Regulatory compliance for digital assets across federal and state frameworks and the requirements still being written, with the forward planning that keeps a digital-asset business defensible as the rules keep moving.
A business that takes custody of customer cryptocurrency is a money services business the day it opens, with 180 days to register with FinCEN, and a money transmitter in every state but Montana, each with its own license, bond and examiner. One that only publishes software is neither. Most compliance failures here begin with a company that did not know which it had become.
The federal frame is older than the asset. The Bank Secrecy Act requires an anti-money-laundering program with four pillars, a suspicious activity report within 30 days of detecting the activity, and records kept for five years. The travel rule attaches originator and beneficiary information to transfers of $3,000 or more. Above that sit the SEC where a token is a security, the CFTC where it is a commodity, and the GENIUS Act of July 2025, which will confine the issuance of payment stablecoins to permitted issuers holding reserves one to one once it takes effect. We have represented clients in matters before the SEC, the CFTC and the IRS, and in each case the company was our client and the agency was across the table.
Guidance across the federal and state frameworks that reach cryptocurrency operations, including money transmission, securities, tax reporting, and consumer-protection requirements, so the right rules are mapped to your specific activities.
Analysis of which regulatory frameworks apply to a given business model, and how overlapping federal and state obligations fit together for your products, markets, and customer base.
MSB registration within 180 days of opening, the state money-transmitter applications through the NMLS, and New York's BitLicense where it applies, sequenced so launch waits for the licenses that matter and not for the ones that do not.
Design and implementation of compliance programs fitted to your operations, with flexible policies and procedures that can be updated as new regulations are issued and enforcement priorities evolve.
Preparation of regulatory filings and the supporting documentation that demonstrates good-faith compliance and stands up to later scrutiny.
Identification of regulatory risks specific to your business model, geographic operations, and customer base, with mitigation strategies that reduce enforcement exposure while preserving operational efficiency.
OFAC screening of addresses and counterparties at onboarding and per transaction, blocked-property reporting within ten business days, and travel-rule records for transmittals of $3,000 or more.
Continuous monitoring of guidance, rulemaking, and enforcement trends, translated into updates to your policies, procedures, and filings throughout the year.
FinCEN's 2019 guidance draws the line. A developer who publishes a wallet or a protocol and never holds customer value is not a money transmitter. A hosted wallet, an exchange or a payment processor that accepts and transmits value is one, registers with FinCEN within 180 days and then faces the state licenses.
Money transmission is licensed state by state, every state but Montana, each with its own application, surety bond and net-worth test, and New York adds the BitLicense under 23 NYCRR Part 200. The Money Transmission Modernization Act is harmonizing the forms, but a license is still a license in each state that requires one.
A money services business must have a written AML program with policies and controls, a designated compliance officer and periodic training, tested by an independent review, under 31 C.F.R. § 1022.210. The review is the part examiners ask for first, because a program nobody has tested is a document rather than a program.
A suspicious activity report is due within 30 calendar days of the initial detection of facts that may constitute a basis for filing, extended to 60 if no suspect has been identified, and the filing itself may not be disclosed to the customer. Transaction monitoring is designed around that clock, not around the quarterly review.
For a transmittal of $3,000 or more, the transmitting institution records and passes along the originator's name, address and account number with the beneficiary's details, and FinCEN treats convertible virtual currency as funds for this purpose. Transfers to a self-hosted wallet still have to be recorded, even when no counterparty will receive the message.
OFAC does not require intent. A platform that lets a sanctioned address transact has violated the regulations whether or not anyone noticed, and the penalty analysis turns on screening, voluntary self-disclosure and remediation. Addresses on the SDN list are screened at onboarding and at every transaction, and blocked property is reported within ten business days.
Before any license is filed, the asset itself is classified: Howey analysis on the token, its commodity or security posture, and the custody or exchange functions that may trigger money-transmission status. Every downstream obligation flows from this taxonomy.
We chart which regimes reach your activities, from FinCEN MSB registration and state money-transmitter licensing across the jurisdictions you touch to SEC and CFTC exposure and IRS reporting, and, as important, which ones do not.
Policies, AML/KYC procedures, transaction-monitoring rules, and filing calendars are drafted to your actual business model and written to be amended, because in this field the rules will not hold still.
Guidance, rulemaking, and enforcement trends are tracked continuously and translated into revisions of the program, so that on the day a regulator asks, the record already shows a business that kept pace.
In crypto the rulebook is still being written, and your compliance file should read as if you helped draft it.
Because one activity can sit under four regimes at once. Taking custody of customer coin makes a business a money services business under the Bank Secrecy Act and a money transmitter under state law; listing a token that is a security brings in the Securities Exchange Act; offering margined trading in a commodity brings in the Commodity Exchange Act. None of those statutes mentions cryptocurrency, so the obligations are found by analogy, and the agencies have not always agreed on the analogy. The practical answer is a written map of which regime reaches which product, revisited whenever a product or a regulator changes.
Depending on the business model, cryptocurrency operations can fall within the reach of the SEC, the CFTC, FinCEN, the IRS, and other federal authorities, alongside state-level money-transmission and licensing regimes. We help clients identify which frameworks apply to their specific activities and represent clients in matters before the SEC, the CFTC, and the IRS where a regulator is involved.
Four things the regulations name and one they assume. The named ones, for a money services business, are written policies and controls, a designated compliance officer, and training tested by an independent review, under 31 C.F.R. § 1022.210. The assumed one is a risk assessment that explains why the controls are set where they are, by product, geography and customer type. The program then produces its own evidence: suspicious activity reports within 30 days, travel-rule records at $3,000 and a five-year archive. An examiner reads the evidence before the policy.
It is the document that justifies every other one. A risk assessment rates each product, customer segment and jurisdiction for money-laundering, sanctions and fraud exposure, and the controls are then set to the rating, so a platform serving only verified US institutions can defend lighter monitoring than one with retail users in high-risk jurisdictions. FinCEN and state examiners read it first, because a program without one cannot explain itself. It is refreshed when a product launches, when a jurisdiction is added and at least annually, and each version is kept, since the question in an enforcement matter is what the company knew at the time.
Yes, and the agencies have said how. FinCEN's enforcement factors and OFAC's enforcement guidelines both treat a voluntary self-disclosure, the quality of the compliance program at the time and the remediation since as mitigating, and OFAC's guidelines halve the base penalty for a voluntary self-disclosure in a non-egregious case. The SEC's cooperation framework works the same way. The common thread is a record showing the company found the problem, fixed it and told the regulator before the regulator told the company. A program that generates that record is cheaper than the alternative, which is building it afterward from emails.
By treating the program as a filing calendar with a change log. The fixed dates are known: FinCEN registration renews every two years, state licenses renew annually through the NMLS and the independent AML review runs on the cycle the risk assessment sets. The variable part is tracked: new guidance, rulemaking and enforcement actions are logged as they issue, each is mapped to the policy it touches, and the policy is amended with a dated version. When an examiner asks what changed and when, the answer is a table rather than a recollection.
Securities-regulation compliance for cryptocurrency projects, token offerings, and digital-asset securities under SEC oversight.
Explore →Tax compliance and planning for cryptocurrency transactions, mining operations, and digital-asset investments.
Explore →Anti-money-laundering and know-your-customer compliance frameworks and risk management for cryptocurrency businesses.
Explore →Corporate structuring for cryptocurrency and blockchain companies, covering entity selection, governance, and multi-jurisdictional planning.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.