Crypto Regulation in the US: Who Regulates What in 2026

If you run a business that touches crypto, or you just want to know who protects you when you buy it, the US system can look like a maze. One agency calls a token a security, another treats it as a commodity, your exchange needs a license in dozens of states, and Congress has been debating a market structure law for years.

Here’s the good news: the map is clearer in 2026 than it has ever been. A federal stablecoin law is on the books, the SEC and CFTC have issued a joint framework for classifying tokens, and states have filled in licensing rules. This guide explains who regulates what, in one chart, and what’s still unsettled.

This is general information, not legal advice. Crypto rules change quickly, so confirm current requirements with the agencies listed here or a qualified attorney.

Who regulates what: it depends on the asset and the activity

US crypto regulation is “functional.” Regulators look at the asset and the activity, not the label:

• Is the token an investment contract or security? The SEC.
• Is it a commodity, and are you trading futures, options or leveraged contracts? The CFTC.
• Are you moving money for customers? FinCEN at the federal level, plus state money transmitter or crypto licenses.
• Are you a bank or a stablecoin issuer? Bank regulators like the OCC, Federal Reserve and FDIC, or a state regulator.
• Did you earn or sell crypto? The IRS.

Most crypto businesses deal with several of these at once.

The chart

Key takeaway: “Who regulates crypto?” has no single answer. Match the asset (security, commodity or stablecoin) and the activity (issuing, trading, holding or transmitting) to the agency, and expect state licensing on top.

The SEC: when a token is a security

The SEC regulates securities, and for crypto the central question has long been whether a token is sold as an investment contract under the Supreme Court’s Howey test. In plain terms, are buyers investing money in a common enterprise expecting profits from someone else’s efforts?

On March 17, 2026, the SEC, in coordination with the CFTC, issued an interpretation that sorts crypto assets into 5 categories: digital commodities, digital collectibles, digital tools, stablecoins and digital securities. Under that framework, only digital securities, such as tokenized stocks and bonds, are treated as securities in themselves. The SEC identified bitcoin and ether as digital commodities. The other non-security categories can still be pulled into securities law when they are sold as part of an investment contract, for example in a fundraising where buyers rely on a development team’s promises.

Two caveats matter. First, an interpretation is not a statute or a formal rule, so a future SEC could change it and courts aren’t bound by it. Second, the SEC has also signaled further rulemaking on crypto offerings, exemptions and safe harbors, so watch for proposals.

If you’re interested in stocks and bonds issued on blockchains, our guide to real-world asset tokenization explains why those remain securities.

The CFTC: crypto as a commodity

The CFTC regulates commodity futures, options and swaps, and polices fraud and manipulation in commodity markets. It has treated bitcoin and ether as commodities for years, and regulated crypto futures traded on registered exchanges.

The CFTC’s direct authority over spot (cash) crypto trading is limited without new legislation. On October 5, 2026, the CFTC published an advance notice of proposed rulemaking, titled “Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets,” seeking comment on a framework for retail crypto transactions using its existing authority. An advance notice doesn’t contain final rules. It is an early step that asks the public for input.

Treasury: money laundering, sanctions and taxes

Treasury touches crypto through 3 offices:

• FinCEN treats most businesses that exchange or transmit crypto for customers, including exchanges and crypto ATMs, as money services businesses. They must register, run anti-money laundering programs, verify customers and file suspicious activity reports.
• OFAC sanctions individuals, groups and services involved in hacking, ransomware or sanctions evasion, and lists specific crypto addresses. US persons generally can’t deal with sanctioned parties, in crypto or otherwise.
• The IRS treats crypto as property for tax purposes. Brokers began filing Form 1099-DA for 2025 sales. See our guide on how crypto is taxed in the US.

Stablecoins and the GENIUS Act

Stablecoins got their own federal law. The GENIUS Act (Public Law 119-27) was signed on July 18, 2025. Key points from the Congressional Research Service and the OCC:

• Payment stablecoin issuers must hold at least $1 of permitted reserves for each $1 of stablecoins issued, and can use reserves only for limited purposes, such as redemptions.
• Issuers are supervised by federal bank regulators, led by the OCC for non-bank federal issuers, or by state regulators. A state issuer with up to $10 billion outstanding can choose a state regime if it is certified as substantially similar to the federal framework.
• Starting January 18, 2027, a person generally must be an approved permitted payment stablecoin issuer to issue a payment stablecoin in the US.

