Crypto & Digital Assets

Key dates

2026-11-03

The EAER expanded and amended the Swiss sanctions lists relating to Russia and Belarus.

2026-11-04

The Federal Council decided to adopt the EU’s 21st Russia and Belarus sanctions package and related measures.

2026-11-04

The amended sanctions lists entered into force at 23:00 Swiss time.

2026-11-05

The sectoral measures, including the strengthened crypto-sector restrictions and transaction prohibitions, entered into force.

Suggested considerations

• Compliance teams may wish to refresh sanctions screening against the amended Swiss Russia and Belarus lists, including customer, beneficial-owner, authorised-signatory, counterparty and payment screening records.
• Swiss crypto-sector companies should consider reviewing ownership registers, pending acquisitions, shareholder changes, control arrangements and beneficial-ownership information for Russian nationals and persons resident in Russia, including indirect acquisition structures.
• Firms should consider mapping exposure to the newly prohibited banks, financial institutions, crypto-service providers and other entities, and placing appropriate holds on affected transactions and assets pending resolution.
• Financial intermediaries may wish to document asset-freeze decisions and report affected business relationships to SECO in accordance with the applicable Ukraine sanctions ordinance.
• Where sanctions-related facts create suspicion of money laundering or terrorist financing, firms should consider completing the additional clarifications required by Article 6 AMLA and filing an immediate report under Article 9 AMLA if the suspicion cannot be dispelled.
• Firms may wish to update sanctions procedures, transaction-monitoring scenarios, onboarding questionnaires and escalation controls to distinguish SECO sanctions reporting from separate AMLA reporting.
• Compliance teams may wish to review external exposure to EU sanctions controls as well as Swiss measures; independent Swiss sanctions commentary describes the regime as not being a general Russia or Belarus embargo, but highlights continuing expansion of financial, crypto, services and circumvention controls.

What changed

The EAER expanded and amended the Russia and Belarus sanctions lists, adding 254 individuals, companies and organisations to measures including asset freezes and restrictions on making funds or economic resources available. Switzerland also introduced transaction prohibitions covering, among others, 33 Russian banks, one bank in a third country, 17 financial institutions and crypto-service providers, five third-country companies, four Russian airports and two Russian ports.

Key dates

2024-06-30

MiCAR provisions concerning asset-referenced tokens and e-money tokens became applicable.

2024-12-30

Most remaining MiCAR provisions, including the principal Title II framework for offers and admissions to trading of other crypto-assets and Title V CASP requirements, became applicable.

2026-11-06

The AFM published its warning and reminder concerning public crypto-asset offerings, memecoins, white papers and marketing communications.

Suggested considerations

• Compliance teams may wish to identify every token launched, distributed or promoted to EU users and document whether the activity is an issuance, public offer, admission to trading or a crypto-asset service under MiCAR.
• Firms should consider confirming that the issuer is a legal person and recording the basis on which any MiCAR exemption is relied upon, including the relevant investor-count or EUR 1,000,000 12-month threshold where applicable.
• Before marketing or distribution, firms should consider preparing, notifying and publishing the required MiCAR white paper and ensuring that its content follows the applicable regulatory technical standards and AFM submission expectations.
• Marketing, influencer activity, website content and social-media posts should be reviewed for fair, clear and non-misleading presentation, clear advertising identification, balanced risk disclosure and consistency with the white paper.
• Firms should consider retaining approval records, versions of promotional content, influencer instructions, audience and jurisdiction controls, and evidence supporting any exemption or risk classification.
• Trading platforms and CASPs may wish to assess onboarding and listing controls for tokens whose issuer, white paper, promotional claims or market-abuse risk indicators are unclear.
• Compliance teams should consider escalation procedures for exaggerated profit claims, undisclosed paid promotion, misleading statements about token utility or supply, and conduct suggesting fraud or market manipulation.
• Firms should consider checking whether the token is instead a financial instrument or an asset-referenced token or e-money token, in which case MiFID II or MiCAR Titles III or IV and their associated authorisation requirements may apply rather than, or in addition to, the ordinary Title II analysis.

What changed

The publication does not introduce a new regulation or effective date; it restates and foregrounds existing obligations under Regulation (EU) 2023/1114 on markets in crypto-assets (MiCAR). Under MiCAR Title II, a person intending to make a public offer of a crypto-asset other than an asset-referenced token or e-money token, or seeking its admission to trading, generally must be a legal person, draw up a crypto-asset white paper, notify it to the competent authority and publish it.

Key dates

2025-06-12

The SFC launched the consultation on expanding section 34 of the SFO and introducing similar restrictions under the AMLO.

2025-08-11

The consultation period closed; the SFC reported receiving nine submissions from industry associations, professional bodies, a bank and other interested parties.

2026-11-06

The SFC published its consultation conclusions, updated the FAQs and announced its intention to introduce an amendment bill into LegCo.

Suggested considerations

• Compliance teams may wish to inventory legal-entity names, business names, brands, websites, domains, mobile applications, social-media handles, product names and marketing descriptions against the SFC's proposed Table A and Table B titles.
• Firms should consider mapping each relevant name to the activities actually performed, including trading, brokerage, matching, exchange, clearing, settlement, custody and virtual-asset services, and documenting whether SFO or AMLO licensing could be required.
• Unregulated entities may wish to assess whether current names imply SFC licensing, regulated status or an association with a well-known exchange, clearing house or VATP, including through abbreviations, translated names and closely resembling wording.
• Licensed VATPs and financial groups may wish to review whether group-company names, partnerships, white-label arrangements, sponsorships or marketing references could create an apparent association with an established operation that does not exist.
• Legal and compliance functions may wish to monitor the amendment bill, LegCo proceedings, commencement provisions, transitional arrangements, the final restricted-title list and any future mechanism for updating that list.
• Firms considering a new name or business launch may wish to obtain independent Hong Kong legal advice and, where appropriate, seek SFC authorisation before adopting a potentially restricted title; the SFC has not announced a final application deadline or commencement date.
• Marketing and financial-promotion controls may be updated to require enhanced review of terms such as "exchange", "trading platform", "clearing house", "virtual asset", "digital asset", "token" and "crypto" once the amendments are enacted.

What changed

The SFC will proceed with legislative amendments to expand the existing section 34 SFO restrictions beyond titles such as "stock exchange" and "commodity exchange". The expanded scope is intended to cover titles commonly used instead of "exchange", titles describing SFO-regulated products, titles referring specifically to clearing operations, and names or acronyms implying association with established or well-known exchanges, clearing houses, VATPs or similar operations, whether located in Hong Kong or elsewhere and whether regulated or unregulated.

Key dates

2026-09-30

The FCA’s application window for the new UK cryptoasset regime opened.

2026-10-01

The application window opened for the FCA Regulatory Sandbox themed cohort on climate scenario models.

2026-11-02

The FCA published Wholesale banks supervision - Insights 3 (Autumn 2026).

2026-11-30 Deadline

The application window closes for the FCA Regulatory Sandbox climate scenario models cohort.

2027-02-28 Deadline

FCA-encouraged deadline for wholesale banks to submit a variation-of-permission application for new regulated cryptoasset activities to obtain the stated pre-regime application treatment.

2027-10-25

The new UK cryptoasset regime comes into force.

Suggested considerations

• Firms should consider performing a control-by-control review of critical data ingestion, including completeness checks, reconciliation, coding-change testing, source-to-consumption lineage and evidence of design and operating effectiveness for financial-crime and surveillance controls.
• Compliance and technology teams may wish to test communications surveillance after system changes, including lexicon configuration, geographic and channel coverage, third-party-provider interfaces, ingestion completeness and retention or auditability of records for in-scope activities.
• Firms should consider reconciling the technology-asset inventory to procurement, disposal, redeployment, identity and endpoint-management records across all regions, assigning clear lifecycle accountability and confirming that assets cannot leave service without security and inventory updates, including encryption status.
• Algorithmic-trading firms should consider testing enhancements across the complete order lifecycle, including near-simultaneous and geographically distributed fills, order-management and fill-notification interactions, overfills, stop-loss scenarios, venue behaviour, pre-trade limits, kill or cancel mechanisms and post-implementation monitoring, with governance aligned to UK MiFID RTS 6.
• Firms should consider testing DLP controls against deliberate circumvention, including split messages, altered classifications, changed file formats, embedded images and misleading subjects, while reviewing staff training, monitoring, escalation and privacy safeguards.
• Operational-resilience owners may wish to refresh important-business-service impact tolerances using potential disruption to trading, settlement, clients, counterparties and time-critical market processes rather than relying solely on generic recovery-time or availability metrics.
• Firms should consider separating current resilience capability from planned remediation in self-assessments, linking incidents, near misses and test results to mapping and remediation decisions, and validating completed remediation through retesting.
• Settlement-related firms should consider the effect of T+1 on post-trade dependencies, reconciliation, funding, exception management, recovery capability, scenario testing and impact-tolerance calibration.

What changed

The FCA has not introduced new binding rules through this publication; it has consolidated supervisory findings and clarified areas against which wholesale banks may be assessed. Firms are expected to be able to evidence complete data lineage and ingestion controls, auditable recording and communications surveillance even where third parties are used, reliable asset inventories, end-to-end algorithmic-trading testing and controls consistent with UK MiFID RTS 6, and DLP controls capable of addressing adaptive evasion techniques.

Key dates

2026-10-29

The SEC announced charges against BG Wealth Sharing Ltd and DSJ Exchange Pty Ltd and filed the related enforcement complaint in the U.S. District Court for the Northern District of California.

