Is Crypto Legal in the United States?

SEC — regulates crypto assets that are securities and transactions in them, including broker-dealer and exchange registration under the Exchange Act. Its 17 March 2026 interpretation (Rel. 33-11412, 91 FR 13714) sets a token taxonomy of digital commodities, digital collectibles, digital tools, stablecoins and digital securities, and applies the Howey test to determine when a non-security crypto asset is subject to an investment contract.

CFTC — administers the Commodity Exchange Act for crypto assets that are commodities (the 17 March 2026 SEC interpretation, joined by the CFTC, lists Bitcoin and Ether as digital commodities), regulates crypto derivatives, holds anti-fraud and anti-manipulation authority over commodity spot markets (7 U.S.C. 9), and since 4 December 2025 has permitted listed spot crypto trading on CFTC-registered exchanges.

FinCEN — Treasury bureau (31 U.S.C. 310) that administers the Bank Secrecy Act: MSB registration on Form 107 within 180 days of establishment and every two years (31 CFR 1022.380), and the funds-transfer recordkeeping and travel rule for transmittals of $3,000 or more (31 CFR 1010.410(e)-(f)).

OCC — charters and supervises national banks and federal savings associations, which may provide crypto-asset custody, certain stablecoin activities and node participation without prior supervisory non-objection (Interpretive Letter 1183, 7 March 2025); conditionally approved five national trust bank charters for digital-asset firms on 12 December 2025; and is the primary federal payment stablecoin regulator for Federal qualified issuers under the GENIUS Act.

IRS — administers federal tax on digital assets, which are treated as property, not currency; brokers report digital-asset sales on Form 1099-DA beginning with transactions on or after 1 January 2025.

Federal Reserve — supervises state member banks and bank holding companies; joined the 14 July 2025 interagency crypto-asset safekeeping statement; proposed GENIUS Act rules for Board-supervised stablecoin issuers on 29 September 2026 (91 FR 61580); and proposed a special-purpose payment account category under Regulation D (R-1893). Executive Order 14178 (23 January 2025) prohibits agencies from acting to establish, issue or promote a CBDC.

OFAC — administers U.S. economic sanctions, which apply to virtual currency transactions; on 15 October 2021 it published 'Sanctions Compliance Guidance for the Virtual Currency Industry'.

DOJ — prosecutes federal crimes involving crypto assets, including money laundering (18 U.S.C. 1956) and operating an unlicensed money transmitting business (18 U.S.C. 1960), as well as fraud and sanctions-evasion offences.

Bank Secrecy Act (Public Law 91-508, 1970; codified at 31 U.S.C. 5311 et seq.) is the federal AML/CFT statute. It requires reports and records useful in criminal, tax and regulatory investigations and requires money transmitting businesses to register with Treasury (31 U.S.C. 5330), implemented by FinCEN Form 107 within 180 days of establishment and renewal every two years (31 CFR 1022.380).

Securities Act of 1933 section 5 (15 U.S.C. 77e) prohibits offers and sales of securities without an effective registration statement or an exemption, and Securities Exchange Act of 1934 section 15 (15 U.S.C. 78o) requires brokers and dealers to register with the SEC. Their application to crypto assets is set out in the SEC interpretation of 17 March 2026 (Rel. 33-11412, 91 FR 13714), which the CFTC joined.

GENIUS Act (Public Law 119-27, S. 1582), approved 18 July 2025, establishes the federal payment stablecoin framework. It takes effect on the earlier of 18 months after enactment (18 January 2027) or 120 days after the primary federal payment stablecoin regulators issue final implementing regulations (section 20). As of 14 October 2026 the OCC (91 FR 10202, 2 March 2026) and Federal Reserve Board (91 FR 61580, 29 September 2026) implementing rules are proposed, not final.

Custody: federally, national banks and federal savings associations may custody crypto assets (OCC Interpretive Letter 1183, 7 March 2025) and the OCC conditionally approved five national trust bank charters for digital-asset custodians on 12 December 2025; broker-dealers holding crypto asset securities are subject to Rule 15c3-3 possession requirements (SEC staff statement, 17 December 2025); and on 6 October 2026 the SEC proposed crypto custody rules for registered advisers and funds (91 FR 63870). State trust charters are available separately under state law.

