Summary. Digital asset regulation in the United States is not one regime but the collision of several older ones, each written for something else and each claiming part of the field. This article works through the claims in order: when a token is a security under Howey and what Ripple and Terraform actually held, where CFTC authority begins and ends, why every meaningful intermediary is a money services business with Bank Secrecy Act and sanctions obligations, how the federal payment stablecoin framework changed the analysis for issuers, what the tax rules require now that broker reporting and per-wallet basis tracking are in effect, and how customer assets are treated when an exchange fails.

Three companies, one asset.

A protocol issues a token to fund development, selling it to institutional buyers under contracts promising the proceeds will build the network. That is almost certainly an investment contract, and the buyers are almost certainly purchasing a security.

Two years later the same token trades on a dozen exchanges. A retail buyer purchases it on a screen, from an anonymous seller, with no idea who issued it and no promise from anyone. Whether that transaction involves a security is a genuinely contested question, and one court has said it does not.

A third company accepts that token as payment for goods, converts it to dollars, and remits the dollars to its merchants. It has almost certainly become a money transmitter and a money services business, with obligations that have nothing to do with whether the token is a security.

The asset is the same in all three. The regulatory answer is different in all three, because U.S. digital asset regulation is not about assets. It is about transactions, relationships, and functions. Every productive analysis in this field starts by identifying what the company does, not what it holds.

The securities question

The test. SEC v. W.J. Howey Co., 328 U.S. 293 (1946): an investment contract exists where there is (1) an investment of money, (2) in a common enterprise, (3) with a reasonable expectation of profits, (4) to be derived from the entrepreneurial or managerial efforts of others.

Elements one and two are rarely contested. The fight is over three and four.

What the SEC has maintained. In its 2019 Framework for "Investment Contract" Analysis of Digital Assets and in a long enforcement record, the Commission has emphasized reliance on an active participant — a promoter or development team essential to the network's success — and the presence of promotional statements about price appreciation, secondary market listing, and use of proceeds for development. Its position has been that most tokens sold to fund development are securities, and that the analysis can change over time as a network becomes sufficiently decentralized.

What the courts have done. The record is uneven, and the differences matter.

SEC v. Telegram Group Inc., 448 F. Supp. 3d 352 (S.D.N.Y. 2020) — the court looked through a two-step structure of private purchase agreements followed by token delivery and treated the scheme as a whole as an unregistered securities offering.

SEC v. Ripple Labs, Inc. — the court distinguished among transaction types in the same token. Institutional sales, made under written contracts with sophisticated buyers who understood that proceeds would fund the network, satisfied Howey. Programmatic sales on exchanges to blind bidders who did not know their money went to the issuer did not, on the court's reasoning that those buyers could not have relied on the issuer's efforts because they did not know who they were buying from. Distributions to employees and partners failed the investment-of-money element. The programmatic-sales holding is the most contested proposition in the field and has been criticized by other district courts.

SEC v. Terraform Labs — the court rejected the transaction-type distinction, holding that the manner of sale does not change whether the underlying scheme is an investment contract.

Where that leaves practitioners. There is no safe harbor and no bright line. The honest summary is:

  • A fundraising sale of a token by an issuer that will use proceeds to build the thing is high risk under any reading.
  • A secondary market trade of a mature, functional, widely distributed token with no active promoter is a much better fact pattern, though not a settled one.
  • Marketing is evidence. Statements about scarcity, burn mechanisms, price appreciation, exchange listings, and the team's roadmap are the facts on which element four turns. Many projects have converted a defensible utility token into an indefensible one through their own communications.
  • Bitcoin is not a security — a position the SEC has consistently taken — and the Commission's leadership has stated the same of Ether, though the reasoning has never been fully articulated in a rule.

If it is a security, the consequences are the full securities framework: registration under the Securities Act of 1933 or an exemption (Regulation D, Regulation S, Regulation A+, or Regulation Crowdfunding, each with its own conditions and resale restrictions); broker-dealer registration for anyone effecting transactions for others; exchange registration or ATS relief for anyone matching orders; investment adviser registration for managers; custody requirements; and Rule 10b-5 antifraud liability, which applies regardless of registration.

