Legal & Legislative

Anti-Money Laundering (AML) refers to the body of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. In the context of cryptocurrency, AML obligations require Virtual Asset Service Providers (VASPs) — including exchanges, custodians, and certain DeFi protocols — to implement controls that detect, report, and prevent the use of digital assets for money laundering. Core AML obligations include customer due diligence (CDD), transaction monitoring, suspicious activity reporting (SAR), and record-keeping requirements.

The Bank Secrecy Act (BSA), formally the Currency and Foreign Transactions Reporting Act (31 U.S.C. §§ 5311–5336), is the primary U.S. federal anti-money laundering statute. Enacted in 1970, it requires financial institutions — including cryptocurrency exchanges and money services businesses — to assist government agencies in detecting and preventing money laundering. Key BSA obligations include filing Currency Transaction Reports (CTRs) for cash transactions exceeding $10,000, filing Suspicious Activity Reports (SARs), maintaining customer identification programs (CIP), and retaining records for five years.

The Commodity Futures Trading Commission (CFTC) is an independent U.S. federal agency established in 1974 under the Commodity Exchange Act (CEA) to regulate U.S. derivatives markets, including futures, options, and swaps. The CFTC has asserted jurisdiction over digital assets it classifies as commodities — most notably Bitcoin and Ether — and over derivatives markets built upon them. The agency has brought numerous enforcement actions against cryptocurrency exchanges, DeFi protocols, and fraudulent token schemes operating without proper registration.

Under U.S. law, a commodity is broadly defined by the Commodity Exchange Act (CEA) as any good, article, service, right, or interest in which contracts for future delivery are dealt in. The CFTC has determined that Bitcoin and Ether qualify as commodities, placing them within its regulatory purview for derivatives markets. The commodity classification is significant because it subjects digital assets to a different — and generally less restrictive — regulatory regime than the securities framework administered by the SEC. Whether a given digital asset is a commodity or a security is one of the most contested questions in U.S. cryptocurrency law.

The FATF Travel Rule (FATF Recommendation 16) requires Virtual Asset Service Providers (VASPs) to collect, verify, and transmit originator and beneficiary information alongside virtual asset transfers above a threshold of USD/EUR 1,000. The rule — originally applied to wire transfers in traditional finance — was extended to virtual assets by the Financial Action Task Force (FATF) in its 2019 updated Guidance on Virtual Assets. The information required to "travel" with the transaction includes the originator's name, account number (wallet address), and physical address or national identity number, as well as the beneficiary's name and account number.

The Howey Test is a four-part legal standard established by the U.S. Supreme Court in SEC v. W.J. Howey Co., 328 U.S. 293 (1946), used to determine whether a transaction qualifies as an "investment contract" and therefore a security subject to federal regulation under the Securities Act of 1933 and the Securities Exchange Act of 1934. Under the test, a transaction is a security if it involves: (1) an investment of money; (2) in a common enterprise; (3) with a reasonable expectation of profits; (4) derived from the efforts of others. The test has become the primary analytical framework applied by the SEC and federal courts to evaluate whether digital assets and token offerings constitute securities.

An investment contract is a type of security under U.S. federal law, as defined and interpreted through the Howey Test. It encompasses any scheme whereby a person invests money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party. The investment contract concept is intentionally broad and flexible, designed to capture novel financial instruments that do not fit neatly into traditional categories such as stocks or bonds. The SEC has consistently argued that many digital token offerings — particularly those sold through Initial Coin Offerings (ICOs) — constitute investment contracts and are therefore unregistered securities.

Know Your Customer (KYC) refers to the mandatory process by which financial institutions and regulated entities verify the identity of their clients before and during the course of a business relationship. In the cryptocurrency context, KYC obligations require exchanges, custodians, and other VASPs to collect and verify identifying information — typically government-issued identification, proof of address, and in some cases source-of-funds documentation — before allowing customers to transact. KYC is a foundational component of AML compliance programs and is required under the Bank Secrecy Act's Customer Identification Program (CIP) rules in the United States.

