The Wharton Blockchain and Digital Asset Project spent two reports building the most complete map of the stablecoin world that currently exists. Part I (January 2026) established that stablecoins are not one asset class but four distinct stabilization mechanisms wearing the same name. Part II (August 2026) established that the world's regulators have converged on exactly one of those four, and that the gap between the regulatory perimeter and the market as it actually exists "generates both regulatory-arbitrage risk and persistent shortfalls in consumer and systemic protection."
Both reports are right, and both stop one layer short. Market structure is the first layer. Law is the second. The third layer is assurance: for each mechanism in Wharton's taxonomy, what can an independent practitioner actually verify, under what professional standard, and what happens to the mechanisms where the answer is nothing?
I maintain a registry of every independent assurance document over offchain-backed tokens that I can verify against a real report: 128 records as of this writing, 88 of them verified to a directly linkable practitioner document, spanning stablecoin reserve attestations, tokenized fund audits, commodity token examinations, and exchange proof-of-reserves engagements. Overlay that dataset on Wharton's four mechanisms and the finding is stark. The assurance market has converged on precisely the same narrow core as the regulators. Everything outside it runs on cryptography and trust.
Wharton's Four Mechanisms, Restated as Assurance Problems
Part I classifies stabilization into four mechanisms: off-chain fully-collateralized, programmatic overcollateralized, supply-based algorithmic, and synthetic hedged. Each one is, from a practitioner's chair, a completely different engagement.
1. Off-Chain Fully-Collateralized: The Only Mature Assurance Market
This is the custodial model: USDC, USDT, PYUSD, FDUSD, GUSD, and the rest of what Part II calls the "regulated core," a fiat-referenced token, redeemable at par, fully backed by segregated high-quality liquid reserves, issued by a licensed entity.
It is the only category with a functioning assurance supply chain, and the registry quantifies it. Of the 88 verified records, essentially all of the stablecoin records attach to this mechanism: 32 USDC examination reports under AT-C 205 (Deloitte, and Grant Thornton before them), 18 Tether engagements across three practitioners and three engagement types, monthly BPM examinations for GUSD, KPMG redemption asset reports for the Paxos family, Prescient for FDUSD, Crowe for USD1. The adjacent asset classes tell the same story: PwC audits Franklin's onchain fund, EY audits WisdomTree's, BDO Italia signs quarterly opinions on Tether Gold's vault holdings.
But "mature" does not mean uniform, and this is where the Toolkit's market-level view compresses something practitioners cannot afford to compress. Within this single mechanism, the assurance spread runs from a monthly PCAOB-registered examination with an affirmative opinion (the GENIUS Act standard, which Circle has met for years) down to quarterly agreed-upon-procedures-style reports that express no opinion at all. Both get called "attestations" in press coverage. They are not the same product. An examination opinion says the practitioner tested the assertion and concluded it is fairly stated. An AUP report says the practitioner performed the procedures management asked for and here is what was found. The distance between those two sentences is the distance Part II is pointing at when it notes that reserve composition, redemption design, and custody architecture are "the very features that determine their treatment under law."
The GENIUS Act closes that spread by statute for US payment stablecoins in November 2026: monthly, PCAOB-registered, examination-level, with CEO and CFO certification under criminal penalty. Inside the core, assurance is about to stop being a differentiator and start being a floor.
2. Programmatic Overcollateralized: Cryptographic Transparency, Zero Practitioners
DAI/USDS and its descendants hold collateral onchain, visible to anyone with a block explorer. Wharton correctly notes these designs "do not depend on traditional banks and central banks." They also do not depend on accountants, and the registry reflects that: zero verified practitioner reports exist for this entire mechanism. Not few. Zero.
The standard response is that they do not need attestation because the chain is the attestation. That answer is half right, and the half that is wrong is the half that matters. Onchain visibility answers the existence question completely: the collateral is there, block by block. It answers nothing else an assurance engagement answers. Who controls the keys, and would a court agree (the "control" concept Part II traces through UCC Article 12 and the UK Property Act 2025)? Is the collateral encumbered elsewhere? Are the oracles pricing the collateral manipulable at the moment it matters? And critically: as these protocols allocate reserves into tokenized treasuries and real-world assets, the collateral quietly walks off the chain, and the transparency argument walks off with it. A protocol whose balance sheet is one-third RWA has one-third of a custodial stablecoin's assurance problem and none of a custodial stablecoin's assurance habits.
There is a real engagement type waiting to be standardized here: control attestations over vault governance, SOC-style reports on oracle infrastructure, and examinations of the offchain slice of the balance sheet. Nobody performs them today because no framework requires them and no criteria exist to examine against.