Legislative and regulatory movement. Congress has repeatedly considered market structure legislation dividing jurisdiction between the SEC and CFTC on a decentralization or control test, and the SEC's approach has shifted materially with changes in Commission leadership — including the establishment of a dedicated crypto task force and the withdrawal or settlement of several pending enforcement actions. Anyone relying on this article's framing should verify the current state of both, because this is the fastest-moving area described here.

The commodities question

Bitcoin and Ether are commodities under the Commodity Exchange Act's broad definition at 7 U.S.C. § 1a(9), which sweeps in "all other goods and articles" and "all services, rights, and interests" in which contracts for future delivery are dealt in. Courts have consistently agreed. CFTC v. McDonnell, 287 F. Supp. 3d 213 (E.D.N.Y. 2018).

The CFTC's authority is asymmetric, and this is the structural fact that confuses most newcomers:

  • Full regulatory authority over derivatives — futures, options, and swaps on digital assets — including registration of exchanges as designated contract markets, clearing organizations, futures commission merchants, and introducing brokers.
  • Full regulatory authority over retail commodity transactions offered with leverage, margin, or financing to non-eligible-contract-participants, which are treated as futures unless actual delivery occurs within 28 days. The CFTC's actual delivery guidance for digital assets requires the customer to obtain possession and control and the offeror to relinquish all interest — which is why leveraged spot trading platforms have been a persistent enforcement target.
  • Antifraud and anti-manipulation authority only over the spot market. The CFTC can pursue fraud and manipulation in cash digital asset markets under § 6(c)(1) and Rule 180.1, but it has no registration or supervisory regime for spot exchanges.

The gap that follows. A spot exchange trading non-security tokens is not registered with the SEC (no securities), not registered with the CFTC (no spot regime), and therefore regulated principally by state money transmitter licensing and the Bank Secrecy Act. That gap is the central problem U.S. market structure legislation has repeatedly tried to close, and it explains why state regulators and FinCEN have been the most consequential supervisors of the industry to date.

DeFi. The CFTC has brought actions against decentralized protocols offering leveraged trading and prediction markets, taking the position that the absence of a corporate operator does not create an exemption and pursuing the founders, the developers, and in some instances the governing token holders as an unincorporated association. Governance participation is not a costless act.

Money transmission, the Bank Secrecy Act, and sanctions

This is the layer that applies to nearly every business in the space, regardless of how the securities and commodities questions come out.

FinCEN's position, set out in its 2013 and 2019 guidance, is that an administrator or exchanger of convertible virtual currency is a money transmitter and therefore a money services business, subject to registration, program, recordkeeping, and reporting requirements.

Who is covered: exchanges; hosted wallet providers with control over customers' assets; kiosk and ATM operators; payment processors that accept and transmit value; token issuers that sell and redeem; peer-to-peer exchangers doing it as a business; and mixing services, which FinCEN has separately proposed to designate as a class of primary money laundering concern.

Who is generally not: users spending their own funds; unhosted wallet software providers that never take control of keys; miners and validators receiving block rewards for their own account; and providers of anonymizing software as distinct from anonymizing services. The dividing line, repeatedly, is control. Software that helps a user transact is different from a service that holds the user's value.

Obligations, if covered:

  • FinCEN registration as an MSB within 180 days, renewed every two years.
  • A written AML program with the five pillars: policies and controls, a designated compliance officer, training, independent testing, and customer due diligence including beneficial ownership for legal entity customers.
  • A customer identification program.
  • Suspicious activity reports, filed within 30 days, with absolute confidentiality.
  • Currency transaction reports for cash transactions over $10,000, which apply to kiosk operators.
  • Recordkeeping for five years, and the Travel Rule — 31 C.F.R. § 1010.410(f) — requiring transmittal of originator and beneficiary information for transmittals at or above the threshold. Compliance across counterparties without a common messaging standard remains a genuine operational problem.

