How crypto finance compliance is changing under MiCA, the GENIUS Act and FATF guidance

a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}a[data-rs-seo-link]{text-decoration:underline!important;color:#1a56db!important;cursor:pointer!important;}

Why finance compliance in crypto has become an operating model issue

Finance compliance in crypto is no longer limited to registration filings or periodic AML reviews. As of October 16, 2026, the regulatory direction is clear: supervisors increasingly expect crypto firms to show that controls work in practice across customers, wallets, reserves, custody, disclosures, outsourcing, incident response and cross-border access. The EU’s MiCA regime has moved crypto-asset service providers into an authorization and supervision model, the U.S. GENIUS Act has created a federal payment stablecoin framework, and FATF continues to press jurisdictions on Travel Rule implementation and stablecoin-related illicit finance risks. (esma.europa.eu)

For readers tracking this issue across digital assets, banking relationships and market infrastructure, the wider Regulation and Compliance section follows the same theme: compliance value now comes from operational evidence, not policy wording alone.

The compliance map now has four layers

A crypto business that handles customer assets, stablecoins, trading, staking, custody or cross-border payments should treat finance compliance as a layered control map. The exact legal duties depend on jurisdiction, business model and token activity, but the questions below are increasingly common in supervisory reviews, bank due diligence and institutional onboarding.

A common mistake is to manage these areas as separate checklists. In practice, they often overlap. A stablecoin redemption, for example, can trigger AML due diligence, sanctions screening, liquidity controls, customer disclosures and operational resilience procedures at the same time.

MiCA turns EU access into an authorization question

The EU’s Markets in Crypto-Assets Regulation applies from December 30, 2024, while its rules for asset-referenced tokens and e-money tokens have applied since June 30, 2024. That phasing matters because it separated stablecoin-style obligations from the broader crypto-asset service provider regime. By 2026, the key issue is less whether MiCA exists and more whether a firm has authorization, a valid transitional position or a credible wind-down plan. (eur-lex.europa.eu)

ESMA stated on April 17, 2026, that by July 1, 2026, when transitional periods ended across the EU, any unauthorized crypto-asset service provider relying on transition should have implemented its wind-down plan. ESMA also emphasized onboarding, AML/CFT compliance and the narrowness of reverse solicitation for third-country firms seeking EU clients. This matters for non-EU crypto firms because marketing, outsourcing, custody delegation and business-to-business service models can still create EU regulatory exposure. (esma.europa.eu)

From a finance compliance perspective, MiCA changes the diligence conversation. Banks, payment partners and institutional clients are likely to ask whether the firm is authorized as a CASP, which EU member state is the home regulator, how customer assets are safeguarded, how complaints are handled and whether outsourcing arrangements could amount to unauthorized provision of services into the EU.

U.S. stablecoin rules raise the baseline for reserves, AML and sanctions

The GENIUS Act, enacted on July 18, 2025, provides a U.S. statutory framework for payment stablecoins. It requires permitted payment stablecoin issuers to maintain identifiable reserves backing outstanding payment stablecoins on at least a one-to-one basis, with specified reserve assets including U.S. currency, demand deposits, short-term Treasuries and certain other liquid government-backed instruments. It also requires public reserve composition disclosures and monthly examination and certification procedures. (govinfo.gov)

The same law treats permitted payment stablecoin issuers as financial institutions for Bank Secrecy Act purposes and subjects them to federal laws covering sanctions, money laundering prevention, customer identification and due diligence. FinCEN and other U.S. agencies have also proposed rules to implement the GENIUS Act’s customer identification program requirement and other AML obligations for permitted payment stablecoin issuers. (govinfo.gov)

The compliance impact extends beyond issuers. Exchanges, custodians, payment processors and institutional users may need to reassess which stablecoins they list, accept as collateral, use for settlement or hold in treasury operations. A stablecoin that works well from a liquidity perspective may still raise onboarding, disclosure, redemption, reserve-quality or sanctions-control questions.

SEC and CFTC activity should be read carefully

U.S. crypto market structure remains a moving target, so compliance teams should distinguish statutes and final rules from interpretive releases, staff statements and proposals. In August 2026, the SEC proposed Regulation Crypto Assets, a tailored offering regime for certain investment contracts involving crypto assets. The proposal described two exemptions from Securities Act registration: one for offerings up to $5 million during a four-year period and another for up to $75 million during each 12-month period. Because this was a proposal, it should not be treated as an available exemption unless and until final action is adopted. (sec.gov)

The SEC’s Crypto@SEC materials also show continuing work on custody, tokenized securities venues, disclosure, trading and coordination with the CFTC. For compliance officers, the takeaway is practical rather than political: document the basis for each token classification, keep product launch committees connected to legal analysis, and make sure marketing, yield, staking and custody descriptions do not outrun the firm’s regulatory position. (sec.gov)

AML, sanctions and Travel Rule supervision remain the global floor

FATF’s June 26, 2025 targeted update reported that 99 jurisdictions had passed or were in the process of passing legislation implementing the Travel Rule, while also noting ongoing difficulty with licensing, registration and offshore VASPs. FATF said the materially important jurisdictions covered in its table represented about 98 percent of the global virtual asset market. That makes AML/CFT implementation a cross-border business issue, not only a local compliance task. (fatf-gafi.org)

FATF’s March 3, 2026 report on stablecoins and unhosted wallets also highlighted rapid stablecoin growth, with more than 250 stablecoins in circulation by mid-2025 and market capitalization above $300 billion. The same report cited Chainalysis for the point that stablecoins accounted for 84 percent of illicit virtual asset transaction volume in 2025. These figures do not mean stablecoins are inherently illicit; they show why liquidity, interoperability and broad adoption make controls around redemption, wallet exposure and cross-chain movement more important. (fatf-gafi.org) See also: Blockchain Technology.

