Crypto Regulation Basics
Cryptocurrency operates in a regulatory environment that is still taking shape. Governments around the world have introduced rules covering how exchanges verify users, how transactions are reported to tax authorities, and how tokens are classified under securities law. These rules apply whether you trade occasionally on a centralized exchange or run a DeFi protocol accessible from anywhere.
This page maps the regulatory landscape in plain terms. It is not legal advice. It is a survey of the key mechanisms, risks, tools, and decisions that determine how crypto regulation affects individuals and businesses. Each section below points to a dedicated article that answers a specific question in full.
Token classification and securities law
The most consequential question in crypto regulation is whether a token is a security. If it is, selling or trading it may require registration with the SEC, or the transaction may violate securities law.
The Howey Test determines this. Under US law, an asset is a security if it involves an investment of money in a common enterprise with a reasonable expectation of profit derived from the efforts of others. Many tokens, particularly those sold in initial coin offerings, meet this test. Some major projects - including XRP and SOL - have faced SEC enforcement actions arguing they are unregistered securities. Others, like Bitcoin and Ethereum, have been classified as commodities by the CFTC.
The decision has practical consequences. Exchanges that list tokens later deemed securities can face delisting notices and forced-sale deadlines. The error message "Exchange delisting notification for registered security" is not hypothetical. When the SEC classified several tokens as securities in lawsuits against Binance and Coinbase in 2023, those tokens were removed from US trading pairs within days.
The full article What Is the Howey Test and Why Does It Matter for Crypto walks through the four prongs of the test and applies them to real token examples.
A related mechanism is the token classification framework that regulators use to distinguish utility tokens from securities. Utility tokens grant access to a service or network but do not promise profit from the efforts of a centralized team. The line between them is often blurry, and the SEC has not issued a bright-line rule. Most crypto projects that raised money from US investors now structure sales to avoid meeting the Howey Test's third and fourth prongs.
Exchange compliance: licensing, AML, and sanctions
Any business that holds customer crypto or facilitates trading must comply with a web of federal and state requirements.
Anti-Money Laundering (AML) compliance procedures require exchanges to monitor transactions, report suspicious activity to FinCEN, and maintain records of customer identity. The Bank Secrecy Act treats most crypto exchanges as Money Services Businesses, which means they must register with FinCEN, implement a written AML program, and file Suspicious Activity Reports (SARs) when warranted. The article How Anti Money Laundering Rules Apply to Cryptocurrency Platforms explains exactly what obligations apply and how exchanges implement transaction monitoring systems.
Know Your Customer (KYC) identity verification is the front door of exchange compliance. When you create an account on Coinbase, Kraken, or Gemini, you submit a government-issued ID, proof of address, and sometimes a selfie. This data is checked against sanctions lists and watchlists. If verification is incomplete, you see the error "Account restricted: KYC verification incomplete" until you finish the process.
Money Transmitter licensing requirements add another layer. While federal law requires MSB registration, most states require a separate money transmitter license to operate within their borders. New York's BitLicense is the most stringent, requiring detailed compliance policies, cybersecurity audits, and surety bonds. The article When Does a Crypto Business Need a Money Transmitter License breaks down exactly what threshold an activity crosses - holding customer funds, facilitating transfers, or operating a fiat on-ramp - and where different licenses apply.
Sanctions screening against OFAC lists is mandatory for any US exchange. Every transaction is checked against the Specially Designated Nationals (SDN) list maintained by the Office of Foreign Assets Control. When an address matches a sanctioned entity, the transaction is blocked. The error "OFAC screening flag: transaction blocked" appears. This screening is done by compliance tools like Chainalysis, Elliptic, and TRM Labs, which maintain databases of addresses linked to sanctioned wallets, ransomware groups, and darknet markets. The dedicated article How OFAC Sanctions Screening Works on Crypto Platforms explains how these tools work and what happens to the flagged address.
Travel Rule information sharing is a newer requirement. Under FinCEN's Travel Rule, exchanges must share sender and receiver identity information for transactions above $3,000. This requires technical infrastructure to transmit customer data between platforms that may use different compliance systems. If the receiving exchange does not have the required data, you may see "Travel Rule data missing: recipient info required" when attempting a withdrawal.