The Markets in Crypto-Assets Regulation (MiCA) is a comprehensive European Union regulatory framework for crypto-assets, published in the Official Journal of the EU on June 9, 2023 (Regulation (EU) 2023/1114). MiCA establishes a harmonized legal framework across all 27 EU member states for the issuance, offering, and trading of crypto-assets not already covered by existing EU financial services legislation. It introduces authorization requirements for Crypto-Asset Service Providers (CASPs), disclosure obligations for issuers of crypto-assets, and specific regimes for asset-referenced tokens (ARTs) and e-money tokens (EMTs) — the two categories of stablecoins.

A Money Services Business (MSB) is a category of financial institution defined under U.S. federal law (31 C.F.R. § 1010.100(ff)) that is subject to Bank Secrecy Act registration, reporting, and recordkeeping requirements. MSB categories include money transmitters, currency dealers or exchangers, check cashers, issuers of traveler's checks or money orders, and providers of prepaid access. FinCEN has determined that administrators and exchangers of convertible virtual currency — including cryptocurrency exchanges and certain wallet providers — qualify as money transmitters and are therefore MSBs subject to full BSA compliance obligations.

Regulation D (Reg D) is a set of SEC rules (17 C.F.R. §§ 230.500–230.508) that provide exemptions from the registration requirements of the Securities Act of 1933, allowing companies to raise capital through private placements without filing a full registration statement with the SEC. In the cryptocurrency context, Reg D — particularly Rule 506(b) and Rule 506(c) — has been widely used by token issuers to conduct private token sales to accredited investors while avoiding the full SEC registration process. A Form D must be filed with the SEC within 15 days of the first sale of securities under a Reg D exemption.

Staff Accounting Bulletin No. 121 (SAB 121) is guidance issued by the SEC's Office of the Chief Accountant and Division of Corporation Finance in March 2022, addressing the accounting treatment for obligations to safeguard crypto-assets held for platform users. SAB 121 requires entities that hold crypto-assets in custody on behalf of others to record a liability on their balance sheet equal to the fair value of those assets, with a corresponding asset. This treatment — which differs from traditional custodial arrangements — significantly increases the capital requirements for banks and financial institutions seeking to offer cryptocurrency custody services.

The Securities and Exchange Commission (SEC) is the primary U.S. federal agency responsible for enforcing federal securities laws and regulating the securities industry. In the digital asset context, the SEC has taken the position that most cryptocurrencies — other than Bitcoin and, more recently, Ether — are securities subject to its jurisdiction under the Securities Act of 1933 and the Securities Exchange Act of 1934. The SEC has pursued an aggressive enforcement-first approach to cryptocurrency regulation, bringing actions against exchanges (Coinbase, Binance), token issuers (Ripple, Telegram), and lending platforms (BlockFi, Celsius).

A security token is a digital asset that represents an investment contract or other security as defined under applicable securities laws — most commonly analyzed under the U.S. Howey Test. Security tokens may represent ownership interests in real-world assets (equity, debt, real estate), profit-sharing rights, or other investment interests. Because they qualify as securities, security tokens are subject to full securities law compliance, including registration with the SEC (or an applicable exemption), disclosure requirements, and broker-dealer regulations for secondary market trading. Security Token Offerings (STOs) emerged as a regulatory-compliant alternative to ICOs following the SEC's 2017–2018 enforcement actions.

A utility token is a digital asset designed to provide holders with access to a specific product, service, or platform — rather than representing an investment interest or ownership stake. In theory, a utility token functions analogously to a software license or a prepaid service voucher: its value derives from its use within a specific ecosystem, not from the expectation of profit generated by the efforts of others. Utility tokens are frequently cited by token issuers as a basis for arguing that their tokens are not securities and therefore not subject to SEC registration requirements.

The Wyoming DAO LLC is a legal entity structure created by Wyoming's Decentralized Autonomous Organization Supplement (W.S. §§ 17-31-101 through 17-31-116), which became effective July 1, 2021, making Wyoming the first U.S. state to recognize DAOs as a distinct legal entity. Under the Wyoming framework, a DAO may be organized as a limited liability company, providing members with limited liability protection while allowing governance to be conducted through smart contracts and on-chain voting. The DAO's operating agreement may be written in code (a "smart contract"), in a traditional written document, or a combination of both.