The Run-Off Assumption: How Stablecoins Rewrite Bank Balance Sheets Without Moving a Single Dollar

Consider a single accounting identity that should be trivially stable. A household holds $100 in a retail bank account. That $100 becomes a stablecoin. The bank's total deposit liabilities — on paper — do not change by a single cent. And yet the same bank's Liquidity Coverage Ratio, the regulatory invariant that governs whether it can survive a 30-day stress scenario, falls from 120% to 109%.

No money left. No money entered. The ratio broke anyway.

I spent six months in 2017 auditing the Ethereum Yellow Paper against the EVM specification, hunting edge cases where the gas-cost model for CALL operations could be made to loop. The lesson that survived was not about gas. It was that the quantity of a system's state is not the same as the quality of that state — and most auditors, most regulators, and most commentators only measure the first. The stablecoin debate is now repeating that error at the scale of the global banking system, and almost nobody has instrumented the second variable.

Let me define the mechanism precisely, because the imprecision is where the confusion lives. A reserve-backed stablecoin is a hybrid architecture: an off-chain reserve — bank deposits, short-dated US Treasuries, and the plumbing that connects them — mapped to an on-chain token through a redemption promise. The token is the interface. The reserve is the state. The issuer is the only writer to that state, and its write access is total.

The conventional critique asks a quantity question: are stablecoins draining bank deposits? This framing treats the banking system as a tank and stablecoins as a siphon. Under that model, the risk scales with the total dollars that leave. The model is wrong, and it is wrong in the same way that measuring a contract by its gas usage misses whether it can be drained.

What actually happens is a change of owner, not a change of quantity. When a household converts $100 into a stablecoin, the issuer's bank account rises by $100 and the household's falls by $100. The aggregate deposit base is invariant. But the account now holding those funds has migrated from a dispersed retail account — sticky, insured, low run-off probability — to a concentrated institutional account — volatile, uninsured, high run-off probability. Same number. Different state class.

This is a money hierarchy, and it has an ordering. Household deposits sit at the top for stability. Stablecoin balances sit in the middle. Issuer institutional deposits sit lower down. Every conversion moves value down that hierarchy. The BIS, the Federal Reserve, and the Basel Committee have each begun publishing on this migration — and when three of the world's highest-authority financial governance bodies study the same interface in the same window, the output is rarely academic. It is a rule waiting for a date.

A caveat on sourcing: one of the BIS references is timestamped 2026, which cannot be reconciled with the present. I flag it rather than smooth it over. In any audit, an inconsistent timestamp is not a cosmetic defect; it is a signal that the data pipeline has a bug somewhere upstream, and the burden of proof sits with the source, not the reader.

Here the analysis becomes accounting, and the accounting becomes an attack surface. Let me walk the execution paths.

Path A — reserve held as deposits. The household's $100 becomes the issuer's $100 in a bank account. Aggregate deposits unchanged. Owner class changed. This is the baseline migration, and it is the one every commentator describes.

Path B — reserve deployed into existing Treasuries on the secondary market. The issuer's bank balance falls by 100; the Treasury seller's bank balance rises by 100. Aggregate deposits, again, unchanged. The owner class has simply moved once more, from issuer to Treasury seller. Two paths, two owner transfers, zero change in the total.

Path C — reserve deployed into Treasuries held by a bank, or into newly issued Treasuries. This is the path that matters and the one least discussed. If the issuer buys a Treasury the bank already holds, the bank's balance sheet contracts on both sides simultaneously: the asset leaves, and the deposit liability that funded it is extinguished. The banking system shrinks. If the issuer buys a newly issued Treasury, the funds route into the Treasury General Account and only re-enter circulation through government spending, on the government's schedule, not the bank's. Path C is the most contractionary of the three, and it is the one whose second-order effects are being ignored.

Now layer the regulatory invariant on top. The Liquidity Coverage Ratio requires a bank to hold high-quality liquid assets sufficient to cover 30-day net cash outflows under stress. The numerator is the liquid-asset stock. The denominator is not the deposit total — it is the deposit total weighted by a run-off assumption: a regulator's model of how much of each deposit class would flee in a panic. Retail deposits receive a low run-off weight. Institutional and wholesale deposits receive a high one.

So when $100 migrates from a retail account to an issuer's institutional account, the numerator is untouched and the denominator inflates. The ratio falls. The 120% to 109% move is not a hypothetical; it is the arithmetic of an owner-class migration with zero change in the underlying total.

Let me express the invariant in the form it actually takes:

LCR = HQLA / ( Σ deposit_class_i × runoff_weight_i ) Migration event: retail_deposit -= 100 → institutional_deposit += 100 ΔHQLA = 0 Δdenominator = 100 × (runoff_institutional - runoff_retail) > 0 ∴ LCR falls

The bug is not in the money. It is in the assumption that classifies the money. A bug is just an unspoken assumption made visible, and the banking system has been running for decades on an implicit assumption that a deposit is a deposit. The stablecoin migration is the test case that falsifies it.

There is a second variable the quantity framing flattens entirely: deposit stickiness versus the velocity of money. The same $100 held by a household and held by an issuer are not the same instrument. The household balance is slow, insured, and behaviorally anchored. The issuer balance is fast, uninsured, and responds to a single API call. Stablecoins did not merely move deposits; they increased the velocity at which the aggregate can be reallocated, while simultaneously lowering the stability of the account class that now holds it. Two effects, one direction, and neither shows up in a headline total.

