US Crypto Regulations in 2026: What is law, What is not, and What already binds you

On 1 July 2026, California’s Digital Financial Assets Law switched on its licensing requirement, and any firm serving California residents without a licence or a pending application moved outside the statute overnight. In Washington that same week, the CLARITY Act sat on the Senate calendar with no floor vote scheduled.

That contrast is the shape of US crypto regulations in 2026. The obligations that actually bind a crypto business keep arriving from statutes and state licences, while the market structure bill that everyone tracks has not moved since June.

This split is why most guides provide confusing information on US crypto regulations. They track the bills moving through Congress when the obligations that actually bind a US crypto business come from statutes and licences that have been in force for years.

Who regulates cryptocurrency in the United States?

No single agency or institute regulates cryptocurrency in the US. Six bodies hold overlapping authority over US crypto activity, and which ones reach you depends on what your business actually does.

The practical consequence is that businesses have to understand all regulations cumulatively rather than in isolation in order to fully understand what their obligations are. A US exchange can satisfy the Securities and Exchange Commission (SEC) on every token it lists and still be trading illegally for want of a state licence, because the two questions are decided by different regulators under different statutes.

What is the GENIUS Act and who does it apply to?

The Guiding and Establishing National Innovation for U.S. Stablecoins Act, signed on 18 July 2025, is the first US statute written specifically for a category of crypto asset. It reaches issuers of payment stablecoins, meaning tokens designed as a means of payment or settlement whose issuer is obliged to redeem them for a fixed amount of money.

The law does not reach exchanges, custodians, wallet providers or token projects in general. Teams outside stablecoin issuance keep reading it as a crypto rulebook and then budget for obligations that were never aimed at them.

What the law asks of payment stablecoin issuers

Only a permitted payment stablecoin issuer may issue a payment stablecoin for US use, and the Act defines three routes to that status. An issuer can be a subsidiary of an insured depository institution, a federal qualified issuer, or a state-qualified issuer. State qualified issuers with up to $10 billion outstanding may stay under a state regime where that regime is substantially similar to the federal one and has been approved by the Stablecoin Certification Review Committee.

The anti-money laundering piece is the part onboarding teams should read first. In April 2026 FinCEN and OFAC issued a joint proposed rule that would treat permitted issuers as financial institutions for Bank Secrecy Act purposes and require a sanctions compliance programme. Stablecoin issuers therefore inherit the full customer due diligence and reporting stack that banks already carry, rather than a lighter bespoke regime.

Why the GENIUS Act is not yet in force

The Act takes effect on the earlier of two dates, being 18 months after enactment, which is 18 January 2027, or 120 days after the primary federal stablecoin regulators issue final implementing regulations. Rulemaking was due within a year of enactment, and agencies including the Office of the Comptroller of the Currency have issued proposals rather than final rules.

The gap matters because the SEC said so itself. In its March 2026 interpretation, the Commission noted that the GENIUS Act is not yet effective and therefore analysed stablecoins under the existing case law instead. Anyone treating the statute as live today is making a mistake and taking measures that aren’t even needed yet.

The yield ban and what it means for crypto lending

There is no single set of crypto lending regulations US firms can point to, and the closest thing to one arrived sideways. The GENIUS Act prohibits a permitted payment stablecoin issuer from paying any form of interest or yield to holders, in cash, tokens or any other consideration, solely in connection with holding or using the stablecoin.

Congress narrowed that provision to issuers rather than to the wider market, which is why the question of whether exchanges and other intermediaries may pay rewards on stablecoin balances became one of the sticking points in the Senate. Lending and yield products built on stablecoins therefore sit in a live policy argument rather than a settled rule, and product teams should expect the answer to move.

What is the CLARITY Act and has it become law?

No. As of early August 2026, the Digital Asset Market Clarity Act has cleared one chamber and one committee, and it has never reached a Senate floor vote.

The bill would split supervision between the two federal market regulators, giving the CFTC jurisdiction over digital commodities and their spot markets while the SEC keeps securities, and would create registration categories for the exchanges, brokers, and dealers handling them. Passage would harden the agencies’ current position into statute, which matters because guidance can be withdrawn by a future administration, and a statute cannot.

The legislative record on H.R. 3633 runs as follows.

1. 17 July 2025: The House passed the bill by 294 votes to 134, with substantial bipartisan support.
2. September 2025: The Senate received it and referred it to the Committee on Banking, Housing, and Urban Affairs.
3. 14 May 2026: The Senate Banking Committee approved its version by 15 votes to 9.
4. 1 June 2026: The bill was reported with an amendment and placed on the Senate Legislative Calendar under General Orders as Calendar No. 423, making it eligible for floor consideration.

Eligible is not the same as scheduled. To become law, the bill still needs a Senate floor vote, reconciliation with the Senate Agriculture Committee’s competing digital commodity text, reconciliation with the House-passed version, and a presidential signature. The Senate’s August state work period narrows the window for any of that to happen in 2026.

When is a crypto token treated as a security rather than a commodity?

Since 23 March 2026 the answer starts with a joint interpretation from the SEC and the Commodity Futures Trading Commission (CFTC), which sorts crypto assets into five categories and concludes that four of them are not securities. The release supersedes the SEC staff framework that had guided the question since 2019, so analysis built on that older document is now out of date.

The release names sixteen assets as examples of digital commodities, including Bitcoin, Ether, Solana and XRP, and adds two more in a footnote. It also confirms that protocol mining, protocol staking, liquid staking and wrapping do not involve the offer and sale of a security when they follow the patterns described.