State licensing. Money transmitter licensing applies in most states, and the analysis is state-specific: a minority of states have concluded that transmitting virtual currency alone is not "money" transmission, while most have concluded otherwise or amended their statutes to say so. New York's BitLicense, 23 NYCRR Part 200, is a separate and demanding regime with its own capital, custody, cybersecurity, consumer protection, and coin-listing approval requirements. Several states have adopted virtual currency business acts based on a uniform model. There is no shortcut here; the analysis is fifty-state and it changes.

OFAC. Sanctions apply to digital asset activity exactly as to any other, on a strict liability basis, and OFAC has designated individual wallet addresses as blocked property and has designated mixing services — most notably Tornado Cash, whose designation was subsequently the subject of litigation over whether immutable smart contracts constitute property in which a foreign person has an interest, and whose treatment has since changed. The compliance obligations are concrete: screen customers and, where feasible, counterparty addresses against the SDN list and known-illicit clusters; block or reject as required; report blockings within 10 business days; and maintain records. Blockchain analytics is now a standard control, and its absence is an examination finding.

Criminal exposure. 18 U.S.C. § 1960 criminalizes unlicensed money transmitting, including operating without state licensure where required and without FinCEN registration, and it has been charged against exchange operators and peer-to-peer traders. 18 U.S.C. § 1956 money laundering and the sanctions statutes carry substantially greater penalties, and the largest resolutions in the industry to date have been AML and sanctions cases, not securities cases.

Stablecoins

Stablecoins are the segment where the regulatory picture changed most decisively.

The federal framework. Legislation enacted in 2025 established a regime for payment stablecoins — digital assets designed to maintain a stable value against a fixed monetary amount and used for payment or settlement. Its core elements:

  • Permitted issuers only. Issuance is restricted to subsidiaries of insured depository institutions, federally qualified nonbank issuers approved by the OCC, and state-qualified issuers under state regimes certified as substantially similar, with a size threshold above which federal oversight applies.
  • Full reserve backing — one-to-one in cash, insured deposits, short-dated Treasury securities, repurchase agreements collateralized by Treasuries, and similarly liquid instruments, held segregated from the issuer's own assets.
  • Monthly reserve reporting, examined by a registered public accounting firm, with executive certification.
  • Redemption at par, with published policies and timely processing.
  • No interest or yield paid by the issuer to holders on the stablecoin itself.
  • AML and sanctions obligations, with a technical capability to seize, freeze, or burn tokens in response to lawful orders.
  • Priority for holders in an issuer insolvency, ahead of other creditors.
  • A prohibition on non-permitted issuance after a transition period, with restrictions on secondary trading of non-compliant stablecoins by regulated intermediaries.

What it does not resolve. Algorithmic stablecoins are outside the permitted framework. The treatment of yield offered by distributors and exchanges rather than issuers has been contested. And the interaction with the securities laws for stablecoins carrying returns remains fact-specific — a stablecoin paying a return derived from reserve investments looks materially more like a security or a money market fund than one that does not.

Practical consequence. For anyone issuing or distributing a dollar-referenced token, the question is no longer "is this a security" but "are we a permitted issuer, and if not, whose stablecoin are we distributing and does it comply." That is a much more tractable question than the one the industry faced before.

Tax

The foundational position, from IRS Notice 2014-21: virtual currency is property, not currency. Every disposition is a taxable event producing capital gain or loss measured by the difference between the fair market value received and the basis.

Consequences that surprise people:

  • Spending crypto is a sale. Buying a coffee with appreciated Bitcoin realizes gain.
  • Trading one token for another is a sale. There is no like-kind exchange treatment; § 1031 has been limited to real property since 2017.
  • Hard forks producing new tokens over which the taxpayer has dominion and control produce ordinary income at fair market value. Rev. Rul. 2019-24.
  • Airdrops are ordinary income on receipt when the taxpayer gains dominion and control.
  • Mining and staking rewards are ordinary income at fair market value when received, per Rev. Rul. 2023-14 — the position that staking rewards are taxable on receipt rather than on sale, which has been challenged in litigation but remains the Service's position.
  • NFTs may be collectibles subject to the higher 28 percent long-term capital gains rate, under a look-through analysis to the associated asset.
  • Wash sale rules under § 1091 do not currently apply to digital assets, because they reach "stock or securities." Loss harvesting is therefore available in a way it is not for equities — a position Congress has repeatedly proposed to change.
  • Charitable contributions over $5,000 require a qualified appraisal; the Service has confirmed that exchange price data is not a substitute.

