Cryptocurrency & Digital Asset Regulation — Federal Rules for Crypto

Cryptocurrency and digital assets exist in one of the most contested regulatory spaces in American law — with multiple federal agencies claiming jurisdiction, Congress debating comprehensive legislation, and the courts defining the boundaries through landmark enforcement cases. The fundamental question: are digital assets securities, commodities, or something else? The answer determines which regulator — the SEC (securities) or CFTC (commodities) — has primary jurisdiction, and which rules apply. The SEC, under Chair Gary Gensler (2021-2025), took the position that most crypto tokens are securities under the Howey test (SEC v. W.J. Howey Co., 1946) — meaning they represent "investment contracts" where purchasers invest money in a common enterprise expecting profits from the efforts of others. The CFTC has jurisdiction over commodities and derivatives — and both agencies agree that Bitcoin is a commodity (not a security). But for the thousands of other digital assets — Ethereum, Solana, XRP, and others — the classification remains disputed, with courts reaching different conclusions. The regulatory picture also includes FinCEN (anti-money laundering for crypto exchanges under the Bank Secrecy Act), IRS (tax treatment — crypto is property for tax purposes), OCC (bank custody and stablecoin activities), and state regulators (New York's BitLicense, state money transmitter licenses). Congress has debated comprehensive crypto legislation — most notably the Financial Innovation and Technology for the 21st Century Act (FIT21) — and has enacted federal stablecoin legislation in the GENIUS Act of 2025 (signed July 18, 2025), the first comprehensive federal framework specifically for payment stablecoins. A broader market-structure statute remained pending in 2026.

Current Law (2026)

Legal Authority

• Securities Act of 1933 / Securities Exchange Act of 1934 (15 U.S.C. §§ 77a, 78a) — SEC authority over securities, including digital asset securities
• Commodity Exchange Act (7 U.S.C. § 1a et seq.) — CFTC authority over commodities, including digital commodities
• Bank Secrecy Act (31 U.S.C. § 5311 et seq.) — FinCEN authority over money services businesses, including crypto exchanges
• 26 U.S.C. § 6045 — Broker reporting requirements (extended to digital asset brokers by the Infrastructure Investment and Jobs Act of 2021)
• SEC v. W.J. Howey Co. (1946) — The "Howey test" for determining when an instrument is an "investment contract" (security)

How It Works

The central regulatory question is whether a given crypto token is a security (SEC jurisdiction) or a commodity (CFTC jurisdiction). The Howey test determines security status: whether there is (1) an investment of money (2) in a common enterprise (3) with an expectation of profits (4) derived from the efforts of others. The SEC argues most token offerings satisfy this test — token purchasers invest money, the project team runs the enterprise, and purchasers expect appreciation from the team's efforts. Bitcoin is universally recognized as a commodity; Ethereum is increasingly treated as one following the 2022 merge. The CFTC has authority over crypto derivatives (futures, options, swaps) and anti-fraud/anti-manipulation authority over commodity spot markets. In SEC v. Ripple Labs (2023), a federal judge drew a distinction within the same token: institutional sales of XRP were securities transactions (Howey satisfied because institutional buyers expected profits from Ripple's efforts), while programmatic exchange sales to retail buyers were not (retail buyers didn't know they were purchasing from Ripple). The split decision has been criticized as unworkable and the SEC appealed portions of the ruling.

Crypto exchanges in the U.S. face a layered compliance landscape. If they list tokens that are securities, the SEC requires registration as national securities exchanges or broker-dealers — requirements most exchanges have not met; the SEC has brought enforcement actions against Coinbase, Binance, and Kraken for operating unregistered securities exchanges. Exchanges handling only commodities (Bitcoin) face less SEC oversight but may fall under CFTC jurisdiction for derivatives. All exchanges that convert crypto to/from fiat currency are money services businesses under FinCEN rules and must implement anti-money laundering and know-your-customer (AML/KYC) programs. The IRS treats cryptocurrency as property — not currency — meaning every disposition (sale, exchange, or use to purchase goods) triggers a capital gains or loss event. The Infrastructure Investment and Jobs Act of 2021 extended broker reporting requirements (Form 1099-DA) to digital asset exchanges, effective 2025–2026, requiring customer transaction reporting to the IRS. See Cryptocurrency Tax Treatment for detailed tax rules.

