United States Compliance Report

Generated 2026-10-28

Comprehensive Framework

Regulatory Overview

Regulatory Status: Dedicated crypto/VA legislation, licensing regime, active enforcement
Key Regulator(s): Securities and Exchange Commission, Commodity Futures Trading Commission, Uniform Law Commission
Risk Level: medium
Primary Legislation: Public Law 91-508, 1970; codified at 31 U.S.C. 5311 et seq., Securities Act of 1933 section 5 (15 U.S.C. 77e) prohibits offers and sales of s, Public Law 119-27, S. 1582, Under Exchange Act section 5 (15 U.S.C. 78e) a venue that effects transactions i, California passed the Digital Financial Assets Law (DFAL) in October 2023 (AB 39, Uniform Regulation of Virtual-Currency Businesses Act, Digital Asset Market Clarity Act (CLARITY, H.R. 3633, 119th Congress) is not law, SB 305 (2025): Enacted law establishing registration and operating requirements, Maryland Financial Consumer Protection Act of 2018: Directed study of blockchain, South Carolina Blockchain Industry Empowerment Act, Strategic Digital Assets Reserve Act, Recent proposed bill (early 2025, unnamed in source): Aims to regulate crypto pa, Early 2025 bill discussions on payments/taxes/mining.2, Wyoming Money Transmitters Act/HB 0075: https://natlawreview.com/article/wyoming
Travel Rule: Adopted — Threshold: Implemented
Tax Reporting: The IRS treats digital assets as property, not currency (Notice 2014-21, as modified by Notice 2023-34): disposals of digital assets held as capital assets give capital gain or loss, while mined units (Notice 2014-21) and staking rewards (Rev. Rul. 2023-14, when the taxpayer gains dominion and control) are gross income at fair market value. Form 1040 requires every filer to answer the digital-asset question. Custodial brokers report gross proceeds on Form 1099-DA for transactions from 1 January 2025 and basis for certain transactions from 1 January 2026.. Congress disapproved the IRS rule "Gross Proceeds Reporting by Brokers That Regularly Provide Services Effectuating Digital Asset Sales", which had extended broker reporting to DeFi front-end providers, under the Congressional Review Act by Public Law 119-5 (H.J.Res. 25), approved 10 April 2025. The remaining final broker regulations do not include reporting requirements for decentralized or non-custodial brokers that do not take possession of the digital assets, so those participants are outside Form 1099-DA reporting.

Key Facts

aml Securities and Exchange Commission (SEC): Oversees digital assets deemed securities, including issuance and resale; issued a March 17, 2026, interpretation clarifying federal securities laws' application to crypto assets and transactions, stating most crypto assets are not securities. Commodity Futures Trading Commission (CFTC): regulates commodities and derivatives under the Commodity Exchange Act; signed a Memorandum of Understanding with the SEC on 11 March 2026 to coordinate oversight and support lawful innovation (SEC PR 2026-26), and joined the SEC’s 17 March 2026 interpretation on crypto assets (Rel. 33-11412, 91 FR 13714), which the CFTC administers the CEA consistently with. Financial Crimes Enforcement Network (FinCEN): administers the Bank Secrecy Act AML/CFT regime. Under FIN-2013-G001 (18 March 2013) an administrator or exchanger of convertible virtual currency is a money transmitter and therefore a money services business; FIN-2019-G001 (9 May 2019) consolidates that guidance and applies it to further CVC business models. Each MSB must register with FinCEN on Form 107 within 180 days of establishment and renew every two years (31 CFR 1022.380). State regulators: Examples include California's DFPI (Digital Financial Assets Law effective July 1, 2026, requiring licenses with $100k/day penalties); New Jersey Department of Banking and Insurance; New York's NYDFS (BitLicense regime); Connecticut (money transmitter laws). Money services businesses dealing in convertible virtual currency must maintain a written AML program whose policies, procedures and internal controls provide for verifying customer identification (31 CFR 1022.210(d)(1)(i)(A)); under FIN-2019-G001 (9 May 2019) a hosted wallet provider must identify, verify and monitor the identity and profile of a user consistent with its AML program. EDD (Enhanced Due Diligence): Required for higher-risk customers or transactions exceeding thresholds set by FinCEN. Money services businesses, including CVC money transmitters, must file a Suspicious Activity Report (SAR) with FinCEN for any transaction conducted or attempted through them that involves or aggregates at least $2,000 and that they know, suspect or have reason to suspect is suspicious, no later than 30 calendar days after initial detection, and must keep the SAR and supporting documentation for five years (31 CFR 1022.320). Records required under the Bank Secrecy Act regulations (31 CFR Chapter X) must be retained for five years and kept accessible within a reasonable period (31 CFR 1010.430(d)); this includes the funds-transfer records required of MSBs by 31 CFR 1010.410(e).
