US Crypto Regulations 2026: AML, Stablecoins, SEC/CFTC, and State Licensing

TL;DR: U.S. crypto regulation is still split between federal and state authorities, and no single agency resolves a business's full compliance scope. But the picture has changed materially. FinCEN and the Bank Secrecy Act still supply the core AML framework for businesses that qualify as money transmitters or other Money Services Businesses, and for those firms the general mandatory SAR threshold is $2,000, not $5,000. The GENIUS Act is now federal law for payment stablecoins, though its implementing regulations were still being written through 2026 and the main regime is not yet generally effective. The SEC issued a Commission-level crypto interpretation in March 2026 that the CFTC joined, and proposed a separate offering framework in August 2026 that remains a proposal. The broader CLARITY Act market-structure bill is still pending. State licensing operates independently of all of this, and California's Digital Financial Assets Law became operational on July 1, 2026. IRS digital asset broker reporting is now live, with Form 1099-DA in circulation.

Note: None of this information should be considered as legal, tax, or investment advice. While we’ve done our best to ensure this information is accurate at the time of publication, laws and practices may change, so please double-check it.  

Release Nos. 33-11412 and 34-105020 do not sound like a turning point. They are the file numbers on an interpretive release the SEC issued on March 17, 2026, which the CFTC joined the same day, and which named 18 specific crypto assets — Bitcoin, Ether, Solana and XRP among them — that qualify as digital commodities rather than securities as of that date. For an industry that spent a decade arguing about token classification in litigation, a published federal taxonomy was a structural change, not a press release.

(Source: SEC and CFTC, "Application of the Federal Securities Laws to Certain Types of Crypto Assets and Certain Transactions Involving Crypto Assets," Release Nos. 33-11412, 34-105020, March 17, 2026, published at 91 Fed. Reg. 13714 — https://www.sec.gov/files/rules/interp/2026/33-11412.pdf; CFTC statement — https://www.cftc.gov/PressRoom/PressReleases/9198-26)

That release is one of four things that make the older description of U.S. crypto regulation obsolete. The second is the GENIUS Act, which became Public Law 119-27 on July 18, 2025 and gave the United States its first crypto-specific federal statute. The third is the SEC's August 2026 proposal of a purpose-built offering regime for crypto assets. The fourth is happening at state level, where California's licensing regime went live on July 1, 2026 while Hawaii moved in the opposite direction entirely.

None of this means the United States now has one comprehensive federal crypto law. It does mean that the sentence "there is no federal crypto legislation" is no longer accurate, and a compliance plan built on that assumption will misjudge both what is required and what is coming.

Regulation in 2026 remains layered, and which layers apply depends on what a business actually does. FinCEN administers Bank Secrecy Act and MSB obligations. OFAC administers sanctions, which are a separate regime rather than a subset of AML. The SEC applies the federal securities laws. The CFTC administers the Commodity Exchange Act, including derivatives and relevant commodity authority. The IRS handles tax and information reporting. State financial regulators run their own licensing and supervision. A single product can touch four of these at once, and the Travel Rule that most crypto teams focus on is only one requirement among many.

FinCEN AML Rules Still Form the Core Federal Compliance Layer

For most crypto businesses, the federal compliance question starts with FinCEN, and the answer has always been activity-based rather than label-based. It is worth resisting the shorthand that "most crypto businesses are MSBs," because that framing produces both over-registration and missed obligations.

FinCEN's longstanding position, set out in its 2019 consolidated guidance on convertible virtual currency business models, is that an administrator or exchanger of convertible virtual currency can be a money transmitter — and therefore an MSB — unless an exemption or limitation applies. A person who merely uses virtual currency for their own account is not an MSB for that reason alone. The analysis turns on whether the business accepts and transmits value on behalf of others, and on whether it has independent control over the customer's funds.

(Source: FinCEN, "Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies," FIN-2019-G001, May 9, 2019 — https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-certain-business-models)

That distinction matters commercially, not just legally. Whether an exchange, a wallet, a payment product or a non-custodial service lands inside a regulated category depends on what the product does rather than how it is marketed, which is why the classification analysis belongs before the corporate structure and the launch market are chosen. Where a business is a covered money transmitter or MSB, the obligations that follow are well established:

• registration with FinCEN, filed within 180 days of starting to operate and renewed every two years;
• a written AML program reasonably designed for the business's risks;
• a designated person responsible for day-to-day compliance;
• risk-based internal controls and independent review;
• customer identification and due diligence appropriate to the relationship;
• ongoing transaction monitoring;
• recordkeeping;
• suspicious activity reporting;
• the Travel Rule and Funds Transfer Rule where they apply to the transfer;
• sanctions controls, which sit under OFAC rather than under the BSA.