How It Affects You

If you own, buy, sell, or use cryptocurrency: Every disposition is a taxable event — every sale, swap (exchanging one token for another), and use of crypto to purchase goods or services. The IRS treats crypto as property. For each disposition: your gain or loss is proceeds minus your cost basis (what you paid). Hold more than 12 months: long-term capital gains rates (0%, 15%, or 20% depending on income). Hold 12 months or less: short-term rates (your ordinary income tax rate). Starting in tax year 2026, digital asset brokers must issue Form 1099-DA reporting your transactions to both you and the IRS — which means the IRS will have your transaction data and can identify discrepancies with your return. If you've been trading crypto without tracking cost basis or reporting gains, 2025-2026 is the time to reconcile. For tokens that went to zero (FTX credits, failed protocols): capital loss treatment requires a final disposition date, not just a token with a near-zero market value. See Cryptocurrency Tax Treatment for the full mechanics.

If you operate a crypto exchange, trading platform, or custody service: You face regulatory risk from multiple directions. For the SEC: if any token you list qualifies as a security under the Howey test — investment in a common enterprise expecting profits from others' efforts — you may need to register as a national securities exchange or broker-dealer. The SEC has brought enforcement actions against Coinbase, Binance, and Kraken on exactly this theory. For FinCEN: all exchanges converting crypto to/from fiat are money services businesses under the Bank Secrecy Act — required to register, implement AML/KYC programs, and file Suspicious Activity Reports. For states: money transmitter licenses are required in most states (New York's BitLicense is the most stringent and has driven some companies out of the state entirely). The 1099-DA reporting requirements (effective 2026) require new compliance infrastructure: collecting customer basis information sufficient to report cost basis and proceeds for each transaction. The current administration's more crypto-friendly regulatory posture has slowed SEC enforcement, but the underlying securities-vs-commodity classification question for thousands of tokens remains unresolved.

If you use decentralized finance (DeFi) protocols — lending, yield farming, liquidity provision, or decentralized exchanges: The same regulatory questions apply as to centralized exchanges, but enforcement is structurally more difficult because there's no identifiable company operating the protocol. For taxes: every DeFi transaction is taxable. Swapping tokens on a DEX triggers capital gains. Earning yield through liquidity provision generates ordinary income when received. Staking rewards are taxable in the year received at fair market value. Many DeFi users have inadequate records because decentralized protocols don't issue 1099s — but the IRS expects reporting regardless. For the securities question: the SEC signaled in SEC v. Uniswap Labs (filed 2024) that DeFi protocols with identifiable development teams may face securities law coverage. For operational risks that no regulator covers: smart contract exploits, rug pulls, oracle failures, and bridge hacks are not recoverable under FDIC, SIPC, or any insurance program. DeFi users bear counterparty and technical risks with no consumer protection backstop.

If you're a business deciding whether to accept cryptocurrency as payment: Accepting crypto creates accounting and tax complexity that most businesses underestimate. When a customer pays you in Bitcoin or another crypto, you recognize ordinary income equal to the fair market value of the crypto at the moment of receipt — your gross receipts for income tax and sales tax purposes. If you then hold the crypto and later sell or use it, you have a second taxable event: a capital gain or loss based on the difference between your received value and disposal proceeds. Businesses holding crypto on the balance sheet must track cost basis per unit and account for changes in value under applicable accounting standards. For payroll in crypto: the fair market value at payment is wages subject to withholding, FICA, and employment taxes. The practical result for most businesses: you need accounting software that tracks every crypto transaction at the spot price and converts to USD for reporting. Most small businesses find this complexity not worth the operational benefit compared to payment processors that settle in dollars automatically.