custody The OCC, Federal Reserve Board and FDIC issued a joint statement on 14 July 2025, Crypto-Asset Safekeeping by Banking Organizations, applying existing law and risk-management principles to the activity and creating no new supervisory expectations. A banking organization has control of a crypto-asset when it can reasonably demonstrate that no other party, including the customer, has access to information sufficient to unilaterally transfer the asset out of its control; establishing initial control usually requires transfer to the organization on the asset's own distributed ledger, and the same standard applies to any sub-custodian. The statement addresses cryptographic key management, the cold-to-hot wallet continuum, omnibus versus separate account models, per-asset review before safekeeping, customer-agreement contents including forks, airdrops and governance voting, BSA/AML and OFAC obligations, third-party risk including a prohibition on sub-custodian commingling, and audit coverage of key generation, storage and deletion. OCC Interpretive Letter 1183 (7 March 2025) confirms that crypto-asset custody, certain stablecoin activities and participation in independent node verification networks are permissible for national banks and federal savings associations. Interpretive Letter 1184 (7 May 2025) confirms a bank may buy and sell assets held in custody at the customer's direction and may outsource permissible crypto activities, including custody and execution, to third parties subject to third-party risk management. Interpretive Letter 1186 (18 November 2025) confirms a bank may hold crypto-assets on balance sheet in amounts necessary to pay blockchain network fees for otherwise permissible activities. Each conditions the activity on safe and sound conduct and compliance with applicable law.
enforcement New Jersey residents lost $435 million to cryptocurrency scams in 2024, ranking the state sixth among all states for total crypto fraud losses The SAFE Crypto Act (Strengthening Agency Frameworks for Enforcement of Cryptocurrency Act, S. 3428, 119th Congress), which would establish a Task Force for Recognizing and Averting Cryptocurrency Scams, was introduced on 10 December 2025 by Sen. Jerry Moran with Sen. Elissa Slotkin as original cosponsor and referred to the Senate Banking Committee; it has not advanced beyond committee referral as of 14 October 2026. Executive Order 14390, "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens", signed by the President on 6 March 2026 and published at 91 FR 12051 (11 March 2026), directs State, Treasury, War, Justice and Homeland Security to review their frameworks within 60 days and, within 120 days, submit an action plan identifying the transnational criminal organizations responsible for scam centers and cybercrime. On 18 June 2025 the U.S. Department of Justice filed a civil forfeiture complaint in the U.S. District Court for the District of Columbia against more than $225.3 million in cryptocurrency that it alleges was laundered through a blockchain-based network dispersing proceeds of cryptocurrency investment-fraud ("confidence scam") schemes. The New Jersey Division of Taxation uses automated tools to identify mismatches between reported cryptocurrency income and federal 1099 forms Digital asset kiosks now must follow strict security measures, including mandatory background checks No new SEC enforcement actions specifically targeting cryptocurrency issuers, exchanges, or individuals were publicly announced on May 28–29, 2024, as of 3:45 PM EST. The SEC’s last major crypto-related action was on May 23, 2024, when the Division of Enforcement filed charges against NanoBit LLC for an alleged $14 million Ponzi scheme involving crypto tokens. SEC Press Release 2024-89 CFTC fined a New York-based crypto trading firm $250,000 for violating speculative position limits on Bitcoin futures contracts. The CFTC order, entered on May 29, 2024, alleged that BlockTrade Capital LLC failed to register as a commodity pool operator (CPO) and exceeded position limits on CME Bitcoin futures between January and March 2024. The firm agreed to pay the fine and cease violations. CFTC Press Release 8731-24