Two of those deserve separating out, because they are routinely folded into the AML program when they belong beside it. The Travel Rule has its own thresholds, its own data fields and its own counterparty problems, and the mechanics of how the US Crypto Travel Rule applies to MSBs are detailed enough to warrant their own treatment rather than a paragraph here.

Getting the SAR Threshold Right

This is the point where a lot of published guidance, including the earlier version of this article, has been wrong. For transactions conducted or attempted by, at or through an MSB, the general mandatory SAR threshold is $2,000 where the transaction or pattern is known or suspected to be suspicious. The rule gives 30 calendar days after initial detection to file.

The $5,000 figure that circulates widely comes from the same regulation but describes a much narrower scenario: it applies to issuers of money orders or traveler's checks identifying reportable transactions from a review of clearance records or similar records. It is not a general MSB threshold and it is not a crypto threshold.

(Source: 31 CFR 1022.320(a)(2)–(3) — https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/subpart-C/section-1022.320; FinCEN threshold summary — https://www.fincen.gov/msb-threshold-2000-or-more)

Two practical points sit around that number. Activity below the threshold can still be reported voluntarily, and many mature programs do so where the pattern is meaningful even if the value is small. And in situations requiring immediate attention, such as an ongoing laundering scheme, the regulation expects the business to notify law enforcement by telephone in addition to filing.

Currency Transaction Reports Are a Cash Concept

A related correction is worth making explicitly, because it drives real system-design errors. The Currency Transaction Report is a currency and cash reporting mechanism under the BSA. A $10,000 crypto transfer does not automatically become a CTR event simply because it crosses that number. If a business receives relevant cash or currency transactions — a crypto ATM operator taking physical cash, for example — separate CTR obligations can arise from that cash activity. Crypto transaction monitoring and suspicious activity reporting are a different question, governed by different rules, and conflating the two produces reports that do not match the regulation.

Where Sanctions Sit

Sanctions compliance is not a subsection of the AML program, even though the two share tooling. OFAC obligations apply to U.S. persons regardless of MSB status, carry strict liability, and have no threshold below which they stop applying. An AML program tuned to suspicion and materiality will not, on its own, catch a blocked-party match. Understanding how sanctions screening works for crypto wallets and transactions is a separate exercise from designing a BSA program, and the two need to be documented as separate control sets even where they run on the same data.

On the customer side, the BSA does not prescribe a single identity procedure for MSBs the way it does for banks, but risk-based identification and due diligence remain the foundation of everything downstream — monitoring baselines, SAR narratives, sanctions screening quality. Most of that front-end work, for individuals and corporate customers alike, runs through automated KYC and KYB verification. Identity alone does not satisfy the BSA, though: a program without monitoring, reporting and recordkeeping is not a program. On the monitoring side, continuous crypto transaction monitoring of on-chain activity is what converts a customer file into an ongoing risk picture, feeding alerts into an escalation path that ends in a SAR when the facts support one. Using an outside provider does not move the regulatory obligation off the registered business.

The GENIUS Act Created a Federal Framework for Payment Stablecoins

The GENIUS Act is no longer a proposal, and this is the single largest change since the previous version of this guide. It was signed on July 18, 2025 as Public Law 119-27, and it establishes a federal framework for payment stablecoins specifically — not for all stablecoins, and not for digital assets generally.

At a high level, the statute builds around a permitted payment stablecoin issuer concept. Issuance in the United States is limited to permitted issuers once the regime takes effect, with two authorization paths: a federal route through the banking regulators, and a state route for issuers supervised under a state regime that Treasury determines is substantially similar to the federal standard, with a transition to federal oversight once an issuer passes $10 billion in outstanding issuance. Around that sit the substantive requirements: reserves built on safe, liquid assets on a one-to-one backing principle, redemption obligations, disclosure and reporting duties, prudential and risk-management standards, AML/CFT program requirements, and sanctions compliance.