Suggested considerations

• Compliance teams may wish to review third-party crypto platforms, advisers, issuers, introducers, and promoters for unsupported claims that an SEC filing represents licensing, approval, endorsement, or authorization.
• Firms should consider independently verifying Form ADV, Form D, and other regulatory filings through official regulator databases and documenting the precise legal effect of each filing before relying on it in due diligence or investor communications.
• Marketing and financial-promotion controls may wish to test for claims of risk-free or guaranteed returns, extraordinary monthly performance, government approval, SEC registration, fake certificates, and statements that a Rule 506(c) filing authorizes operation of a crypto exchange.
• Firms with exposure to BG Wealth Sharing, DSJ Exchange, or associated promoters should consider escalating the relationship for legal, fraud, sanctions, counterparty, and suspicious-activity review and preserving relevant communications, transaction records, and onboarding materials.
• Investment advisers and other regulated firms may wish to assess whether referral, custody, payment, or platform relationships involving similar schemes create customer-protection, books-and-records, disclosure, or reputational risks.
• Compliance teams may wish to incorporate the related state and foreign warnings into typology monitoring, particularly indicators such as recruitment-based compensation, blocked withdrawals, advance exit or compliance fees, fake account balances, and periodic payments used to sustain investor confidence.

What changed

This is an enforcement action, not a new rule or generally applicable compliance requirement. The SEC alleges violations of the antifraud provisions of the Securities Act of 1933 and Securities Exchange Act of 1934 by both entities, and violations of Sections 204(a) and 207 of the Investment Advisers Act of 1940 by BG Wealth. The SEC is seeking permanent injunctions, disgorgement with prejudgment interest, civil penalties against both entities, and conduct-based injunctions against BG Wealth.

Key dates

2025-10-21

The FCA commenced High Court proceedings in the Business and Property Division against Huobi Global S.A. and persons unknown concerning alleged breaches of section 21 FSMA.

2026-02-10

The FCA publicly announced its enforcement action against HTX for unlawful cryptoasset promotions to UK consumers.

2026-10-29

The FCA announced the High Court settlement and undertakings; HTX was no longer active in the UK, with no deposits or new UK registrations permitted.

2027-10-01

The FCA publication states that cryptoassets remain largely unregulated in the UK, apart from anti-money-laundering and financial-promotion requirements, until October 2027.

2031-10-21

The court order provides that Huobi Global's undertakings continue until this date.

Suggested considerations

• Compliance teams may wish to identify all UK-facing cryptoasset communications across websites, applications, email, affiliates, influencers and social-media platforms, including communications published by overseas group entities.
• Firms should consider documenting the legal basis for each UK financial promotion under section 21 FSMA, including the firm's authorisation status, any authorised-person approval and any applicable exemption under the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005.
• Overseas firms should consider geo-blocking and other durable controls for UK users, while testing whether content, account access, app availability, search visibility or social-media activity remains capable of having an effect in the UK.
• Marketing and compliance teams may wish to implement pre-publication approval, withdrawal and monitoring controls for third-party affiliates, influencers and social-media operators, with records showing who approved each communication and where it was distributed.
• Firms with existing UK users should consider reviewing account-access, deposit, withdrawal and customer-communications arrangements so that any UK exit strategy does not leave consumers exposed to continuing unlawful promotions.
• Cryptoasset businesses may wish to monitor the FCA Warning List and Firm Checker and assess whether their UK activities could also trigger UK anti-money-laundering registration or other authorisation requirements.

What changed

This is a settlement and enforcement outcome rather than a new generally applicable rule. Huobi Global is bound by court undertakings not to knowingly, directly or indirectly, communicate or cause to be communicated financial promotions contravening section 21 FSMA, including promotions on HTX websites, software applications and social-media platforms. HTX will not target, solicit or actively seek to engage UK consumers; UK consumers can no longer deposit funds or open new accounts, and residual-asset withdrawals are addressed through HTX's published arrangements.

Key dates

2026-10-29

The Bank of England published the consultation and draft Supervisory Statement on CCP acceptance of tokenised collateral.

2027-02-12 Deadline

Consultation closes; responses on the draft supervisory expectations and wider tokenised-collateral policy are requested by this date.

2028-01-01

Target year for the Bank’s planned RT2 synchronisation capability supporting settlement between digital-asset ledgers and central bank money; this is a stated implementation target, not a compliance deadline.

Suggested considerations

• CCPs and prospective CCP applicants should consider whether tokenised versions of currently accepted or eligible collateral would constitute new collateral requiring notification to, or permission from, the Bank under the existing supervisory and margin-permission processes.
• Compliance, legal and risk teams should consider mapping each proposed tokenised collateral arrangement end to end, including issuance, representation of rights, custody, transfer, settlement finality, redemption, liquidation and default management.
• CCPs should consider preparing evidence on valuation methodology, price reliability, liquidity, conversion between tokenised and conventional forms, repo or outright-sale access, stress-market behaviour and concentration treatment across identical underlying assets.
• CCPs and their service providers should consider legal opinions addressing ownership, enforceability, insolvency treatment, settlement finality under the Settlement Finality Regulations, transfer restrictions and the relationship between ledger records, CSD records and underlying assets.
• Operational-resilience assessments should consider ledger, bridge, smart-contract, custodian, wallet, key-management and other third-party failure scenarios, including alternative access, transfer, liquidation and recovery arrangements.
• CCPs should consider whether proposed arrangements require changes to models, parameters, margining, collateral haircuts, default-management procedures, investment-policy controls, outsourcing oversight or governance approvals.
• Affected firms and infrastructure providers may wish to submit responses to the Bank’s consultation by 2027-02-12, particularly on practical barriers, wider tokenised-asset use cases and whether the proposed expectations remain suitable for future collateral types.
• Firms operating cross-border collateral arrangements should consider the interaction with parallel international developments, including ESMA’s October 2026 call for evidence on tokenised collateral in EU central clearing.

What changed

The Bank proposes to assess tokenised collateral through the existing supervisory process for new collateral, including where a tokenised version has risk characteristics that differ from the approved non-tokenised asset because of its delivery method, credit risk or liquidity profile. The draft Supervisory Statement adopts a technology-neutral, outcomes-focused and proportionate approach: CCPs would need to demonstrate that tokenised collateral can be valued, transferred, controlled and realised within required timeframes in normal and stressed conditions.

Key dates

2025-10-22

The SFC issued its consultation paper on proposed amendments to the UT Code.

2026-10-07

The SFC published consultation conclusions announcing the enhancements to Hong Kong's retail fund regime.

2026-10-16

The revised UT Code was gazetted.

2026-11-01 Deadline

The revised UT Code takes effect. New funds must comply with the revised requirements immediately, and the 12-month transitional period for existing funds begins.

2027-10-31 Deadline

The 12-month transitional period ends. Existing funds generally must comply with the revised UT Code requirements by this date.

2027-11-01 Deadline

Existing funds continuing to be offered to the Hong Kong public must use KFSs containing the enhanced disclosure requirements after expiry of the transitional period.

Suggested considerations

• Compliance teams may wish to map each existing fund against the revised UT Code requirements and determine which requirements fall within the 12-month transitional period.
• Managers should consider documenting whether each fund will use the existing net derivative exposure approach or the new VaR approach, and assess the required models, data, governance, validation, stress testing, limits and reporting processes.
• Managers should consider reviewing fund asset liquidity, portfolio liquidity and redemption terms, including whether daily-dealing funds investing mainly in less liquid assets require anti-dilution liquidity management tools.
• Compliance teams may wish to inventory available liquidity management tools, assess their calibration and activation triggers, and verify that the fund documentation and operational procedures describe their use consistently.
• MMF managers should consider testing compliance with the revised minimum credit-quality standards and eligible-instrument and deposit requirements, including the additional safeguards applicable to constant-NAV MMFs.
• Fund boards, trustees and management companies may wish to review governance and escalation arrangements for derivatives exposure, liquidity risk and use of liquidity management tools.
• Managers should consider updating KFSs, offering documents, product classifications, liquidity disclosures and related marketing materials using the revised SFC templates.
• Applications for new funds submitted from 1 November 2026 should be prepared against the revised UT Code and updated application guides rather than the former requirements.

What changed

The revised UT Code introduces a Value-at-Risk approach alongside the existing net derivative exposure approach, with accompanying calculation methodology and standards. Funds complying with the applicable NDE or VaR limits will generally be treated as non-complex products, although the SFC retains discretion to classify products as complex based on their features and risks.

Key dates

2026-10-28

ADGM published the Guidance on Crypto Mining Activities in and from ADGM under section 23 of the Commercial Licensing Regulations 2025.

Suggested considerations

• Firms considering establishment or continued operation in ADGM should perform the RA pre-application self-assessment and document why their activities fall within commercial mining rather than an FSRA-regulated financial service.
• Operators should assess whether they require or should apply for the dedicated commercial licence associated with activity code 7230 and should avoid representing the licence as an authorisation to conduct regulated financial services.
• Compliance teams may wish to prepare an up-to-date corporate structure and ultimate-beneficial-owner information for RA review, together with governance documentation proportionate to the scale and risk of the operation.
• Operators should identify all blockchain addresses used to receive mining rewards and establish controlled procedures for making the required confidential on-chain address disclosures to the RA.
• ADGM-headquartered groups should map global mining activities, reporting lines, outsourced infrastructure, jurisdictional controls and board oversight so that the ADGM entity can demonstrate reasonable supervision of overseas operations.
• Firms should review whether staking, validator, custody, brokerage, token issuance, investment management or other associated activities separately require FSRA permission or create an additional regulatory perimeter.
• Operators may wish to monitor the RA’s forthcoming consultation on the second-phase regulatory framework and preserve records supporting their current perimeter analysis, licensing basis, governance and operational-risk controls.
• Firms should consider the practical implications identified in independent commentary, including operational resilience, cybersecurity, infrastructure security, energy management, transparent service terms and any applicable UAE federal tax, accounting and AML/CFT requirements, without treating those commentary points as additional requirements expressly created by this publication.

What changed

Commercial crypto mining conducted in or from ADGM is associated with dedicated RA commercial activity code 7230 and requires the applicable commercial licensing pathway. The Guidance is technology-neutral and covers Proof-of-Work, Proof-of-Stake and future consensus mechanisms. It establishes a pre-application self-assessment to help applicants distinguish mining from FSRA-regulated financial activities, and highlights expectations concerning corporate structure, ultimate beneficial ownership, and confidential disclosure of on-chain addresses used for reward flows.

