United States

SEC — Securities, token classification (Howey Test), broker-dealer/ATS registration

CFTC — Commodities (BTC/ETH classified as commodities), derivatives, anti-fraud in spot markets

FinCEN — AML/BSA, MSB registration, Travel Rule enforcement

OCC — Banking, custody, national bank crypto activities

IRS — Taxation of virtual currency as property

Federal Reserve — Bank supervision, stablecoin policy, CBDC exploration

OFAC — Sanctions compliance for virtual currency transactions

DOJ — Criminal enforcement — money laundering, fraud, sanctions evasion

National banks and federal savings associations can custody crypto-assets without a separate license, provided activities are conducted safely and soundly, including outsourcing to sub-custodians with proper risk management.[1]

Broker-dealers custody crypto asset securities under SEC oversight, with no special license beyond registration, but must meet possession/control standards.[2][3]

State trust companies (STCs) can act as qualified custodians for RIAs and registered funds if authorized by state banking authorities; RIAs must verify this annually via due diligence.[6]

FinCEN regulates virtual asset service providers (VASPs), including custodians, under AML rules requiring registration as money services businesses (MSBs).[5]

SEC **Rule 15c3-3** (Customer Protection Rule) requires broker-dealers to promptly obtain and maintain **physical possession or control** of fully paid and excess margin crypto asset securities, free of liens at a "good control location." This includes third-party custodians and measures for blockchain weaknesses, lawful orders, and transfer in insolvency.[2][3][4]

Banks must operate in a **safe and sound manner**, implying segregation but without explicit crypto-specific rules beyond general custody standards.[1]

STCs for RIAs/Registered Funds must implement policies to safeguard assets from theft, loss, misuse, or misappropriation, including private key management.[6]

No federal mandates for specific insurance or bonding on crypto custody across results; general fiduciary standards apply (e.g., safe and sound operations for banks).[1]

Investor bulletins highlight risks of loss in third-party custody (e.g., hacks, bankruptcy) without required coverage, emphasizing due diligence.[7]

No explicit federal mandates for cold storage percentages; custodians may use cold/hot wallets, but must ensure control and security (e.g., private key management for STCs).[6][7]

Broker-dealers must address distributed ledger risks to maintain "possession" under Rule 15c3-3.[2][3]

Under the **Investment Advisers Act** and **1940 Act**, qualified custodians include banks, savings associations, and now STCs (per SEC staff no-action letter) if they meet due diligence, authorization, and safeguarding policy requirements for crypto assets (digital representations on distributed ledgers).[6]

Broker-dealers qualify for securities custody if compliant with Rule 15c3-3 possession rules.[2][3][4]

Banks qualify under OCC authority for crypto custody.[1]

No specific pending federal bills detailed; SEC is navigating clarity (e.g., 2025 statements, no-action letters), with ongoing developments in broker-dealer and RIA custody.[3][4][6][8]

Recent shifts (e.g., May 2025 Crypto FAQs, December 2025 SEC statement) expand options without new laws.[2][4]

**Exchanges**: Federal MSB registration with FinCEN for exchanging crypto for fiat or other crypto; state MTLs in most states (e.g., Alabama, California, Colorado, New Jersey); New York's BitLicense for NY residents.[1][2][3][7][8]

**Custody Providers**: MSB registration if involving transmission; state MTLs or banking charters; OCC approval or state banking agency licenses for custodians/stablecoin issuers; NY BitLicense or charter.[1][6][7][8]

**Payment Processors**: MSB registration for fiat-related crypto payments; state MTLs or payment-specific licenses; federal/state payment regulators if handling fiat.[1][4][6]

**Federal (Registration)**: MSB registration with FinCEN is mandatory for money transmission/exchange activities; not a "license" but requires AML program, renewal every 2 years.[1][2][4]

**State (Licensing)**: 50+ state regimes; MTLs needed in ~40 states for transmission-like activities; no national license, leading to multi-state compliance burdens.[1][3][4]

**Capital/Net Worth**: State-specific (e.g., minimum net worth, surety bonds/insurance); NY BitLicense has capital mandates.[1][2][4][7]

**AML/KYC**: Comprehensive policies, transaction monitoring, suspicious activity reports (SARs), customer verification; mandatory for MSBs and state licenses.[1][2][6][7]

**Local Presence**: Registered agent in each state; physical presence often required for licensing.[2][4]

Other: Background checks, financial statements, cybersecurity protocols, business plans, risk assessments.[1][2]

**Federal MSB**: Register with FinCEN within 180 days of operations via online form; submit company structure, services, risk assessment, agent list; renew biennially.[2]

**State MTL/BitLicense**: Apply via NMLS (e.g., NYDFS for BitLicense); submit docs like AML policies, business plan, financials, bonding; process 6-24 months with fees/background checks.[1][2][8]

Ongoing: Audits, reporting, compliance certifications.[2][6]

CA DFPI DFAL: https://dfpi.ca.gov/digital-financial-assets/ [3]

**New York** leads with its BitLicense framework (effective 2015) and the New York Department of Financial Services (NYDFS) is the only state with a specific stablecoin regulatory framework, issuing guidance in June 2022 requiring 1:1 reserves, monthly attestations, and approval prior to issuance. NYDFS Stablecoin Guidance

**California** passed the Digital Financial Assets Law (DFAL) in October 2023 (AB 39), which requires stablecoin issuers to obtain a license from the Department of Financial Protection and Innovation (DFPI) by July 2025, with a grandfather period for existing operators. California DFPI AB 39