Reporting, which changed substantially. Section 6045 broker reporting now requires custodial digital asset brokers to report gross proceeds on Form 1099-DA, with basis reporting phased in for covered securities. Rev. Proc. 2024-28 ended the ability to use a universal basis pool across wallets and accounts and requires per-wallet or per-account basis tracking, with a transition allocation as of the effective date. Taxpayers who never separated their lots by account now must, and doing it retroactively is difficult.

Also live: the Form 1040 digital asset question, which must be answered; FBAR and Form 8938 reporting, whose application to foreign-held digital assets has been the subject of proposed rules; and the § 6050I requirement to report receipt of more than $10,000 in a trade or business, which by its terms extends to digital assets and has been challenged on constitutional grounds.

Custody, consumers, and insolvency

Custody is where the industry's largest losses have occurred, and the rules depend on the custodian's status.

For investment advisers, the SEC's custody framework requires client assets to be held with a qualified custodian, and the Commission has proposed extending and modifying it for digital assets. For broker-dealers, the customer protection rule and its possession-or-control requirement have historically been difficult to satisfy for digital assets, which is why special purpose broker-dealer relief was created and narrowly used. For banks, the OCC has issued interpretive letters permitting custody of digital assets, with the supervisory posture shifting over time. For state trust companies, custody is authorized under state law with state capital and control requirements — the structure most large custodians use.

Accounting. The FASB's ASU 2023-08 requires fair value measurement for in-scope crypto assets, replacing the indefinite-lived intangible impairment model. And the SEC's staff accounting guidance on safeguarding obligations, which had required custodians to recognize a liability and corresponding asset on the balance sheet, was rescinded — a change that materially altered the economics of bank custody.

When an exchange fails, the question that determines everything is whether customer assets were held in custody for the customer or owned by the exchange subject to a contractual claim. The bankruptcy courts have answered by reading the terms of service. Where the terms provided that title to assets in an interest-bearing or earn account transferred to the platform, customers were unsecured creditors sharing pro rata in a residual estate. Where assets were held in segregated custodial accounts and the terms disclaimed any transfer of title, customers had property interests recoverable from the estate.

Two practical lessons follow. For users: read the account terms, understand which product tier you are in, and recognize that "not your keys, not your coins" is a statement about bankruptcy law as much as about cryptography. For platforms: the terms of service are the single most important legal document in the business, and the operational reality must match them — commingling assets that the terms describe as segregated creates both a bankruptcy problem and a fraud problem.

Consumer protection applies independently. The CFPB has asserted that Regulation E error resolution applies to certain digital asset transfers from consumer accounts, state UDAP statutes reach misleading claims about yield and insurance, and the FDIC's rule on misrepresenting deposit insurance addresses a claim the industry made frequently.

Building a compliant business

Start with function, not asset. Write down what the company does: issue, sell, exchange, custody, lend, stake on behalf of others, advise, match orders, process payments, or provide software. Each verb maps to a regime.

Then, in order:

  1. Securities analysis for any token the company issues or lists, documented, with the marketing reviewed as part of it.
  2. Money transmission analysis, federal and fifty-state, with the flow of funds and the question of control at its center.
  3. BSA/AML program built before launch — registration, written program, CIP, transaction monitoring, SAR procedures, Travel Rule capability, independent testing.
  4. Sanctions program with address screening and blockchain analytics.
  5. Custody architecture — key management, segregation, multi-signature or MPC controls, insurance, and terms of service that describe what actually happens.
  6. Tax reporting infrastructure — per-wallet basis tracking, 1099-DA capability, and cost basis data collection at onboarding.
  7. Consumer disclosures that survive a UDAAP reading, particularly about yield, insurance, and risk.
  8. Cybersecurity, including the specific controls state regimes require, and an incident response plan that contemplates key compromise.