The OCC finalized a rule implementing parts of the act in October 2026, with anti-money laundering and sanctions rules handled separately in coordination with Treasury. Payment businesses should follow this closely; our explainer on embedded finance and real-time payments shows where stablecoins may fit.

Stablecoins are not bank deposits. Unless a product is actually a deposit at an insured bank, FDIC insurance doesn’t apply. See is your money FDIC insured in a fintech app.

The CLARITY Act: the market structure bill

The CLARITY Act (H.R. 3633) aims to divide oversight of crypto markets between the SEC and CFTC by law, including giving the CFTC more authority over spot markets for digital commodities. Its path so far:

• July 17, 2025: Passed the House 294 to 134.
• January and May 2026: The Senate Agriculture and Banking committees advanced their own versions.
• September 15, 2026: A Senate procedural vote to begin debate fell short of the 60 votes needed. A motion to reconsider was entered, which keeps the bill technically alive.

As of October 2026, the CLARITY Act is not law. Regulators are working within their existing authorities in the meantime.

The states: licenses and consumer rules

States are often the first regulator a crypto business meets. Most require a money transmitter license for businesses holding or transmitting customer funds, and many have adopted crypto-specific rules:

• New York: The NYDFS “BitLicense” has required virtual currency businesses serving New Yorkers to be licensed since 2015, or to hold a New York trust charter.
• California: The Digital Financial Assets Law requires licensing from the Department of Financial Protection and Innovation. The licensing requirement took effect July 1, 2026, after being delayed from 2025.
• Crypto kiosks: A growing number of states, including Illinois, have passed laws targeting crypto ATMs, such as transaction limits and fraud warnings, because kiosks are widely used in scams.

Requirements vary widely, so a business operating nationally may need dozens of licenses. If you’re looking for local tech and compliance partners, our top lists by state can help, such as New York and California.

Where to start: a 5-step compliance check for businesses

1. Classify your activity. Are you issuing tokens, running a trading platform, holding customer assets, accepting crypto payments or just investing your own cash? Each triggers different rules.
2. Classify the assets. Use the SEC’s 5-category taxonomy as a starting point, and get a legal opinion for anything new or tied to a fundraising.
3. Check money transmission rules. If you hold or move crypto for others, review FinCEN registration and state licenses, including New York and California.
4. Build anti-money laundering and sanctions controls. Customer verification, OFAC screening of wallets and suspicious activity reporting are table stakes.
5. Plan for tax reporting and consumer protection. Prepare for 1099-DA reporting if you’re a broker, and review marketing claims and scam warnings, especially for kiosks. Our guide on how to avoid crypto scams covers the most common schemes customers face.

What to watch next, and the bottom line

The next year should bring more detail: additional GENIUS Act rules from Treasury and bank regulators ahead of the January 2027 deadline, possible SEC proposals on crypto offerings, the CFTC’s next step after its advance notice, and whether Congress revives the CLARITY Act after the November 2026 midterm elections. For terms like stablecoin and investment contract, see our glossary.

US crypto regulation is a patchwork, but a more readable one than before. Securities go to the SEC, commodity markets to the CFTC, money laundering, sanctions and taxes to Treasury, stablecoins to bank regulators under the GENIUS Act, and licensing to the states. Until Congress passes a market structure law, agency interpretations fill the gaps, and they can change. Build compliance around what you actually do, and check official sources often.

Sources

• SEC: SEC clarifies the application of federal securities laws to crypto assets — March 17, 2026 interpretation and 5-category token taxonomy
• CFTC: Release 9307-26 — October 5, 2026 advance notice on crypto asset transactions and markets
• Congressional Research Service: GENIUS Act of 2025 (P.L. 119-27) — stablecoin reserve, issuer and state regime rules
• OCC: Final rule to implement the GENIUS Act — OCC implementation and separate AML rulemaking
• Congress.gov: H.R. 3633, CLARITY Act — bill text and legislative actions
• California DFPI: Digital Financial Assets Law — state licensing requirement effective July 1, 2026