Key dates

2026-10-23

FCA consultation CP26/38 opened and published.

2026-12-24 Deadline

Deadline for submitting responses to the FCA consultation.

2027-10-01

The FCA describes the new cryptoasset regime as applying from October 2027; the precise commencement date should be confirmed against the final legislation and FCA rules.

Suggested considerations

• Compliance teams may wish to review the proposed changes and submit consultation responses through the FCA online form by 24 December 2026, particularly where the proposals would create material implementation costs or operational challenges.
• Firms should consider mapping current fraud, AML/CTF, sanctions, proliferation-financing, data-security and financial-crime systems-and-controls frameworks against the consultation themes, while recognising that the proposals are not yet final guidance.
• Cryptoasset businesses and firms intending to provide regulated cryptoasset services may wish to assess readiness for the new regime expected in October 2027, including AML/KYC controls, blockchain analytics, Travel Rule processes, sanctions screening, transaction monitoring and governance.
• Firms using AI or external technology providers for transaction monitoring, customer screening or other financial-crime controls should consider documenting model governance, validation, parameter testing, explainability, human oversight, data security, third-party oversight and retention of decision records.
• Senior management and boards may wish to review whether financial-crime management information, risk assessments and escalation arrangements adequately cover proliferation financing, sanctions evasion, cryptoasset risks and reliance on outsourced or AI-enabled controls.
• Firms may wish to monitor the FCA's final Policy Statement and consolidated Financial Crime Guide, since the final text may differ from the consultation proposals and is likely to inform future supervisory assessments.

What changed

No new binding rules have been made by this consultation. The FCA proposes to revise non-Handbook guidance and practical examples in the Financial Crime Guide to reflect emerging risks and regulatory developments, including AI and third-party tools used in financial-crime controls, cryptoasset-specific risks, evolving financial and trade sanctions, proliferation financing, data security, fraud, and AML/CTF systems and controls.

Key dates

2026-10-22

FCA published CP26/37 and opened the consultation.

2027-01-22 Deadline

Deadline for consultation responses.

2027-06-30

End of the first half of 2027, during which the FCA expects to publish final regulatory requirements; the exact publication date is not specified.

Suggested considerations

• Firms should assess the consultation proposals against their current SMF population, including whether SMF18, SMF22 or the existing SMF7 definition is used and how responsibilities would be reallocated.
• Dual-regulated and Enhanced firms should review whether SMF5 and SMF10 to SMF15 appointments would move from prior approval to notification, while considering the continuing need for documented fitness and propriety assessments.
• Compliance teams may wish to model whether the proposed £200 million, £100 billion, £75 million and £750 million Enhanced thresholds would change the firm's classification, including group-level and three-year rolling-average calculations.
• Firms should plan to preserve accurate internal Statements of Responsibilities and Management Responsibilities Maps even if routine FCA submissions are removed.
• Firms should review Prescribed Responsibility allocations and identify the impact of removing nine responsibilities, including the proposed retention of A, D, Z and J-3.
• Certification-function inventories, annual certification processes, regulatory-reference procedures and Directory reporting should be mapped so that transition arrangements can be implemented if the proposals are finalised; firms should not discontinue current obligations before final rules and commencement.
• Conduct and HR teams should assess changes to training, staff notifications, disciplinary classifications, appeal processes and breach-reporting workflows, distinguishing staff subject only to Individual Conduct Rules from those also subject to Senior Manager Conduct Rules.
• Firms should retain processes for prompt notification of matters of regulatory significance under Principle 11, SUP 15 and SUP 10C, because the consultation does not remove those obligations.

What changed

The FCA proposes to make SMF5 (Head of Internal Audit) and SMF10 to SMF15 functions notified rather than subject to prior approval at specified dual-regulated and Enhanced firms. It proposes to remove SMF18 (Other Overall Responsibility) and SMF22 (Local Responsibility), narrow SMF7 (Group Entity Senior Manager), and retain SMF24 (Chief Operations Function) as a pre-approved function.

Key dates

2020-11-01

Beginning of the period during which the Central Bank found Coinbase Ireland breached safeguarding and outsourcing obligations under the Electronic Money Regulations 2011.

2025-08-19

End of the enforcement period identified by the Central Bank.

2026-10-21

Central Bank of Ireland and Coinbase Ireland reached the settlement under the undisputed-facts settlement process.

2026-10-22

Central Bank published the enforcement outcome and announced the proposed reprimand and discounted monetary penalty.

Suggested considerations

• Firms should map all safeguarding responsibilities to the specific Irish or EU-authorised entity that holds the regulatory obligation and document how the entity retains effective control despite group or third-party outsourcing.
• Compliance teams may wish to assess whether the regulated entity has sufficient local expertise, decision-making authority and management information to oversee safeguarding and challenge outsourced providers on an ongoing basis.
• Firms should consider independently validating the design of safeguarding calculations, reconciliations, treasury-rebalancing processes and designated safeguarding-account funding, including testing for data, systems and mapping errors.
• Firms may wish to perform daily or otherwise risk-appropriate reconciliations between customer liabilities, safeguarding obligations and funds held in designated accounts, with documented investigation and remediation of exceptions.
• Boards and senior management should consider whether control testing covers the complete safeguarding process, including outsourced components, and whether testing is sufficiently independent and frequent to identify prolonged shortfalls.
• Firms should review escalation procedures for safeguarding incidents, control failures, underfunding and material changes to operating models, including criteria and ownership for notifying the Central Bank of Ireland.
• Authorised firms should compare their current operating model with representations, commitments and governance arrangements submitted during authorisation and assess whether any material changes were notified to the Central Bank.
• Outsourcing registers, contracts and service-level arrangements should be reviewed to confirm clear regulatory access, audit rights, information rights, incident reporting, business-continuity provisions and accountability for safeguarding outcomes.

What changed

The publication does not introduce a new statutory rule; it applies existing obligations under the Electronic Money Regulations 2011 and establishes a substantial enforcement precedent. Coinbase Ireland admitted that it lacked an adequate outsourcing-governance framework, relied excessively on a US Coinbase Group entity, lacked sufficient local skill and expertise to oversee safeguarding, used inadequately designed and tested systems that left its designated safeguarding account underfunded, and lacked adequate escalation and reporting arrangements for material safeguarding changes.

Key dates

2026-10-21

FCA published GC26/7 and opened the guidance consultation.

2026-11-18 Deadline

Deadline for consultation responses to GC26/7.

2027-01-01

FCA plans to publish final DeFi guidance during January 2027; no specific publication day has been stated.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are due to bring new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Compliance teams may wish to map each DeFi use case, protocol, smart-contract dependency, service provider and customer-facing activity against the firm's existing SYSC 15A, SYSC 6 and Money Laundering Regulations obligations.
• Firms should consider documenting governance and accountability for DeFi arrangements, including who controls or can materially influence protocol changes, access permissions, treasury assets, upgrades, emergency controls and customer outcomes.
• Operational resilience teams may wish to assess important business services, impact tolerances, vulnerabilities, third-party and smart-contract dependencies, oracle and bridge risks, key-management arrangements, cyberattack scenarios and credible disruption testing.
• Financial-crime teams should consider whether existing customer due diligence, transaction monitoring, sanctions screening, blockchain analytics, wallet-risk assessment, suspicious activity escalation and record-keeping controls remain effective for pseudonymous, automated or cross-chain activity.
• Firms may wish to review outsourcing and third-party risk assessments for protocol developers, validators, custodians, wallet providers, analytics providers, cloud infrastructure and other critical DeFi dependencies.
• Legal and regulatory teams should assess whether current and planned activities fall within the existing perimeter or the new cryptoasset activities introduced by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, including whether there is an identifiable controlling entity.
• Affected stakeholders may wish to submit responses to the FCA by 18 November 2026 and identify any areas where the illustrative guidance is unclear, disproportionate or difficult to apply to genuinely decentralised arrangements.
• Firms may wish to track the FCA's planned final guidance in January 2027 and update risk assessments, policies, control testing and implementation plans before the new cryptoasset regime commences.

What changed

The FCA is proposing guidance describing the operational resilience and financial crime risks associated with DeFi and providing illustrative measures firms may consider. The guidance is relevant to firms within SYSC 15A, SYSC 6 and the Money Laundering Regulations, including firms using distributed-ledger technology, automated protocols, open and interoperable systems or arrangements with limited traditional intermediation. It is intended to clarify application of existing requirements rather than establish a separate DeFi regime or new Handbook obligations.

Key dates

2026-09-30

The application period opened for existing UK cryptoasset businesses seeking to conduct new regulated cryptoasset activities and benefit from the savings provision.

2026-10-21

FCA consultation CP26/36 opened and was published.

2026-11-18 Deadline

Deadline for responses to FCA consultation CP26/36.

2027-01-01

FCA aims to publish final perimeter guidance after considering consultation responses.

2027-02-28 Deadline

Application period closes for firms seeking to rely on the savings provision for newly regulated cryptoasset activities.

2027-10-25

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are scheduled to bring the new cryptoasset activities into the FCA regulatory perimeter.

Suggested considerations

• Firms should map each proposed and existing cryptoasset activity against the statutory regulated activities in the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 and the proposed PERG guidance, documenting the factual basis for any exclusion relied upon.
• Technical-service providers should assess whether they merely provide access to a third-party service or decentralised protocol, or whether they also arrange, execute, safeguard, operate, control or otherwise provide a service to users; the use of automation or decentralised technology should not be treated as determinative.
• Stablecoin and payment businesses should identify the precise duration, purpose, parties and asset flows associated with temporary holding and backing-asset arrangements and test whether the relevant statutory conditions are met.
• Trading firms and market makers should distinguish genuine proprietary trading from activity performed as a service for another person and retain evidence supporting any reliance on the proprietary-trading or qualifying-cryptoasset-trading-platform market-maker exclusion.
• Firms should review safeguarding and settlement structures, including structures involving central securities depositaries and third-country central securities depositaries, for possible inclusion within the proposed exclusions or within regulated custody-related activities.
• Businesses that may need authorisation should consider submitting responses to CP26/36 by 18 November 2026 and should not defer application planning while the guidance remains in consultation.
• Existing UK cryptoasset businesses seeking to conduct newly regulated activities should consider submitting an otherwise complete application between 30 September 2026 and 28 February 2027 to preserve access to the applicable savings provision.
• Firms materially affected by uncertainty about the technical-services-provider exclusion should consider engaging the FCA through its pre-application support service and retaining evidence of how that uncertainty affected application preparation.