FinCEN treats a business that exchanges convertible virtual currency for fiat currency, funds or other virtual currency, or that accepts and transmits it for others, as a money transmitter and therefore a money services business under the Bank Secrecy Act (guidance FIN-2019-G001, issued 9 May 2019).

Money services businesses must keep originator and beneficiary records for each transmittal of funds of $3,000 or more (31 CFR 1010.410(e)) and retain Bank Secrecy Act records for five years (31 CFR 1010.430(d)); a Currency Transaction Report is required for a transaction in currency (cash) of more than $10,000 (31 CFR 1010.311).

A money services business must file a Suspicious Activity Report with FinCEN for a suspicious transaction conducted or attempted through it that involves or aggregates at least $2,000, no later than 30 calendar days after initial detection (31 CFR 1022.320).

Under 31 CFR 1010.410(e)-(f) the Funds Travel Rule applies to transmittals of funds of $3,000 or more, and FinCEN guidance FIN-2019-G001 applies it to convertible-virtual-currency transmittals. There is no separate $10,000 tier for foreign transfers ($10,000 is the cash CTR threshold), and the October 2020 proposal to cut the cross-border threshold to $250 (85 FR 68005) was never adopted.

Under SEC v. W.J. Howey Co., 328 U.S. 293 (1946), an investment contract is an investment of money in a common enterprise with an expectation of profits derived from the efforts of others. The SEC applied this test to crypto assets in its 17 March 2026 interpretation (Rel. 33-11412, 91 FR 13714), which explains how a non-security crypto asset can become, and cease to be, subject to an investment contract.

SEC's stance: in its 17 March 2026 interpretation (Rel. 33-11412, effective 23 March 2026), joined by the CFTC, the SEC adopted a taxonomy of digital commodities, digital collectibles, digital tools, stablecoins and digital securities, named Bitcoin and Ether as examples of digital commodities, and stated that an investment contract involving a non-security crypto asset can come to an end; Chairman Atkins said most crypto assets are not themselves securities.

Issuers: an offer or sale of a crypto asset that is a security, including one sold subject to an investment contract, must be registered under Securities Act section 5 (15 U.S.C. 77e) or qualify for an exemption; the SEC interpretation of 17 March 2026 (Rel. 33-11412) addresses when a non-security crypto asset becomes and ceases to be subject to an investment contract.

Under Exchange Act section 5 (15 U.S.C. 78e) a venue that effects transactions in securities, including crypto assets offered as or subject to investment contracts, must register as a national securities exchange under section 6 or be exempt; 17 CFR 240.3a1-1(a)(2) exempts a venue that complies with Regulation ATS (17 CFR 242.300-242.304).

Broker-dealers: firms in the business of effecting transactions in crypto asset securities for others (brokers) or buying and selling them for their own account (dealers) must register with the SEC under Exchange Act section 15(a) (15 U.S.C. 78o(a)), subject to the statutory exceptions.

Investment advisers: persons who advise others for compensation about investing in crypto asset securities are investment advisers and must register with the SEC under Advisers Act section 203(a) (15 U.S.C. 80b-3(a)) unless exempt under section 203(b) or prohibited from SEC registration by section 203A.

The CFTC has treated Bitcoin and other virtual currencies as commodities under the Commodity Exchange Act since its 17 September 2015 Coinflip order (Release 7231-15). The 17 March 2026 SEC interpretation, joined by the CFTC (Rel. 33-11412), lists Bitcoin, Ether, Solana, XRP and other tokens as examples of digital commodities.

Derivatives trading: futures contracts on a crypto asset that is a commodity fall under CFTC jurisdiction and, unless exempted, must be traded on or subject to the rules of a board of trade designated or registered by the CFTC as a contract market (CEA section 4(a), 7 U.S.C. 6(a)).

Anti-fraud and anti-manipulation: CEA section 6(c)(1) (7 U.S.C. 9(1)) prohibits any manipulative or deceptive device in connection with any swap or any contract of sale of a commodity in interstate commerce, which reaches spot markets in crypto assets that are commodities; the CFTC and SEC interpretation of 17 March 2026 states non-security crypto assets could meet the CEA 'commodity' definition.

Registration: intermediaries in crypto commodity derivatives must register with the CFTC, including futures commission merchants (CEA section 4d, 7 U.S.C. 6d) and swap dealers and major swap participants (CEA section 4s, 7 U.S.C. 6s).