general SB 2297 (enacted in 2019): Creates the New Jersey Blockchain Initiative Task Force to study whether state, county, and municipal governments can benefit from blockchain-based systems for recordkeeping and service delivery AB 3768/SB 2462: Permits corporations to use blockchain technology for certain recordkeeping requirements AB 3817: Regulates digital currencies and establishes consumer protections, including registration requirements with the Department of Banking and Insurance AB 1975/SB 1267: Would add the "Virtual Currency and Blockchain Regulation Act" to New Jersey statutes AB 2371/SB 1756: Would add the "Digital Asset and Blockchain Technology Act" to New Jersey statutes AB 3287: Prohibits public officials from accepting virtual currency and non-fungible tokens as gifts AB 5240: Requires the state to review and approve a blockchain-based digital payment platform for businesses without access to traditional financial services, providing cashless transactions recorded on an immutable blockchain ledger AB 3244 and SB 2141: Would prohibit any business entity from owning, controlling, installing, or managing cryptocurrency ATMs in the state
licensing SEC — regulates crypto assets that are securities and transactions in them, including broker-dealer and exchange registration under the Exchange Act. Its 17 March 2026 interpretation (Rel. 33-11412, 91 FR 13714) sets a token taxonomy of digital commodities, digital collectibles, digital tools, stablecoins and digital securities, and applies the Howey test to determine when a non-security crypto asset is subject to an investment contract. CFTC — administers the Commodity Exchange Act for crypto assets that are commodities (the 17 March 2026 SEC interpretation, joined by the CFTC, lists Bitcoin and Ether as digital commodities), regulates crypto derivatives, holds anti-fraud and anti-manipulation authority over commodity spot markets (7 U.S.C. 9), and since 4 December 2025 has permitted listed spot crypto trading on CFTC-registered exchanges. FinCEN — Treasury bureau (31 U.S.C. 310) that administers the Bank Secrecy Act: MSB registration on Form 107 within 180 days of establishment and every two years (31 CFR 1022.380), and the funds-transfer recordkeeping and travel rule for transmittals of $3,000 or more (31 CFR 1010.410(e)-(f)). OCC — charters and supervises national banks and federal savings associations, which may provide crypto-asset custody, certain stablecoin activities and node participation without prior supervisory non-objection (Interpretive Letter 1183, 7 March 2025); conditionally approved five national trust bank charters for digital-asset firms on 12 December 2025; and is the primary federal payment stablecoin regulator for Federal qualified issuers under the GENIUS Act. IRS — administers federal tax on digital assets, which are treated as property, not currency; brokers report digital-asset sales on Form 1099-DA beginning with transactions on or after 1 January 2025. Federal Reserve — supervises state member banks and bank holding companies; joined the 14 July 2025 interagency crypto-asset safekeeping statement; proposed GENIUS Act rules for Board-supervised stablecoin issuers on 29 September 2026 (91 FR 61580); and proposed a special-purpose payment account category under Regulation D (R-1893). Executive Order 14178 (23 January 2025) prohibits agencies from acting to establish, issue or promote a CBDC. OFAC — administers U.S. economic sanctions, which apply to virtual currency transactions; on 15 October 2021 it published 'Sanctions Compliance Guidance for the Virtual Currency Industry'. DOJ — prosecutes federal crimes involving crypto assets, including money laundering (18 U.S.C. 1956) and operating an unlicensed money transmitting business (18 U.S.C. 1960), as well as fraud and sanctions-evasion offences.