What changed

The FCA proposes guidance on exclusions from regulated cryptoasset activities introduced by the draft Cryptoassets (Miscellaneous Amendments) Regulations 2026. The examples include temporary settlement arrangements; temporary arrangements for holding UK qualifying stablecoins in connection with payment transactions; arrangements involving backing assets held in relation to a UK qualifying stablecoin; proprietary trading where the person is not providing a service to another person; proprietary trading by a market maker on a qualifying cryptoasset trading platform; and technical services that...

Key dates

2026-10-21

OCC publishes Bulletin 2026-52, revised PS-01 and PS-02 forms for public comment, and issues its GENIUS Act implementing final rule.

2027-01-18

The OCC final rule implementing the GENIUS Act and the GENIUS Act take effect, according to the OCC’s related final-rule materials.

2027-01-25 Deadline

First weekly PS-01 report date, subject to OMB approval of the information collection.

2027-03-31 Deadline

First quarterly PS-02 report date, subject to OMB approval of the information collection.

Suggested considerations

• Compliance teams at affected issuers should review the revised PS-01 and PS-02 workbooks and instructions and identify every required data element, reporting frequency, aggregation rule, and responsible control owner.
• Firms should consider submitting comments within 30 days after publication of the information-collection notice in the Federal Register, with particular attention to data availability, calculation methodology, confidentiality, reporting burden, and transition timing.
• Issuers should map daily issuance, redemption, reserve, ownership-concentration, and trading data to PS-01 and test whether systems can produce a complete weekly submission for the January 25, 2027 report date, subject to OMB approval.
• Issuers should assess whether finance and regulatory-reporting systems can produce PS-02 information on income, assets, liabilities, off-balance-sheet activities, and capital for the March 31, 2027 report date.
• Firms should establish governance for data certification, reconciliation to general-ledger and reserve records, exception management, senior review, and retention of supporting documentation for OCC examination.
• Issuers should assess the interaction between the reporting forms and the final rule’s reserve, redemption, risk-management, audit, capital, custody, and supervisory requirements, rather than treating the forms as an isolated reporting exercise.
• Foreign issuers should confirm their OCC registration status, reporting perimeter, U.S. activities, and allocation of information-production responsibilities between U.S. operations, parent entities, and service providers.

What changed

The OCC is reopening public comment on revised weekly Form PS-01 and quarterly Form PS-02 and their instructions. PS-01 requires daily data compiled and submitted weekly for each payment stablecoin, covering issuance, reserves, ownership concentration, and trading activity. PS-02 requires quarterly reporting on the issuer’s condition and income, including balance-sheet assets and liabilities, off-balance-sheet activities, income, and capital.

Key dates

2026-10-21

The OCC issued Bulletin 2026-51 and stated that applications and waiver requests will be accepted only after OMB approves the related information collection.

2027-01-18 Deadline

The GENIUS Act and OCC final rule become effective; the Prior Approval Requirement generally applies, and unauthorized issuance of a payment stablecoin in the United States may carry criminal penalties.

2028-01-18 Deadline

The maximum statutory period for a waiver beginning on January 18, 2027 expires, subject to the terms and shorter duration of any individual waiver.

Suggested considerations

• Firms should determine whether they are currently issuing a payment stablecoin in the United States and whether they fall within the OCC application pathway or another primary federal payment stablecoin regulator's pathway.
• Existing issuers should consider preparing and submitting a substantially complete OCC application as soon as the agency announces that applications are accepted, rather than relying on the waiver as a substitute for authorization.
• Applicants should map their submission against every prescribed application question and documentation requirement, including the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML, OFAC, third-party risk, enterprise risk, compliance risk, and audit functions.
• Compliance teams may wish to prepare a separate written waiver request addressing the Prior Approval Requirement, identifying any additional GENIUS Act or final-rule requirements that cannot be met by January 18, 2027, and explaining the requested duration and operational rationale.
• Issuers should monitor the OCC's GENIUS Act landing page and press releases for OMB approval and the opening of the application and waiver process, because the bulletin does not provide a fixed application-opening date.
• Firms should maintain evidence supporting the completeness and accuracy of their applications and establish a process to respond promptly to OCC requests for missing information within the 30-day review cycles.
• Prospective issuers that are not already operating in the United States should consider planning for operations to begin only after OCC approval, consistent with the agency's stated position on waiver eligibility.
• Regulatory change teams should continue tracking separate FinCEN, OFAC, OCC, and other agency rulemakings concerning AML, CFT, sanctions, and customer-identification requirements rather than assuming that an OCC application or Prior Approval Requirement waiver resolves those obligations.

What changed

Beginning January 18, 2027, a person generally must be approved as a permitted payment stablecoin issuer before issuing a payment stablecoin in the United States; unauthorized issuance may carry criminal penalties. Under GENIUS Act section 5(f) and 12 CFR 15.30(g), an issuer with a substantially complete OCC application pending on January 18, 2027 may request a written waiver of the Prior Approval Requirement and other statutory or final-rule requirements that it cannot satisfy by the effective date.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule and related application, waiver and reporting materials.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment stablecoin issuance generally requires permitted payment stablecoin issuer status, and a substantially complete application must be pending by this date to support eligibility for an OCC waiver request.

2027-01-25

Proposed first weekly OCC reporting date, subject to OMB approval of the information collection.

2027-03-31

Proposed first quarterly OCC reporting date, subject to OMB approval of the information collection.

Suggested considerations

• Firms seeking permitted payment stablecoin status should consider mapping their licensing strategy, corporate structure and applicable OCC pathway under 12 CFR part 15 before 2027-01-18.
• Existing U.S. issuers that need transitional relief should consider submitting a substantially complete OCC application on or before 2027-01-18 and preparing a written waiver request promptly after the OCC begins accepting applications and waiver requests.
• Applicants should consider documenting business plans, management, reserve assets, issuance and redemption processes, capital and liquidity, risk management, third-party and shared-services arrangements, audit functions and compliance governance in the application package.
• Issuers should consider validating reserve composition, one-to-one backing, liquidity, concentration, counterparty exposure, stress-testing and redemption controls against the final rule rather than relying on the proposal's reserve assumptions.
• Issuers should consider testing operational capacity to process redemptions within two business days and to notify the OCC within 24 hours when the 10% redemption-demand trigger is reached.
• Issuers and distribution partners should consider reviewing stablecoin rewards, yield, rebate and promotional arrangements on a transaction-by-transaction basis because pre-existing programs are not automatically grandfathered and the final rule provides no general safe harbor.
• Covered firms should consider establishing governance for audits, reporting, examination responses, custody controls, foreign-issuer oversight and potential approval revocation or rescission.
• Compliance teams should track the separate Treasury-coordinated BSA, AML and OFAC rulemaking and avoid treating this final rule as the complete GENIUS Act compliance framework.

What changed

The final rule applies to national banks and their subsidiaries, federal savings associations and their subsidiaries, federal branches and their subsidiaries, federal qualified payment stablecoin issuers, foreign payment stablecoin issuers, and state qualified payment stablecoin issuers over which the OCC has regulatory or enforcement authority.

Key dates

2025-07-18

The GENIUS Act was enacted.

2026-10-21

The OCC published the final rule, application and waiver guidance, and revised proposed reporting forms.

2027-01-18 Deadline

The GENIUS Act and OCC final rule take effect; U.S. payment-stablecoin issuance generally requires permitted payment stablecoin issuer approval, and existing issuers seeking a waiver generally must have a pending substantially complete OCC application by this date.

2027-01-25 Deadline

Proposed effective report date for the weekly reporting form, subject to Office of Management and Budget approval.

2027-03-31 Deadline

Proposed effective report date for the quarterly reporting form, subject to Office of Management and Budget approval.

Suggested considerations

• Firms considering U.S. payment-stablecoin issuance should assess whether they qualify as a permitted payment stablecoin issuer, a federal qualified issuer, a state-qualified issuer subject to OCC authority, or a foreign issuer within the rule's scope.
• Existing U.S. issuers should consider preparing a substantially complete OCC application and evaluating whether a waiver request is needed by January 18, 2027; the OCC may grant waivers for up to 12 months beginning on that date, generally where an eligible application is pending.
• Applicants should prepare documentation covering the business plan, management, reserve assets, issuance and redemption processes, risk management, capital and liquidity, shared services, BSA/AML/OFAC controls, third-party risk, enterprise risk, compliance risk, and audit functions.
• Issuers should map reserve assets to the final rule's 1:1 backing, daily-liquidity, diversification, and counterparty-concentration requirements and establish controls capable of supporting generally timely redemption within two business days.
• Compliance and product teams should inventory interest, yield, cashback, loyalty, referral, and exchange rewards arrangements involving payment stablecoins and document the business purpose and consideration supporting each payment, because the OCC has not provided a categorical safe harbor and will apply the statutory prohibition case by case.
• Issuers should design weekly reserve and payment-stablecoin activity reporting and quarterly reports of condition and income, subject to confirming the final OMB-approved forms and effective reporting dates.
• Banks and other OCC-supervised custodians should review custody arrangements, segregation and control frameworks, third-party dependencies, and contractual allocation of responsibility for stablecoin and reserve-asset custody.
• Firms should track the separate Treasury, FinCEN, OFAC, Federal Reserve, and FDIC implementation work because the OCC final rule does not complete BSA, AML, or sanctions requirements and is only one component of the GENIUS Act framework.