Sanctions controls are part of the same baseline. OFAC’s virtual currency guidance states that sanctions compliance obligations apply to virtual currency transactions as they do to traditional fiat transactions and encourages a tailored, risk-based program for exchanges, administrators, wallet providers and other virtual currency participants. In practice, sanctions screening should cover customers, counterparties, wallet addresses, geographies, nested relationships and high-risk transaction patterns. (ofac.treasury.gov)

Operational resilience is becoming a compliance requirement, not an IT side project

In the EU, the Digital Operational Resilience Act has applied since January 17, 2025. ESMA describes DORA as a framework to strengthen ICT security for financial entities and improve resilience during severe digital disruption. For crypto firms subject to EU financial regulation, incident response, vendor governance, cloud dependency, cyber testing and business continuity now belong in the finance compliance file. (esma.europa.eu)

This matters because crypto compliance failures often begin as operational failures: a vendor cannot deliver Travel Rule data, a chain analytics alert is not reviewed, a custody reconciliation breaks, a smart contract incident is not escalated, or a sanctions update is not deployed across all wallets. A mature compliance program should connect legal obligations to system controls, service-level monitoring and board-level risk reporting.

A practical finance compliance checklist for crypto teams

For firms reviewing their control environment, the following checklist is a useful starting point. It is not a substitute for legal advice, but it reflects the direction of current regulatory expectations.

• Map regulated activities before products launch. Identify whether each activity involves exchange, custody, transfer, issuance, redemption, staking, lending, market making, payment stablecoins or investment contracts.
• Maintain a token classification record. Record the rationale for each supported asset, the jurisdictions considered, reviewer approvals and triggers for re-review.
• Separate stablecoin due diligence from general token listing. Review issuer status, reserve disclosures, redemption rights, sanctions functionality, audit or attestation practices and legal restrictions on U.S. or EU access.
• Test AML and sanctions controls with real scenarios. Include cross-chain flows, mixers, high-risk jurisdictions, nested exchanges, unhosted wallets, law enforcement requests and false-positive handling.
• Document Travel Rule governance. Track data quality, counterparty VASP due diligence, message failures, rejected transfers and escalation decisions.
• Align custody, reconciliation and client asset disclosures. Make sure operational records match customer-facing language and contractual terms.
• Build a board reporting pack. Include risk appetite, incident metrics, suspicious activity trends, blocked transactions, audit findings, remediation status and regulatory change updates.
• Review outsourcing and third-party risk. Compliance vendors, cloud providers, custody technology, liquidity partners and blockchain analytics tools should all sit inside a controlled vendor-management process.

What counterparties will ask before onboarding crypto exposure

Banks, funds, payment companies and market infrastructure providers increasingly want evidence that a crypto firm can explain its control model. Typical questions include which regulators supervise the entity, where customers are located, how customer assets are segregated, whether stablecoins are permitted for settlement, how suspicious activity is reported, how sanctions alerts are resolved, which blockchain analytics tools are used, and whether the firm can produce audit-ready records.

The best answer is not a long policy manual. It is a clear control narrative backed by artifacts: approvals, reports, logs, reconciliations, testing results, training completion, incident tickets and remediation evidence. That is where finance compliance becomes a commercial asset. Strong controls may not eliminate regulatory risk, but they can reduce onboarding friction and improve credibility with partners that must manage their own supervisory exposure.

Frequently asked questions

Is finance compliance in crypto only about AML?

No. AML/CFT remains central, but crypto finance compliance now includes sanctions, Travel Rule data, token classification, stablecoin reserves and redemption, customer asset protection, disclosures, cybersecurity, outsourcing and incident response.

Does MiCA replace AML/CFT obligations in the EU?

No. MiCA creates a crypto-asset regulatory framework, but AML/CFT duties continue to apply through separate financial crime rules and supervisory expectations. ESMA’s 2026 statement specifically connected CASP migration and wind-down expectations with robust AML/CFT onboarding and compliance. (esma.europa.eu)

Are the SEC’s proposed crypto exemptions already usable?

No. The SEC’s Regulation Crypto Assets item was described as a proposed rule. Until a final rule is adopted and effective, firms should not treat the proposed $5 million or $75 million exemptions as available compliance paths. (sec.gov)

What is the first step for a crypto firm improving compliance?

Start with an activity map. List every customer-facing and treasury-facing activity, every jurisdiction served, every token supported, every third-party dependency and every fiat or stablecoin rail. From there, match obligations to controls and assign accountable owners.