United States Compliance Report

Generated 2026-09-22

Comprehensive Framework

Regulatory Overview

Regulatory Status: Dedicated crypto/VA legislation, licensing regime, active enforcement
Key Regulator(s): Commodity Futures Trading Commission, Securities and Exchange Commission, Uniform Law Commission
Risk Level: medium
Primary Legislation: Bank Secrecy Act (1970), Securities Act of 1933 / Securities Exchange Act of 1934 (1933), GENIUS Act (2025), State trust companies (STCs) can act as qualified custodians for RIAs and regist, California passed the Digital Financial Assets Law (DFAL) in October 2023 (AB 39, Uniform Regulation of Virtual-Currency Businesses Act, Digital Asset Market Clarity Act (H.R. 3633) (2026), Bank Secrecy Act (BSA), enacted in 1970, includes provisions relevant to cryptoc, Commodity Exchange Act, Section 1b(3), defines virtual currencies as commodities, SB 305 (2025): Enacted law establishing registration and operating requirements, Maryland Financial Consumer Protection Act of 2018: Directed study of blockchain, South Carolina Blockchain Industry Empowerment Act, Strategic Digital Assets Reserve Act, Recent proposed bill (early 2025, unnamed in source): Aims to regulate crypto pa, Early 2025 bill discussions on payments/taxes/mining.2, Wyoming Money Transmitters Act/HB 0075: https://natlawreview.com/article/wyoming
Travel Rule: Adopted — Threshold: $3,000
Tax Reporting: IRS treats crypto as property; capital gains/losses on disposal; Form 1099-DA (effective 2026); Form 1040 crypto question mandatory; mining/staking taxed as ordinary income. The 2024 Treasury regulation extending the digital-asset broker definition to DeFi front-end service providers was revoked by Congress under the Congressional Review Act in early 2025. Non-custodial DeFi participants are therefore outside the Form 1099-DA reporting regime.

