Crypto regulation in the USA is undergoing its most significant transformation in years. The federal framework has historically been fragmented across multiple agencies, but recent legislative and regulatory developments are moving the country toward a more unified approach. For founders, exchanges, token issuers, and institutional investors, understanding where the rules stand today is essential before entering or expanding in the US market. This guide covers the current regulatory landscape, the agencies that enforce it, the compliance obligations businesses face, and the practical implications of recent changes.
The United States does not have a single crypto law. Instead, digital assets are regulated through a patchwork of existing securities, commodities, banking, and money transmission laws, applied by multiple federal and state agencies. This multi-regulator structure has created significant uncertainty for businesses, particularly around the central question of whether a given digital asset is a security or a commodity.
The Securities and Exchange Commission (SEC) has historically claimed broad jurisdiction over digital assets, arguing that most tokens qualify as securities under the Howey test - a legal standard derived from a Supreme Court case that defines an investment contract. The Commodity Futures Trading Commission (CFTC) asserts jurisdiction over digital assets it classifies as commodities, including Bitcoin and Ether. The overlap between these two agencies has been a persistent source of legal ambiguity.
The Financial Crimes Enforcement Network (FinCEN), a bureau of the US Treasury, regulates crypto businesses as money services businesses (MSBs) under the Bank Secrecy Act. This requires registration with FinCEN, implementation of anti-money laundering (AML) programmes, and filing of suspicious activity reports. The Office of Foreign Assets Control (OFAC) enforces sanctions compliance, which applies to crypto transactions just as it does to traditional finance.
At the state level, most jurisdictions require crypto businesses to obtain a money transmitter licence. New York';s BitLicense, introduced under the New York Financial Services Law, remains the most demanding state-level framework and is often treated as a benchmark by other states.
The most consequential recent development is the passage of comprehensive federal digital asset legislation. The Financial Innovation and Technology for the 21st Century Act, commonly known as FIT21, establishes a clearer division of regulatory authority between the SEC and CFTC based on the degree of decentralisation of a blockchain network. Under FIT21, digital assets associated with sufficiently decentralised blockchains are classified as digital commodities under CFTC jurisdiction, while assets tied to centralised projects remain securities subject to SEC oversight.
FIT21 also creates a new disclosure and registration regime for digital asset issuers and exchanges, with distinct pathways depending on whether a project is classified as a digital commodity or a restricted digital asset. The legislation represents the first time Congress has directly addressed the SEC-CFTC jurisdictional question in statute, which has been a defining gap in US crypto law for years.
Separately, stablecoin regulation has advanced through the GENIUS Act, which establishes a federal licensing framework for payment stablecoin issuers. The act requires issuers to maintain one-to-one reserves in high-quality liquid assets, submit to regular audits, and register with either a federal banking regulator or an approved state regulator. Non-bank issuers above a certain asset threshold must seek federal approval. This framework directly addresses the regulatory vacuum that previously surrounded dollar-pegged stablecoins.
In practice, founders should consider that these laws create new compliance timelines and registration obligations that did not previously exist. Businesses already operating in the US market should assess whether their activities fall under the new classification rules and whether existing licences or registrations remain sufficient.
Understanding which agency governs which activity is essential for any business operating in the US crypto market.
The SEC oversees the issuance and trading of digital assets that qualify as securities. This includes initial coin offerings (ICOs), token sales, and platforms that facilitate trading of security tokens. Businesses that issue or trade securities must register with the SEC or qualify for an exemption. The SEC has brought enforcement actions against numerous crypto exchanges and token issuers for operating without registration.
The CFTC regulates derivatives markets involving digital assets, including futures, options, and swaps. Under FIT21, its spot market authority over digital commodities is significantly expanded. Exchanges offering commodity-based crypto products must register as designated contract markets or swap execution facilities.
FinCEN requires all crypto businesses that qualify as MSBs to register and maintain robust AML and Know Your Customer (KYC) programmes. This obligation applies regardless of whether a business is also regulated by the SEC or CFTC.
The Office of the Comptroller of the Currency (OCC) has issued guidance permitting national banks to custody digital assets and engage in certain crypto activities, creating a pathway for traditional financial institutions to enter the market under federal banking supervision.
