whether these practices become a bridge to legislation or a substitute for it remains open, but the direction is clear. Raju offered one prediction. Within three years, he said, "we'll probably stop using the word 'crypto' as tokenized Treasuries and money funds become routine." If he is right, the infrastructure being built now, without a statute to guide it, will matter well beyond this cycle.

How should advisors vet tokenized platforms?

Diego Grassano, commercial director at Shyft and chief product officer at Lumia, flags the core risk of temporary permissions: committing long-term capital to infrastructure that may only have provisional authority to operate. He wants clear ownership rights, segregated custody and a tested exit route that allows investors to recover their assets.

On bridging siloed, private blockchains, Grassano recommends keeping the legally recognized ownership record on the original chain and allowing backed, redeemable representations to circulate elsewhere, with eligibility and transfer restrictions enforced on both networks. Bridges are improving, in his view, but still carry real security and operational risks.

His due diligence checklist for advisors starts with two questions: what does my client actually own, and how do they get their money back? Then verify who holds the assets, who independently verifies the numbers and what happens if the platform fails. Fees, conflicts and withdrawal restrictions deserve close scrutiny. His closing standard is unforgiving: if an advisor cannot clearly explain the ownership structure, the risks and the recovery process to a client, the due diligence is not finished.

The SEC's innovation exemption remains revocable at will, which makes the next legislative window — and any committee movement on the CLARITY Act — the benchmark to watch before institutions commit permanent capital.