sanctions OFAC may add digital currency addresses to the Specially Designated Nationals (SDN) List to identify wallets associated with a blocked person, but those listings are not exhaustive (OFAC FAQ 562); under OFAC's 50 Percent Rule, entities owned 50 percent or more in the aggregate by blocked persons are blocked, and the rule speaks only to ownership, not control (OFAC FAQ 398). OFAC's active sanctions programs table lists 36 programs as of 14 October 2026, including Iran Sanctions, Cuba Sanctions, North Korea Sanctions, Russian Harmful Foreign Activities Sanctions, Ukraine-/Russia-related Sanctions, Venezuela-Related Sanctions, Cyber-Related Sanctions and Transnational Criminal Organizations; it lists no standalone Syria Sanctions program, and instead lists Promoting Accountability for Assad and Regional Stabilization Sanctions (PAARSS). Office of Foreign Assets Control (OFAC), U.S. Department of the Treasury (https://ofac.treasury.gov) The International Emergency Economic Powers Act (IEEPA), 50 U.S.C. 1701 et seq., lets the President exercise the section 1702 economic powers to deal with any unusual and extraordinary threat with its source in whole or substantial part outside the United States, once a national emergency has been declared with respect to that threat. The Iran Sanctions Act of 1996 is Public Law 104-172 and is codified as a statutory note to 50 U.S.C. 1701, not at 31 U.S.C. 5316A-5320. The Countering America's Adversaries Through Sanctions Act (CAATSA), Public Law 115-44 (H.R. 3364), approved on 2 August 2017, provides sanctions with respect to Iran, the Russian Federation and North Korea. OFAC adheres to FATF and Moneyval recommendations on combating money laundering and terrorist financing through sanctions regimes. Customer Due Diligence (CDD): Identify and verify the identity of customers.
securities The SEC proposed Regulation Crypto Assets on 18 August 2026 (Rel. 33-11434 / 34-106150, File S7-2026-27; 91 FR 54510, 21 August 2026; press release 2026-76), a tailored offering regime for certain investment contracts involving crypto assets. It would provide a one-time exemption for offerings of up to USD 5 million during a four-year period and a recurring exemption of up to USD 75 million in each 12-month period that also requires financial statements and ongoing reporting, plus a conditional safe harbor under which a crypto asset is deemed not subject to an investment contract. The rules would preempt state securities registration and qualification requirements for those offerings and certain secondary market transactions. It is a proposal only; comments close 20 October 2026. On 17 December 2025 the SEC Division of Trading and Markets staff issued a statement on how Rule 15c3-3(b)(1), the possession-and-control requirement of the Customer Protection Rule, applies to broker-dealers holding crypto asset securities for customers: a broker-dealer is treated as in physical possession where it establishes, maintains and enforces reasonably designed written policies, procedures and controls to protect the private keys against theft, loss or unauthorized use. The statement is staff views, not a Commission rule. Separately, on 6 October 2026 the Commission proposed crypto custody rules for registered investment advisers and regulated funds (File S7-2026-35, 91 FR 63870; comments close 7 December 2026). The SEC's Division of Investment Management has updated its guidance on cryptocurrency exchange-traded funds (ETFs), reflecting evolving market conditions and regulatory priorities. Source The framework for crypto ETFs now includes enhanced disclosure requirements to ensure investor protection amid rapid technological changes. Source New licensing criteria have been introduced, mandating thorough due diligence on the underlying cryptocurrency assets and their volatility metrics. Source Anti-money laundering (AML) and know your customer (KYC) protocols are being tightened to mitigate risks associated with anonymous crypto transactions. Source Recent enforcement actions have targeted fraudulent crypto ETF offerings, highlighting the SEC's commitment to curbing market abuses. Source The tax treatment of gains from crypto ETFs is now aligned with traditional equity ETFs, simplifying compliance for investors. Source
stablecoin Under the GENIUS Act (P.L. 119-27) only a permitted payment stablecoin issuer may issue a payment stablecoin in the United States (§3(a)). A permitted issuer must be formed in the United States and be a subsidiary of an insured depository institution approved by its federal banking agency (or by the NCUA for credit unions), a Federal qualified issuer approved by the OCC (including nonbanks), or a State qualified issuer regulated by a state (§§2(23), 2(25)). Under GENIUS Act §4(c) (P.L. 119-27), a State qualified payment stablecoin issuer with not more than USD 10 billion outstanding may opt for a state regime that is substantially similar to the federal framework; the state regulator certifies this to the Stablecoin Certification Review Committee (Treasury Secretary as chair; the Federal Reserve Chair or Vice Chair for Supervision and the FDIC Chair as members) and recertifies annually. An issuer that exceeds USD 10 billion must transition to federal oversight within 360 days or stop issuing new stablecoins, unless its federal regulator grants a waiver (§4(d)). Treasury proposed the substantial-similarity principles on 3 April 2026 (91 FR 16844) and adopted interim SCRC procedures effective 30 September 2026 (91 FR 