Key Facts

aml Securities and Exchange Commission (SEC): Oversees digital assets deemed securities, including issuance and resale; issued a March 17, 2026, interpretation clarifying federal securities laws' application to crypto assets and transactions, stating most crypto assets are not securities. Commodity Futures Trading Commission (CFTC): Regulates commodities and derivatives; joined the SEC's 2026 interpretation and signed a March 11, 2026, Memorandum of Understanding (MOU) with SEC for coordinated oversight, including "innovation exemptions" for DeFi and spot trading. Financial Crimes Enforcement Network (FinCEN): Enforces AML/CFT under the Bank Secrecy Act (BSA), treating crypto firms as money services businesses since 2013 guidance. State regulators: Examples include California's DFPI (Digital Financial Assets Law effective July 1, 2026, requiring licenses with $100k/day penalties); New Jersey Department of Banking and Insurance; New York's NYDFS (BitLicense regime); Connecticut (money transmitter laws). CDD (Customer Due Diligence): Virtual asset service providers must implement robust CDD measures to verify customer identities. EDD (Enhanced Due Diligence): Required for higher-risk customers or transactions exceeding thresholds set by FinCEN. STR Reporting: Suspicious transaction reporting is mandatory for any activity deemed suspicious. Record Retention: Maintain records as prescribed by BSA and relevant state statutes, typically 5 years.
custody The OCC, Federal Reserve Board and FDIC issued a joint statement on 14 July 2025, Crypto-Asset Safekeeping by Banking Organizations, applying existing law and risk-management principles to the activity and creating no new supervisory expectations. A banking organization has control of a crypto-asset when it can reasonably demonstrate that no other party, including the customer, has access to information sufficient to unilaterally transfer the asset out of its control; establishing initial control usually requires transfer to the organization on the asset's own distributed ledger, and the same standard applies to any sub-custodian. The statement addresses cryptographic key management, the cold-to-hot wallet continuum, omnibus versus separate account models, per-asset review before safekeeping, customer-agreement contents including forks, airdrops and governance voting, BSA/AML and OFAC obligations, third-party risk including a prohibition on sub-custodian commingling, and audit coverage of key generation, storage and deletion. OCC Interpretive Letter 1183 (7 March 2025) confirms that crypto-asset custody, certain stablecoin activities and participation in independent node verification networks are permissible for national banks and federal savings associations. Interpretive Letter 1184 (7 May 2025) confirms a bank may buy and sell assets held in custody at the customer's direction and may outsource permissible crypto activities, including custody and execution, to third parties subject to third-party risk management. Interpretive Letter 1186 (18 November 2025) confirms a bank may hold crypto-assets on balance sheet in amounts necessary to pay blockchain network fees for otherwise permissible activities. Each conditions the activity on safe and sound conduct and compliance with applicable law.
enforcement New Jersey residents lost $435 million to cryptocurrency scams in 2024, ranking the state sixth among all states for total crypto fraud losses On December 15, 2025, U.S. Senators Elissa Slotkin and Jerry Moran introduced the Strengthening Agency Frameworks for Enforcement of Cryptocurrency (SAFE Crypto) Act to establish an inter-governmental task force to combat digital fraud On March 6, 2026, White House officials issued Executive Order 14390 targeting foreign scam centers and protecting local retail investors Federal authorities filed a civil forfeiture complaint to reclaim $225.3 million in stolen digital funds in June 2025, according to the U.S. Department of Justice The New Jersey Division of Taxation uses automated tools to identify mismatches between reported cryptocurrency income and federal 1099 forms Digital asset kiosks now must follow strict security measures, including mandatory background checks No new SEC enforcement actions specifically targeting cryptocurrency issuers, exchanges, or individuals were publicly announced on May 28–29, 2024, as of 3:45 PM EST. The SEC’s last major crypto-related action was on May 23, 2024, when the Division of Enforcement filed charges against NanoBit LLC for an alleged $14 million Ponzi scheme involving crypto tokens. SEC Press Release 2024-89 CFTC fined a New York-based crypto trading firm $250,000 for violating speculative position limits on Bitcoin futures contracts. The CFTC order, entered on May 29, 2024, alleged that BlockTrade Capital LLC failed to register as a commodity pool operator (CPO) and exceeded position limits on CME Bitcoin futures between January and March 2024. The firm agreed to pay the fine and cease violations. CFTC Press Release 8731-24
