Compliance with laws and regulations in crypto finance after MiCA and the GENIUS Act
a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}
What compliance means for crypto finance in 2026
Compliance with laws and regulations in crypto finance now requires a documented operating system for licensing, token classification, anti-money laundering controls, sanctions screening, tax reporting, custody, disclosures, and market conduct. As of November 3, 2026, several areas that were previously handled mainly through guidance or enforcement are moving into more formal rulebooks. The European Union’s MiCA framework is in force, the United States has enacted a payment stablecoin law, and global anti-money laundering expectations for virtual asset service providers continue to tighten. For readers tracking this area, our Regulation and Compliance section follows the policy changes shaping digital asset markets.
This article is an informational overview, not legal advice. The practical point is that a crypto business should not treat compliance as one generic checklist. Each product, token, customer activity, and jurisdiction should be mapped to the specific rules and supervisory expectations that apply.
The regulatory map is becoming more specific
United States rules are splitting by activity
In the United States, crypto compliance remains activity-based. A platform may face Bank Secrecy Act obligations through FinCEN, securities law issues through the SEC, derivatives or commodity market issues through the CFTC, sanctions obligations through OFAC, tax reporting duties through the IRS, and state money transmission requirements. The same company can therefore be regulated in different ways depending on whether it issues a token, lists third-party assets, provides custody, transmits value, offers derivatives, or reports customer transactions.
The biggest statutory change is the GENIUS Act, signed on July 18, 2025, which creates a federal framework for payment stablecoins. The public law text requires permitted payment stablecoin issuers to maintain identifiable reserves on at least a one-to-one basis, publish monthly reserve composition information, support redemption, and meet risk management standards. On October 21, 2026, the OCC issued a final rule for entities under its jurisdiction, with the rule and the GENIUS Act framework taking effect on January 18, 2027. The OCC also noted that Bank Secrecy Act, anti-money laundering, and OFAC sanctions requirements would be addressed through separate coordinated rulemaking.
Token offerings remain less settled. The SEC proposed Regulation Crypto Assets on August 18, 2026. If adopted, it would create tailored exemptions for certain investment contracts involving crypto assets, including proposed offering limits of up to $5 million over a four-year period and up to $75 million during a 12-month period under different conditions. Because that framework is proposed rather than final, issuers still need counsel-led analysis instead of assuming that a new exemption is available.
MiCA has changed the EU compliance baseline
In the European Union, the Markets in Crypto-Assets Regulation, known as MiCA, is now the central framework for many crypto assets and crypto-asset service providers. Rules for asset-referenced tokens and e-money tokens applied from June 30, 2024, while broader MiCA provisions applied from December 30, 2024. Eligible firms that were already providing services under national law could rely on transitional arrangements, but the maximum transition period ended on July 1, 2026. EU-facing service providers now need to check authorisation status, white paper obligations, governance requirements, safeguarding rules, complaint handling, market abuse controls, and country-specific supervisory expectations.
AML and sanctions expectations are global
Anti-money laundering and sanctions controls are not optional add-ons. FinCEN’s long-standing guidance treats many administrators and exchangers of convertible virtual currency as money services businesses when they perform money transmission. OFAC’s virtual currency sanctions guidance encourages a risk-based sanctions compliance program. FATF’s July 16, 2026 targeted update reported that 83% of surveyed jurisdictions had passed legislation implementing the Travel Rule, up from 73% in 2025, while also warning that implementation gaps remain. The operational expectation is clear: firms should identify customers, monitor transactions, screen counterparties, escalate suspicious activity, and preserve records.
Core obligations by crypto business model
| Business model | Main compliance focus | Practical control |
|---|---|---|
| Centralized exchange or custodial wallet | Licensing, AML, sanctions, custody, consumer disclosures, asset listing governance | Maintain a documented asset review process, customer risk scoring, transaction monitoring, wallet screening, and incident response plan. |
| Payment stablecoin issuer | Issuer permission, reserves, redemption, monthly reporting, risk management, AML and sanctions | Separate reserve governance from product growth, reconcile supply and reserves daily, and prepare board-level liquidity reporting. |
| Token issuer or foundation | Securities analysis, disclosures, marketing claims, market abuse risk, insider controls | Document the purpose of the token, user rights, issuer commitments, treasury policy, and promotional statements before launch. |
| Digital asset broker or platform handling customer sales | Tax reporting, customer statements, basis information, backup withholding where applicable | Map whether transactions trigger Form 1099-DA reporting and preserve acquisition, disposal, proceeds, and basis data. |
| DeFi interface or protocol contributor | Unclear perimeter, front-end access controls, sanctions exposure, governance transparency | Assess whether the team controls access, fees, upgrades, admin keys, user communications, or other functions that regulators may view as managed activity. |
How to build a defensible compliance program
Start with product and jurisdiction mapping
The first step is a live inventory of what the business actually does. Many crypto firms run into trouble when their compliance documents describe an earlier version of the product. The inventory should identify every token, supported network, customer type, revenue stream, jurisdiction, third-party provider, custody arrangement, and fiat on-ramp or off-ramp. Each item should be linked to a legal and compliance owner.