For U.S. federal tax purposes the IRS treats digital assets, including virtual currency, as property and not as currency.

Under IRS guidance, selling, exchanging or otherwise disposing of a digital asset, including exchanging it for goods or services, is a disposition of property that produces a capital gain or loss when the asset is held as a capital asset, computed from its basis and its value on the transaction date.

Digital assets received as payment for property or services, as a reward or award, from mining or staking, or in an airdrop following a hard fork are taxable income at their U.S.-dollar fair market value; Rev. Rul. 2023-14 (IRB 2023-33, 14 August 2023) includes staking rewards in gross income in the year the taxpayer gains dominion and control over them.

The IRS directs taxpayers with digital-asset transactions to keep records documenting each purchase, receipt, sale, exchange or other disposition, and the U.S.-dollar fair market value of digital assets received as income or as payment in a trade or business.

Digital-asset brokers report sales to the IRS on Form 1099-DA, not Form 1099-B: gross proceeds for transactions on or after 1 January 2025 and basis for certain transactions on or after 1 January 2026. The final regulations exclude decentralized (non-custodial) brokers, and Pub. L. 119-5 (10 April 2025) disapproved the separate DeFi broker rule.

Every Form 1040 filer must answer Yes or No to the digital-asset question, which asks whether during the tax year the taxpayer received a digital asset as a reward, award or payment for property or services, or sold, exchanged or otherwise disposed of a digital asset or a financial interest in one.

OCC's stance: Interpretive Letter 1183 (7 March 2025) confirms that crypto-asset custody, certain stablecoin activities and participation in independent node verification networks are permissible for national banks and federal savings associations, subject to the same risk-management controls as traditional activities.

Fed's stance: on 24 April 2025 the Federal Reserve Board withdrew its crypto-asset and dollar-token guidance; on 14 July 2025 it joined the FDIC and OCC in a crypto-asset safekeeping statement; and it has proposed a special-purpose payment account category under Regulation D (R-1893). Executive Order 14178 (23 January 2025) prohibits agency action to establish, issue or promote a CBDC.

Banks under Federal Reserve supervision no longer need advance notification or supervisory non-objection for crypto-asset or dollar-token activities: on 24 April 2025 the Board rescinded its 2022 notification letter and its 2023 non-objection letter and now monitors these activities through the normal supervisory process. On 29 September 2026 it proposed GENIUS Act rules for Board-supervised stablecoin issuers (91 FR 61580).

Non-fungible tokens: the SEC's 17 March 2026 interpretation (Rel. 33-11412) classes NFTs designed to be collected or used, such as art, music, trading cards and in-game items, as digital collectibles that are not themselves securities, but states that offering a fractionalized digital collectible could constitute the offer or sale of a security.

OFAC sanctions obligations are the same whether a transaction is denominated in digital currency or fiat currency (OFAC FAQ 560). OFAC may list digital-currency addresses on the SDN List, but those listings are not exhaustive (FAQ 562), and on 15 October 2021 it issued Sanctions Compliance Guidance for the Virtual Currency Industry.

National banks and federal savings associations may provide crypto-asset custody, buy and sell assets held in custody at the customer's direction, and outsource custody and execution services to sub-custodians subject to third-party risk management, provided activities are conducted safely and soundly (OCC Interpretive Letter 1184, 7 May 2025).

Broker-dealers may custody crypto asset securities for customers under their SEC broker-dealer registration with no separate custody licence; under a Division of Trading and Markets staff statement of 17 December 2025, staff will not object to a broker-dealer deeming itself in 'physical possession' of a crypto asset security under Rule 15c3-3(b)(1) when it meets specified conditions.

Under a 30 September 2025 SEC Division of Investment Management staff no-action letter, registered advisers and regulated funds may treat a state trust company as a 'bank' for custody of crypto assets and related cash if, before engagement and annually, they have a reasonable basis to believe it is authorized by its state banking authority to provide such custody and maintains safeguarding policies.

SEC Rule 15c3-3(b)(1) requires broker-dealers to promptly obtain and maintain physical possession or control of customers' fully paid and excess margin securities. Under the 17 December 2025 Trading and Markets staff statement, a broker-dealer may deem itself in physical possession of a crypto asset security if it can access and transfer it, assesses the underlying ledger, protects private keys, and has plans for forks and 51% attacks, lawful seizure or freeze orders, and transfer on insolvency.

