Crypto Regulation

State of play.

• The SEC and CFTC have jointly issued interpretive guidance establishing a five-category digital asset taxonomy, explicitly designating Bitcoin, Ether, Solana, XRP, and roughly a dozen other major assets as digital commodities outside the securities framework—a material narrowing of the prior enforcement posture .
• The GENIUS Act stablecoin framework is generating a cascade of implementing rules, with Treasury/FinCEN/OFAC issuing NPRMs establishing BSA/AML, reserve, redemption, and sanctions compliance requirements for permitted payment stablecoin issuers—with a January 2027 compliance deadline .
• The CLARITY Act has reached Senate Banking Committee markup, with a bipartisan stablecoin yield compromise in place and Treasury, the SEC, and the Trump administration pressing for passage before the July 4th recess .
• The SEC's Division of Trading and Markets has issued a five-year no-action position for Covered User Interface providers, exempting neutral non-custodial DeFi interfaces from broker-dealer registration—the first concrete safe harbor for crypto infrastructure since the February 2024 dealer-definition expansion (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• For counsel advising digital asset issuers, exchanges, DeFi protocols, or institutional adopters, the practical baseline is: the securities/commodity classification question is largely resolved at the agency level but remains sub-statutory and reversible, stablecoin compliance infrastructure must be operational by January 2027, the CUI safe harbor is available now but expires in five years absent Commission rulemaking, and California licensing cannot be deferred past July 1.

Where things stand.

• The SEC-CFTC joint interpretive release is the operative classification framework. Issued March 2026, it establishes five asset categories—digital commodities, collectibles, tools, stablecoins, and securities—and explicitly names Bitcoin, Ether, Solana, XRP, Cardano, Avalanche, Polkadot, Chainlink, Dogecoin, and Shiba Inu as digital commodities. The guidance supersedes the 2019 framework but is interpretive, not final rulemaking, and SEC Chairman Atkins has acknowledged it will not survive a change in administration without statutory codification .
• The GENIUS Act (enacted July 2025) is the statutory anchor for stablecoin regulation. Implementing rules are advancing on parallel tracks: FinCEN/OFAC AML/sanctions rules (April 8 NPRM, comments due June 9). The framework imposes 1:1 reserve backing, two-business-day redemption, monthly audited reserve reports, and technical controls to freeze or burn tokens pursuant to lawful orders. Full compliance deadline is January 2027 .
• The SEC's five-year no-action position on Covered User Interface providers exempts neutral non-custodial DeFi interfaces, wallet providers, and crypto trading tools from broker-dealer registration under Section 15(a) if they satisfy a nine-factor neutrality test—no order routing, no custody, no investment advice, flat fees only, objective execution display. The exemption expires April 13, 2031 absent further Commission action, and the SEC is soliciting public comment (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• State crypto kiosk regulation has reached critical mass. Eight states have enacted laws (South Dakota, Wisconsin, Utah, Illinois, Iowa, Maine, Oklahoma, Wyoming); Indiana has banned kiosks entirely. Common provisions include daily transaction limits of $500–$2,000 for new customers, fee caps of 15–25%, and mandatory fraud disclosures. The FBI reported over $333 million in kiosk scam losses nationally in 2025 .
• The SEC's policy posture has shifted from enforcement to principles-based rulemaking. Chairman Atkins and Commissioners Peirce and Uyeda have publicly committed to SEC-CFTC coordination on spot crypto trading frameworks and have criticized the prior administration's enforcement-heavy approach as inconsistent with the SEC's core mission .
• Regulatory talent is flowing from government to industry. Former CFTC Chair Chris Giancarlo departed Willkie Farr to advise crypto founders and boards directly; former acting CFTC Chair Caroline Pham joined MoonPay as CLO. The pattern correlates with industry confidence in the current policy environment .
• Coinbase has received conditional OCC approval for a national trust charter, joining Ripple and Circle, which reshapes the custody and banking relationship landscape for major exchanges.
• EU MiCA CASP licensing is accelerating toward the July 1, 2026 transitional deadline, with banks now representing roughly 20% of EU licensees. CaixaBank's authorization illustrates the streamlined pathway available to banks versus crypto-native firms.
• Hong Kong has issued its first stablecoin licenses under the Stablecoins Ordinance to HSBC and Anchorpoint Financial, with HKD-backed stablecoin launches targeted for H2 2026—signaling high barriers to entry favoring established institutions.
• The UK's cryptoasset authorization regime takes effect October 25, 2027, with FCA application windows opening September 30, 2026. UK firms are also subject to OECD Cryptoasset Reporting Framework obligations since January 1, 2026, with penalties up to £300 per user for deficient data.