State regulators remain active. The New York Department of Financial Services (NYDFS) enforces the BitLicense regime and has issued detailed guidance on cybersecurity, AML, and consumer protection for crypto businesses operating in New York. Other states, including California, Texas, and Wyoming, have developed their own frameworks, with Wyoming being particularly notable for its special purpose depository institution (SPDI) charter, which allows crypto-native banks to operate under state banking law.
Any business operating in the US crypto market faces a layered set of compliance requirements that vary by activity type, asset classification, and jurisdiction.
For exchanges and trading platforms, the core obligations include registering with the appropriate federal regulator (SEC, CFTC, or both), obtaining state money transmitter licences in each state where users are located, and implementing AML and KYC programmes that meet FinCEN standards. Under FIT21, exchanges dealing in digital commodities must register with the CFTC as digital commodity exchanges, while those handling security tokens must register with the SEC as alternative trading systems or national securities exchanges.
For token issuers, the classification of the token under FIT21 determines the disclosure and registration pathway. Issuers of restricted digital assets must file disclosures with the SEC and comply with securities offering rules. Issuers seeking to establish that their asset is a digital commodity must demonstrate sufficient decentralisation and file a certification with the CFTC. A common mistake is assuming that a token';s economic design alone determines its classification - the degree of decentralisation of the underlying network is now a statutory factor.
For stablecoin issuers, the GENIUS Act imposes reserve, audit, and registration requirements. Non-compliant stablecoin issuers face the risk of enforcement action from both federal banking regulators and state authorities.
For custodians and wallet providers, the SEC';s custody rule amendments impose specific requirements on registered investment advisers that hold client crypto assets. Custodians must use qualified custodians, which under current guidance includes certain state-chartered trust companies and federally chartered banks with OCC approval.
Many underestimate the cost and complexity of obtaining and maintaining state money transmitter licences. Each state has its own application process, bonding requirements, and renewal obligations. A business serving customers in all 50 states may need to hold licences in most of them, with New York';s BitLicense being the most resource-intensive to obtain and maintain.
If you are structuring a crypto business for the US market and need clarity on which licences and registrations apply to your specific activities, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.
Scenario one: a European exchange seeking US market access. A European crypto exchange regulated under the EU';s Markets in Crypto-Assets framework (MiCA) wishes to serve US retail customers. MiCA authorisation does not provide any passporting rights into the US market. The exchange must separately register with the CFTC or SEC depending on the assets it offers, obtain FinCEN MSB registration, and secure state money transmitter licences. If it offers stablecoins, it must comply with the GENIUS Act. The process typically takes 12 to 24 months and involves significant legal and compliance expenditure. A non-obvious requirement is that the exchange must also comply with OFAC sanctions screening from day one of onboarding US customers.
Scenario two: a US-based token issuer launching a new project. A startup based in California plans to issue a governance token for a decentralised protocol. Under FIT21, the issuer must assess whether the token qualifies as a digital commodity or a restricted digital asset. If the network is not yet sufficiently decentralised at launch, the token is likely a restricted digital asset and must be offered under SEC exemptions or through a registered offering. The issuer can later file a certification with the CFTC to transition the asset to digital commodity status once decentralisation thresholds are met. A common mistake is launching without this analysis and later facing SEC enforcement for an unregistered securities offering.
The Internal Revenue Service (IRS) treats digital assets as property for federal tax purposes, a classification established in IRS Notice 2014-21 and reinforced by subsequent guidance. This means that every disposal of a digital asset - whether by sale, exchange, or use in a transaction - is a taxable event subject to capital gains or ordinary income tax depending on the holding period and the nature of the activity.
For businesses, crypto received as payment for goods or services is treated as ordinary income at fair market value on the date of receipt. Mining and staking rewards are also treated as ordinary income. Businesses must maintain detailed records of every transaction, including acquisition cost, date, and disposal proceeds, to calculate gain or loss accurately.
The Infrastructure Investment and Jobs Act introduced broker reporting requirements for digital asset transactions. Brokers - defined broadly to include exchanges, custodians, and certain other intermediaries - must report customer transactions to the IRS on Form 1099-DA. These requirements are being phased in, with full implementation expected to cover a wide range of digital asset service providers. Businesses that qualify as brokers must implement systems to collect customer tax identification information and generate accurate reports.
