NewsFlash Articles Data Fundraising Skill&API

Coinbase Spent Ten Years Building Compliance, PayPal Undergoes Monthly Audits, Musk Granted a “Backdoor” to X Money

深潮TechFlow

Read this article in 16 Minutes

From announcing participation to dismantling the referee, only nine days were needed.

Original Title: "On the Eve of X Money Launch, Musk Takes Down the Referee First"

On February 7, 2025, four young people walked into a federal office building in Washington, D.C.

They belonged to DOGE, part of Elon Musk's "Government Efficiency Department." Their destination was the CFPB (Consumer Financial Protection Bureau) headquarters. This agency is responsible for regulating all digital payment products in the U.S., including Apple Pay, Venmo, Cash App, and the upcoming X Money.

According to Bloomberg, the DOGE team initially had only "read-only" access. But by Friday night, an email was sent by White House Office of Management and Budget Director Russell Vought requesting broader data access for DOGE. 90 minutes later, Vought was appointed as the Acting Director of the CFPB.

By Sunday, the CFPB had turned into a skeleton. Funds were frozen, activities were suspended, and nearly 90% of employees faced layoffs.

And just nine days ago, X had announced a partnership with Visa.

Nine days. From announcing participation to taking down the referee, it only took nine days.

Compliance Marathon vs. Nine-Day Blitz

In 2013, Coinbase registered with FinCEN as a money services business, becoming one of the first to proactively embrace federal regulation among crypto companies. At that time, Bitcoin was worth less than $200, and the total market capitalization of the entire industry was not enough to buy an apartment in Manhattan.

The next decade was a compliance marathon. Coinbase obtained money transmission licenses in 49 states and territories, with each state requiring a security deposit ranging from $1,000 to $500,000 and net worth thresholds ranging from $5,000 to $2 million.

Obtaining the BitLicense in New York was particularly grueling, requiring quarterly financial reports and annual independent audits. Coinbase's compliance framework revolved around three core pillars: regulatory registration, operational transparency, and active engagement with financial regulatory authorities, with the entire compliance framework covering over 100 countries.

But lawsuits still came. In 2023, the SEC sued Coinbase for "operating an unregistered security-based exchange." The company was forced into a protracted legal battle. The U.S. Court of Appeals for the Third Circuit ruled that the SEC "failed to adequately explain why it refused to formulate rules," marking a partial victory.

But what truly led to the dismissal of the lawsuit was the 2024 U.S. election. Coinbase and the cryptocurrency industry's Super PAC poured over $130 million to support the campaign, with Coinbase alone contributing $75 million. In February 2025, the newly appointed SEC Acting Chair, Mark Uyeda, dropped the lawsuit against Coinbase, unconditionally, with no fine, and unable to sue again on the same grounds.

Ten years of compliance, one lawsuit, $75 million in political donations. This was the price Coinbase paid to obtain the words "lawful operation."

PayPal took a different but equally expensive path. In August 2023, PayPal launched the stablecoin PYUSD, with the issuer being Paxos Trust Company regulated by the New York State Department of Financial Services. Following the requirements of the GENIUS Act (U.S. Stablecoin Regulatory Bill) for 100% reserve backing and monthly public attestations, PYUSD complied in full. Moreover, for each expansion to a new blockchain (from Ethereum to Solana and then to Stellar), regulatory approval from NYDFS was required. In December 2025, PayPal declared that PYUSD was the "largest federally approved dollar-backed stablecoin."

These are the rules. To enter the U.S. financial market, one must obtain licenses state by state, pass through each regulatory agency one by one. Coinbase spent ten years, PayPal spent hundreds of millions of dollars on compliance infrastructure.

X Payments LLC also obtained licenses. As of May 2025, it had secured money transmitter licenses in 40 states. On the surface, everything was compliant.

But the gap between formal compliance and substantive regulation is anything but small.

On November 21, 2024, the CFPB finalized a rule to subject large digital payment apps processing over 50 million transactions to federal oversight, similar to the regulation of traditional credit cards and bank accounts. This rule directly impacted X Money. Six days later, Musk tweeted a single phrase on X: "Delete CFPB."

Three months later, DOGE entered the CFPB's purview. Another three months, and the Senate voted to repeal the CFPB's digital payment regulation rule. On April 9, the House followed suit.

Coinbase spent ten years, $75 million, and a high-stakes lawsuit to prove its legitimacy within the regulatory framework. Yet Musk dismantled the framework itself with a single tweet in just nine days.

The Trump Card in Musk's Hand

Dismantling regulators was already outrageous. But the story has an even more absurd twist.

The CFPB is not a "guardian"; it holds data.