And document the reasoning contemporaneously. In an area where the law is genuinely unsettled, a written, dated analysis by counsel is both the best defense on scienter and the best evidence of good faith in a negotiated resolution.

Conclusion

The most useful framing for U.S. digital asset regulation is that there is no digital asset regulator. There are securities laws, commodities laws, banking and money transmission laws, tax rules, sanctions rules, and consumer protection statutes, each of which asks whether a particular transaction or relationship falls within its own older definitions. A token is not regulated; a transaction is.

Three points carry the most weight in practice.

The AML and sanctions layer is the one that applies to everyone. The securities debate absorbs the commentary, but the largest enforcement resolutions in this industry have been Bank Secrecy Act and sanctions cases, and those obligations attach on function and control without regard to how the securities question comes out.

Marketing creates the securities problem more often than structure does. Element four of Howey is about reliance on the efforts of others, and projects routinely supply the evidence themselves through roadmaps, burn mechanics, and listing announcements.

The terms of service determine what happens in a failure. Every large exchange insolvency has turned on the same question, answered the same way: what did the contract say about title, and did operations match it.

Three worked examples

A protocol launching a token. The team plans a public sale to fund two years of development, with a roadmap, a burn mechanism, and announced exchange listings. Counsel's analysis is short: under any reading of Howey, this is an offering of investment contracts, because purchasers are paying money to a common enterprise in the expectation that the team's efforts will make the token more valuable, and the team has said so in writing. The realistic paths are a Regulation D private placement to accredited investors with resale restrictions and a Form D filing; a Regulation S offering to non-U.S. persons with genuine offshore transaction requirements and no directed selling efforts into the United States; a Regulation A+ qualified offering, which is slow and expensive but produces freely tradable securities; or delaying the token until the network is functional and the distribution is not a fundraise. What is not available is a "utility token" label applied to a fundraising sale. Counsel also rewrites the marketing: every statement about price, scarcity, and the team's future work is evidence on element four, and the ones that are not necessary are removed.

An exchange listing third-party tokens. The securities analysis is per token and cannot be delegated to the issuer's assurances. The exchange builds a listing committee with a written framework — issuance history, distribution, promoter activity, current marketing, functional use, and whether any court or regulator has spoken — and documents each decision. Separately and independently, it registers with FinCEN, obtains money transmitter licenses state by state (and a BitLicense to serve New York), builds the five-pillar AML program with blockchain analytics screening on deposits and withdrawals, implements Travel Rule messaging with its counterparties, and constructs custody with segregated wallets, multi-party computation key management, and terms of service that state plainly that the customer retains title and that the exchange holds assets as custodian. It offers no yield product, because a yield product changes both the securities analysis and the bankruptcy outcome. It builds per-wallet basis tracking and Form 1099-DA reporting from the start, because retrofitting basis data is close to impossible.

A company accepting crypto for payment. The simplest case, and the one most often mishandled. If the company accepts a token and immediately converts through a third-party processor that bears the price risk and never lets the company hold customer funds, the company is a merchant and the processor carries the regulatory weight — though the company still has a tax obligation, because it has received property at fair market value and recognizes income accordingly. If instead the company holds balances for customers, converts on their behalf, or remits to third parties, it has become a transmitter and the entire money services business framework attaches. The difference between the two models is a paragraph in a contract and a decision about who touches the funds, and it is worth substantially more than it costs to get right.

Frequently asked questions

Is Bitcoin a security? No. The SEC has consistently taken that position, and the CFTC and the courts treat it as a commodity. That answer does not extend automatically to any other asset.

Does decentralization make a token not a security? Decentralization is relevant to element four of Howey — whether purchasers rely on the efforts of others — but it is a factual question, not a status. There is no threshold at which a project becomes exempt, and a project that is decentralized in governance may still have an active promoter whose efforts drive value.

