Crypto regulation is not one global rulebook. A token, exchange, wallet, or lending product may fall under different laws depending on where the provider is established, where the customer lives, how the product works, and how it is marketed. Even within one country, several regulators may oversee different parts of the same activity.

This article provides general education, not legal, tax, or investment advice. Rules and regulatory interpretations change, and anyone making a legal or compliance decision should check the current requirements with the relevant authority or a qualified adviser.

Why jurisdiction changes the answer

Financial law usually attaches to activities and legal rights, not simply to the word “crypto.” Authorities may ask whether a product functions as a security, commodity, payment instrument, deposit, derivative, collective investment, or something else. They may also consider whether a business holds customer assets, transmits value, operates a trading venue, provides advice, or promotes investments.

Location matters in several ways. A company may be incorporated in one country, operate servers in another, and serve customers in many more. A provider that is licensed at home may still need permission—or may be prohibited from soliciting customers—in another market. Website availability alone does not prove that a service is lawfully offered to every visitor.

The European Union: a harmonised framework with limits

The EU’s Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, is commonly known as MiCA. It entered into force on 29 June 2023. Titles III and IV, covering asset-referenced tokens and e-money tokens, applied from 30 June 2024; the regulation generally applied from 30 December 2024. Transitional arrangements for qualifying existing crypto-asset service providers may run as late as 1 July 2026, but Member States can shorten or decline those arrangements.

MiCA introduces requirements for issuers and crypto-asset service providers, including authorisation, governance, conduct, disclosure, and complaints handling. It does not cover every digital asset or activity. Crypto-assets already governed by other EU financial-services law can fall outside MiCA, and decentralised arrangements require analysis of their actual structure. Anti-money-laundering, data-protection, consumer, tax, and sanctions rules continue to apply alongside it.

The United Kingdom: activity-specific regulation

The UK does not treat every cryptoasset as a regulated investment. The regulatory position depends on the token and service. Certain businesses conducting in-scope cryptoasset activity in the UK must register with the Financial Conduct Authority for anti-money-laundering and counter-terrorist-financing supervision. FCA registration is not the same as authorisation for every financial service, and it is not an endorsement of the firm.

The UK financial promotions regime also matters. Since 8 October 2023, promotions of qualifying cryptoassets to UK consumers generally must be made or approved through a permitted route and comply with requirements such as fairness, clarity, risk warnings, and restrictions on incentives. These rules can apply to overseas firms marketing to UK consumers.

The United States: overlapping federal and state rules

The United States has no single licence that settles every crypto question. Federal agencies administer different statutes. The Securities and Exchange Commission addresses products and activities within securities law; the Commodity Futures Trading Commission regulates derivatives markets and has enforcement authority concerning fraud and manipulation in commodity spot markets; the Financial Crimes Enforcement Network administers federal anti-money-laundering obligations for covered money services businesses.

State law may add money-transmission, trust-company, consumer-protection, or virtual-currency requirements. New York’s virtual currency framework is one prominent example, but it should not be treated as a substitute for checking other states. A business may therefore face federal registration or compliance duties plus a state-by-state licensing analysis.

Common regulatory layers

  • Market and product rules: determine whether tokens, derivatives, investment schemes, or trading services fall under financial regulation.
  • Licensing and prudential rules: may require minimum capital, governance, risk controls, safeguarding, audits, or regulatory reporting.
  • KYC, AML, and sanctions: may require customer identification, transaction monitoring, recordkeeping, and suspicious-activity reporting.
  • Custody and client assets: address control of private keys, segregation, disclosures, reconciliation, and insolvency treatment.
  • Marketing rules: govern risk statements, approval of promotions, influencer communications, and claims about returns.
  • Tax: can treat disposals, income, mining, staking, airdrops, and business activity differently.
  • Privacy and cybersecurity: regulate personal data and, in some regimes, operational resilience and incident reporting.

International standards are not domestic law

Organisations such as the Financial Action Task Force and the International Organization of Securities Commissions publish standards and policy recommendations. FATF’s guidance addresses virtual assets, service providers, and measures such as the transfer-information requirement often called the Travel Rule. IOSCO has issued recommendations for crypto and digital asset markets.

These documents influence national policy but generally do not create obligations for a customer by themselves. Each jurisdiction implements standards through its own legislation, regulations, guidance, supervision, and enforcement. Implementation timing and scope therefore vary.

Licensing does not guarantee safety

A regulatory licence or registration can indicate that a firm has passed a defined process and is subject to particular obligations. It cannot eliminate market losses, cyberattacks, operational failure, fraud, poor governance, or insolvency. The protection attached to customer assets may also differ from protection for bank deposits or conventional brokerage accounts.

Investors should verify a firm directly in the regulator’s official register, confirm that the legal entity and website domain match, and read the scope and status of the permission. Fraudsters can clone the identity of a real firm. A genuine listing may also cover only limited activities, not every product on a platform.

A practical cross-border checklist

  • Identify the exact legal entity providing the service, not only the consumer-facing brand.
  • Check the customer’s country and the provider’s place of establishment.
  • Determine what activity is involved: trading, custody, transfer, lending, staking, advice, issuance, or promotion.
  • Use official registers and warning lists; do not rely on a licence badge or link supplied by the provider.
  • Read custody, redemption, fees, conflicts, complaints, and insolvency disclosures.
  • Check whether local compensation or ombudsman arrangements actually cover the product.
  • Keep records and obtain jurisdiction-specific advice where the consequences are material.

The most reliable way to understand crypto regulation is to replace the question “Is crypto regulated?” with narrower questions: which activity, which asset, which entity, and which jurisdiction? Regulation can improve accountability and disclosure, but due diligence and risk management remain necessary.

Related reading on CoinToday

Sources