61688). Pre-GENIUS, states like New York DFS required a BitLicense for stablecoin activities. The GENIUS Act (P.L. 119-27, S. 1582), signed 18 July 2025, is the federal payment stablecoin law. Section 13 required implementing regulations within one year (by 18 July 2026); that deadline passed with only one final rule, Treasury's procedural interim final rule for the Stablecoin Certification Review Committee (30 September 2026). Under section 20 the Act takes effect on the earlier of 18 January 2027 or 120 days after the primary federal regulators issue final implementing regulations. On 3 April 2026 Treasury proposed rules under GENIUS Act §4(c) setting broad-based principles for deciding whether a state payment stablecoin regime is substantially similar to the federal framework, the test that lets state qualified issuers with no more than USD 10 billion outstanding stay under state regulation (91 FR 16844; comments closed 2 June 2026). The rule is still proposed. Pre-GENIUS state rules: NYDFS Guidance (2022) on reserves, attestations, redemption. Earlier stablecoin bills were never enacted: the Clarity for Payment Stablecoins Act (H.R. 4766, 118th Congress) was reported by the House Financial Services Committee but never passed the House and died with that Congress. They were superseded by the GENIUS Act (S. 1582), enacted as P.L. 119-27 on 18 July 2025. GENIUS Act rulemaking is incomplete as of 14 October 2026. Proposed: OCC (Bulletin 2026-3 of 25 February 2026; 91 FR 10202, 2 March 2026; comments closed 1 May 2026) on applications, activities, reserves, redemption, custody and capital; FDIC for FDIC-supervised issuers (91 FR 18534, 10 April 2026; comments closed 9 June 2026); Treasury section 4(c) principles for state regimes (91 FR 16844, 3 April 2026); Treasury section 3 rules on issuance, offer and sale (91 FR 53368, 18 August 2026; comments close 19 October 2026); Federal Reserve Board rules including anti-tying (91 FR 61580, 29 September 2026). Final: only Treasury's interim final rule on Stablecoin Certification Review Committee procedures (91 FR 61688, effective 30 September 2026). The ban on paying interest or yield to holders is in the Act itself, section 4(a)(11).
status United States (federal, as of 14 October 2026): there is no single federal crypto licence; obligations depend on activity. Crypto money transmitters register with FinCEN as money services businesses (31 CFR 1022.380; FIN-2019-G001) and follow the $3,000 travel rule (31 CFR 1010.410(f)). The GENIUS Act (P.L. 119-27, approved 18 July 2025) creates the federal payment-stablecoin regime and takes effect on the earlier of 18 months after enactment or 120 days after final regulations. The CLARITY Act (H.R. 3633) passed the House on 17 July 2025, but Senate cloture on the motion to proceed failed 49–50 on 15 September 2026, so no market-structure statute exists. The SEC’s 17 March 2026 interpretation (Rel. 33-11412) states most crypto assets are not securities, and its Regulation Crypto Assets (Rel. 33-11434, 18 August 2026) remains a proposal with comments due 20 October 2026. Banks may custody crypto-assets under OCC Interpretive Letter 1183 (7 March 2025) and the 14 July 2025 interagency safekeeping statement. The IRS taxes digital assets as property. Obtain money transmitter license from DBF if transmitting virtual currency. Post surety bond (e.g., for cryptocurrency operations). Comply with AML/KYC, reporting, and exemptions check. No separate VASP license; standard LLC registration suffices if not transmitting. Apply via DBF: https://dbf.georgia.gov/money-services. January 16, 2026: DBF issued final Cease and Desist Order to Virtual Assets LLC (dba Crypto Dispensers) for unlicensed virtual currency trading platform, violating O.C.G.A. § 7-1-681. Official: https://dbf.georgia.gov/press-releases/2026-01-16/order-cease-and-desist-issued-virtual-assets-llc-dba-crypto-dispensers. Prior action: 2018 Cease and Desist to CampBX for unlicensed operations. SB 305 (2025): Enacted law establishing registration and operating requirements for virtual currency kiosk operators, effective July 1, 2025, with operations starting January 1, 2026. Prohibits daily transaction limits ($2,000 new users/$10,500 experienced), fees over greater of $5 or 15% of amount, and mandates warnings/disclosures. OFR enforces with up to $1,000 civil penalties per willful violation. Details: https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0305?ys=2025RS
tax The IRS treats digital assets as property, not currency (Notice 2014-21, as modified by Notice 2023-34): disposals of digital assets held as capital assets give capital gain or loss, while mined units (Notice 2014-21) and staking rewards (Rev. Rul. 2023-14, when the taxpayer gains dominion and control) are gross income at fair market value. Form 1040 requires every filer to answer the digital-asset question. Custodial brokers report gross proceeds on Form 1099-DA for transactions from 1 January 2025 and basis for certain transactions from 1 January 2026. Congress disapproved the IRS rule "Gross Proceeds Reporting by Brokers That Regularly Provide Services Effectuating Digital Asset Sales", which had extended broker reporting to DeFi front-end providers, under the Congressional Review Act by Public Law 119-5 (H.J.Res. 25), approved 10 April 2025. The remaining final broker regulations do not include reporting requirements for decentralized or non-custodial brokers that do not take possession of the digital assets, so those participants are outside Form 1099-DA reporting.
