Compliance standards for crypto finance after MiCA, DORA, Basel and FATF
a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}
What compliance standards mean in crypto finance
In crypto finance, compliance standards no longer mean a loose mix of AML checklists, cybersecurity policies and legal disclaimers. As of October 2026, they increasingly refer to an auditable operating model that connects customer due diligence, Travel Rule data, market conduct, custody, reserves, operational resilience, sanctions controls and board accountability. The practical point is straightforward: there is no single global crypto compliance standard. Regulators are, however, converging around similar control outcomes. FATF focuses on AML/CFT and virtual asset service providers, MiCA sets EU conduct and authorization rules, DORA raises ICT resilience expectations, Basel addresses bank crypto exposures, and U.S. stablecoin implementation is moving through rulemaking after the GENIUS Act. (fatf-gafi.org)
This matters for any business involved in trading, custody, token issuance, settlement, stablecoins or crypto-related banking. A firm trying to demonstrate credibility to regulators, counterparties and institutional clients should not start by asking which single certificate it needs. It should first identify its legal role, where its customers are located, which assets it supports, who controls private keys, how funds move, and what evidence it can produce when a supervisor asks for proof. For more regulatory coverage, visit our Regulation and Compliance section.
Why standards are becoming supervisory tests
The direction of travel is clear: regulators are moving from broad policy principles toward supervision, enforcement and proof of effectiveness. FATF’s July 16, 2026 targeted update says jurisdictions have continued to make progress on risk assessments, licensing or registration, Travel Rule implementation and supervisory action. The same update also identifies significant gaps in translating risk assessments into mitigation, operating licensing regimes in practice, identifying entities conducting VASP activity, and supervising or enforcing rules effectively. (fatf-gafi.org)
That distinction matters. A written policy may show intent, but it does not prove that high-risk customers are reviewed, sanctioned addresses are blocked, suspicious activity is escalated, third-party vendors are controlled or customer assets are segregated. The compliance standard that matters in practice is the control standard that survives testing. Supervisors increasingly expect governance minutes, risk assessments, alerts, exception logs, reconciliation records, vendor due diligence, incident reports and training evidence.
FATF’s 2026 update also highlights rising risks around virtual asset-enabled fraud, stablecoin misuse, peer-to-peer activity through unhosted wallets, offshore VASPs outside effective oversight and continuing challenges involving DeFi arrangements. These risk categories explain why compliance cannot stop at onboarding forms. It has to connect identity, wallets, transaction flows, customer behavior, product design and cross-border exposure. (fatf-gafi.org)
The practical standards map
Crypto firms should map compliance standards by activity, not by marketing label. A platform may be a crypto-asset service provider in the EU, a money transmitter or MSB in the United States, a bank counterparty under prudential rules, a stablecoin issuer, a broker-dealer depending on asset characteristics, or several of these at the same time. The table below summarizes the standards most often relevant to regulated crypto finance.
| Standard or regime | Main scope | Core compliance expectation | Practical control output |
|---|---|---|---|
| FATF Recommendation 15 and the Travel Rule | Virtual assets and VASPs | Risk assessment, AML/CFT controls, licensing or registration, Travel Rule information exchange and supervision | Customer risk files, transaction monitoring, originator and beneficiary data, suspicious activity escalation |
| EU MiCA | Crypto-asset issuers, asset-referenced tokens, e-money tokens and crypto-asset service providers | Authorization, white papers, fair disclosures, governance, complaints, conflicts, prudential safeguards, market abuse controls and client asset segregation | Regulatory permissions, product disclosures, client asset procedures, conduct controls and wind-down plans |
| EU DORA | Financial entities within scope, including digital finance firms affected through EU financial regulation | ICT risk management, incident reporting, resilience testing, third-party risk management and oversight of critical ICT providers | ICT risk register, vendor inventory, incident playbooks, resilience tests and board reporting |
| Basel cryptoasset standards | Banks with cryptoasset exposures | Classification, prudential treatment, capital and liquidity implications, and standardized disclosure of cryptoasset exposures | Exposure classification, capital calculations, risk reports and public disclosure templates |