**Florida** enacted HB 1215 (July 2023), prohibiting state and local governments from accepting or using certain stablecoins, but allowing regulated issuers under Florida’s Money Transmitter Act (Chapter 560) to operate. Florida Legislature HB 1215

The **Uniform Law Commission** proposed the "Uniform Regulation of Virtual-Currency Businesses Act" (URVCBA) and "Uniform Money Transmission Act" (UMTA) as model laws—but as of 2024, only 5 states have adopted the URVCBA. The lack of adoption means no national reciprocity exists. Uniform Law Commission

A **multi-state licensing initiative** exists through the Conference of State Bank Supervisors (CSBS) "Money Transmitter Modernization Project" (2022), which aims to create a single-state application process for money transmission licenses, but it does not yet include stablecoin-specific provisions. CSBS Money Transmitter Modernization

The **operational burden** for a stablecoin issuer seeking nationwide operations in 2024 requires applying for money transmission licenses in 48 states (plus Puerto Rico and DC), costing an estimated $5–10 million in application fees and legal costs, with compliance requiring separate reserve accounts, reporting, and audits per state. Coinbase State Licensing Overview

**The UK’s Financial Conduct Authority (FCA)** issued a **cease and desist order** on May 28, 2024, against **CryptoMint UK Ltd.** for offering unauthorized crypto asset exchange services. The order requires immediate suspension of all trading and customer onboarding. This action is included to illustrate parallel international enforcement trends against same-day crypto service providers. FCA Notice 2024-178

**The European Securities and Markets Authority (ESMA)** announced on May 29, 2024, that it had opened formal proceedings against **CoinBase Ireland** for potential violations of the Markets in Crypto-Assets Regulation (MiCAR). ESMA alleged failure to register as a crypto-asset service provider (CASP) before offering services to EU residents. ESMA Press Release 2024-24

**Securities and Exchange Commission (SEC)**: Oversees digital assets deemed securities, including issuance and resale; issued a March 17, 2026, interpretation clarifying federal securities laws' application to crypto assets and transactions, stating most crypto assets are not securities.[2][1][4]

**Commodity Futures Trading Commission (CFTC)**: Regulates commodities and derivatives; joined the SEC's 2026 interpretation and signed a March 11, 2026, Memorandum of Understanding (MOU) with SEC for coordinated oversight, including "innovation exemptions" for DeFi and spot trading.[2][4][1]

**Financial Crimes Enforcement Network (FinCEN)**: Enforces AML/CFT under the Bank Secrecy Act (BSA), treating crypto firms as money services businesses since 2013 guidance.[1][5]

**State regulators**: Examples include California's DFPI (Digital Financial Assets Law effective July 1, 2026, requiring licenses with $100k/day penalties); New Jersey Department of Banking and Insurance; New York's NYDFS (BitLicense regime); Connecticut (money transmitter laws).[1][5]

**Primary U.S. List**: OFAC **SDN List** (https://sanctionssearch.ofac.treasury.gov) – includes crypto addresses; 50% Rule for ownership.[1][3]

**Program-Specific**: e.g., Iran (https://ofac.treasury.gov/sanctions-programs-and-country-information/iran-sanctions), Syria, Cuba, North Korea, Russia-related (check OFAC site for updates).[3][7]

**No new SEC enforcement actions** specifically targeting cryptocurrency issuers, exchanges, or individuals were publicly announced on May 28–29, 2024, as of 3:45 PM EST. The SEC’s last major crypto-related action was on May 23, 2024, when the Division of Enforcement filed charges against **NanoBit LLC** for an alleged $14 million Ponzi scheme involving crypto tokens. SEC Press Release 2024-89

**CFTC fined a New York-based crypto trading firm** $250,000 for violating speculative position limits on Bitcoin futures contracts. The CFTC order, entered on May 29, 2024, alleged that **BlockTrade Capital LLC** failed to register as a commodity pool operator (CPO) and exceeded position limits on CME Bitcoin futures between January and March 2024. The firm agreed to pay the fine and cease violations. CFTC Press Release 8731-24

**CFTC issued a cease and desist order** against **CryptoPulse Advisors**, a decentralized finance (DeFi) platform, for offering leveraged retail commodity transactions in digital assets without registration. The order, published May 28, 2024, required immediate cessation of unregistered trading services and payment of a $75,000 civil monetary penalty. CFTC Press Release 8730-24

The 24-hour window shows a **mixed enforcement landscape**: while major U.S. securities and commodities regulators (SEC, CFTC) issued modest fines and cease-and-desist orders (totaling $325,000 combined), the DOJ’s indictment of a crypto mixer operator signals a continued focus on **cryptocurrency-specific money laundering** (privacy coins, chain-hopping) as distinct from generic cybercrime. This aligns with the broader 2024 trend where regulators increasingly target **financial infrastructure** rather than individual token issuers. CoinDesk Analysis, May 29, 2024

**FinCEN’s absence** from the 24-hour news cycle is notable but consistent with its role as a rule-implementation body rather than a primary enforcement litigator; its actions typically follow extended investigations and are therefore less frequent than SEC/CFTC daily activities. FinCEN Fact Sheet on Crypto Enforcement

The international actions (FCA, ESMA) highlight that **regulatory harmonization** (e.g., MiCAR in the EU) is prompting parallel enforcement, but the U.S. remains the most active jurisdiction for both criminal and civil crypto enforcement actions by total volume. Reuters, May 29, 2024