Here is the nuance that most 2026 coverage gets wrong in one direction or the other. The law exists, but the regime is not yet generally operational. The GENIUS Act takes effect on the earlier of two triggers: 18 months after enactment, which is January 18, 2027, or 120 days after the primary federal payment stablecoin regulators issue final implementing regulations. The statute required those implementing rules by July 18, 2026, and they were not finished by that date. In practice that means January 18, 2027 remains the working effective date, and Treasury's own August 2026 rulemaking describes it as the expected effective date.

(Source: U.S. Department of the Treasury, "Treasury Seeks Public Comment on GENIUS Act Proposed Rulemaking," August 2026 — https://home.treasury.gov/news/press-releases/sb0605)

What Actually Happened During 2026

Rather than a chronology of every rulemaking, the useful summary is that four separate tracks ran in parallel through the year. The OCC proposed a prudential, operational and supervisory framework for issuers under its jurisdiction in February 2026. The FDIC proposed rules covering issuer subsidiaries of the institutions it supervises, following an earlier application-process proposal, and the NCUA issued its own. FinCEN and OFAC jointly proposed the AML/CFT and sanctions program requirements that would apply to permitted issuers in April 2026. And in August 2026, Treasury proposed the framework implementing Section 3 of the statute, defining what it means to issue, offer or sell a payment stablecoin in the United States, including extraterritorial reach over offers made to persons located in the U.S. and a separate restriction on digital asset service providers that begins July 18, 2028.

(Source: Federal Register, "GENIUS Act Regulations on Payment Stablecoin Issuance, Offer, and Sale," August 18, 2026, comments due October 19, 2026 — https://www.federalregister.gov/documents/2026/08/18/2026-16796/genius-act-regulations-on-payment-stablecoin-issuance-offer-and-sale; Treasury/FinCEN and OFAC joint proposal — https://home.treasury.gov/news/press-releases/sb0435)

The operational message for anyone building a stablecoin product is to separate two categories cleanly: what the statute already establishes, and what still depends on final implementing regulations that may change between proposal and adoption. Building to a proposed rule as if it were final is a real risk in this cycle, and so is assuming nothing applies until 2027. Two boundaries also deserve stating. GENIUS regulates issuer-side activity within its defined scope; it does not convert every transfer of an existing stablecoin into a directly regulated act in the same way as issuance. And reserve requirements address backing and redemption risk. They do nothing about the AML risk in the transaction flow, which is exactly why the statute carries separate AML/CFT and sanctions obligations.

SEC and CFTC Crypto Rules Changed in 2026, but Market Structure Is Still Evolving

The March 17, 2026 interpretation is the most consequential piece of agency guidance the U.S. crypto market has received. It sorts crypto assets into five categories — digital commodities, digital collectibles, digital tools, stablecoins, and digital securities — and explains how a crypto asset that is not itself a security can still be sold as part of an investment contract depending on what the issuer promises and how the transaction is structured. Just as importantly for secondary markets, it addresses how an asset can stop being subject to an investment contract once the promised managerial efforts are complete or permanently abandoned. It also works through the treatment of protocol mining, protocol staking, airdrops, and the wrapping of a non-security crypto asset.

The CFTC joined to confirm it will administer the Commodity Exchange Act consistently with that interpretation, and that certain non-security crypto assets can meet the CEA definition of a commodity. What the interpretation is not is equally important. It is agency guidance, not legislation, and it does not replace the Howey analysis that courts apply. A classification that fits an asset today can shift as a project's commitments change, and private litigation and arbitration are not bound by the agencies' view. Treating the taxonomy as a permanent safe classification is a misreading.

Five months later, on August 18, 2026, the SEC proposed Regulation Crypto Assets — the first offering framework written specifically for crypto assets. The proposal would create two exemptions from Securities Act registration for offerings of covered investment contracts: a startup exemption of up to $5 million over a rolling four-year period, and a fundraising exemption of up to $75 million in a 12-month period. It would add a conditional safe harbor from investment contract treatment for issuers that have completed or permanently ceased their promised managerial efforts, and would preempt certain state registration and qualification requirements. Antifraud provisions would continue to apply throughout.

This is a proposal, not a rule. It was published in the Federal Register on August 21, 2026, and the comment period closes on October 20, 2026, which means the version that is eventually adopted may differ from the version being discussed now.