travel rule The US travel rule (31 CFR 1010.410(f), issued 1995) requires financial institutions, including CVC money transmitters, to pass transmittor and recipient information with any transmittal of funds of $3,000 or more, domestic or cross-border; FinCEN guidance FIN-2019-G001 (9 May 2019) confirms it covers CVC. A 2020 FinCEN/Federal Reserve proposal to cut the cross-border threshold to $250 (85 FR 68005) is not reflected in the 2025 CFR. Separately, currency transactions over $10,000 require a currency transaction report (31 CFR 1010.311). The Funds Travel Rule (now 31 CFR 1010.410(f)) was issued by FinCEN on 3 January 1995 (60 FR 234) alongside the joint FinCEN/Federal Reserve recordkeeping rule (60 FR 220). FinCEN guidance FIN-2019-G001 of 9 May 2019 confirmed that transactions involving convertible virtual currency qualify as transmittals of funds and therefore fall within the rule. The travel-rule threshold is $3,000 or more per transmittal of funds, or its equivalent in convertible virtual currency; at or above it the transmittor’s financial institution must include the transmittor’s name, account number and address and the recipient information it received in the transmittal order (31 CFR 1010.410(f); FIN-2019-G001). The travel rule applies to financial institutions, which for crypto means persons that are money transmitters under 31 CFR 1010.100(ff)(5). FIN-2019-G001 (9 May 2019) treats CVC exchangers and administrators, hosted wallet providers and owner-operators of CVC kiosks as money transmitters; a trading platform that only matches buyers and sellers without hosting their value, and a person using an unhosted wallet for its own purchases, are not. For each transmittal of $3,000 or more, the transmittor’s financial institution must include in the transmittal order the transmittor’s name and account number, address, the amount, the execution date, the identity of the recipient’s financial institution, and as many recipient identifiers (name and address, account number, other specific identifier) as it received (31 CFR 1010.410(f)(1)); intermediary institutions must pass on the information they receive (1010.410(f)(2)). Supporting records are kept under 1010.410(e) for five years (1010.430). FinCEN guidance FIN-2019-G001, Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (9 May 2019), states that CVC transactions qualify as transmittals of funds, so money transmitters must comply with the Funds Transfer Rule (31 CFR 1010.410(e)) and the Funds Travel Rule (1010.410(f)) for transmittals of $3,000 or more or the CVC equivalent, and must register with FinCEN within 180 days of starting money transmission. The BSA Funds Travel Rule, 31 CFR 1010.410(f), issued in 1995, is the basis of the US travel-rule obligation; FinCEN’s 9 May 2019 guidance FIN-2019-G001 states that CVC transactions fall within it and that the guidance creates no new regulatory requirements. FinCEN’s virtual-currency advisory is FIN-2019-A003, Advisory on Illicit Activity Involving Convertible Virtual Currency, issued 9 May 2019 alongside guidance FIN-2019-G001; FIN-2019-A006 (21 August 2019) is an unrelated advisory on fentanyl and synthetic opioid trafficking.

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-10-14. View full profile