Digital Asset Compliance Checklist: A Practical Checklist

Document type: Checklist Practice area: Corporate — Securities Jurisdiction: United States (federal and state) Last reviewed: 5 September 2026

Part 1 — Money transmission and BSA (do this FIRST)

Do this before the securities analysis. It applies more broadly, it is criminal under 18 U.S.C. § 1960, and state licensing takes eighteen months.

Do we ever hold customer funds or assets, even momentarily?
Do we move value between persons?
Do we convert between assets, or between an asset and fiat?
Do we control keys that can move someone else's assets?
Do we operate any custodial wallet, escrow, or settlement function?
Determination documented, with an architecture description signed off by engineering (because the answer depends on facts a product change can alter).
Non-custodial architecture, if relied on, recorded as a standing engineering constraint — not a filed opinion.

If a money services business:

FinCEN registration filed.
AML program meeting 31 U.S.C. § 5318: designated compliance officer, written policies and procedures, training, independent testing.
Customer identification program.
Recordkeeping and travel rule compliance.
Suspicious activity reporting process and filings.
State licensing map built for every state where customers are; timelines and costs modeled.
Availability restricted technically where licenses are pending.
Digital-asset-specific state frameworks checked.

Part 2 — Entity, treasury, and governance structure

Operating company and any foundation or token entity defined, with roles.
If a foundation: independent directors, own budget and staff, own decision-making, arm's-length agreements. (A wholly controlled affiliate is a subsidiary with different letterhead.)
Investment Company Act analysis under 15 U.S.C. § 80a-3 for any entity holding a portfolio of tokens that may be securities.
Investment adviser analysis under 15 U.S.C. § 80b-2 for anyone advising others for compensation.
Supply allocation set: founders, company, foundation, investors, ecosystem, public — with vesting for each.
Named approvers for token transactions, communications, and listings.

Part 3 — The securities analysis, transaction by transaction

Not "is our token a security." List every transaction and analyze each.

Institutional or seed sale
Public sale, if any
Distribution for contributed services
Airdrop or incentive distribution
Treasury sales
Exchange listing / secondary trading
Use to pay for the network's service

For each, apply Howey:

Investment of money — what did the recipient give up?
Common enterprise — horizontal (pooling, pro rata) or vertical, per circuit.
Reasonable expectation of profits — what were purchasers actually motivated by? United Housing Foundation, Inc. v. Forman, 421 U.S. 837 (1975) turns on motivation, and a fixed return is still a profit after SEC v. Edwards, 540 U.S. 389 (2004).
From the efforts of others — whose undeniably significant managerial efforts?
Load-bearing facts identified; what would change the conclusion stated.

Also screen:

Notes analysis under Reves v. Ernst & Young, 494 U.S. 56 (1990) for any lending, yield, or interest-bearing arrangement — presumption that a note is a security.
"Utility" is not an answer, and neither is the label — see Landreth Timber Co. v. Landreth, 471 U.S. 681 (1985).
Commodity-side exposure: 7 U.S.C. § 1a definitions, § 2 jurisdiction, and — critically — § 9 antifraud and anti-manipulation authority over spot markets.
Retail leveraged/margined commodity transaction rules.
State blue sky registration and exemptions.
Tax characterization: property treatment, realization on disposition, barter valuation, service-provider grants, staking, airdrops, forks.
Sanctions exposure.

Part 4 — If it is a securities transaction

Exemption chosen and complied with: Rule 506(b) (no general solicitation; accredited plus up to 35 sophisticated non-accredited) or Rule 506(c) (general solicitation permitted; verification required, not self-certification) under Regulation D.
Section 5 satisfied — registered or exempt.
Form D filed; state notice filings made.
Transfer restrictions imposed, and implemented in the transfer mechanism where technically possible.
Resale analyzed. Restricted securities listed on a public venue have been resold. Fungibility and on-chain transferability do not dissolve the restriction.
Lockups, staged launch, or venue restrictions designed accordingly.
Exchange Act registration/reporting thresholds modeled against holder counts and scale.
Antifraud understood to apply regardless of exemption — Rule 10b-5.

Part 5 — Disclosure

The whitepaper is a disclosure document.

Token supply and issuance schedule; allocations; vesting; what can change them and who decides.
What the token does — present tense for what exists, future tense clearly labeled.
Governance and control: who can change the protocol, who holds upgrade/admin keys, emergency powers.
Funds raised and use of proceeds.
Team and their holdings.
Real risk factors: technical, regulatory, market, key-person, competitive, and the risk that the regulatory characterization is wrong.

Removed:

Price projections; return language; performance comparisons; "investment" framing.
Unagreed listing claims.
Supply-mechanic claims (burns, buybacks, deflation) the company cannot control or that function as returns.
Separate private placement memorandum drafted for the securities offering. (One document cannot serve as both product marketing and risk disclosure.)

Part 6 — Communications policy

The largest category of adverse evidence in every enforcement action in this sector.

Nobody discusses price — founders included. No targets, no commentary, no retweets of price analysis.
No listing announcements before agreed; no speculation.
No return, yield, or investment framing anywhere.
Roadmap statements labeled as plans, dated, and qualified; tracked against outcomes.
One approval path for anything public — social, AMAs, podcasts, conference talks, Discord, Telegram.
Community team trained (highest volume, least training).
Everything archived.
Policy applies to founders, and is enforced against them.