The reserve composition is where the mechanism acquires a steering wheel. A reserve weighted toward bank deposits keeps the system on Path A: the money never leaves the banking perimeter, and the damage is confined to a reclassification. A reserve weighted toward short-dated Treasuries pushes toward Path B and, at the margin, Path C, where the banking system contracts and the funds route toward the Treasury General Account. The tilt is not fixed; it is a policy variable the issuer can turn. And as regulatory pressure on the bank-custody leg rises, the rational issuer turns it toward Treasuries — which means the systemic outcome is partly a function of rules written to constrain a different risk.

Trace the redemption path and the asymmetry sharpens. Redemption is cheap: a token holder can exit in seconds, and the issuer must fund that exit from a reserve whose redemption-side liquidity is a function of Treasury settlement cycles, not of block times. In calm markets the mismatch is invisible — duration looks matched because nothing is being demanded. In stress it is exactly the gap between on-chain finality and off-chain settlement. And re-intermediation does not restore the prior state: when funds return to the banking system, they tend to land in a different account class than the one they left, so the migration ratchets rather than reverses. Reversibility is assumed; the assumption is untested.

The second-order transmission is a funding-cost cascade, and it runs in four hops. First, deposit structure shifts from retail to institutional. Second, the LCR run-off assumption worsens, forcing the bank to either hold more liquid assets — a drag on yield — or shift toward longer-term wholesale funding — a higher cost. Third, the bank's cost of funds rises. Fourth, that cost surfaces as a higher lending rate, and the borrower pays. The BIS line of research is explicit here: the ultimate payer may be someone who has never touched a stablecoin and cannot define one. The borrower's cost rises without the borrower's consent and without the borrower's knowledge.

Now follow the revenue, because the asymmetry is the point. The issuer earns interest on its Treasury reserve. That is a seigniorage-like margin — private capture of a quasi-monetary issuance spread — while the deposit-stability cost lands on the banking system and, through the lending channel, on borrowers. The reserve-backed stablecoin carries no Ponzi risk: the backing is real, full, and auditable. But its economics are a structural transfer, not a neutral innovation. Value is captured at the issuer layer and cost is socialized downward through the credit stack. The transfer is real even when it is invisible.

Here is the calibration question that will decide the outcome. The run-off assumption is not a market price; it is a regulatory judgment, and it is revisable. If a regulator decides that a deposit which can be converted to a stablecoin in one transaction is, in effect, a wholesale deposit, the run-off weight assigned to it jumps, and the LCR denominator jumps with it. No token changes. No reserve changes. Only the classification changes — and the bank's required liquid-asset buffer grows overnight. This is the leverage point, and it is administrative rather than cryptographic.

I want to be precise about where the smart-contract analogy holds and where it breaks, because I have watched analysts overfit it. The on-chain token layer is deterministic and auditable — state transitions are checkable, supply is verifiable. The reserve layer is not. It is custodial, permissioned, and reconciled by attestation rather than proof. The architecture is a deterministic interface bolted onto a non-deterministic, trust-based settlement backend. The security of the whole system is therefore bounded by the weaker layer, and the weaker layer is off-chain. Security is not a feature of the token; it is the architecture of the reserve, and the reserve is exactly where the systemic externalities originate.

I keep returning to an analogy from AMM design — the same one that occupied me through the DeFi Summer of 2020, when I was deriving slippage bounds instead of watching TVL. A constant-product pool survives arbitrary swaps because the product of reserves is invariant: the curve bends, but the invariant holds. The banking system's analogue invariant was that aggregate deposits are stable enough to be modeled as such. Stablecoins do not break the quantity. They break the classification the invariant rests on — and a broken classification is harder to detect than a broken number, because every dashboard still reads green.

Here is the counter-intuitive angle the loudest voices miss. The stablecoin conversation is dominated by a quantity panic — "trillions could leave the banks." That panic is both overstated and misdirected. Across Paths A and B the aggregate deposit base is largely invariant; the system is not being siphoned. The real exposure is structural and slow: a permanent degradation of deposit quality that no total-volume metric will ever surface.

The deeper blind spot is reflexive. Once depositors expect banks to be pressured, migration becomes self-justifying. A stress episode does not require a solvency trigger — it only requires an expectation of illiquidity, and a stablecoin is a frictionless exit ramp with no branch queue and no withdrawal limit. This is a bank run compiled for the digital age: same execution path, faster settlement. The untested exit condition is the vulnerability, and it has never been run at scale.

There is a second front most analysts are not watching. Banks are not passive endpoints; they are adversarial participants. The counter-architecture forming under the label "tokenized deposits" keeps the deposit on the bank's own ledger, wraps it in programmability, and denies the stablecoin issuer the migration in the first place. If that route wins, the competitive moat of today's issuers is not regulatory approval — it is the assumption that on-chain dollars must leave the bank. Watch that assumption, not the headline total. Code is law, but logic is the judge, and the logic here favors whoever controls the ledger the deposit never leaves.

The vulnerability forecast is specific. The next attack surface is not the stablecoin token; it is the run-off assumption inside the LCR framework. If regulators reclassify stablecoin-linked deposits into a worse outflow class, banks will be forced to hold more high-quality liquid assets against them, the cost of the stablecoin-bank interface rises, and issuer reserves get pushed further toward Treasuries — accelerating the very Path C contraction that started the analysis. The rule revision, not the token audit, is the event to price. Compiling truth from the noise of the blockchain means reading the assumption, not the total.

The curve bends. The invariant — that a dollar's stability depends on whose ledger holds it — holds.