| U.S. BSA, FinCEN and stablecoin implementation | Money transmitters, MSBs, payment stablecoin issuers and related digital asset service providers | AML program, registration, reporting, sanctions compliance, reserve and redemption requirements where applicable | Written AML program, SAR and CTR process, sanctions screening, reserve reports and supervisory records |
MiCA is especially important because it creates a broad EU framework for crypto-asset issuers and service providers. EUR-Lex summarizes its coverage as including transparency and disclosure, authorization and supervision, governance, holder and client protection, and measures to prevent insider dealing and market manipulation. MiCA has applied generally from December 30, 2024, while its rules for asset-referenced tokens and e-money tokens have applied since June 30, 2024. (eur-lex.europa.eu)
DORA is different because it does not focus on token economics. It focuses on digital operational resilience. ESMA describes DORA as applying from January 17, 2025 and covering ICT risk management, third-party risk, resilience testing, incident handling and information sharing for financial entities within scope. For crypto firms, the practical lesson is that a strong AML program is not enough if key management, cloud infrastructure, custody systems or incident reporting are weak. (esma.europa.eu)
Controls that translate standards into daily operations
Governance and accountability
A credible compliance framework starts with ownership. Senior management should approve the risk appetite, define product approval criteria, review high-risk exposure, and make sure compliance, legal, cybersecurity, finance and operations do not work in silos. For a crypto exchange, the listing committee should not be disconnected from sanctions risk, market abuse surveillance, custody capacity or customer disclosures. For a stablecoin issuer, reserve governance and redemption operations belong in the same risk framework as AML and sanctions controls.
Customer and transaction controls
AML standards require firms to know who they are dealing with and how funds move. In the United States, FinCEN’s virtual currency guidance treats administrators and exchangers that accept and transmit convertible virtual currency as money transmitters in relevant circumstances, while IRS guidance notes that MSBs must register with FinCEN, maintain AML programs and file required reports. (fincen.gov)
In practice, customer and transaction controls should include risk-based onboarding, sanctions screening, politically exposed person checks, wallet risk analytics, monitoring for typologies such as layering or scam proceeds, and escalation rules for suspicious activity. The Travel Rule should not be treated as a vendor plug-in alone. Firms also need procedures for data quality, counterparty VASP due diligence, rejected or incomplete transfers, privacy protection and record retention.
Custody, reserves and asset segregation
Custody failures are often compliance failures as much as technology failures. MiCA requires crypto-asset service providers to keep client crypto-assets and funds separate from their own assets and not use them on their own account. It also requires complaint handling, conflict management, outsourcing risk controls and an orderly wind-down plan. (eur-lex.europa.eu)
Stablecoin issuers face an additional control layer because users expect redemption at or near par. The U.S. GENIUS Act was enacted on July 18, 2025, and U.S. Treasury materials state that it establishes a framework for payment stablecoin activities, restricts issuance to permitted payment stablecoin issuers, and contemplates requirements for reserves, redemption, risk management, audits, reports, supervision and custody under implementing regulations. (home.treasury.gov)
Operational resilience and vendor risk
Crypto firms depend on cloud providers, custody technology, blockchain analytics vendors, node infrastructure, market data, payment rails and smart contract tooling. DORA’s structure is useful even outside the EU because it forces a firm to ask whether it can keep critical functions operating during a cyberattack, vendor outage, key compromise or chain disruption. The compliance standard is not merely having a business continuity document. It is proving that testing, escalation, recovery and third-party oversight work under stress.
Reporting and evidence
Supervisors, auditors and bank counterparties increasingly expect evidence. A mature program should maintain a control library, regulatory obligation map, testing calendar, incident register, training records, suspicious activity documentation, policy attestations, vendor reviews and remediation tracking. The strongest compliance files are not created after a problem. They are produced continuously as part of business operations. See also: Blockchain Technology.