Two limits are easy to miss, and both carry real exposure.

• The interpretation does not bind courts: Judges decide independently whether an asset is a security, and the Howey test remains binding precedent that this release explicitly does not replace. Private litigants can still sue under federal and state securities law.
• A non-security token can still be sold subject to an investment contract: Where an issuer induces investment with promises of managerial effort, the surrounding contract is a security even though the token itself is not, and that contract can follow the token into secondary trading until it separates.

What AML and KYC obligations apply to US crypto businesses?

Federal anti-money laundering duties attach the moment a business accepts and transmits value on someone else’s behalf, and they have applied to crypto since 2013. FinCEN’s 2019 consolidated guidance restated the position across common business models and was explicit that it created no new expectations, which means these are the crypto regulations US businesses have been living under for more than a decade.

A firm that qualifies as a money services business carries five duties.

1. Registration with FinCEN as a money services business, renewed on the statutory cycle.
2. A written AML programme covering policies, internal controls, a designated compliance officer, training and independent testing.
3. Customer identification and due diligence, with enhanced scrutiny where the risk assessment calls for it.
4. Suspicious activity reporting and currency transaction reporting, filed on the standard BSA timetables.
5. Recordkeeping and travel rule compliance on qualifying transmittals, plus sanctions screening against OFAC lists.

FinCEN’s analysis turns on whether a business accepts and transmits value, so calling a product a wallet, a bridge or a protocol interface changes nothing if value moves through it. Custodial wallet providers and hosted exchanges generally fall inside the perimeter, while unhosted wallet software and self-directed miners generally do not. The harder problem is that screening a person is only half the picture.

The counterparty risk in a crypto transfer does not live in the customer file, which is why onboarding data alone cannot answer whether the money is going somewhere clean. Transaction monitoring after the account opens is where that gap gets closed.

Do crypto exchanges need state money transmitter licences?

In most states, yes. State licensing is the part of USA crypto regulations that surprises foreign operators most, because the trigger is where the customer sits rather than where the company is incorporated. A crypto-friendly state of incorporation does nothing for a firm serving residents of forty others.

Two states run dedicated regimes on top of ordinary money transmission.

New York

New York requires a BitLicense from the Department of Financial Services for virtual currency business activity involving New York or its residents, under 23 NYCRR Part 200, with a limited purpose trust company charter as the alternative route. Approval timelines commonly run past a year, so the licence is a roadmap item rather than a launch task.

California

California switched on its Digital Financial Assets Law on 1 July 2026. Firms conducting covered digital financial asset business activity with California residents must now hold a licence from the Department of Financial Protection and Innovation or have an application pending, and applications opened through the Nationwide Multistate Licensing System on 9 March 2026. Anyone who missed the filing date is operating outside the statute now, not at some future review point.

Why federal legislation would not remove this layer

Federal legislation would not sweep this away either. The Conference of State Bank Supervisors wrote to the Senate Banking Committee in May 2026 to press for further limits on the CLARITY Act’s preemption language, having already secured narrowing of earlier drafts on state money transmission. State supervisors are defending that ground actively, so plan for crypto exchange regulations to stay two-tier.

How do US crypto rules compare with MiCA in the EU?

The EU built one statute and one licence. The US built neither, and runs a patchwork of federal statutes plus state licensing instead.

The practical difference is the cost of scale. A crypto-asset service provider (CASP) authorised in one EU member state can serve all 27 under a single licence, while a US operator repeats the licensing exercise state by state. ESMA confirmed in April 2026 that the transitional period would not be extended, and firms serving both markets now hold one EU licence alongside a stack of US ones. Our guide to MiCA and the CASP deadline covers the European side in detail.

The mistake teams make when reading US crypto regulations

Search for us crypto regulations 2026 and nearly every result is a legislative scorecard. Congress is the most visible part of the story and the least useful one, because a bill that has not passed creates no obligation, while the statutes that have been enforceable for a decade create a great many.

He compared it to the way regulators moved on cards and payment services a decade earlier, once they concluded they did not want anonymous money moving through the system.

Read against that, the market structure fight looks less decisive than it sounds. Whether the SEC or the CFTC supervises a given token changes disclosure and registration duties, and it does not touch the identity and AML layer at the fiat boundary, which binds either way.

Three things follow for a compliance roadmap.

1. Build for the obligations already in force: FinCEN registration, an AML programme, sanctions screening and state licences apply now, and none of them waits on a Senate vote.
2. Treat the GENIUS Act as a 2027 project with a 2026 design phase: Stablecoin issuers have time, and the final implementing rules will set the detail, so track the rulemaking rather than the statute alone.
3. Keep the token classification question separate from the onboarding question: Classification decides which regulator reviews your listings. Onboarding decides whether you can operate at all.

How Shufti helps crypto businesses meet US compliance obligations

If you run onboarding at a US exchange or wallet, the frustration is rarely the rulebook. Identity and AML obligations bind you in every state you serve while the market structure question that would tell you how to build stays open, so teams bolt a screening tool onto a verification tool onto a monitoring tool and then cannot show an examiner one clean record across the three.

Shufti’s AML screening for crypto businesses runs as a single decisioning layer from onboarding through continuous monitoring, covering OFAC, EU consolidated, UK HMT and UN sanctions lists, 1,200+ PEP and associate databases, and adverse media in 80+ languages. One decision trail follows the customer from sign-up onward, so the evidence an examiner asks for sits in one system rather than three.

Binance uses Shufti for non-Latin documents across global markets where accuracy requirements exceed standard solutions.