Proof of reserves attestation is not legally required in the US, but after the FTX collapse, many exchanges voluntarily publish verifiable proof that they hold customer assets. The article What Is Proof of Reserves and Which Exchanges Actually Use It compares the methods used by Kraken, Binance, and others, and explains how third-party auditors verify the numbers.
Tax obligations: events, methods, and software
Tax reporting on cryptocurrency is not optional. The IRS treats crypto as property, not currency, which means nearly every transaction involving disposal - selling, trading, spending, or gifting - triggers a taxable event.
The core article Which Crypto Transactions Are Taxable Events You Must Report provides a complete list: selling crypto for fiat, trading one token for another, using crypto to buy goods or services, receiving crypto as payment or mining reward, and most airdrops. The misconception that "If I don't cash out to fiat, I don't owe taxes" is false. Trading ETH for USDC is a disposal of ETH, and you owe capital gains tax on any difference between your cost basis and the fair market value at the time of trade.
The IRS Form 1099-DA, which was proposed in draft form in 2023, would require exchanges to report cost basis and proceeds to the IRS. The error "Form 1099-DA discrepancy with exchange records" reflects what happens when your reported tax figures do not match what the exchange submitted. The IRS cross-references these forms against your return.
Cost-basis tracking methods determine how you calculate gains when you hold multiple lots of the same asset purchased at different prices. The three main methods are FIFO (first in, first out), LIFO (last in, first out), and HIFO (highest in, first out). The article FIFO LIFO or HIFO Which Cost Basis Method for Crypto Taxes explains how each method affects your tax liability and which one minimizes realized gains in common scenarios. The error "Tax lot mismatch: unable to reconcile cost basis" typically appears when an exchange cannot match a sell order to a specific purchase lot because the accounting method is inconsistent with what the exchange uses.
Tax software automates this tracking and generated its own industry. CoinTracker integrates with over 500 exchanges and wallets and supports DeFi transactions. Koinly is a direct competitor with a similar feature set. TokenTax targets high-volume traders with dedicated account managers. TaxBit is enterprise-grade software used by exchanges themselves. The article CoinTracker vs Koinly vs TokenTax Which Crypto Tax Software Is Best compares their exchange integrations, DeFi support, pricing tiers, and which type of user each serves best.
The capital gains tax rate brackets apply based on how long you held the asset. Short-term gains (assets held under one year) are taxed as ordinary income at rates up to 37%. Long-term gains (held over one year) are taxed at 0%, 15%, or 20% depending on your income. This rate is not static - the brackets are adjusted annually for inflation - but the differential is large enough that holding for over a year can halve your tax rate.
Airdrops create a special confusion. The IRS treats airdropped tokens as ordinary income at the time you gain dominion and control over them - typically when you claim them or they appear in your wallet. The article How to Report Crypto Airdrops on Your Taxes Correctly walks through the timing, valuation, and reporting requirements, including the misconception that "Airdrops are free gifts with no tax implications."
The decision between filing as capital gains vs. ordinary income matters when you receive tokens through staking, lending, or mining. Staking rewards have been classified inconsistently: some tax professionals treat them as ordinary income at receipt, while others argue for capital gains treatment at sale. The error "Staking rewards classified as miscellaneous income" reflects IRS enforcement that treats rewards as ordinary income. The article Which Crypto Transactions Are Taxable Events You Must Report covers the latest IRS guidance on staking.
Stablecoins, jurisdiction, and exchange access
Stablecoins are widely used as dollar proxies, but regulators view them differently. The two largest stablecoins, USDC and USDT, differ in their regulatory posture.
USDC is issued by Circle, a US-registered money transmitter that publishes monthly attestations from Grant Thornton of its reserve holdings. Circle holds reserves primarily in cash and short-term US Treasuries. USDT, issued by Tether, has faced sustained skepticism over its reserve composition. Tether settled with the New York Attorney General in 2021, paying $18.5 million for allegedly misrepresenting reserve backing. It now publishes quarterly reports but has not undergone the same level of independent audit as Circle. The article USDC vs USDT Which Stablecoin Has Less Regulatory Risk compares issuer transparency, reserve breakdowns, and enforcement history.