This mapping should include negative decisions as well as positive ones. If a firm decides not to serve a country, not to list a privacy-enhancing asset, not to support a stablecoin, or not to allow a type of staking product, that decision should be documented. Regulators often examine whether a company understood the risk before launching or expanding.
Use risk-based onboarding and monitoring
Know-your-customer processes should match the firm’s risk profile. A retail spot exchange, an institutional custody desk, a cross-border payments product, and a DeFi front end do not present the same risk. At minimum, firms should define customer identity requirements, beneficial ownership checks for entities, sanctions screening, politically exposed person handling, enhanced due diligence triggers, and rules for rejecting or exiting customers.
Transaction monitoring also needs crypto-specific inputs. Traditional red flags may miss blockchain behavior such as rapid chain hopping, peel chains, mixer exposure, bridge use after suspicious events, or repeated interaction with high-risk wallets. Blockchain analytics can help, but it should not replace human review, escalation standards, or suspicious activity reporting decisions where required. See also: Blockchain Technology.
Control disclosures and marketing claims
Regulatory risk often starts in marketing. Promising yield, implying price appreciation, describing a token as risk-free, or comparing a stablecoin to an insured bank deposit can affect the legal analysis. Compliance teams should review websites, white papers, app screens, social media, affiliate materials, and community announcements. The key question is whether the average customer would understand the product’s risks, limitations, fees, redemption rights, custody structure, and regulatory status.
Keep evidence, not just policies
A policy is useful only if the company can show that it was followed. Firms should retain board minutes, risk assessments, compliance approvals, training logs, monitoring alerts, investigation notes, vendor due diligence, code-change approvals, reserve reports, and customer communications. In a regulatory review, contemporaneous records can show that the company acted deliberately rather than reactively.
Where compliance failures usually start
- Misclassification: The company assumes a token is outside securities, commodities, payments, or money transmission rules without written analysis.
- Jurisdiction creep: A product designed for one market becomes available to users in another market through an app, affiliate, API, or liquidity pool.
- Weak sanctions controls: Screening is performed only at onboarding and not during wallet changes, withdrawals, bridging, or secondary transfers.
- Reserve opacity: A stablecoin or yield product makes claims about backing, liquidity, or safety that are not supported by reconciled records.
- Tax data gaps: Platforms collect trade data but cannot reliably determine basis, transfer history, customer statements, or reporting categories.
- Governance shortcuts: Listing decisions, admin-key changes, treasury movements, or incident responses happen without documented approval.
A practical timeline for compliance planning
| Date or period | Why it matters | Planning implication |
|---|---|---|
| June 30, 2024 | MiCA rules for asset-referenced tokens and e-money tokens began applying in the EU. | Stablecoin issuers and platforms serving EU users need token-level eligibility and disclosure checks. |
| December 30, 2024 | Broader MiCA rules began applying, including the framework for crypto-asset service providers. | EU-facing service providers need authorisation, governance, safeguarding, and market conduct controls. |
| January 1, 2025 | IRS digital asset broker reporting for gross proceeds began for covered transactions. | Platforms should preserve sale, exchange, customer, and proceeds data in reportable formats. |
| January 1, 2026 | IRS basis reporting began for certain digital asset transactions. | Cost-basis systems and transfer-in records became more important for brokers and customers. |
| July 1, 2026 | The maximum MiCA transitional period for eligible existing CASPs ended. | EU service providers should verify authorisation or wind-down status rather than relying on legacy national regimes. |
| January 18, 2027 | The OCC’s GENIUS Act final rule and stablecoin framework become effective for entities under its jurisdiction. | Stablecoin issuers should prepare application, reserve, redemption, reporting, and governance files before the effective date. |
Frequently asked questions
What does compliance with laws and regulations mean for a crypto business?
It means identifying which rules apply to each activity and proving that controls operate in practice. For a crypto business, that usually includes licensing, AML, sanctions, tax reporting, disclosures, custody controls, cybersecurity, consumer communications, and governance over token listings or launches.
Are U.S. crypto tokens now clearly classified as securities or commodities?
Not always. The SEC and CFTC have provided more interpretive guidance, and the SEC has proposed a new crypto asset offering framework, but classification still depends on the facts. Token function, decentralization, issuer promises, purchaser expectations, marketing, governance, and ongoing managerial efforts can all matter.
Does MiCA replace AML obligations in Europe?
No. MiCA creates a harmonized EU framework for many crypto assets and crypto-asset services, but AML and counter-terrorist financing obligations continue under separate EU and national regimes. A firm can satisfy one framework and still fail another if onboarding, monitoring, reporting, or sanctions controls are weak.
What should smaller crypto firms prioritize first?
Smaller firms should start with product mapping, jurisdiction restrictions, customer due diligence, sanctions screening, recordkeeping, disclosure review, and a written escalation process. The goal is not to copy the largest exchange’s compliance department. The goal is to build controls that match the firm’s actual risks and can be tested.
Bottom line
Crypto compliance is moving from broad principles to detailed operating requirements. The firms best positioned for 2026 and 2027 are those that treat compliance as product infrastructure: mapped before launch, reviewed when rules change, tested during operations, and documented well enough to withstand regulatory scrutiny.
