Crypto Regulation Explained: MiCA, VASP Registers and US Rules

Last reviewed: 1 October 2026

Crypto regulation mostly targets the businesses in the middle: exchanges, brokers, custodians, payment processors and stablecoin issuers. Holding bitcoin in your own wallet is legal in most of the world, but a company that holds it for you usually needs a licence or a registration from a national regulator.

What does crypto regulation actually cover?

The global baseline comes from the Financial Action Task Force (FATF), the standard setter for anti-money-laundering rules. Its guidance on virtual assets asks countries to license or register virtual asset service providers (VASPs), check their owners and managers, and make them follow the same customer checks banks do.

On top of that baseline, larger markets add conduct rules: how firms must keep customer assets separate, what they can advertise, how much capital they hold and what they must tell customers.

How does MiCA work in the EU?

The Markets in Crypto-Assets Regulation (MiCA, Regulation 2023/1114) is a single rulebook for all 27 member states. Its stablecoin rules applied from 30 June 2024 and the rest from 30 December 2024. It has three main parts:

• Crypto-asset service providers (CASPs). Firms offering services such as custody, running a trading platform, exchange, executing orders or transfers generally need authorisation from a national regulator; some banks and investment firms can use a notification route instead. Once authorised in one country, they can passport the same services across the EU.
• Stablecoins. MiCA splits them into e-money tokens, which reference one official currency and can only be issued by banks or e-money institutions, and asset-referenced tokens, which reference another value or right, or a mix. Our USDT guide covers how one large stablecoin works in practice.
• Other tokens. Issuers that offer tokens to the public or seek a listing generally must publish a white paper with set disclosures, with some exemptions. A white paper on file is not regulatory approval of the token.

Firms already operating under national rules could keep going during a transition that member states set, but 1 July 2026 was the latest possible end date; several countries ended it earlier. In a statement of 23 June 2026, the European Securities and Markets Authority (ESMA) said unauthorised providers must stop onboarding EU clients, stop marketing and wind down in an orderly way. It also said firms outside the EU cannot serve EU clients unless the client approached them entirely on their own initiative, a narrow exception.

The Transfer of Funds Regulation (2023/1113) applies the FATF Travel Rule alongside MiCA: providers pass sender and recipient details with transfers they handle, with no minimum amount, and transfers to or from self-hosted wallets carry extra checks. It does not apply to two people moving coins between their own wallets.

How do you read a VASP or CASP register?

ESMA publishes an interim MiCA register listing authorised CASPs and white papers. When you look a firm up, check four things:

• The exact legal entity. Groups often run several companies. The one in your terms of service must be the one on the register.
• The services listed. Authorisation is granted service by service. A firm licensed only to transfer crypto is not licensed to hold it for you.
• Where it can operate. Look for the countries it has passported into.
• Who supervises it. Complain to the firm first; the home regulator handles regulatory concerns but will not necessarily recover an individual loss.

Outside the EU, national registers work the same way but often mean less. In many countries a VASP registration only proves the firm passed anti-money-laundering checks, not that it meets capital or custody standards. The regulator’s own site is the source of record; screenshots and logos on a company’s website are not.

How is crypto regulated in the US?

There is no single federal crypto licence. A typical exchange or payment firm stacks several layers:

• FinCEN. Firms that transmit value, including crypto, register as money services businesses with the Treasury’s Financial Crimes Enforcement Network and run anti-money-laundering programmes. The MSB registrant search is public, but FinCEN says registration is not a licence or an endorsement.
• State licences. Most states require a money transmitter licence, depending on the activity, and a FinCEN registration does not show a firm holds them. New York has its own crypto licence, the BitLicense, run by the Department of Financial Services.
• SEC and CFTC. Depending on the facts of an offer, a token sale can be a securities transaction, which brings in the Securities and Exchange Commission. The Commodity Futures Trading Commission regulates crypto derivatives and can pursue fraud and manipulation in spot commodity markets. The House passed the CLARITY Act in July 2025 to split spot-market oversight between the two, but as of the last review it had not become law.

Stablecoins now have their own federal law. The GENIUS Act, signed in July 2025, requires payment stablecoin issuers to be permitted under a federal or state route and back tokens fully with liquid reserves such as cash and short-term Treasuries. Treasury says that from the expected effective date of 18 January 2027, a person generally may not issue a payment stablecoin in the US without that licence, and from 18 July 2028 platforms generally may not offer or sell any payment stablecoin to US persons unless a licensed issuer issued it.

What is changing in the UK?

Since January 2020, firms carrying on in-scope crypto activities in the UK have had to register with the Financial Conduct Authority (FCA) for anti-money-laundering purposes, and since October 2023 all crypto promotions to UK consumers must follow FCA rules. That registration is narrow and is being replaced.

A full regime under the Financial Services and Markets Act comes into force on 25 October 2027. It covers trading platforms, dealing, custody, staking and stablecoin issuance, with rules on safeguarding, market abuse and capital. The FCA opened applications on 30 September 2026 and says firms that want to continue should apply by 28 February 2027. Authorisation is not automatic, and an existing anti-money-laundering registration does not roll over. Our report on the FCA authorisation window has the timeline.

How does this affect you as a user?

Regulation does not stop prices falling or protect you from your own trades. A full authorisation brings rules on how a firm holds your assets and what it must disclose; an anti-money-laundering registration brings far less. Neither guarantees repayment after a hack, insolvency or market loss, and a UK crypto registration alone does not give access to the Financial Ombudsman Service or FSCS compensation. Unauthorised providers, ESMA warns, give their clients none of MiCA’s protections. The collapse of unregulated platforms, and the way crypto exchange hacks happen, show why the custody rules matter.

Before you deposit with any provider, check the crypto company: find the legal entity in its terms, look it up on your country’s register and confirm the service you plan to use is listed.

Tax is separate from licensing. In the EU, the DAC8 directive requires providers to report customer transactions to tax authorities from 2026, and US custodial brokers report covered sales on Form 1099-DA starting with 2025 transactions.

Sources

• FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (October 2021)
• Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (Transfer of Funds)
• ESMA, Public statement on the end of the MiCA transitional period (23 June 2026) and MiCA page and interim register
• US Treasury, GENIUS Act section 3 proposed rule (17 August 2026); FinCEN MSB Registrant Search
• FCA, FCA opens the gateway to regulated crypto (30 September 2026) and cryptoasset regime policy statement (June 2026)