What changed

New 12 CFR part 15 establishes requirements for permitted payment stablecoin issuers, foreign payment stablecoin issuers subject to OCC authority, certain state-qualified issuers, and specified custody activities conducted by OCC-supervised entities. The framework covers issuer activities, reserve assets, redemption, risk management, audits, reports, examinations, supervision, custody, applications and registrations, state-to-federal transitions, foreign-issuer supervision, approval revocation or rescission, and capital and operational backstops.

Key dates

2026-10-21

The French Treasury, AMF, Banque de France and ACPR published their joint response to the European Commission consultation on the MiCA review.

2026-09-30 Deadline

The European Commission consultation deadline identified in independent legal commentary; this date had passed before publication of the French authorities' response.

Suggested considerations

• Compliance teams may wish to maintain the existing MiCA control framework because this publication does not create an immediate amendment, authorisation requirement or prohibition.
• Firms should consider mapping each token, service and distribution channel against the definitions and perimeter provisions of MiCA, MiFID II and payment-services legislation, with particular attention to products that could require more than one authorisation.
• EU-authorised crypto-asset service providers should consider reviewing onboarding, asset-admission, execution, custody, trading and distribution controls for exposure to asset-referenced tokens or e-money tokens that may not satisfy MiCA requirements.
• Stablecoin issuers and groups using the same fungible token across EU and third-country markets should consider documenting issuance structures, reserve segregation, redemption rights, equivalence assumptions and supervisory-cooperation dependencies in anticipation of possible multi-issuance rules.
• Significant crypto-asset service providers and crypto-conglomerates should consider assessing governance, prudential, group-risk and supervisory-reporting readiness for a possible future shift of direct or enhanced oversight toward ESMA.
• Banks, payment firms and investment firms should consider assessing strategic opportunities and regulatory dependencies arising from euro-denominated e-money tokens and tokenised bank deposits without treating the French position as approval of any specific product.
• DeFi, staking and crypto-lending businesses should consider identifying responsible intermediaries, documenting due-diligence controls and preserving evidence of protocol governance and risk assessments pending any future EU framework.
• Industry participants may wish to monitor the Commission's MiCA review, subsequent legislative proposals, ESMA and EBA opinions, and national implementation developments before changing operating models.

What changed

No legal requirements changed on 2026-10-21. The French authorities proposed streamlining MiCA and clarifying when an activity falls under MiCA, the legislation governing financial instruments, or payment-services legislation, including where one business model could require multiple authorisations. They stated that a financial instrument should remain fully subject to the financial-instruments regime irrespective of the technology used for issuance or trading, and that the same principle should apply to payment instruments.

Key dates

2021-04-22

Beginning of the period in which ASIC alleges the Panacea Capital Cryptocurrency Investment Fund was offered without an AFS licence.

2022-06-17

End of the period in which ASIC alleges the Crypto Fund operated without an AFS licence.

2024-03-21

ASIC announced that Brian Creigh was permanently banned from providing financial services or being involved in a financial services business.

2026-10-19

Creigh was charged in the Melbourne Magistrates’ Court and granted conditional bail.

2026-10-20

ASIC published the enforcement release announcing the criminal charges.

Suggested considerations

• Firms should consider confirming that every entity and individual providing financial product advice, dealing, arranging or other financial services in Australia holds the required AFS licence or is properly appointed as an authorised representative for the relevant activities.
• Compliance teams may wish to map digital-asset products against the financial product and financial services definitions in Chapter 7 of the Corporations Act 2001 (Cth), including where pooled investor money is used to pursue returns from a portfolio of digital assets.
• Firms should consider reviewing marketing materials, fact sheets and investor communications for unsupported claims about licensing status, capital protection, guarantees, historical performance, targeted returns and the nature of underlying investments.
• Compliance teams may wish to strengthen onboarding and ongoing due diligence for digital-asset fund operators, directors, promoters, overseas counterparties and receiving entities, including checks against ASIC banning and disqualification records.
• Firms should consider reviewing transaction-monitoring and escalation controls for investor funds moving to offshore entities or unrelated investment vehicles, with particular attention to circumstances that could raise proceeds-of-crime or fraud concerns.
• Distributors and professional intermediaries may wish to retain evidence of licence verification, product governance reviews, investor disclosures and the basis for any representations made to prospective investors.
• Firms should consider treating the charges as allegations not yet determined by a court and separating the criminal proceeding from ASIC’s earlier administrative banning action when assessing legal, conduct and reputational risk.

What changed

No new licensing rule or general obligation was introduced. The publication announces enforcement proceedings: one charge under section 911A(1) of the Corporations Act 2001 (Cth) for carrying on a financial services business without an AFS licence, and one charge under section 400.3(1) of the Criminal Code (Cth) for dealing with proceeds of crime worth $1 million or more. The matter is being prosecuted by the Commonwealth Director of Public Prosecutions following ASIC’s referral of a criminal brief.

Key dates

2022-05-12

The CFTC filed its complaint against Alexandre and EminiFX, alleging fraudulent solicitation, misappropriation, and operation of an unregistered commodity pool.

2026-07-01

As of July 2026, the court-appointed receiver had returned more than $98 million to over 28,000 investors.

2026-10-19

The CFTC announced that the Southern District of New York had entered orders granting summary judgment, injunctive relief, and a civil monetary penalty against Alexandre and EminiFX.

Suggested considerations

• Compliance teams may wish to inventory products, investment clubs, managed accounts, and digital-asset offerings that pool customer contributions and obtain exposure to forex, futures, options, or other commodity interests.
• Firms should consider assessing whether their activities constitute operating a commodity pool or acting as a commodity pool operator or associated person under the Commodity Exchange Act and CFTC regulations, including whether registration or an available exemption is required.
• Firms should consider validating marketing claims about returns, automated trading, proprietary technology, trading results, and risk, with particular scrutiny of unusually high or consistent returns such as weekly performance representations.
• Compliance teams may wish to test segregation, custody, reconciliation, withdrawal, and use-of-funds controls to detect commingling, personal use of customer assets, payments to earlier investors, and unexplained transfers.
• Firms should consider maintaining evidence supporting reported performance, trading activity, investor statements, and asset ownership so that customer communications can be reconciled to underlying records.
• Digital-asset businesses may wish to review whether crypto terminology or a technology-focused structure obscures activities that remain subject to commodities, anti-fraud, registration, or customer-protection requirements.
• Firms should consider escalating suspected misappropriation, fabricated performance, or unregistered commodity-pool activity through applicable internal investigation, suspicious-activity, and regulatory-reporting processes.

What changed

This is a final enforcement outcome rather than a new rule or generally applicable regulatory amendment. The Southern District of New York entered summary judgment and injunctive relief against Alexandre and EminiFX, finding that the defendants made fraudulent representations, misappropriated investor funds, and operated as an unregistered commodity pool operator, with Alexandre acting in an unregistered associated-person capacity. The judgment imposes $228,576,962 of restitution, $15,049,500 of disgorgement subject to offset by restitution payments, and a $45,148,500 civil monetary penalty.

Key dates

2026-10-16

ESMA published Q&As 2949, 2950, 2936, 2937 and 2938.

2025-06-25

The EMIR 3 active account regime began applying to counterparties already within scope after the six-month implementation period.

Suggested considerations

• CASPs should consider mapping each client-funds flow against MiCA Article 70(2) and (3), documenting the end-of-next-business-day transfer control and verifying that any intermediary-held credit-institution account is specifically held for the CASP and technically segregated.
• CASPs and their payment-service-provider partners may wish to review contractual terms, account mandates, insolvency protections, reconciliation processes and evidence demonstrating clients’ ownership rights and prohibition of proprietary use.
• Crowdfunding providers using registration, membership or access fees should consider documenting why their model does or does not constitute a crowdfunding service under Regulation (EU) 2020/1503 and reviewing website disclosures, fee descriptions, client communications and investor-protection controls.
• AAR counterparties should recalculate the 12-month aggregate month-end average gross notional position, including the applicable group perimeter and excluding client-clearing activity, against the EUR 6 billion and EUR 100 billion thresholds.
• AAR counterparties relying on the 85% exemption should consider testing the one-half rule across the relevant derivative classes, retaining the underlying EU-CCP clearing data and avoiding any assumption that the exemption removes the representativeness requirement.
• Affected counterparties should review trade-level residual-maturity data, bucket allocation, annual-average trade counts and reporting calendars so that representative clearing can be demonstrated at the applicable reporting date.
• Compliance teams may wish to update policies, procedures, management information and regulatory inventories to distinguish ESMA Q&A interpretive expectations from directly binding Level 1 and Level 2 requirements.

What changed

For CASPs, ESMA clarifies that client funds may be temporarily held in an account with a non-bank payment service provider, such as a payment institution or electronic money institution, provided the funds are transferred to an account with a credit institution or central bank no later than the end of the business day following receipt.

Key dates

2026-10-09

FSRA published Consultation Paper No. 6 of 2026 on proposed revisions to the FEES and GEN Rulebooks.

2026-11-06 Deadline

Consultation closes and written comments are due to the FSRA.

2027-01-01

Implementation is proposed by independent market commentary to begin, subject to consultation feedback and final FSRA rulemaking; this is not yet an adopted effective date.