State Variations

State crypto regulation varies significantly:

• New York: BitLicense (2015) — the most comprehensive state crypto licensing regime; stringent requirements have driven some companies out of New York
• Wyoming: Pro-crypto legislation — special purpose depository institution charter for crypto banks, favorable tax treatment
• Most states: Require money transmitter licenses for crypto exchanges; vary in enforcement
• State securities regulators: Some states have brought their own enforcement actions against token offerings under state securities laws

Implementing Regulations

• 17 CFR Part 240 — SEC securities exchange rules, applied to digital asset securities platforms and broker-dealers transacting in crypto tokens that qualify as securities under the Howey test
• 17 CFR Parts 41–42 — CFTC regulations applied to digital asset commodities and derivatives, including futures and swaps on Bitcoin and other recognized digital commodities
• 31 CFR Parts 1010–1022 — FinCEN Bank Secrecy Act regulations requiring know-your-customer (KYC) and anti-money laundering (AML) compliance for virtual currency exchanges classified as money services businesses
• 26 CFR 1.6045-1 — IRS broker reporting requirements extended to digital asset transactions (effective 2026), requiring exchanges to issue Form 1099-DA to customers and report to the IRS

Pending Legislation

The FIT21 Act passed the House in the 118th Congress but did not clear the Senate. Similar market structure and stablecoin bills have been introduced in the 119th Congress. See Securities Regulation for related activity.

• HR 2046 — No China in Index Funds Act: bans index funds from investing in Chinese companies, with 180-day divestment window. Status: Introduced.
• HR 3314 — Stop Presidential Profiteering from Digital Assets Act: bans crypto tokens using the name or likeness of federal officials. Status: Introduced.
• HR 2117 — Preventing Deep Fake Scams Act: creates a Task Force to study AI and deep fake risks in banking. Status: Introduced.

Recent Developments

• In February 2026, the House Ways and Means Committee voted to repeal a Biden-era cryptocurrency broker reporting rule and advanced bipartisan tax filing relief for disaster victims, combining digital asset policy with traditional tax measures.
• In January 2026, Congress advanced stablecoin legislation as part of an intensified "crypto week" on Capitol Hill, with Bloomberg reporting that the stablecoin vote marked the most concrete legislative progress on digital asset regulation in the 119th Congress.
• Treasury launches cybersecurity info-sharing for digital assets (April 2026): Treasury launched a cybersecurity information sharing initiative specifically for the digital asset industry, creating a formal channel for crypto companies to share and receive threat intelligence with the federal government.
• Treasury designates BNY as financial agent for Trump Accounts Program (April 2026): The Treasury Department designated Bank of New York Mellon as the financial agent to support the new Trump Accounts program, a government savings initiative.
• GENIUS Act stablecoin rulemaking advances (April 2026): Treasury proposed rules implementing the GENIUS Act's requirements for stablecoin issuers and sought comment on state-level regulatory regimes for stablecoin oversight.

The SEC's enforcement-first approach to crypto regulation generated significant controversy and litigation. The Ripple decision (2023) created uncertainty about when a token is a security. The SEC's cases against Coinbase and Binance are testing whether major crypto exchanges must register as securities exchanges. The approval of spot Bitcoin ETFs (January 2024) was a landmark — allowing traditional investors to gain Bitcoin exposure through regulated investment products. Ethereum spot ETFs followed. FIT21's passage in the House (2024) was the furthest any comprehensive crypto legislation has advanced — but the Senate has not acted. The collapse of FTX (2022) and subsequent criminal conviction of Sam Bankman-Fried intensified calls for regulation while also demonstrating the risks of the current patchwork approach. The Financial Stability Oversight Council has flagged crypto as a potential systemic risk, and the Dodd-Frank framework's orderly liquidation authority may apply to the largest crypto firms.