CLARITY Act Faces 18-AG Opposition as EU Imposes 24-Hour Crypto Bug Reporting Rule

A bipartisan coalition of 18 state attorneys general is urging U.S. senators to reject the CLARITY Act ahead of Tuesday's cloture vote, warning that the latest version of the digital asset market structure bill would undermine state enforcement power over crypto companies. The group, led by New York Attorney General Letitia James, argued that key provisions could restrict states' ability to pursue fraud and misconduct cases against digital asset firms. The cloture vote requires 60 votes to advance the legislation to full Senate debate.

Senate Republicans simultaneously released what they described as the final draft of the bill, incorporating 126 substantive changes sought by Democrats. The revised text also tightens ethics rules after President Donald Trump agreed to roughly 80% of a bipartisan proposal from Senators Thom Tillis and Ruben Gallego. Under the new framework, officials with significant financial interests in crypto issuers could be required to divest or move those holdings into a blind trust, while state attorneys general would gain a formal role in enforcing the ethics provisions. If passed, the CLARITY Act would establish a federal market structure for digital assets and split oversight responsibilities between the SEC and CFTC.

Separately, the European Commission confirmed that the EU's Cyber Resilience Act (CRA) took effect on Friday, imposing strict reporting timelines on cryptocurrency hardware and software wallet providers. Under the new rules, manufacturers must submit an early warning for any actively exploited bug or severe vulnerability within 24 hours of discovery, followed by a full notification within 72 hours. A final report is required 14 days after mitigations become available, or within one month for severe incidents.

The European Commission said the CRA reporting requirements apply to all products "with digital elements" made available in the EU market, extending well beyond crypto wallets. Officials framed the measures as a necessary step to protect consumers and businesses from escalating cyber threats targeting digital infrastructure, though wallet providers now face one of the tightest vulnerability disclosure windows in any major regulatory regime.