Banks that hold crypto assets for customers must do so in a safe and sound manner and in compliance with applicable law; the 14 July 2025 interagency statement 'Crypto-Asset Safekeeping by Banking Organizations' (Fed, FDIC, OCC) describes existing risk-management principles and creates no new supervisory expectations, and OCC Interpretive Letter 1184 (7 May 2025) applies the same standard to custody through sub-custodians.

State trust companies used as crypto custodians under the SEC staff no-action letter of 30 September 2025 must maintain written policies and procedures reasonably designed to safeguard crypto assets from theft, loss, misuse and misappropriation, addressing private key management and cybersecurity, and may not lend or rehypothecate client crypto assets without consent.

Federal crypto custody guidance sets private-key controls rather than a cold-storage percentage: the 14 July 2025 interagency safekeeping statement for banks creates no new supervisory expectations; the SEC's 17 December 2025 broker-dealer staff statement requires private-key policies consistent with industry best practices; and the 30 September 2025 staff no-action letter on state trust companies requires written policies addressing private key management and cybersecurity.

To deem itself in possession of a crypto asset security under Rule 15c3-3, a broker-dealer must assess the distributed ledger technology and associated network before taking custody and at reasonable intervals thereafter, and must not deem itself in possession if it knows of material security or operational weaknesses (SEC Division of Trading and Markets staff statement, 17 December 2025).

Under Advisers Act Rule 206(4)-2 and 1940 Act section 17(f), qualified custodians include banks; SEC staff (no-action letter, 30 September 2025) will not recommend enforcement against advisers or funds treating qualifying state trust companies as banks for crypto assets. On 6 October 2026 the SEC proposed new adviser and fund crypto custody rules (Rel. IA-7023, 91 FR 63870), which are not yet adopted.

National banks and federal savings associations may provide crypto-asset custody under OCC authority without first obtaining supervisory non-objection: OCC Interpretive Letter 1183 (7 March 2025) confirmed custody is permissible and rescinded the prior non-objection requirement.

Federal crypto custody requirements for SEC registrants are set by staff guidance and rulemaking, not by enacted legislation: the Division of Trading and Markets staff statement of 17 December 2025 addresses broker-dealer possession of crypto asset securities under Rule 15c3-3, and on 6 October 2026 the SEC proposed adviser and fund crypto custody rules (Rel. IA-7023, 91 FR 63870; comments close 7 December 2026). The market-structure bill H.R. 3633 (CLARITY) remains pending after Senate cloture failed 49-50 on 15 September 2026.

Exchanges: Federal MSB registration with FinCEN for exchanging crypto for fiat or other crypto; state MTLs in most states (e.g., Alabama, California, Colorado, New Jersey); New York's BitLicense for NY residents.

Custody providers: a custodian that also transmits value is a money transmitting business that must register with FinCEN (Form 107 within 180 days, renewed every two years; 31 CFR 1022.380), and that federal registration applies whether or not the business holds a state money transmitter licence (31 U.S.C. 5330). Banks custody crypto assets under existing charters (OCC Interpretive Letter 1183, 7 March 2025). State licences, including New York's BitLicense, are imposed separately under state law.

FinCEN MSB registration is a federal registration distinct from state licensing: 31 CFR 1022.380 requires it whether or not the business is licensed by any state, and 31 CFR 1022.210 separately requires every MSB to develop, implement and maintain a written, risk-based anti-money-laundering program covering customer verification, reporting and recordkeeping.

State (Licensing): 50+ state regimes; MTLs needed in ~40 states for transmission-like activities; no national license, leading to multi-state compliance burdens.

Capital/Net Worth: State-specific (e.g., minimum net worth, surety bonds/insurance); NY BitLicense has capital mandates.

Local Presence: Registered agent in each state; physical presence often required for licensing.

A money services business, including a convertible-virtual-currency exchanger, must register with FinCEN on FinCEN Form 107 within 180 days after it is established and renew the registration every two years (31 CFR 1022.380). Registration applies whether or not the business holds a state licence, and the MSB must maintain, not file, a list of its agents.