Part 7 — Distributions and airdrops

What did the recipient give up? Money, effort, data, a lockup, or nothing.
What were they told to expect? A network they will use, or appreciation. Program marketing is the evidence.
Who are they relying on? If the answer is us, the analysis is the same as for a sale.
Tasks, wallet connections, referrals, and holding requirements recognized as possible contributions of value.
Recipients given information about tax on receipt at fair market value.
Sanctions screening applied — a distribution is a transfer of value.
Restricted jurisdictions excluded technically, not by checkbox.
Distributions for genuine contributed services (nodes, compute, storage) preferred where the network permits.

Part 8 — Treasury and insider trading policies

Treasury:

Named approval committee with legal represented; quorum required.
Defined sale triggers (runway threshold, budgeted grants, liquidity program); anything else goes to the board.
Volume and pacing limits tied to trailing average daily volume; no selling into a thin market.
Blackouts before material announcements — listings, governance changes, partnerships, incident disclosures, financings.
Method defined; a pre-adopted, non-discretionary program preferred over discretionary sales.
Disclosure practice decided (silence plus visible on-chain movement is worse than disclosure).
Records: date, amount, counterparty, method, approver, trigger.

Insiders:

Personal trading policy covering founders, employees, advisers, and affiliates.
Holdings disclosed; blackout periods; pre-clearance.
Prohibition on trading on non-public information about listings, protocol changes, partnerships, or incidents.
Policy enforced — company exposure turns on whether controls existed.

Part 9 — Operational controls

Sanctions screening of counterparties and wallet addresses; blocking, rejecting, and reporting procedures.
Customer identification at the standard the money transmission analysis requires.
Transaction monitoring and SAR filing, if an MSB.
Geographic restrictions implemented technically and documented.
Tax information provided to distribution recipients; broker reporting obligations confirmed against current requirements.
Records: every distribution, treasury transaction, listing decision, communication approval, and analysis version.

Part 10 — Launch readiness review

Money transmission position confirmed; licenses in place or availability restricted.
Securities analysis complete, dated, and current.
Exemption complied with; filings made.
Disclosure documents final and reviewed.
Communications policy adopted and trained; all channels inside the approval flow (check for the forgotten Discord).
Sanctions and identification controls live and tested.
Treasury policy approved; no unrestricted sale path exists.
Governance and approvals documented.
Incident plan written.
Banking, insurance, and audit relationships in place.

Part 11 — Intermediaries: listing committee

Standing committee with legal and compliance; quorum; minutes; named approver per decision.
Written analysis per asset, covering: original distribution and whether it was a securities offering; current decentralization across development, governance, upgrade authority, token concentration, and economics; issuer's public communications; identifiable promoter; commodity characterization; money transmission implications; sanctions exposure; liquidity, holder concentration, and manipulation indicators.
Load-bearing facts and a monitoring plan documented.
Delisting triggers agreed before listing: regulatory action, control or governance change, monitoring failure, liquidity loss, integrity event.
Scheduled re-review, not only news-driven.
Exchange and broker analysis run: 15 U.S.C. § 78c exchange definition, § 78f registration or ATS, § 78o broker-dealer status.
Listing file retained.

Part 12 — Intermediaries: custody

Three documents must agree.

Terms of service: customer retains ownership; assets held for customer's benefit; no right to use, lend, pledge, or rehypothecate; segregated from firm assets. (Read the current version.)
Operational reality: actual segregation on-chain and in the books; key custody controls and quorum; no commingling in fact; individual entitlements reconstructable from records.
Accounting and disclosure treatment consistent with the legal analysis.
Reconciled — and any disagreement resolved by changing the documents or the operations, not by choosing a favorite.
Insolvency analysis written by counsel who has litigated one.
Proof: reserve attestations or proof-of-reserves, independent examination, internal reconciliation cadence.
Backing claims supportable — exposure under FTC Act § 5 and, where securities are involved, Rule 10b-5.
Yield products analyzed separately under Reves and Edwards; retail versions reconsidered.

Part 13 — Stablecoin issuers

The promise stated precisely: fiat-backed and redeemable at par / over-collateralized / algorithmic.
Reserve composition, concentration, and duration documented.
Where reserves are held, at which institutions, in whose name.
Segregation and bankruptcy remoteness mechanism identified.
Claim priority defined; shortfall waterfall stated.
Redemption: legal right or discretionary practice? Terms, timeline, minimums, fees, suspension rights.
Attestation or audit: frequency, provider, and standard — and described accurately (a management assertion is not an audit).
Money transmission analysis completed (near-certain).
Any yield feature analyzed as a note or investment contract.
Current federal statutory framework confirmed rather than assumed from an earlier description.

Part 14 — Incident response

Regulatory inquiry: counsel same day; litigation hold covering chat platforms, Discord, Telegram, and personal devices; no informal responses by engineers or community managers; produce the analysis memorandum early.
Security incident: named commander; technical, communications, and legal paths; decisions on pausing, disclosure, law enforcement, and recovery made in the first six hours; evidence preserved; contemporaneous timeline.
Operational failure (failed redemption, halted withdrawal, depeg): say what is true, say what is unknown, say when you will update. Silence during a run becomes a misrepresentation by omission.
Counterparty failure: exposure to each custodian, venue, lender, and bank stateable within an hour.
Insider problem: trading policy, disclosed holdings, enforcement record.

Part 15 — Ongoing review

Quarterly: treasury transactions against policy; communications audit; distribution and vesting reconciliation; sanctions screening effectiveness; listing file reviews.
Annually: memorandum refreshed; decentralization facts re-measured; licensing footprint re-checked against where customers actually are; independent AML testing; policy training.
On event: governance change, upgrade authority change, new product, new listing, material treasury sale, regulatory contact, litigation.
One named owner who can stop a launch, block a communication, and pull a listing.