The risk of a stablecoin depegging event is real. USDT briefly depegged to $0.95 in May 2022 during the Luna collapse, and USDC depegged to $0.87 in March 2023 when Circle disclosed exposure to Silicon Valley Bank. Both recovered, but the events demonstrated that a peg does not guarantee stability.
Why Crypto Exchanges Block Access From Certain Countries is the subject of a dedicated article. Exchanges restrict access based on where their licenses allow them to operate. Binance blocks IP addresses from the US, the UK, Japan, and over 20 other countries. Uniswap's frontend blocks access from US IP addresses for certain tokens following SEC enforcement actions. The article explains the legal basis for these blocks and the risks of bypassing them, including the misconception that "Using a VPN solves all geo-blocking compliance issues."
When an exchange delists a token because of regulatory action, users see "This asset is not available in your jurisdiction" and have a limited window to sell or transfer the token. The forced-sale deadline window is typically 30 to 90 days, after which the exchange may sell remaining holdings.
Security, custody, and bankruptcy risk
The FTX bankruptcy in November 2022 made clear what happens when customer assets are held on an exchange that fails. The article What Happens to Your Crypto If an Exchange Goes Bankrupt explains the legal status of customer crypto assets under US bankruptcy law. In a standard exchange bankruptcy, assets become property of the bankruptcy estate, meaning customers are unsecured creditors who may recover only cents on the dollar after years of litigation.
This drives the decision between custodial wallet vs. self-custody hardware wallet. A custodial wallet (such as the one Coinbase or Binance provides) means the exchange controls the private keys. A self-custody hardware wallet like Ledger or Trezor means you control the keys. The article Ledger vs Trezor Which Hardware Wallet Keeps Crypto Safer compares their security architectures: Ledger uses a secure element chip to isolate private keys; Trezor uses a simpler microcontroller but offers open-source firmware. Neither is bulletproof against physical theft, but both are far more secure than keeping assets on an exchange.
The seed phrase loss resulting in permanent wallet lockout is the most common self-custody risk. If you lose your 12- or 24-word recovery phrase, no one can recover your funds. Ledger offers a recovery service called Ledger Recover that encrypts and stores seed phrase shards, but it has been controversial within the crypto community for introducing a trust third party.
Phishing attacks remain the most effective way hackers drain exchange accounts. The article How to Spot and Avoid Fake Crypto Exchange Phishing Scams covers the most common techniques: fake login pages that steal credentials, SIM-swap attacks that bypass SMS authentication, and fake customer support accounts on Telegram. The error "Phishing attack via fake exchange login page" is not a technical error message - it is the result after a user's account is drained.
Smart contract exploit draining approved token allowances is a DeFi-specific risk. When you approve a DeFi protocol to spend ERC-20 tokens, you can approve an unlimited amount - many protocols request this by default for convenience. If the protocol is exploited, the attacker can drain all tokens you approved. The article Why You Should Revoke Old Smart Contract Token Allowances explains how to find these approvals on Etherscan and how to use tools like Revoke.cash to remove them.
DeFi, DAOs, and the Unregulated Frontier
Decentralized finance protocols and autonomous organizations operate in a regulatory gray zone. The misconception that "Decentralized protocols cannot be regulated" has been tested repeatedly.
The Uniswap frontend blocks access from your region message appears when you visit the Uniswap website from a US IP address for certain tokens. The protocol itself remains accessible through smart contracts via other frontends or directly, but the frontend operator (Uniswap Labs) has chosen to comply with US securities law. This demonstrates how "decentralized" protocols can still have regulated choke points at the interface level.
DAOs face a specific legal problem: if a DAO has a governance token and members vote on protocol changes, the DAO may be considered a general partnership or an unregistered investment company under US law. The article discusses **Off
Not financial advice. thomasdank.xyz publishes market data and general information about digital assets. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.
Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.