State MTL/BitLicense: Apply via NMLS (e.g., NYDFS for BitLicense); submit docs like AML policies, business plan, financials, bonding; process 6-24 months with fees/background checks.

On 17 March 2026 the SEC issued a Commission interpretation, 'Application of the Federal Securities Laws to Certain Types of Crypto Assets and Certain Transactions Involving Crypto Assets' (Rel. 33-11412 / 34-105020, File S7-2026-09), published at 91 FR 13714 on 23 March 2026 and effective that day; the CFTC joined it with guidance that it will administer the Commodity Exchange Act consistently.

On 28 January 2026 the SEC Divisions of Corporation Finance, Investment Management, and Trading and Markets issued a staff Statement on Tokenized Securities: a tokenized security is a security formatted as or represented by a crypto asset with ownership recorded on a crypto network, and it falls into issuer-tokenized or third-party-tokenized categories. The statement is a staff view, not a Commission rule.

Securities and Exchange Commission (SEC): regulates crypto assets that are securities and transactions in them, applying its 17 March 2026 interpretation (Rel. 33-11412, 91 FR 13714); its Crypto Task Force seeks to clarify how the federal securities laws apply to crypto assets and to recommend policy measures.

Commodity Futures Trading Commission (CFTC): regulates commodity derivatives and holds anti-fraud and anti-manipulation authority over commodity spot markets; listed spot crypto trading on CFTC-registered exchanges began 4 December 2025; on 11 March 2026 it signed a Memorandum of Understanding with the SEC creating a Joint Harmonization Initiative; and on 13 October 2026 it issued an ANPRM on Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets (91 FR 64811; comments close 14 December 2026).

Office of the Comptroller of the Currency (OCC): primary federal payment stablecoin regulator under the GENIUS Act for Federal qualified payment stablecoin issuers, which are OCC-approved nonbank entities, uninsured national banks and Federal branches (sections 2(11), 2(25)(D)); it proposed implementing rules on 2 March 2026 (91 FR 10202, docket OCC-2025-0372).

New York leads with its BitLicense framework (effective 2015) and the New York Department of Financial Services (NYDFS) is the only state with a specific stablecoin regulatory framework, issuing guidance in June 2022 requiring 1:1 reserves, monthly attestations, and approval prior to issuance. NYDFS Stablecoin Guidance

California passed the Digital Financial Assets Law (DFAL) in October 2023 (AB 39), which requires stablecoin issuers to obtain a license from the Department of Financial Protection and Innovation (DFPI) by July 2025, with a grandfather period for existing operators. California DFPI AB 39

Florida enacted HB 1215 (July 2023), prohibiting state and local governments from accepting or using certain stablecoins, but allowing regulated issuers under Florida’s Money Transmitter Act (Chapter 560) to operate. Florida Legislature HB 1215

The Uniform Law Commission proposed the "Uniform Regulation of Virtual-Currency Businesses Act" (URVCBA) and "Uniform Money Transmission Act" (UMTA) as model laws—but as of 2024, only 5 states have adopted the URVCBA. The lack of adoption means no national reciprocity exists. Uniform Law Commission

A multi-state licensing initiative exists through the Conference of State Bank Supervisors (CSBS) "Money Transmitter Modernization Project" (2022), which aims to create a single-state application process for money transmission licenses, but it does not yet include stablecoin-specific provisions. CSBS Money Transmitter Modernization

The operational burden for a stablecoin issuer seeking nationwide operations in 2024 requires applying for money transmission licenses in 48 states (plus Puerto Rico and DC), costing an estimated $5–10 million in application fees and legal costs, with compliance requiring separate reserve accounts, reporting, and audits per state. Coinbase State Licensing Overview

Digital Asset Market Clarity Act (CLARITY, H.R. 3633, 119th Congress) is not law. The House passed it 294-134 on 17 July 2025 (Roll no. 199); the Senate Banking Committee ordered it reported with a substitute on 14 May 2026 and reported it on 1 June 2026 (Calendar No. 423). On 15 September 2026 cloture on the motion to proceed failed 49-50 (Record Vote 234), and Sen. Tillis entered a motion to reconsider.