Suggested considerations

• Compliance teams may wish to review the consultation paper, Appendix 1 amendments to FEES, Appendix 2 amendments to GEN and Attachment 1 amendments to the GPM, and submit written comments to [email protected] by 2026-11-06.
• Market-infrastructure operators may wish to model the proposed application, annual supervision, Official List and trading-related charges against current budgets and assess whether the proposals affect pending applications or planned launches.
• Virtual-asset MTF operators and applicants may wish to recalculate total regulatory costs using the proposed USD 100,000 base MTF application fee, USD 40,000 base annual supervision fee, USD 25,000 virtual-asset application fee and USD 20,000 virtual-asset annual fee.
• Authorised Persons may wish to inventory permissions covering Virtual Assets, Fiat-Referenced Tokens and Spot Commodities and determine whether a proposed permission addition would trigger a separate variation or activity fee.
• Regulatory reporting owners may wish to test filing calendars, escalation controls and management information against the proposed USD 1,000, USD 2,000 and USD 3,000 late-filing stages, while recognising that the proposed regime is not yet binding.
• Applicants and compliance officers may wish to review change-in-control and variation-of-permission procedures, including whether proposed applications require additional supporting information or revised fee calculations.
• Firms may wish to prepare implementation plans for a possible 2027-01-01 commencement while continuing to apply the existing FEES and GEN requirements until final amendments are published.

What changed

The consultation proposes completing the FSRA's review of market-infrastructure fees by revising charges payable by Recognised Bodies and by operators of Multilateral Trading Facilities and Organised Trading Facilities. For a virtual-asset MTF, independent analysis of the proposed FEES amendments identifies a proposed underlying MTF application fee of USD 100,000 and annual supervision fee of USD 40,000, plus proposed virtual-asset-specific fees of USD 25,000 on application and USD 20,000 annually, producing proposed totals of USD 125,000 and USD 60,000 before any applicable trading levy or...

Key dates

2026-09-30

The extended sector-wide no-action position associated with INFO 225 ended.

2026-11-27 Deadline

Deadline for submissions on ASIC Consultation Paper 392, at 5pm AEDT.

2027-04-08

The DAF Act and the new DAP and TCP framework are scheduled to commence.

2027-10-07 Deadline

The proposed transition deadline by which platforms already operating as DAPs or TCPs should apply for an AFS licence or variation.

Suggested considerations

• Firms should assess whether their products, custody arrangements and platform activities fall within the DAP or TCP definitions under the DAF Act and the proposed ASIC guidance.
• Affected operators should consider whether they need a new Australian financial services licence or a variation to an existing licence, including whether any streamlined process may apply.
• Compliance teams may wish to map current custody, segregation, asset-control, reconciliation, trading, settlement and incident-management processes against the proposed standards.
• Firms should assess the likely impact of the proposed net tangible asset and other financial requirements on capital planning, liquidity and licence documentation.
• Operators should review proposed customer disclosure documents and platform rules, including how digital-asset risks, custody arrangements, execution and settlement are explained to clients.
• Businesses affected by the framework should consider submitting comments to ASIC by 2026-11-27 and engaging with ASIC's consultation events or targeted roundtables.
• Firms should maintain evidence of their licensing analysis and transition planning, particularly because the sector-wide INFO 225 no-action position ended on 2026-09-30 and independent commentary indicates that existing licensing obligations apply outside the relief period.

What changed

CP 392 proposes implementation guidance for digital asset platforms (DAPs), which hold digital tokens for clients and provide associated platform services, and tokenised custody platforms (TCPs), which record underlying client assets as digital tokens. ASIC is proposing standards covering asset holding, trading and settlement activities, and financial requirements including net tangible asset requirements where relevant.

Key dates

2026-10-14

The EBA announced that USDC issued by Circle Internet Financial Europe SAS had been classified as a significant EMT under MiCA.

2026-11-12 Deadline

Dual supervision of USDC begins: the EBA assumes direct responsibility for own funds, reserve of assets, liquidity requirements, and recovery and redemption plans, while the ACPR retains specified governance and organisational responsibilities.

Suggested considerations

• Circle and its regulatory counsel should map existing own-funds, reserve-of-assets, liquidity, recovery, and redemption controls to the EBA’s supervisory expectations and establish clear evidence and reporting channels before 2026-11-12.
• Circle should confirm the allocation of responsibilities between the EBA and ACPR, including supervisory contacts, escalation procedures, information requests, and documentation ownership for prudential and organisational matters.
• Crypto-asset service providers should reassess their USDC due diligence, product governance, liquidity, redemption, custody, safeguarding, and operational-risk controls in light of the significant-EMT designation.
• Firms using USDC should identify exposures in client assets, settlement, treasury, collateral, and payment flows and assess whether updated counterparty, liquidity, concentration, and business-continuity assessments are appropriate.
• Compliance teams should monitor EBA and ACPR communications, supervisory-college activity, and any subsequent guidance or requests concerning significant EMT reporting and recovery or redemption planning.
• Firms operating across the EU and United States should review information-sharing, incident-notification, and cross-border supervisory arrangements, noting the EBA’s memorandum of understanding with the New York State Department of Financial Services.

What changed

USDC will be subject to the MiCA framework for significant EMTs from 2026-11-12. The EBA will assume direct supervisory responsibility for own-funds requirements, the reserve of assets, liquidity requirements, and recovery and redemption plans; the ACPR will continue supervising governance, qualifying holdings, fit and proper assessments, outsourcing, and conflicts of interest. Under MiCA Articles 56 and 43(1), an EMT is classified as significant where at least three significance criteria are met during the applicable reporting periods.

Key dates

2026-10-13

Federal Register publication date for the ANPRM, published as 91 FR 64811 and document number 2026-20888.

2026-12-14 Deadline

Deadline for submitting comments to the CFTC on Regulation CTX, Regulation CAM, and the interpretation and implementation of CEA section 2(c)(2)(D).

Suggested considerations

• Compliance teams may wish to determine whether current or planned retail crypto products could constitute transactions covered by CEA section 2(c)(2)(D), including products described as spot, margin, leveraged, financed, perpetual, or otherwise structured to defer delivery.
• Firms should consider mapping current customer agreements, funding arrangements, custody models, delivery controls, and liquidation processes against the CFTC's preliminary positions on offers and actual delivery.
• Prospective venues may wish to assess the potential CAM operating model, including registration perimeter, governance, listing standards, market surveillance, position controls, execution, recordkeeping, cyber and system safeguards, proof-of-reserves, and customer-asset arrangements.
• FCMs, IBs, DCOs, custodians, and leverage providers should consider identifying the registrations, permissions, capital, segregation, margin, clearing, insolvency, and operational dependencies that a CAM structure could create.
• Crypto businesses may wish to prepare comments addressing the scope of section 2(c)(2)(D), the definition and practical test for actual delivery, treatment of fully paid open transactions, permissible crypto assets, and the allocation of responsibilities among CAMs, FCMs, DCOs, and leverage providers.
• Firms should monitor whether the CFTC follows the ANPRM with a formal proposed rule and should not treat the ANPRM as creating immediate registration, margin, reporting, or conduct obligations.
• Affected firms may wish to preserve evidence of product design, delivery capability, customer disclosures, surveillance controls, and legal analysis in anticipation of supervisory or enforcement scrutiny under the CFTC's stated interpretation of section 2(c)(2)(D).

What changed

The CFTC has published ANPRM RIN 3038-AF80, 91 FR 64811, concerning proposed Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets. Regulation CTX would seek to clarify when section 2(c)(2)(D) applies to crypto asset transactions, including the meaning of covered offers, actual delivery, and actual delivery of fully paid open transactions. Regulation CAM would create a crypto asset market subcategory of designated contract market registration under 17 CFR part 38, supported by related amendments or requirements under 17 CFR parts 1, 38, and 39.

Key dates

2021-03-29

The current CFD product intervention order commenced, imposing leverage limits, standardised margin close-out arrangements, negative-balance protection and restrictions on specified inducements.

2022-04-06

ASIC extended the CFD PIO for five years to 23 May 2027.

2027-05-23

The current CFD PIO is due to expire unless it is remade, extended or revoked earlier.

2037-05-23

Indicative end of the proposed further 10-year extension, subject to Ministerial approval and the final instrument's commencement and expiry terms.

2026-11-09 Deadline

Deadline at 5pm AEDT for submissions on the proposed extension, amendments and separate question concerning CFDs over options with losses exceeding the premium.

Suggested considerations

• CFD issuers and distributors should consider mapping all products against the proposed expanded CFD definition, including products settled by cash, set-off or transfer of digital assets.
• Firms should consider testing initial-margin systems so that margin is calculated separately for each CFD and opposing long and short positions cannot reduce the required amount through netting.
• Firms offering CFDs over options should consider classifying contracts by whether retail-client losses are capped at the premium and assessing the effect of the proposed margin methodology on collateral, liquidation and client disclosures.
• Compliance teams may wish to review whether any option-linked CFD could expose a retail client to losses exceeding the premium and prepare evidence for the separate ASIC question on continued retail availability.
• Firms should consider reviewing discounts, rebates, bonuses and educational or research tools against the proposed conditions and assessing whether records can be retained for the proposed seven-year period.
• Product-governance teams may wish to refresh target-market determinations, onboarding controls, leverage settings, margin-close-out logic, negative-balance controls and inducement policies for the proposed extended period.
• Affected stakeholders should consider submitting comments to ASIC by 5pm AEDT on 9 November 2026, particularly on digital-asset settlement, option CFD availability, margin methodology and operational implementation costs.
• Firms should continue complying with the current PIO until any amended instrument takes effect and should plan on the basis that the existing order expires on 23 May 2027 unless remade or otherwise extended.

What changed

The proposed ASIC Corporations (Product Intervention Order Amendment—Contracts for Difference) Instrument 2026/XX would extend the existing CFD PIO until 2037 unless revoked earlier. It would modernise the definition of a CFD to capture products settled by transferring digital assets, replace the term cryptoasset with digital asset, clarify initial-margin rules for CFDs over options, and require initial margin to be calculated separately for each CFD rather than reduced by netting opposing positions.

Key dates

2026-10-09

ESMA launched the Call for Evidence on the use of tokenised collateral by EU CCPs.

2027-01-15 Deadline

Deadline for stakeholders to submit responses to ESMA's Call for Evidence.

2027-03-31

ESMA is expected to assess the feedback during the first quarter of 2027; the source does not specify an exact day.