3. Supply-Based Algorithmic: Nothing to Attest
The honest entry in the taxonomy. A supply-based algorithmic stablecoin makes no asset-backing claim, so there is no assertion for a practitioner to test. Its solvency is reflexive, which is a polite way of describing the mechanism that took Terra from $18 billion to zero in a week. Assurance is structurally impossible, which is itself decision-useful information: any framework that maps assurance obligations onto stablecoin categories, as the GENIUS Act now does, implicitly declares this category unbankable within the perimeter. Part II reaches the same place through law; the assurance lens gets there faster.
4. Synthetic Hedged: The Hardest Engagement Nobody Has Defined
The synthetic dollar model (Ethena's USDe is the flagship; Part I notes it deliberately avoids the word stablecoin) backs its peg with a delta-neutral position: long collateral, short perpetual futures. Its assurance surface is genuinely novel, because the claim is not "assets exceed liabilities at the reserve custodian." The claim is "a derivatives overlay across multiple exchange counterparties will hold the peg through funding regime changes."
Pieces of that claim are attestable with existing tools: custodian holdings can be examined, counterparty exposure can be confirmed, and monthly custodian attestations for this design do exist in the wild. But no attestation standard speaks to hedge effectiveness on a forward basis, and no report I can locate and verify covers the consolidated position across custody, exchange margin, and open interest at a single timestamp. The registry holds no verified record for this mechanism. Everything the market knows about the largest synthetic dollar's backing, it knows from dashboards the issuer controls.
If assurance for mechanism one is a solved problem and mechanism two is an unstarted problem, mechanism four is an unsolved one: the profession would need criteria that blend reserve examination with something closer to a derivatives risk attestation, and nobody has written them.
The Perimeter Lesson From Exchange Proof of Reserves
Part II's sharpest observation is that the regulated core "does not describe the entire market," and that the residual operates outside consumer and systemic protection. The registry contains a natural experiment showing what happens in that residual when assurance is voluntary: exchange proof of reserves.
After FTX collapsed in November 2022, exchanges sprinted to practitioners. Mazars produced agreed-upon-procedures reports for Binance and Crypto.com within weeks; Armanino had been examining Kraken and Gate.io since 2020. Then, in a single week of December 2022, Mazars suspended its entire crypto practice and pulled its reports offline, and Armanino exited the space (its crypto team survives as The Network Firm). The registry records what remains: of ten exchange PoR records, only two are verifiable against a surviving report document. The rest are dead platform links, withdrawn PDFs, and Merkle-tree programs with no practitioner behind them at all.
Self-reported Merkle proofs deserve precision, because they are the periphery's main assurance substitute. A Merkle proof answers liability inclusion: your balance is in the tree. It does not answer liability completeness (is every customer in the tree?), asset ownership (are the wallets the exchange's?), or encumbrance (is the collateral borrowed for the snapshot?). Those three questions are the entire content of an assurance opinion, and they are exactly the three questions the post-FTX AUP reports were criticized for answering only partially. The market's response to that criticism was not stronger engagements. It was practitioner exit, followed by self-reporting. Voluntary assurance markets fail under stress in the direction of less assurance.
That is the strongest empirical argument for Part II's convergence thesis, and it is written in my registry's draft records: where no statute demands a practitioner, the practitioner eventually leaves.
What a Part III Would Contain
Wharton's series runs market, then law. The implied third report is assurance, and its outline falls out of the taxonomy:
Inside the core, the work is harmonization. The GENIUS Act, MiCA, MAS, HKMA, and Japan's PSA all demand independent verification on different cadences under different standards (AT-C 205, ISAE 3000, ISCA, unspecified). A monthly PCAOB-registered examination does not automatically satisfy any other jurisdiction. The AICPA's 2025 criteria for asset-backed fiat-pegged tokens are the only serious attempt at common examination criteria, and they cover only the custodial mechanism.
For programmatic overcollateralized designs, the profession needs an engagement that pairs cryptographic verification (which it should adopt, not duplicate) with attestation over the things cryptography cannot see: key control, oracle governance, and the growing RWA slice of protocol balance sheets.
For synthetic hedged designs, someone must write criteria for attesting a hedged position rather than a static reserve: custody, counterparty, margin, and open interest, consolidated at one timestamp, with disclosure of funding-rate sensitivity rather than a false binary of backed or not backed.
For the exchanges, the lesson is already legislated in miniature: assurance that exists only while reputationally convenient is not assurance. Proof-of-reserves engagements need the same statutory anchoring reserves got, or the 2022 exit will repeat in the next stress event.
Stablecoins became, in Wharton's words, a parallel layer of the monetary system. Money layers get audited. The map of the market exists, the map of the law exists, and the registry now maps who actually verifies what. The unclaimed territory is everything outside the core, and it is where both the risk and the profession's next decade of work are sitting.
Data referenced throughout is from the Reserve Attestation Registry, which links every verified claim to the underlying practitioner report. The Wharton Stablecoin Toolkit is published by the Wharton Blockchain and Digital Asset Project. Views are my own; this analysis is informational and is not professional advice or an assurance conclusion.