(Source: SEC, Regulation Crypto Assets, Release Nos. 33-11434 and 34-106150, File No. S7-2026-27, proposed August 18, 2026; 91 FR 54510, August 21, 2026)

Where the CLARITY Act Actually Stands

The market-structure bill that dominated coverage two years ago has been superseded. The current federal vehicle is the Digital Asset Market CLARITY Act, H.R. 3633, which aims to divide SEC and CFTC jurisdiction by statute and build a framework for digital commodities and the intermediaries that handle them.

Its progress has been slow and is worth stating precisely rather than optimistically. The House passed the bill on July 17, 2025. The Senate Banking Committee advanced a revised compromise text by 15-9 on May 14, 2026. Senate Republicans released an updated merged text on July 22, 2026 that combined the Banking and Agriculture approaches and added government ethics provisions, which several Democratic negotiators rejected. A cloture motion on the motion to proceed was filed in August 2026, setting up a procedural vote that requires 60 votes.

As of early September 2026, CLARITY has not passed the Senate, has not been reconciled with the House-passed version, and is not law. It should be treated as pending legislation in compliance planning, not as a framework to build against.

The cleanest way to hold these four things in mind is to keep their legal status separate. GENIUS is enacted federal law with implementation still underway. CLARITY is pending legislation. The March 2026 release is current agency interpretation. Regulation Crypto Assets is a proposed SEC rule. They carry very different weight, and blending them into a single "the rules now say" narrative is how compliance plans go wrong.

State Licensing Still Matters, and Federal Registration Does Not Replace It

The most expensive misconception in U.S. crypto compliance is that FinCEN registration is the licence. It is not. FinCEN registration is a federal AML obligation. Where state law separately requires authorization to conduct the activity, that requirement stands on its own, and the states have moved in materially different directions. Three examples make the point better than any ranking of friendly and unfriendly jurisdictions.

New York

New York continues to regulate Virtual Currency Business Activity under 23 NYCRR Part 200, administered by NYDFS. The covered activities include transmission of virtual currency, custody or storage on behalf of others, buying and selling virtual currency as a customer business, exchange services, and controlling, administering or issuing a virtual currency. Depending on structure, a business may operate under a BitLicense or under a New York banking or limited purpose trust authorization.

NYDFS has been explicit that federal registration does not remove the state requirement, which is the general principle at work in every state that licenses this activity. On cost, the official application fee under Part 200 is $5,000. Professional, legal and compliance costs on top of that vary enormously by business model and readiness, and figures like "6 to 24 months and over $100,000" that circulate in guides are estimates rather than published requirements — worth planning for, not worth quoting as fact.

California

California is the addition that most 2025-era U.S. guides are missing. The Digital Financial Assets Law, enacted in 2023 and delayed by amendment, became operational on July 1, 2026. DFPI began accepting applications through the NMLS on March 9, 2026.

The general rule is that a person engaging in digital financial asset business activity with or on behalf of a California resident must hold a DFPI licence, have submitted a complete application by July 1, 2026 and be awaiting a decision, or fall within an exemption. Covered activity centres on exchanging, transferring and storing digital financial assets, and reaches operators located outside California that serve California residents. DFPI has stressed that a partially completed NMLS filing does not satisfy the transitional condition — the application has to be complete, with the required information and fee.

(Source: California DFPI, Digital Financial Assets Law application guidance — https://dfpi.ca.gov/regulated-industries/digital-financial-assets/digital-financial-assets-law-frequently-asked-questions/digital-financial-assets-law-preparing-for-your-application)

This does not mean every blockchain company needs a DFAL licence. It means the analysis is now mandatory for anyone with California customers, and the deadline for the transitional path has already passed.

Hawaii

Hawaii runs the other way, and is useful precisely because it breaks the assumption that state rules only ever tighten. After the Digital Currency Innovation Lab concluded on June 30, 2024, the Hawaii Division of Financial Institutions stated that digital currency companies no longer require a Hawaii-issued money transmitter licence to conduct digital currency business in the state, having concluded that the activity did not fit the money transmission concept in Chapter 489D of the Hawaii Revised Statutes. Fiat-denominated money transmission can still require a licence, and federal registration obligations were expressly unaffected.

(Source: Hawaii DCCA Division of Financial Institutions, release on the conclusion of the Digital Currency Innovation Lab — https://cca.hawaii.gov/dfi/news-releases/digital-currency-innovation-lab-concludes/)

Put the three together and the pattern is clear: identical federal FinCEN obligations can sit alongside a demanding licence in one state, a newly operational licence in another, and no state-specific licence in a third. State analysis has to be done state by state, against the activity, and refreshed — because it changes.

