There is no single crypto law
The most common misunderstanding about US crypto regulation is that there is a crypto regulator. There is not. Obligations arise from several bodies of law that predate crypto and are applied to it, plus a state layer that operates independently of the federal one.
In practice a business may simultaneously face: securities law if a token or arrangement is an investment contract; commodities law and CFTC jurisdiction over derivatives and certain spot-market fraud and manipulation; the Bank Secrecy Act and FinCEN registration if it transmits value; state money transmitter licensing in each state it serves; and tax reporting duties.
Securities and commodities
Whether a particular token is a security is decided by applying the Howey test to the facts of how it was offered and sold, not by the token’s technology. This is why the same asset can be characterised differently depending on the transaction, and why litigation rather than rulemaking has produced much of the operative guidance. Conisec does not characterise specific assets — that is a legal conclusion, and getting it wrong has consequences for a reader.
Anti-money-laundering
Money services businesses, including many exchanges and transmitters, must register with FinCEN, maintain an AML programme, file suspicious activity reports, and comply with the Travel Rule for qualifying transfers. FinCEN registration is a federal filing obligation; it is not a licence and does not signal approval of a business.
State licensing
Most states require a money transmitter licence to serve their residents, obtained state by state. New York additionally operates the BitLicense under 23 NYCRR Part 200, a separate authorisation with its own requirements. This is why services are frequently available in some US states and not others, and why “regulated in the US” is not a meaningful statement without naming the regulator.
Tax
The IRS has treated digital assets as property since Notice 2014-21. Selling, exchanging one asset for another, or spending crypto is generally a disposal producing a gain or loss. Every Form 1040 carries a digital asset question that must be answered regardless of activity.
Third-party reporting expanded significantly with Form 1099-DA, phased in from the 2025 tax year. The practical effect is that the IRS now receives information about transactions it previously relied on taxpayers to self-report. That changes the risk of omission substantially without changing what is owed.
Sources
- Internal Revenue Service, Digital assets — guidance and FAQs (1 Jan 2026)
- FinCEN, Money Services Business registration (1 Jan 2026)
- NYS Department of Financial Services, Virtual Currency Businesses (1 Jan 2026)
Not legal or tax advice. This is a summary of published rules, not legal or tax advice. Rules change; check the primary sources linked above.
Last reviewed by Conisec Staff. Review cadence: Quarterly.