Can I avoid U.S. rules by using an offshore entity? Generally no. The securities laws reach offers and sales to U.S. persons; the Bank Secrecy Act reaches financial institutions doing business in the United States; OFAC reaches U.S. persons and transactions touching the U.S. financial system; and prosecutors have charged offshore operators who served U.S. customers. Geofencing that is real — with meaningful controls, not a checkbox — is a strategy. Incorporation abroad by itself is not.

Do I owe tax if I only moved crypto between my own wallets? No, a transfer between wallets you control is not a disposition. But under the per-wallet basis rules you must track which lots moved where, and failing to do so will produce the wrong answer when you eventually sell.

Are staking rewards taxable before I sell? The Service's position is yes — ordinary income at fair market value when you gain dominion and control. That position has been litigated and remains contested, but reporting against it is a decision to take a position, and it should be a documented one.

Is an NFT a security? Usually not, when it is a genuine collectible or a piece of art sold without promises about returns. It becomes one when it is marketed as an investment with promoter efforts driving value — fractionalized NFTs, NFT "floor price" funds, and NFT projects promising roadmap-driven appreciation have all drawn scrutiny.

What about a DAO? A decentralized autonomous organization without a formal entity has been treated as a general partnership or unincorporated association in litigation, which means token holders who participate in governance may face unlimited personal liability. Several states now offer DAO LLC statutes; using one is dramatically better than not.

What is the most common structural mistake? Offering a yield product. It creates a securities issue, changes the bankruptcy characterization of customer assets from custodial property to a general unsecured claim, and — for a stablecoin — runs into the federal prohibition on issuer-paid interest. The product that has ended the most companies in this industry is the one that pays customers to leave their assets on the platform.

What to watch

Four questions will determine the shape of this field over the next several years, and each has a concrete effect on how a business should be structured today.

Market structure legislation. Every serious proposal divides jurisdiction between the SEC and the CFTC using some test of decentralization, control, or functionality, and gives the CFTC a registration regime for spot markets that does not currently exist. If that passes, the largest single gap described in this article closes, and spot exchanges acquire a federal supervisor for the first time. Businesses should build recordkeeping, custody segregation, and financial reporting now on the assumption that a registration regime is coming, because retrofitting those systems under a compliance deadline is far more expensive than building them.

The scope of the Howey analysis in secondary markets. The programmatic-sales reasoning has not been adopted broadly and has been rejected by at least one court squarely. Until an appellate court resolves it, listing decisions should not rest on it.

Custody and accounting. The rescission of the staff guidance requiring on-balance-sheet recognition of safeguarding obligations removed the principal obstacle to bank custody at scale. Whether banks actually enter, and on what terms, changes the competitive landscape for state trust company custodians and changes what "qualified custodian" means in practice for advisers.

Tax administration. Form 1099-DA reporting and per-wallet basis tracking together mean that, for the first time, the Service will receive third-party data about most retail activity. The compliance consequence for individuals is immediate: basis records that were previously self-reported and unverifiable are now checkable, and the mismatch between a taxpayer's universal-pool history and the new per-account regime is the most likely source of notices over the next several filing seasons.

None of these is a reason to wait. The obligations that apply today — registration, program, screening, custody segregation, and reporting — apply regardless of how any of these resolve, and a company that has built them will find every one of these developments easier to absorb than a company that has not.

Do I need a lawyer to launch a token? For anything sold to raise money, yes, and the analysis should precede the marketing rather than follow it. For a business that only accepts digital assets as payment through a processor, a short structural review is usually sufficient. The expensive engagements in this field are almost always remediations of decisions made before anyone asked.

Related articles

This article is provided for general informational purposes and does not constitute legal or tax advice. Digital asset regulation is unsettled and changing rapidly; several matters described here are subject to pending litigation, rulemaking, or legislation. Consult qualified counsel before issuing, listing, custodying, or transmitting digital assets.