The Corporate Transparency Act, administered by FinCEN, also requires most US legal entities to file beneficial ownership information reports. Crypto businesses structured as LLCs or corporations are generally subject to this requirement unless they qualify for an exemption.
The SEC and CFTC have both maintained active enforcement programmes in the crypto sector. The SEC has brought actions against exchanges for operating unregistered securities trading platforms, against token issuers for conducting unregistered securities offerings, and against individuals for market manipulation and fraud. The CFTC has pursued cases involving unregistered derivatives trading and fraud in commodity markets.
FinCEN and OFAC have imposed significant penalties on crypto businesses for AML failures and sanctions violations. Enforcement in this area focuses on businesses that failed to implement adequate KYC procedures, processed transactions for sanctioned persons or jurisdictions, or failed to file required suspicious activity reports.
Under FIT21, the enforcement landscape is expected to shift as the new registration regimes come into effect. Businesses that were previously operating in a grey area may find themselves clearly subject to CFTC or SEC jurisdiction and required to register within defined transition periods. Missing these deadlines carries significant legal risk.
A non-obvious risk area is the treatment of decentralised finance (DeFi) protocols. Regulators have signalled that the mere use of smart contracts does not exempt a protocol from regulatory obligations if there is a sufficiently centralised party that can be held responsible. Founders and developers of DeFi projects should not assume that decentralisation alone provides a regulatory shield.
For businesses navigating enforcement risk or structuring their operations to minimise regulatory exposure, contact info@vlolawfirm.com. We can assist with documents and filings across the full range of US crypto compliance requirements.
What is the biggest compliance risk for a foreign crypto business entering the US market?
The most significant risk is operating without the required federal and state registrations. Many foreign businesses assume that serving US customers through an offshore entity avoids US regulatory jurisdiction, but US regulators apply their rules based on where customers are located, not where the business is incorporated. The SEC, CFTC, and FinCEN have all taken enforcement action against foreign entities for providing unregistered services to US persons. The practical consequence is that a business can face civil penalties, disgorgement of profits, and reputational damage without ever having a US office. Any business with US customers should conduct a regulatory mapping exercise before onboarding them.
How long does it take and what does it cost to become compliant in the US market?
The timeline depends heavily on the scope of activities. Obtaining FinCEN MSB registration is relatively straightforward and can be completed within weeks. State money transmitter licences take between three and 18 months per state, with New York';s BitLicense at the longer end. SEC or CFTC registration processes are more complex and can take 12 months or more. Professional fees for legal, compliance, and technology infrastructure typically run into the hundreds of thousands of dollars for a full market entry, with ongoing annual compliance costs also substantial. Businesses should budget for both the initial licensing phase and the recurring cost of maintaining programmes, reporting, and renewals.
Does the US have an equivalent to the EU';s MiCA framework, and should businesses wait for further regulatory clarity?
The US does not have a single unified framework equivalent to MiCA. FIT21 and the GENIUS Act together represent the closest the US has come to a comprehensive legislative approach, but implementation is ongoing and further rulemaking by the SEC and CFTC is expected. Waiting for complete regulatory clarity is generally not a viable strategy - the US market is too large and competitive for most businesses to defer entry indefinitely. A more practical approach is to structure operations around the current rules while building in flexibility to adapt as new regulations take effect. Businesses that engage with regulators early, through no-action letters or informal guidance, are often better positioned than those that wait on the sidelines.
Crypto regulation in the USA is more structured than it was even a few years ago, but it remains complex and multi-layered. FIT21, the GENIUS Act, and active enforcement by the SEC, CFTC, FinCEN, and OFAC together create a demanding compliance environment. Businesses that invest in proper legal structuring and regulatory engagement from the outset are significantly better positioned than those that treat compliance as an afterthought.
VLO Law Firms advises international clients on crypto regulation in the USA. We can assist with regulatory mapping, licence applications, AML programme design, token classification analysis, and ongoing compliance support. To request a consultation, contact: info@vlolawfirm.com