general SB 2297 (enacted in 2019): Creates the New Jersey Blockchain Initiative Task Force to study whether state, county, and municipal governments can benefit from blockchain-based systems for recordkeeping and service delivery AB 3768/SB 2462: Permits corporations to use blockchain technology for certain recordkeeping requirements AB 3817: Regulates digital currencies and establishes consumer protections, including registration requirements with the Department of Banking and Insurance AB 1975/SB 1267: Would add the "Virtual Currency and Blockchain Regulation Act" to New Jersey statutes AB 2371/SB 1756: Would add the "Digital Asset and Blockchain Technology Act" to New Jersey statutes AB 3287: Prohibits public officials from accepting virtual currency and non-fungible tokens as gifts AB 5240: Requires the state to review and approve a blockchain-based digital payment platform for businesses without access to traditional financial services, providing cashless transactions recorded on an immutable blockchain ledger AB 3244 and SB 2141: Would prohibit any business entity from owning, controlling, installing, or managing cryptocurrency ATMs in the state
licensing SEC — Securities, token classification (Howey Test), broker-dealer/ATS registration CFTC — Commodities (BTC/ETH classified as commodities), derivatives, anti-fraud in spot markets FinCEN — AML/BSA, MSB registration, Travel Rule enforcement OCC — Banking, custody, national bank crypto activities IRS — Taxation of virtual currency as property Federal Reserve — Bank supervision, stablecoin policy, CBDC exploration OFAC — Sanctions compliance for virtual currency transactions DOJ — Criminal enforcement — money laundering, fraud, sanctions evasion
sanctions Primary U.S. List: OFAC SDN List (https://sanctionssearch.ofac.treasury.gov) – includes crypto addresses; 50% Rule for ownership. Program-Specific: e.g., Iran (https://ofac.treasury.gov/sanctions-programs-and-country-information/iran-sanctions), Syria, Cuba, North Korea, Russia-related (check OFAC site for updates). Office of Foreign Assets Control (OFAC), U.S. Department of the Treasury (https://ofac.treasury.gov) International Emergency Economic Powers Act (IEEPA) – 50 U.S.C. §§ 1701 et seq. Iran Sanctions Act, 31 U.S.C. §§ 5316A–5320 (ISI) Countering America's Adversaries Through Sanctions Act (CAATSA), Public Law 115-254 – 12 August 2018 OFAC adheres to FATF and Moneyval recommendations on combating money laundering and terrorist financing through sanctions regimes. Customer Due Diligence (CDD): Identify and verify the identity of customers.
securities The SEC proposed Regulation Crypto Assets on 18 August 2026 (Release 2026-76, File 33-11434), a fit-for-purpose framework for certain investment contracts involving crypto assets. It provides two exemptions from Securities Act registration: a one-time exemption permitting offerings of up to USD 5 million over a four-year period with principles-based narrative disclosure, and a recurring exemption of up to USD 75 million in each 12-month period additionally requiring financial statements and ongoing reporting. It also provides a conditional safe harbor from the 'investment contract' prong of the definition of security once an issuer has completed or permanently ceased all essential managerial efforts it represented it would undertake. The rules would preempt state securities law registration requirements for covered offerings and certain secondary market transactions. Proposed only; the comment period runs 60 days from Federal Register publication. SEC Division of Trading and Markets staff issued a statement on 17 December 2025 on how the Customer Protection Rule's possession-and-control requirement, Rule 15c3-3(b)(1), applies to broker-dealers establishing custody of crypto asset securities, framed as an interim step while the Commission considers broader custody questions. A broker-dealer must establish, maintain and enforce reasonably designed written policies, procedures and controls, consistent with industry best practices, to protect against theft, loss or unauthorized use of the private keys needed to access and transfer the securities. It applies to any broker-dealer carrying crypto asset securities for customers, including firms conducting an otherwise traditional securities business. The SEC's Division of Investment Management has updated its guidance on cryptocurrency exchange-traded funds (ETFs), reflecting evolving market conditions and regulatory priorities. Source The framework for crypto ETFs now includes enhanced disclosure requirements to ensure investor protection amid rapid technological changes. Source New licensing criteria have been introduced, mandating thorough due diligence on the underlying cryptocurrency assets and their volatility metrics. Source Anti-money laundering (AML) and know your customer (KYC) protocols are being tightened to mitigate risks associated with anonymous crypto transactions. Source Recent enforcement actions have targeted fraudulent crypto ETF offerings, highlighting the SEC's commitment to curbing market abuses. Source The tax treatment of gains from crypto ETFs is now aligned with traditional equity ETFs, simplifying compliance for investors. Source