Suggested considerations

• CCPs, clearing members and relevant infrastructure providers should consider whether to submit evidence through ESMA's consultation webpage by 15 January 2027, including practical data on existing pilots, live arrangements, legal structures and stress scenarios.
• Compliance and legal teams may wish to map each proposed tokenisation model against the collateral requirements in Article 46 of Regulation (EU) No 648/2012 and Commission Delegated Regulation (EU) No 153/2013, including quality, liquidity, credit and market-risk, custody and operational-availability criteria.
• Firms developing tokenised collateral arrangements should consider documenting whether the token gives the holder ownership of, a security interest in, or another enforceable right to the underlying asset, and how that right would operate across insolvency, default and cross-border situations.
• CCPs and clearing members may wish to test whether tokenised collateral can be accessed, transferred, valued, liquidated or converted into central-bank money or other liquidity within required default-management timelines, including during distributed-ledger outages, congestion, cyber incidents and loss of connectivity to traditional infrastructures.
• Firms should consider assessing client-asset segregation, title-transfer, custody, insolvency-remoteness and settlement-finality arrangements where distributed-ledger systems interact with traditional custodians, central securities depositories or payment systems.
• Risk and compliance functions may wish to reassess whether tokenisation changes the risk profile of otherwise eligible collateral, including redemption, transfer restrictions, oracle dependence, smart-contract risk, operational resilience, concentration risk and liquidity-discount assumptions.
• Industry respondents may wish to provide ESMA with evidence on interactions between tokenised collateral and tokenised cash, stablecoins, tokenised deposits and other settlement assets, rather than assuming that liquidity in the underlying asset automatically carries over to its tokenised form.
• Firms should monitor ESMA's first-quarter 2027 assessment and any subsequent amendments to EMIR technical standards, supervisory convergence measures or supervisory expectations; no immediate change to existing collateral controls should be inferred from the Call for Evidence.

What changed

ESMA has opened a consultation and requested stakeholder evidence by 15 January 2027. It is examining the full collateral lifecycle, including transfer, custody, protection, segregation, access, valuation, settlement and conversion into liquidity during market stress or following a clearing-member default. The Call for Evidence covers tokenised representations of assets held in traditional infrastructures, assets issued directly on distributed-ledger technology, hybrid models, and interactions with tokenised cash and other settlement assets.

Key dates

2026-10-08

ESMA published its opinion on the provision of crypto-asset services in relation to non-MiCA-compliant asset-referenced tokens and e-money tokens.

2027-01-08 Deadline

Latest date by which National Competent Authorities should require remediation of remaining pre-existing exposures, calculated as three months after publication; firms may be required to act earlier.

Suggested considerations

• Firms should inventory every ART and EMT made available to EU clients and classify whether each token satisfies the applicable MiCA requirements, including any relevant authorisation, notification, offer, and admission-to-trading conditions.
• Compliance teams may wish to map each affected token across trading, exchange, execution, placing, order-routing, advice, transfer, custody, and portfolio-management workflows, including bundled or indirect services.
• Firms should consider suspending onboarding, purchases, subscriptions, trading, swaps, staking-related access where relevant, and other activities that could allow EU clients to acquire or increase exposure to a non-MiCA-compliant token.
• Technology and operations teams should assess geolocation, account, wallet, order-management, token-listing, transfer, and API controls, with testing and monitoring designed to prevent EU-client access or increased exposure.
• Legal and product teams should review client terms, token-listing policies, disclosures, contractual restrictions, and arrangements with issuers, liquidity providers, exchanges, and other intermediaries.
• Firms should identify pre-existing client exposures and prepare a documented wind-down or remediation plan capable of completion by 2027-01-08, subject to any earlier NCA requirement.
• Firms may wish to define narrowly controlled exit-only services for liquidation, conversion, withdrawal, transfer, and safekeeping, with time limits, risk controls, client communications, records, and escalation to the relevant NCA.
• Governance functions should document the interpretation of the ESMA opinion, approvals for affected product changes, control ownership, exceptions, surveillance, management information, and evidence available for supervisory review.

What changed

The opinion covers the full range of MiCA crypto-asset services, including operating trading platforms, exchanging crypto-assets for funds or other crypto-assets, executing orders, placing crypto-assets, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management. ESMA expects National Competent Authorities to supervise so that CASPs do not maintain, introduce, or facilitate EU-client access to non-MiCA-compliant ARTs or EMTs.

Key dates

2026-11-30 Deadline

Consultation period for ADGM FSRA Consultation Paper No. 5 of 2026 closes; comments may be submitted to [email protected].

Suggested considerations

• Compliance teams may wish to review the proposed Guidance and submit written comments to [email protected] by 2026-11-30, particularly on operational feasibility, proportionality and the treatment of permissionless protocols.
• Firms should consider inventorying current and planned DeFi activity, including protocol use, liquidity provision, staking, lending, borrowing, decentralised exchange activity, smart-contract interaction and client-facing exposure.
• Firms should consider mapping each DeFi activity to existing ADGM permissions and identifying activities that may require a variation of permission, additional controls or discontinuation.
• Risk and compliance functions may wish to assess whether existing governance arrangements clearly assign senior accountability for DeFi, approve protocols and counterparties, set exposure limits and address conflicts of interest.
• Firms should consider enhancing due diligence for protocol code, governance structures, upgrade and administrative privileges, oracle dependencies, bridge and composability risks, concentration, liquidity, sanctions exposure and the availability of legal recourse.
• AML and financial-crime teams may wish to assess transaction-monitoring, wallet-screening, sanctions-screening, blockchain analytics, travel-rule and suspicious-activity escalation controls for DeFi-related activity, taking account of limited visibility into beneficial ownership and counterparties.
• Operations and technology teams should consider whether incident-management procedures cover smart-contract exploits, oracle failures, governance attacks, de-pegging, bridge compromise, protocol insolvency, loss of access and material service disruption.
• Client-asset teams should review segregation, custody, ownership, valuation, reconciliation and disclosure arrangements where client assets interact with DeFi protocols or are exposed to protocol failure.

What changed

The proposed Guidance sets supervisory expectations for identifying, assessing, monitoring and managing risks arising from engagement with DeFi protocols and venues. It covers governance and accountability, risk assessments, due diligence, exposure and control measures, ongoing monitoring, financial-crime controls, incident escalation, recordkeeping, auditability, competence and client-asset safeguards. The proposal is guidance under consultation and does not itself introduce binding new rules at this stage.

Key dates

2026-10-07

AFM and DNB published their joint policy statement and exploration on tokenisation of securities in the Netherlands.

2023-03-23

Applications became available under the EU DLT Pilot Regime as implemented and supervised in the Netherlands; this is relevant background for firms assessing DLT market-infrastructure models, not a new deadline arising from the AFM and DNB publication.

Suggested considerations

• Firms should classify each proposed tokenised instrument by its legal and regulatory characteristics, distinguishing securities or other MiFID II financial instruments from crypto-assets covered by MiCA and from non-financial crypto-assets.
• Compliance and legal teams may wish to document whether the proposed arrangement is native tokenisation or a hybrid model, identify which record constitutes the legally authoritative record, and assess the resulting title, transfer, custody, settlement and insolvency risks under Dutch law.
• Market infrastructures and investment firms considering a DLT model should assess whether Regulation (EU) 2022/858 and the Dutch DLT Pilot Regime are available, including the need for specific permission and the eligibility limits applicable to DLT financial instruments and operators.
• Firms should continue applying existing requirements, including MiFID II conduct and organisational rules, the Prospectus Regulation where applicable, Regulation (EU) No 596/2014 on market abuse, Regulation (EU) No 909/2014 on central securities depositories where applicable, and relevant custody, client-asset and investor-protection controls; the AFM and DNB statement does not disapply them.
• Issuers, custodians, trading venues and service providers may wish to participate in or monitor the proposed government-supervisor-market follow-up and prepare concrete use cases that identify where statutory clarification, contractual documentation or a Dutch legislative amendment would be needed.
• Firms operating cross-border should compare the Dutch position with jurisdictions that have introduced specific legal recognition for electronic or DLT-based securities, while avoiding reliance on another jurisdiction's legal treatment without confirming Dutch offering, custody, settlement and investor-protection implications.
• Governance functions may wish to update technology, legal, operational-resilience and outsourcing risk assessments to account for the possibility that infrastructure and issuance activity migrate to jurisdictions offering greater legal certainty.

What changed

No legislation, regulatory technical standard, authorisation requirement or immediate compliance deadline was introduced. AFM and DNB jointly identified a legal gap: although EU and Dutch law do not generally prohibit DLT, market participants are commonly forced to maintain both a DLT-based record and a traditional legal administration, creating uncertainty about the legal significance of the token and limiting efficiency gains.

Key dates

2026-10-06

The proposed rule was published in the Federal Register as 91 FR 63870, covering pages 63870-64103.

2026-12-07 Deadline

Public comments must be received by the SEC on or before this date.

Suggested considerations

• Compliance teams may wish to determine whether client or fund crypto assets are currently held through arrangements that would constitute adviser or regulated-fund self-custody under the proposal, including arrangements involving service providers, private keys, wallets, or decentralized finance protocols.
• Firms should consider mapping proposed requirements for key management, joint authorization, asset segregation, safeguarding expertise, cybersecurity, incident response, annual review, internal control reporting, and client or investor account statements against existing custody, information-security, and operational-resilience controls.
• Advisers and regulated funds may wish to assess whether existing custodians, including state trust companies, could satisfy the proposed authorization, policy, audit, internal-control, and segregation conditions.
• Compliance teams should consider preparing comments for File No. S7-2026-35 by December 7, 2026, particularly on the proposed scope of self-custody, the qualified-custodian determination, treatment of airdropped crypto assets, decentralized finance activity, and the interaction with existing custody arrangements.
• Firms should assess potential changes to Form ADV, Form ADV-E, Form N-CEN, custody records, crypto-network records, audited financial statements, and accountant reports if the proposal is adopted.
• Investment advisers and regulated funds may wish to inventory tokenized private funds and tokenized regulated-fund shares in anticipation of the proposed additional Form ADV and Form N-CEN questions.
• Firms should distinguish proposal-stage planning from current legal obligations because the publication does not itself impose the proposed requirements and does not establish a final compliance date.