Latest developments.

• SEC Division of Trading and Markets April 13 staff statement clarifies that Covered User Interface providers—DeFi front-ends, wallet apps, browser extensions—do not need to register as broker-dealers under Section 15(a) if they meet specified conditions; the safe harbor is interim, expires in five years, and the SEC is soliciting public comment on the framework (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).

Active questions and open splits.

• Whether the CLARITY Act's stablecoin yield compromise holds through Senate floor consideration. The deal prohibits passive yield but permits active-use incentives—a line that banking and crypto constituencies may relitigate. Passage would lock in the SEC/CFTC jurisdictional split and the commodity taxonomy; failure leaves the current sub-statutory guidance regime vulnerable to reversal .
• Whether the SEC's interpretive asset taxonomy survives without codification. Atkins has said explicitly it will not. The March 2026 guidance and April 2026 Howey framework are interpretive releases, not final rules—vulnerable to reversal by a future administration. For clients structuring token offerings or secondary market products around commodity status, the sub-statutory risk is load-bearing .
• Whether the CUI no-action position will be converted to durable rules before 2031. The staff statement is non-binding and expires automatically. DeFi interface developers face a product-planning horizon that terminates in five years absent Commission rulemaking. Firms operating outside the safe harbor's boundaries—particularly those handling custody or providing investment advice—remain exposed to full broker-dealer registration requirements now (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• How the "substantially similar" state-regime standard will be applied under the GENIUS Act. Treasury's NPRM creates a federal-state arbitrage opportunity for issuers under $10B, but the certification mechanics and the Stablecoin Certification Review Committee's standards remain unsettled. Smaller issuers face a strategic choice between federal and state supervision that cannot be made until final rules are published .
• Whether the nine-factor CUI neutrality test creates workable design constraints for DeFi protocols. Prohibited activities—custody, order routing, transaction negotiation, investment advice—map cleanly onto traditional broker functions, but the line between "objective execution display" and impermissible order routing is untested in practice and will define the safe harbor's actual scope (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• State kiosk regulation patchwork versus federal preemption. With eight enacted state regimes, Indiana's outright ban, and nearly 30 states with active proposals, kiosk operators face a compliance matrix that may be rationalized—or complicated—by CLARITY Act preemption provisions .
• Crypto-as-sanctions-evasion: whether paying IRGC Strait of Hormuz tolls in cryptocurrency constitutes material support to a designated FTO. OFAC's SDN/FTO designations make the analysis clear on paper, but the practical question for energy and maritime clients—whether shipping companies can refuse and what alternative routes exist—remains live.

What to watch.

• CLARITY Act Senate floor consideration—whether the stablecoin yield compromise holds and whether DeFi and market structure provisions survive; passage would lock in the SEC/CFTC jurisdictional split and the commodity taxonomy .
• FinCEN/OFAC GENIUS Act AML/sanctions NPRM comment deadline June 9, 2026—final rule will set the January 2027 compliance baseline for all PPSIs; secondary-market freeze/burn technical requirements are the most operationally novel element .
• Whether the SEC converts the CUI no-action position into formal rulemaking before the five-year sunset—any Commission action or public comment response will signal whether DeFi infrastructure operators can rely on the safe harbor for long-term product planning (→ Do Crypto User Interface Providers Need to Register as Broker-Dealers with the SEC? The Staff Offers Its View).
• EU MiCA transitional period expiration June 30/July 1, 2026—unlicensed crypto operations in the EU must cease; bank-licensed CASPs will have competitive advantage in the immediate post-deadline market.
• FCA CP26/13 consultation closing June 3, 2026, and the September 30, 2026 application window opening—firms operating in or into the UK must map activities against the perimeter before the February 28, 2027 gateway closes.
• California DFAL July 1, 2026 application deadline—any exchange, custodian, or kiosk operator without a pending application must halt California operations .