Crypto & Virtual Assets Compliance in the United States

The United States market is open to online crypto businesses, but authorisation is layered: federal registration with the FinCEN, state money transmission or crypto-specific licensing, and, for tokens that are securities or derivatives, the Securities and Exchange Commission (SEC) or the Commodity Futures Trading Commission (CFTC).

The biggest obstacle for a new entrant is the state layer. Licensing is decided state by state, a federal registration does not substitute for any state licence, and the most demanding states apply their regimes to any business serving their residents online.

1. Who regulates this sector

Other states license crypto activity through their own money transmission or digital asset statutes; the Nationwide Multistate Licensing System is the filing platform many of them use, not a regulator. The Department of Justice prosecutes criminal violations, including unlicensed money transmission.

2. Licensing and authorisation

Federal registration

FinCEN treats exchangers and administrators of convertible virtual currency as money transmitters, whatever technology they use, and hosted wallet providers as account-based money transmitters (FIN-2019-G001). Each money services business must register with FinCEN within 180 days of being established, renew every two calendar years, and re-register after a change of control, a transfer of more than 10 percent of voting power or equity, or a more than 50 percent increase in agents (31 CFR 1022.380). A foreign-located business serving US customers must also register and appoint a US agent for service of process. Registration is not a licence and carries no capital test. Firms registered with, and functionally regulated by, the SEC or CFTC are excluded from the money services business definition and carry BSA duties under their own rules instead.

State licensing

Licensing is decided state by state; the two examples below are illustrative, not a survey. New York requires a BitLicense (or a New York trust or bank charter with approval) for transmitting, custodying, buying and selling or exchanging virtual currency, or issuing it, involving New York or its residents, including for out-of-state businesses. FinCEN registration does not affect that requirement, fiat transmission needs a separate New York money transmitter licence, capital is set case by case, and a surety bond or trust account of generally at least $500,000 is required (DFS, Virtual Currency Business Licensing). California's Digital Financial Assets Law has applied since 1 July 2026: businesses exchanging, storing or transferring digital financial assets for California residents must hold a DFPI licence or have applied for one, regardless of licences held elsewhere (DFPI, Digital Financial Assets).

Securities and commodities status

No statute yet draws the boundary between securities and commodities for crypto assets (as of October 2026). In a joint interpretation effective 23 March 2026, the SEC classified crypto assets into digital commodities, digital collectibles, digital tools, stablecoins and digital securities, named bitcoin, ether and other assets as examples of digital commodities, and explained when a non-security asset is sold subject to an investment contract and when it separates from it; the CFTC said it will administer the Commodity Exchange Act consistently (Release No. 33-11412) [In force]. The release states that it does not replace the Supreme Court's investment contract test, that courts have reached divergent views, and that it may be refined. A token sold with promises of managerial effort can therefore still be a securities offering, and the SEC's August 2026 proposal would add tailored exemptions [Proposed].

Operating without the required registration is a federal violation in itself, punishable as a civil penalty for each day it continues and, under federal criminal law, as unlicensed money transmission.

3. AML, KYC and customer due diligence

A crypto exchanger, hosted wallet provider or kiosk operator is a financial institution under the BSA as a money transmitter. Its obligations sit in 31 CFR Part 1022 and the general provisions of Part 1010.

AML programme

Written, risk-based and commensurate with location, size and product risk; policies for verifying customer identification, filing reports and keeping records; a designated compliance officer; training; and independent review, which may be done internally by someone other than the compliance officer (1022.210).

Customer identification

There is no prescriptive customer identification programme rule for money services businesses of the kind banks follow. Verification is a required element of the programme, and FinCEN expects hosted wallet providers to identify, verify and monitor each user's identity and profile.

Suspicious activity

A SAR is required for transactions of at least $2,000 that the business knows or suspects involve illicit funds, structuring, no apparent lawful purpose, or facilitation of crime, filed within 30 calendar days of detection and kept with supporting records for five years (1022.320).

Travel Rule

For transmittals of $3,000 or more, including in crypto, the sending institution records and passes on the sender's name, address, account number, amount, date and recipient details (31 CFR 1010.410(e)-(f)). FinCEN allows the data to travel in a separate message if the blockchain cannot carry it, but not after the value moves.