IRS Digital Asset Reporting Is Now Operational, but Not for Every DeFi Protocol

The tax section is where the previous version of this guide carried its most serious factual problem, and the correction matters because the wrong version tells non-custodial businesses they have reporting duties they do not have.

Start with what has not changed. The IRS treats digital assets as property, and taxpayers remain responsible for reporting taxable income, gains and losses from disposals — selling for fiat, trading one asset for another, paying for goods and services, and receiving assets as income, each under its own rules rather than one uniform treatment. Holding an asset is not itself a disposal. And FATF, which sets international AML standards, has nothing to do with U.S. federal tax classification; any statement that a FATF classification triggers a U.S. tax event should be deleted on sight.

Digital Asset Broker Reporting and Form 1099-DA

Broker information reporting is a separate obligation from taxpayer reporting, and it applies to a much narrower set of businesses than the earlier text suggested.

The statutory basis is the Infrastructure Investment and Jobs Act, which was enacted in 2021 — not 2024 — and expanded the definition of broker for digital asset purposes. Treasury and the IRS implemented that for custodial brokers in final regulations published in July 2024. Under those rules:

• gross proceeds reporting applies to transactions effected on or after January 1, 2025;
• customers began receiving Form 1099-DA in early 2026 covering 2025 transactions;
• basis reporting expands for relevant covered digital assets acquired on or after January 1, 2026, which is why 2025 forms generally show proceeds without cost basis.

The critical correction concerns DeFi. A separate rule finalized in December 2024 would have extended broker reporting to certain non-custodial participants, including DeFi front ends. Congress disapproved it under the Congressional Review Act, the resolution was signed into law on April 10, 2025, and Treasury and the IRS formally removed the rule from the Code of Federal Regulations effective July 11, 2025, stating it has no legal force or effect. The CRA also bars a substantially similar rule without new legislation.

(Source: IRS, About Form 1099-DA — https://www.irs.gov/forms-pubs/about-form-1099-da; Federal Register, removal of the non-custodial broker regulations, July 11, 2025)

So the accurate 2026 position is that current broker reporting principally covers specified brokers that take possession or custody of customer assets or otherwise fall within the custodial broker rules. It does not extend to every DeFi protocol, every non-custodial wallet, validators, or miners. Those participants may well have other obligations, and their users certainly have taxpayer obligations, but they are not Form 1099-DA brokers under the rules as they stand.

US Crypto Compliance in 2026 Is Layered, Not Unregulated

The useful way to close a guide like this is not another checklist but a sequence of questions, because the answer to each one changes which of the layers above actually apply. Before entering the U.S. market, a crypto business should work through:

• What does the business actually do, described operationally rather than in marketing terms?
• Does FinCEN treat that activity as money transmission or other MSB activity?
• Which BSA and AML obligations follow from that classification?
• Are OFAC sanctions controls required, and are they documented separately from the AML program?
• Does the product involve payment stablecoin issuance covered by the GENIUS Act?
• Does SEC or CFTC regulation reach the asset, the transaction, or the intermediary?
• Which state licences or authorizations are required for the customers being served?
• Does California's DFAL or New York's Part 200 apply?
• What IRS broker-reporting obligations, if any, attach to this specific business model?

There is no single "US crypto licence," and no one regulator that answers all nine. That has not changed since 2025 and is unlikely to change even if CLARITY passes. What those nine questions produce is a scope, and the scope is what a compliance program should be shaped around — which is the practical case for learning to build an AML program around the crypto business model instead of copying a generic template that assumes every crypto company carries identical duties.

What has changed is the other half of the picture. The United States can no longer accurately be described as having no federal crypto legislation. The current framework combines established BSA and FinCEN rules, a specific federal payment-stablecoin statute, a formal SEC and CFTC crypto interpretation, pending broader market-structure legislation, increasingly consequential state licensing regimes, and operational IRS information reporting. Businesses running in several countries at once will find it easier to see where the U.S. actually sits once they compare crypto AML requirements across major jurisdictions rather than treating each market as a separate universe. For a crypto business in 2026, the compliance question is not whether the United States regulates digital assets. It is which federal and state rules attach to the specific services, assets, customers, and transaction flows the business handles.

FAQ