What changed

The proposal would add an adviser self-custody framework under proposed Advisers Act rule 223-1(b)(7), allowing an adviser to self-custody client crypto assets only in specified circumstances and subject to conditions addressing safeguarding expertise, documented safeguarding systems, key management, joint authorization, segregation, cybersecurity risk assessment, threat and vulnerability management, incident response and recovery, annual review, an internal control report, and client account statements.

Key dates

2020-12-23

FinCEN published the NPRM at 85 FR 83840 proposing additional reporting, recordkeeping, and identity-verification requirements for certain transactions involving unhosted or otherwise covered wallets.

2026-10-06

FinCEN withdrew the NPRM and stated that it would take no further action on that rulemaking.

Suggested considerations

• Compliance teams may wish to remove implementation workstreams, testing scenarios, and policy language that were created solely for the withdrawn NPRM's proposed $3,000 recordkeeping or $10,000 reporting thresholds.
• Firms should consider documenting that the NPRM was never effective and that its withdrawal does not eliminate existing obligations under the Bank Secrecy Act or applicable implementing regulations in 31 CFR parts 1010, 1020, and 1022.
• Banks and MSBs may wish to reassess whether current controls for transfers involving unhosted wallets remain risk-based and supported by documented AML risk assessments, rather than treating the withdrawn proposal's thresholds as mandatory rules.
• Crypto businesses should continue reviewing applicable customer-identification, customer-due-diligence, suspicious-activity-reporting, recordkeeping, transaction-monitoring, and OFAC sanctions requirements independently of this withdrawal.
• Regulatory-monitoring teams may wish to track whether FinCEN or Treasury develops a replacement digital-asset framework, particularly in light of the stated policy objective that digital-asset regulation be fit for purpose.

What changed

FinCEN withdrew the NPRM published at 85 FR 83840 and stated that it will take no further action on that rulemaking. The withdrawn proposal would have required banks and money services businesses to file reports when a transaction involving an unhosted or otherwise covered wallet exceeded $10,000, or multiple such transactions exceeded $10,000 in 24 hours. It also would have required records, counterparty information, and customer identity verification for covered transactions exceeding $3,000.

Key dates

2023-10-23

FinCEN published the proposed section 311 finding and special measure concerning international CVC mixing at 88 FR 72701.

2026-10-06

FinCEN's withdrawal of the finding and proposed rulemaking became effective upon Federal Register publication at 91 FR 63513.

Suggested considerations

• Compliance teams should discontinue implementation work that was undertaken solely for the withdrawn section 311 CVC-mixing proposal, including plans for the proposal-specific data fields, reporting workflows, and enhanced customer records.
• Firms should not interpret the withdrawal as authorization to process illicit mixer activity without controls; they should continue applying existing risk-based AML, sanctions, transaction-monitoring, escalation, and suspicious activity reporting procedures.
• Crypto exchanges and other covered institutions should review whether current transaction-monitoring scenarios appropriately identify mixer exposure and other indicators of money laundering or terrorist financing under existing requirements, without treating all privacy-preserving activity as inherently suspicious.
• Firms may wish to document the withdrawal in their regulatory inventory, rulemaking-impact assessments, and model or procedure change logs, while preserving controls that address independently applicable BSA or sanctions requirements.
• Compliance teams should monitor future FinCEN notices, section 311 actions, enforcement activity, and interpretive guidance because FinCEN expressly reserved the possibility of future measures concerning mixers.
• Legal and compliance functions should reassess any customer, product, or transaction restrictions adopted specifically in anticipation of the proposed rule and determine whether they remain justified by the firm's risk assessment, other legal requirements, or contractual obligations.

What changed

FinCEN withdrew the proposed rule published at 88 FR 72701 and the underlying section 311 finding concerning international CVC mixing. The proposed special measure one regime would have required covered financial institutions to report specified information for transactions they knew, suspected, or had reason to suspect involved international CVC mixing, including CVC type and amount, mixer and wallet information, transaction hashes, transaction dates, IP addresses, customer-identifying information, and a narrative description.

Key dates

2026-10-05

The CFTC Chairman announced the proposed Regulation CTX and Regulation CAM framework, and independent industry reporting identified the accompanying action as an advance notice of proposed rulemaking.

Suggested considerations

• Compliance teams may wish to monitor the Federal Register for publication of the CTX/CAM ANPRM and calculate the 60-day comment period from the actual publication date rather than from the Chairman’s October 5 statement.
• Affected exchanges should map each product and customer flow against margin, leverage, financing, custody, settlement, and internal-ledger features to determine whether the activity could fall within the proposed CTX concept.
• State-licensed platforms may wish to assess the strategic and operational consequences of pursuing a CFTC registration pathway instead of relying solely on state money-transmitter licenses.
• Firms may wish to review governance, conflicts-of-interest controls, market surveillance, anti-manipulation controls, customer-asset segregation, operational resilience, disclosure, and recordkeeping capabilities against existing CFTC designated contract market and customer-protection expectations.
• Exchanges and service providers may wish to prepare comments addressing the scope of Section 2(c)(2)(D), the treatment of fully paid transactions, the boundary between spot trading and financed transactions, and the interaction between CAM registration and state licensing.
• Legal and compliance functions may wish to inventory crypto assets and classify them consistently with the referenced joint CFTC-SEC interpretation, while preserving separate analysis for assets that may constitute securities or fall outside the proposed framework.
• U.S.-facing offshore platforms should reassess territorial exposure and customer-access controls because the proposal may create a clearer federal compliance pathway without eliminating potential CFTC jurisdiction over unregistered or fraudulent activity.

What changed

The CFTC is proposing to use its existing Commodity Exchange Act authority, including Section 2(c)(2)(D), to develop a purpose-built framework for crypto asset transactions and markets. Regulation CTX would address retail crypto transactions involving margin, leverage, or financing. Regulation CAM would establish a tailored category of CFTC-registered crypto asset market, apparently as a specialized form of designated contract market, for exchanges offering those transactions.

Key dates

2026-10-05

Chairman Michael S. Selig delivered the remarks at the Fordham Law Blockchain Regulatory Symposium and publicly described the CFTC-SEC crypto-asset classification framework and the shift toward formal crypto market regulation.

Suggested considerations

• Compliance teams may wish to inventory each supported token and document its likely classification under the five-category framework, including the facts supporting treatment as a digital commodity, digital collectible, digital tool, stablecoin, or digital security.
• Firms may wish to reassess whether their products involve retail commodity transactions under CEA section 2(c)(2)(D), including transactions involving margin, leverage, financing, or other arrangements that may require execution on or registration with a CFTC-registered venue.
• Crypto exchanges and trading platforms may wish to assess whether their activities could require DCM registration, a future crypto-asset-market registration, SEC registration, or multiple registrations depending on the asset and service provided.
• Issuers and platforms may wish to preserve evidence concerning network functionality, decentralization, token utility, marketing, purchaser expectations, transfer restrictions, and the separation of a crypto asset from any investment contract.
• Firms may wish to maintain controls addressing customer-asset segregation, custody, conflicts of interest, orderly trading, market surveillance, anti-manipulation, recordkeeping, and AML obligations, because the speech criticizes state money-transmission licensing as insufficient to provide federal market protections.
• Legal and regulatory teams may wish to monitor the CFTC and SEC rulemaking dockets and distinguish the Chairman's personal views, the joint interpretation, proposed rules, and any final rules or effective compliance dates.
• U.S. and offshore groups serving U.S. customers may wish to reassess their territorial and solicitation controls because the policy direction is intended to offer a federal pathway without eliminating the risk of CFTC or SEC jurisdiction over offshore conduct.

What changed

The Chairman described a joint CFTC-SEC interpretation that classifies crypto assets into five categories: digital commodities, digital collectibles, digital tools, stablecoins, and digital securities. The interpretation reportedly provides that digital commodities, digital collectibles, and digital tools are generally not securities; stablecoins may in some circumstances be securities; and digital securities remain subject to the federal securities laws.

Key dates

2026-10-05

CFTC published Release 9307-26 announcing the ANPRM and beginning consultation on a potential framework for crypto asset transactions and crypto asset markets.

Suggested considerations

• Compliance teams may wish to determine whether current or planned products involve retail commodity transactions under CEA Section 2(c)(2)(D), particularly where crypto assets are leveraged, margined, financed, or embedded in derivatives or perpetual-style products.
• Firms should consider mapping their customer-facing crypto activities, order execution arrangements, custody model, financing terms, liquidation processes, conflicts, market-abuse controls, and consumer disclosures against the issues identified in the ANPRM.
• Potential commenters may wish to prepare submissions addressing the scope of CTXs, the proposed treatment of spot versus financed transactions, appropriate registration and supervisory requirements, and the operational feasibility of a crypto asset market category.
• Designated contract markets and prospective applicants should consider assessing whether existing governance, surveillance, listing, liquidity, technology, and risk-management controls could support a future crypto asset market registration framework.
• Firms may wish to preserve evidence of existing controls and industry practices that they regard as effective, because the CFTC is specifically seeking information on crypto-specific contextual guidance and compliance practices.
• Compliance teams should monitor the Federal Register for the ANPRM publication and calculate the 60-day comment period from that publication date rather than from the October 5 press release.
• Firms should continue complying with currently applicable CEA, CFTC, securities, commodities, consumer-protection, AML, and state requirements because the ANPRM does not replace or suspend existing obligations.

What changed

The CFTC has opened a consultation process and is considering future rules referred to in market commentary as Regulation Crypto Asset Transactions (CTX) and Regulation Crypto Asset Markets (CAM). The ANPRM seeks views on preventing abusive practices in crypto asset markets and CTXs, providing crypto-specific context on compliance requirements and industry practices that the Commission considers best practices, and codifying a subcategory of designated contract market registration for crypto asset markets.