On 12 December 2025 the OCC conditionally approved five national trust bank charter applications (News Release 2025-125): de novo charters for First National Digital Currency Bank and Ripple National Trust Bank, and conversions of BitGo Bank & Trust, Fidelity Digital Assets and Paxos Trust Company to national trust banks. A national trust charter does not itself give access to a Federal Reserve account; the Federal Reserve Board has proposed a separate special-purpose 'payment account' category distinct from master accounts (Regulation D, R-1893; comments closed 27 July 2026).

The Bank Secrecy Act (Pub. L. 91-508, enacted 26 October 1970; 12 U.S.C. 1951 et seq. and 31 U.S.C. 5311 et seq.) is the federal AML statute FinCEN applies to crypto money services businesses. Since 18 July 2025 it is no longer the only federal law reaching crypto assets: the GENIUS Act (Pub. L. 119-27) regulates payment stablecoins directly.

The Commodity Exchange Act has no section 1b(3). Its definition of 'commodity' in section 1a(9) (7 U.S.C. 1a(9)) covers 'all other goods and articles' and 'all services, rights, and interests' dealt in for future delivery, and the 2026 SEC interpretation with CFTC guidance (Rel. 33-11412) states that non-security crypto assets other than permitted payment stablecoins could meet that definition.

The Financial Action Task Force (FATF) recommendations are followed in the U.S., mandating AML/KYC for virtual asset service providers. Maryland aligns with federal compliance of these international standards. [https://fincen.gov/]

Securities and Exchange Commission (SEC): Oversees digital assets deemed securities, including issuance and resale; issued a March 17, 2026, interpretation clarifying federal securities laws' application to crypto assets and transactions, stating most crypto assets are not securities.

Commodity Futures Trading Commission (CFTC): regulates commodities and derivatives under the Commodity Exchange Act; signed a Memorandum of Understanding with the SEC on 11 March 2026 to coordinate oversight and support lawful innovation (SEC PR 2026-26), and joined the SEC’s 17 March 2026 interpretation on crypto assets (Rel. 33-11412, 91 FR 13714), which the CFTC administers the CEA consistently with.

Financial Crimes Enforcement Network (FinCEN): administers the Bank Secrecy Act AML/CFT regime. Under FIN-2013-G001 (18 March 2013) an administrator or exchanger of convertible virtual currency is a money transmitter and therefore a money services business; FIN-2019-G001 (9 May 2019) consolidates that guidance and applies it to further CVC business models. Each MSB must register with FinCEN on Form 107 within 180 days of establishment and renew every two years (31 CFR 1022.380).

State regulators: Examples include California's DFPI (Digital Financial Assets Law effective July 1, 2026, requiring licenses with $100k/day penalties); New Jersey Department of Banking and Insurance; New York's NYDFS (BitLicense regime); Connecticut (money transmitter laws).

Money services businesses dealing in convertible virtual currency must maintain a written AML program whose policies, procedures and internal controls provide for verifying customer identification (31 CFR 1022.210(d)(1)(i)(A)); under FIN-2019-G001 (9 May 2019) a hosted wallet provider must identify, verify and monitor the identity and profile of a user consistent with its AML program.

Money services businesses, including CVC money transmitters, must file a Suspicious Activity Report (SAR) with FinCEN for any transaction conducted or attempted through them that involves or aggregates at least $2,000 and that they know, suspect or have reason to suspect is suspicious, no later than 30 calendar days after initial detection, and must keep the SAR and supporting documentation for five years (31 CFR 1022.320).

Records required under the Bank Secrecy Act regulations (31 CFR Chapter X) must be retained for five years and kept accessible within a reasonable period (31 CFR 1010.430(d)); this includes the funds-transfer records required of MSBs by 31 CFR 1010.410(e).

The OCC, Federal Reserve Board and FDIC issued a joint statement on 14 July 2025, Crypto-Asset Safekeeping by Banking Organizations, applying existing law and risk-management principles to the activity and creating no new supervisory expectations. A banking organization has control of a crypto-asset when it can reasonably demonstrate that no other party, including the customer, has access to information sufficient to unilaterally transfer the asset out of its control; establishing initial control usually requires transfer to the organization on the asset's own distributed ledger, and the same standard applies to any sub-custodian. The statement addresses cryptographic key management, the cold-to-hot wallet continuum, omnibus versus separate account models, per-asset review before safekeeping, customer-agreement contents including forks, airdrops and governance voting, BSA/AML and OFAC obligations, third-party risk including a prohibition on sub-custodian commingling, and audit coverage of key generation, storage and deletion.