Beneficial ownership verification under 31 CFR 1010.230 applies to banks, broker-dealers and similar covered institutions, not to money services businesses; ownership information for business customers is gathered under the risk-based programme. Records required by Chapter X are kept for five years (1010.430(d)). A FinCEN proposal of April 2026 would rewrite programme requirements across existing financial institution types [Proposed].

4. Identity verification and onboarding

Federal rules for crypto money services businesses do not list acceptable documents or mandate particular methods such as biometric liveness; methods are chosen within the risk-based programme. Two federal texts are more specific. Where the Travel Rule requires verification of an in-person customer who is not an established customer, the document should preferably carry name, address and photograph, and foreign customers may use a passport or alien identification card (1010.410(e)(5)). OFAC's virtual currency guidance lists what to collect at onboarding: for individuals, legal name, date of birth, physical and email address, nationality, IP addresses used for logins and transactions, bank details and government identification and residency documents; for entities, ownership information and locations of business (OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry).

The flow below shows a typical online onboarding sequence that combines these duties.

Reliance on a third party's verification is not codified for money services businesses; an agent and its principal may allocate programme tasks by agreement, but each remains responsible for its own programme (1022.210(d)(1)(iii)).

5. Digital channels: what's different

Bottom line: the core BSA duties are channel-neutral, but online platforms verify customers they never see, must add IP and geolocation controls that a kiosk or counter does not need, and reach residents of every state, which multiplies state licensing.

Verification without a face-to-face check

The Travel Rule is the only federal text that prescribes a different identity step by channel. For an order not made in person by a non-established customer, the platform records the person's name, address and taxpayer identification number (or passport or alien identification number) and a record of the payment method, rather than examining a document (1010.410(e)(2)(ii)). A customer who already holds a verified account is an established customer, so platforms that verify everyone at account opening rarely use the non-established branch.

IP addresses are sanctions data

OFAC expects online platforms to block IP addresses from comprehensively sanctioned jurisdictions, detect VPN misattribution and improbable logins, and use IP data already collected for security; it has penalised firms that held the data but did not use it. FinCEN repeated the point in its December 2025 enforcement action against Paxful, encouraging use of IP address and geolocation data to limit exposure to high-risk jurisdictions.

Kiosks are the regulated exception

FinCEN treats kiosk owner-operators as money transmitters. California additionally caps kiosk activity at $1,000 per customer per day, requires receipts and pre-transaction disclosures, and limits fees.

6. Data protection and biometrics

There is no single federal data protection statute; customer data collected for onboarding is governed by sectoral federal rules and state privacy laws. Several states regulate biometric identifiers specifically, so a selfie or liveness check used for verification needs a notice and consent process designed state by state. Retention runs against minimisation: BSA records are kept for five years (1010.430(d)), and OFAC requires records of transactions subject to its regulations to be preserved for at least 10 years, a period that applies to wallet and IP screening evidence as well as identity data.

7. Sector-specific obligations

Payment stablecoins

The GENIUS Act (Pub. L. 119-27, enacted 18 July 2025) makes it unlawful for anyone other than a permitted issuer to issue a payment stablecoin in the United States, with knowing participation punishable by a fine of up to $1 million per violation and five years' imprisonment. Permitted issuers are US-formed subsidiaries of insured depository institutions, federal qualified issuers approved by the OCC, or state qualified issuers. The Act takes effect on the earlier of 18 January 2027 or 120 days after final implementing regulations [Adopted, effective by 18 Jan 2027]. From 18 July 2028, platforms may not offer or sell to US persons payment stablecoins other than those of permitted issuers or qualifying foreign issuers; foreign-issued stablecoins must meet lawful-order conditions from the effective date. Self-custody wallet transactions and direct person-to-person transfers without an intermediary are excluded from these prohibitions. Treasury's proposal defines when a customer is located in the United States and expects location controls (91 FR 53368) [Proposed, comments close 19 Oct 2026]. Permitted issuers will be a separate BSA financial institution type with their own programme, sanctions and freeze-capability duties (91 FR 18582) [Proposed]; until then issuers remain money services businesses.