Where banks, exchanges and stablecoin issuers differ
Banks usually start from prudential exposure, capital, liquidity, governance and counterparty risk. The Basel Committee published final disclosure standards for banks’ cryptoasset exposures and targeted amendments to its cryptoasset standard in July 2024, with implementation by January 1, 2026. The disclosure framework requires standardized qualitative and quantitative information on cryptoasset activities and the related capital and liquidity requirements. (bis.org)
Exchanges and custodial VASPs have a different risk center. They must focus on customer onboarding, market integrity, custody controls, asset listing governance, complaints, conflicts of interest, transaction monitoring and Travel Rule compliance. If they serve EU clients, MiCA authorization and conduct obligations become central. If they serve U.S. customers, the analysis may include money transmission, BSA obligations, sanctions controls, securities or commodities issues and state-level requirements.
Stablecoin issuers sit between payments, banking, securities, commodities and crypto regulation. Their compliance program should integrate reserve assets, redemption rights, issuer governance, customer disclosures, AML, sanctions, custody, audits and stress planning. The Treasury’s September 18, 2025 ANPRM stated that the GENIUS Act tasks Treasury with issuing regulations designed to protect consumers, mitigate illicit finance risks and address financial stability risks, while noting that the ANPRM itself did not implement new requirements. (home.treasury.gov)
Implementation priorities for 2026
The most useful implementation plan is a control map tied to dates, products and jurisdictions. The following sequence gives firms a practical starting point:
- Classify activities and legal roles. Identify whether the business is acting as an issuer, exchange, custodian, broker, money transmitter, payment stablecoin issuer, bank counterparty, technology provider or DeFi front end operator.
- Map jurisdictions and customer access. A website, app or API can create cross-border exposure even without a local office. EU, U.S., U.K., offshore and emerging-market obligations may not align.
- Build a single obligation register. Link FATF-style AML controls, MiCA conduct controls, DORA-style resilience controls, Basel exposure reporting and U.S. BSA or stablecoin requirements to specific owners.
- Test controls before scale. Run sample onboarding reviews, Travel Rule exceptions, sanctions alert escalations, wallet screening, incident simulations, reconciliation checks and vendor outage scenarios.
- Prepare evidence packs. Keep board minutes, risk assessments, policies, logs, reports, remediation records and training documents ready for banks, auditors, investors and regulators.
Common gaps that weaken crypto compliance programs
The first common gap is treating compliance as a licensing project instead of an operating discipline. A license application may describe a compliant firm, but day-to-day alerts, investigations, reconciliations and incident response show whether that description is accurate.
The second gap is separating cybersecurity from compliance. Under DORA-style expectations, ICT risk, third-party dependency and operational disruption are not purely technical issues. They affect customer protection, market integrity, regulatory reporting and business continuity.
The third gap is assuming that voluntary certifications replace regulatory compliance. SOC 2, ISO 27001 and similar assurance frameworks can be valuable evidence of control maturity, but they do not answer every regulatory question about AML, custody, disclosures, reserves, market abuse or prudential treatment. They should support the compliance program, not define its full scope.
The fourth gap is relying on token labels. Calling an asset a utility token, governance token, stablecoin or digital commodity does not settle every legal analysis. Compliance teams need documented asset review, ongoing monitoring and escalation when features, marketing, governance or use cases change.
Frequently asked questions
What are the main compliance standards for crypto firms?
The main standards depend on activity and jurisdiction, but the core set usually includes AML/CFT and Travel Rule expectations under FATF-style frameworks, licensing and conduct rules such as MiCA, operational resilience rules such as DORA, prudential standards for bank exposure, and local rules such as U.S. BSA, FinCEN and stablecoin requirements.
Is there one global crypto compliance standard?
No. FATF provides influential global AML/CFT standards for virtual assets and VASPs, but each jurisdiction implements laws differently. A firm should build a global control baseline, then add local requirements for licensing, consumer protection, custody, tax reporting, market conduct and prudential treatment.
Are ISO 27001 or SOC 2 enough for crypto compliance?
No. They can help demonstrate information security and control maturity, but they do not replace legal obligations for AML, sanctions, Travel Rule compliance, customer asset segregation, stablecoin reserves, market abuse controls, regulatory reporting or licensing.
How should a small crypto startup begin?
Start with activity classification, customer location mapping, basic AML and sanctions controls, secure custody design, incident response, vendor due diligence and clear records. The program can be proportionate to size, but core risks should be addressed before public launch or institutional onboarding.