In 2021, the CFPB, to assess consumer protection risks of payment technologies, issued mandatory data orders to Amazon, Apple, Facebook, Google, PayPal, and Square (now Block).

These companies submitted a large amount of confidential business information, including product strategies, internal operational data, and compliance records. In the following years, the CFPB initiated investigations or enforcement actions against several of these companies, including PayPal and Cash App.

This data is still in the CFPB's database.

Meanwhile, the DOGE team gained access to the "entire non-public database," including sensitive bank examination reports and enforcement records.

According to Bloomberg, DOGE employees began accessing the system on the same day they entered the CFPB headquarters, without completing the required privacy, cybersecurity, and ethics training.

Seth Frotman, former CFPB chief legal officer, testified before Congress, saying, "Not only did they access information about consumers, but they also accessed information about competitors."

Erie Meyer, former CFPB chief technology officer, recalled that five young DOGE team members roamed around the secure executive suite, trying to access locked offices. She resigned the next day.

Think about what this means. A newcomer about to enter the payment market received full check-up reports on all major competitors before even opening for business. Product strategies, operational weaknesses, regulatory issues, undisclosed enforcement information.

Congresswoman Maxine Waters was more direct in the hearing: "In addition to acquiring the consumer data of millions of Americans, Musk can now illegally obtain sensitive business information from other American companies in the same industry."

Legal scholar Tim Wu described this type of data access as "god-tier," believing it provides a "huge competitive advantage" to companies in the same field of competition.

If a founder of a cryptocurrency exchange were to do the same thing, what would happen? SEC filing, FBI visit, CEO going to jail. This is not a hypothetical scenario; FTX's Sam Bankman-Fried was sentenced to 25 years for misappropriating customer funds.

The difference is: SBF committed a crime under the rules, while Musk operated above the rules.

The Backdoor of the GENIUS Act

If dismantling the CFPB is considered "break," then the GENIUS Act is "make." However, this "make" opened a backdoor.

The GENIUS Act is the U.S. stablecoin regulation bill signed by Trump, establishing the basic framework for stablecoin issuance, including reserve requirements, information disclosure, and regulatory jurisdiction.

But the issue lies with one clause.

Senator Elizabeth Warren pointed out in an open letter to Musk dated April 14, 2026: the GENIUS Act contains a "suspicious exemption clause" allowing private commercial companies like X to issue stablecoins without undergoing certain approval processes and safeguards required of public companies.

Warren's question is sharp: Did Musk or his representatives engage in lobbying or influencing the inclusion of this exemption clause? Because during the drafting and debate period of the GENIUS Act, Musk was serving as a senior advisor to the president, leading DOGE at the same time.

In other words, someone soon to issue a stablecoin sat in the seat of a rulemaker while a favorable exemption clause for stablecoins was being written into the stablecoin bill.

Contrast this with PayPal's PYUSD. Issued by Paxos, fully regulated by the New York Department of Financial Services, requiring 100% reserve backing, and undergoing monthly third-party audit proofs, with each chain extension needing approval. However, the draft of the CLARITY Act considers banning "holding payment-type stablecoins" from earning rewards, directly targeting PYUSD's 4% reward program.

And what about X Money? Claiming a 6% APY on deposits, with the partnering bank being Cross River Bank, which has previously been fined by the FDIC. Warren questioned in the letter: "In an environment where the federal funds rate is 3.5%-3.75%, how does X Money and Cross River intend to pay a 6% interest rate? Is it through high-risk investments, invasive data monetization, or just a gimmick?"

FDIC Chairman Travis Hill already made it clear in March: Under the GENIUS Act framework, stablecoin users' deposits are not covered by FDIC insurance.

PayPal spent two years becoming GENIUS Act compliant, providing proof every month, awaiting approval for every chain, and X Money, even before its launch, has been given a specially carved out fast track. This is unfair competition.

The Weight of Regulation

In April 2026, X Money entered early access. With 600 million monthly active users, partnering with Visa, offering a 6% APY, and without CFPB federal oversight.

In the same month, Coinbase just received conditional approval from the OCC, preparing to establish the Coinbase National Trust Company. From FinCEN registration in 2013 to obtaining a national trust company charter in 2026, a full thirteen years.

Also in April, the CLARITY Act in the Senate has a 50-50 chance of passing.

The regulatory narrative of the past decade in the crypto industry can be summarized in one sentence: Give us the rules, and we will comply. The premise of this statement is that the rules apply equally to everyone.

But when someone can simultaneously create backdoors for their own company, dismantle the enforcement agencies, and use competitors' confidential data to prepare for launch, how much weight do these "rules" still hold?

Warren's deadline for Musk's response is April 21st. As of the time of writing, Musk has not publicly responded.

Meanwhile, X Money has already gone live.