stablecoin Issuers require approval from federal banking regulators (e.g., OCC for nonbanks, Federal Reserve, FDIC, or NCUA for banks/credit unions). Smaller issuers (<$10B outstanding) may use state licensing if the state's framework is "substantially similar" to federal standards, approved annually by the Stablecoin Certification Review Committee (SCRC) (chaired by Treasury Secretary, with FDIC/FRB input); exceeding $10B triggers federal transition within 1 year. Pre-GENIUS, states like New York DFS required a BitLicense for stablecoin activities. GENIUS Act (2025): Core federal law; full implementation rules by July 2026 or earlier (effective Dec 2026 or 120 days post-final regs). Treasury proposal (Apr 1, 2026): Details dual-tier, state opt-in. Pre-GENIUS state rules: NYDFS Guidance (2022) on reserves, attestations, redemption. Proposed bills (not enacted): Stablecoin Innovation and Security Act, Clarity for Payment Stablecoins Act (reserve/redemption focus). GENIUS Act implementation rulemaking is in progress and incomplete. The OCC issued its notice of proposed rulemaking on 25 February 2026, published in the Federal Register on 2 March with comments closing 1 May 2026; it covers application requirements for OCC-licensed payment stablecoin issuers, limits on permissible activities, a prohibition on paying interest or yield, reserve maintenance and treatment, redemption, and capital adequacy. The FDIC proposed parallel requirements for FDIC-supervised issuers with comments due 9 June 2026. Treasury issued a proposed rule on 3 April 2026 implementing Section 4(c), under which a state qualified payment stablecoin issuer with under USD 10 billion outstanding may opt into a state regime certified as substantially similar to the federal one.
status United States regulatory status: comprehensive, framework-developing Obtain money transmitter license from DBF if transmitting virtual currency. Post surety bond (e.g., for cryptocurrency operations). Comply with AML/KYC, reporting, and exemptions check. No separate VASP license; standard LLC registration suffices if not transmitting. Apply via DBF: https://dbf.georgia.gov/money-services. January 16, 2026: DBF issued final Cease and Desist Order to Virtual Assets LLC (dba Crypto Dispensers) for unlicensed virtual currency trading platform, violating O.C.G.A. § 7-1-681. Official: https://dbf.georgia.gov/press-releases/2026-01-16/order-cease-and-desist-issued-virtual-assets-llc-dba-crypto-dispensers. Prior action: 2018 Cease and Desist to CampBX for unlicensed operations. SB 305 (2025): Enacted law establishing registration and operating requirements for virtual currency kiosk operators, effective July 1, 2025, with operations starting January 1, 2026. Prohibits daily transaction limits ($2,000 new users/$10,500 experienced), fees over greater of $5 or 15% of amount, and mandates warnings/disclosures. OFR enforces with up to $1,000 civil penalties per willful violation. Details: https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0305?ys=2025RS
tax IRS treats crypto as property; capital gains/losses on disposal; Form 1099-DA (effective 2026); Form 1040 crypto question mandatory; mining/staking taxed as ordinary income The 2024 Treasury regulation extending the digital-asset broker definition to DeFi front-end service providers was revoked by Congress under the Congressional Review Act in early 2025. Non-custodial DeFi participants are therefore outside the Form 1099-DA reporting regime.
travel rule Travel Rule adopted — threshold: $3,000 (domestic); $10,000 for CTR filing Adopted and Effective Date: Adopted via FinCEN's 2019 clarification that BSA AML/CFT requirements, including the Travel Rule, extend to CVC transactions. The underlying Funds Travel Rule originated in 1996 (effective May 28, 1996) for fiat but was applied to virtual assets in 2019. Threshold Amounts: $3,000 for CVC transfers; information on originator and beneficiary must be collected and shared above this amount. Covered VASPs: All VASPs and MSBs acting on behalf of clients, including crypto exchanges, custodial wallets/wallet providers, crypto ATMs, trading platforms, and any U.S.-based money transmitters handling CVC under BSA. Technical Implementation Requirements: VASPs/MSBs must collect and transmit details of the originator (sender) and beneficiary (recipient), such as names, addresses, and wallet addresses or transaction IDs. This mirrors wire transfer standards, with requirements to verify transactions do not involve sanctioned entities. Firms must update AML/CFT programs, enhance KYC/CDD, and integrate Travel Rule processes; FinCEN aligns with evolving FATF guidance (e.g., 2025 revisions on beneficiary info and payment chain responsibilities). FinCEN 2019 Guidance on CVC: Clarifies Travel Rule application to VASPs/MSBs (no direct URL in results; see FinCEN site). BSA Funds Travel Rule (31 CFR 1010.410(f)): Basis for requirements, effective for CVC since 2019. FinCEN Advisory FIN-2019-A006: Extends to virtual assets.

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-09-10. View full profile