OCC Interpretive Letter 1183 (7 March 2025) confirms that crypto-asset custody, certain stablecoin activities and participation in independent node verification networks are permissible for national banks and federal savings associations. Interpretive Letter 1184 (7 May 2025) confirms a bank may buy and sell assets held in custody at the customer's direction and may outsource permissible crypto activities, including custody and execution, to third parties subject to third-party risk management. Interpretive Letter 1186 (18 November 2025) confirms a bank may hold crypto-assets on balance sheet in amounts necessary to pay blockchain network fees for otherwise permissible activities. Each conditions the activity on safe and sound conduct and compliance with applicable law.

OFAC may add digital currency addresses to the Specially Designated Nationals (SDN) List to identify wallets associated with a blocked person, but those listings are not exhaustive (OFAC FAQ 562); under OFAC's 50 Percent Rule, entities owned 50 percent or more in the aggregate by blocked persons are blocked, and the rule speaks only to ownership, not control (OFAC FAQ 398).

OFAC's active sanctions programs table lists 36 programs as of 14 October 2026, including Iran Sanctions, Cuba Sanctions, North Korea Sanctions, Russian Harmful Foreign Activities Sanctions, Ukraine-/Russia-related Sanctions, Venezuela-Related Sanctions, Cyber-Related Sanctions and Transnational Criminal Organizations; it lists no standalone Syria Sanctions program, and instead lists Promoting Accountability for Assad and Regional Stabilization Sanctions (PAARSS).

The International Emergency Economic Powers Act (IEEPA), 50 U.S.C. 1701 et seq., lets the President exercise the section 1702 economic powers to deal with any unusual and extraordinary threat with its source in whole or substantial part outside the United States, once a national emergency has been declared with respect to that threat.

The Iran Sanctions Act of 1996 is Public Law 104-172 and is codified as a statutory note to 50 U.S.C. 1701, not at 31 U.S.C. 5316A-5320.

The Countering America's Adversaries Through Sanctions Act (CAATSA), Public Law 115-44 (H.R. 3364), approved on 2 August 2017, provides sanctions with respect to Iran, the Russian Federation and North Korea.

Suspicious activity reports are filed with FinCEN under the Bank Secrecy Act, not with OFAC; money services businesses must report suspicious transactions of at least $2,000 within 30 calendar days of initial detection (31 CFR 1022.320), while OFAC requires reports of blocked property (31 CFR 501.603) and of rejected transactions (31 CFR 501.604), each within 10 business days.

Under 31 CFR 501.601, every person engaging in a transaction subject to OFAC regulations must keep a full and accurate record of it, available for examination for at least 10 years after the transaction, and holders of blocked property must keep records for as long as the property is blocked and at least 10 years after it is unblocked.

OFAC published Sanctions Compliance Guidance for the Virtual Currency Industry on 15 October 2021; on 21 March 2025 Treasury removed the sanctions on Tornado Cash; on 14 August 2025 OFAC re-designated the Garantex exchange and designated its successor Grinex; and on 14 October 2025 OFAC sanctioned 146 targets in the Cambodia-based Prince Group Transnational Criminal Organization while FinCEN finalized a section 311 rule severing Huione Group from the U.S. financial system.

The SAFE Crypto Act (Strengthening Agency Frameworks for Enforcement of Cryptocurrency Act, S. 3428, 119th Congress), which would establish a Task Force for Recognizing and Averting Cryptocurrency Scams, was introduced on 10 December 2025 by Sen. Jerry Moran with Sen. Elissa Slotkin as original cosponsor and referred to the Senate Banking Committee; it has not advanced beyond committee referral as of 14 October 2026.

Executive Order 14390, "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens", signed by the President on 6 March 2026 and published at 91 FR 12051 (11 March 2026), directs State, Treasury, War, Justice and Homeland Security to review their frameworks within 60 days and, within 120 days, submit an action plan identifying the transnational criminal organizations responsible for scam centers and cybercrime.

On 18 June 2025 the U.S. Department of Justice filed a civil forfeiture complaint in the U.S. District Court for the District of Columbia against more than $225.3 million in cryptocurrency that it alleges was laundered through a blockchain-based network dispersing proceeds of cryptocurrency investment-fraud ("confidence scam") schemes.