Broker tax reporting

Custodial brokers report gross proceeds on Form 1099-DA for sales from 1 January 2025 and, from 1 January 2026, basis for assets acquired in a custodial account, with customers' taxpayer numbers requested on Form W-9. Backup withholding is subject to transitional relief under Notice 2025-33 [Optional relief] (IRS, Instructions for Form 1099-DA).

Custody and coin listing (New York example)

New York licensees may list only coins DFS has approved, coins self-certified under a DFS-approved listing policy, or coins on the DFS Greenlist, with ten days' notice for Greenlisted coins. DFS updated its guidance on custodial structures that protect customers in insolvency in September 2025.

8. Risk indicators and red flags

Crypto money laundering and sanctions typologies

• Sanctioned-location access: logins from IP addresses or VPNs linked to sanctioned jurisdictions.
• Listed or clustered wallets: transfers to SDN-listed addresses or unlisted addresses sharing a wallet with them.
• Incomplete KYC: inaccurate identity data, or refusal to update it or explain a transaction.
• Anonymity-enhanced flows: deposits from mixers or privacy coins, or transfers designed to break the trail.
• Investment scam proceeds: victim funds converted to stablecoins and spread across co-conspirator wallets.
• Cash-to-stablecoin brokering: bulk cash exchanged for stablecoins on behalf of drug trafficking networks.
• Remote IT worker payments: requests to be paid in stablecoins linked to DPRK revenue schemes.

Sources: OFAC virtual currency guidance; FIN-2019-G001; typologies described in the FinCEN and OFAC stablecoin proposal (91 FR 18582), drawing on Treasury's 2026 National Money Laundering Risk Assessment.

9. Enforcement and penalties

FinCEN civil penalties are statutory maxima adjusted for inflation, last adjusted on 17 January 2025 (31 CFR 1010.821). Penalties for failure to register accrue per day; willful violations are assessed per violation within a range.

OFAC consolidated its penalty provisions in 31 CFR Part 505, effective 25 September 2026, without substantive change; voluntary self-disclosure halves the base penalty (91 FR 60821). In December 2025 FinCEN assessed a $3.5 million penalty against Paxful, a peer-to-peer platform, for willfully failing to register, maintain an effective AML programme and file SARs on more than $500 million in suspicious activity (FinCEN).

10. Recent changes and what to watch

• 25 Sep 2026 [In force] OFAC Sanctions Penalties Regulations (Part 505) consolidate penalty rules; the IEEPA maximum is unchanged.
• 18 Aug 2026 [Proposed, comments close 19 Oct 2026] Treasury's GENIUS Act section 3 rule would define US location and require platforms to control offers of stablecoins to US persons.
• 18 Aug 2026 [Proposed] SEC Regulation Crypto Assets: offering exemptions of up to $5 million over four years and $75 million per 12 months, plus a safe harbor ending investment contract status.
• 1 Jul 2026 [In force] California licensing under the Digital Financial Assets Law; firms serving Californians need a DFPI licence or a pending application.
• 10 Apr 2026 [Proposed] FinCEN and OFAC programme and sanctions rules for permitted stablecoin issuers; customer identification to follow in a separate rule.
• 23 Mar 2026 [In force] SEC and CFTC crypto asset classification interpretation.
• 18 Jan 2027 (latest) [Adopted, not yet effective] GENIUS Act takes effect; earlier if final rules are issued more than 120 days before.

11. What this means for identity verification

Federal law leaves method choice to the platform, so the verification stack is defined by the risk assessment, the Travel Rule data set and OFAC's onboarding list. A defensible online flow collects name, date of birth, address, taxpayer number and government identification at sign-up, so every customer is an established customer before transfers of $3,000 or more. IP and geolocation checks belong at sign-up and at login, not only at onboarding, and wallet-address screening is a separate control from name screening that must run before withdrawals and again when OFAC lists new addresses. State licences add their own expectations, so the same flow should be configurable by state of residence. Biometric checks are a design choice rather than a federal requirement, which makes state biometric consent rules and the 5 and 10 year retention periods the main constraints on how selfie and liveness data are stored. Stablecoin issuers should plan for a dedicated customer identification rule still to come.