Global Regulatory Overview

European Union — MiCA Framework

The Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, MiCA) is now fully applicable. Its rules for stablecoins — asset-referenced tokens (ARTs) and e-money tokens (EMTs) — applied from 30 June 2024, and the full regime for crypto-asset service providers (CASPs) applied from 30 December 2024. The transitional grandfathering window for firms operating under prior national law ended on 1 July 2026, so serving EU clients now requires a MiCA CASP licence. Minimum capital for a CASP is tiered — €50,000, €125,000, or €150,000 depending on the services offered.

Fully decentralised protocols with no identifiable intermediary currently fall outside MiCA’s scope. The Commission’s MiCA review is ongoing: a targeted consultation opened in May 2026 and a full review report — potentially including DeFi-specific proposals — is due by 30 June 2027. Dedicated EU rules for DeFi are therefore still pending, and the practical focus remains on identifiable service providers rather than smart contracts themselves.

EU — Travel Rule, AML Package & AMLA

The recast Transfer of Funds Regulation (Regulation (EU) 2023/1113) has applied since 30 December 2024 and imposes a zero threshold on crypto transfers: full sender and recipient information must accompany every transfer, however small. Enhanced due diligence applies to transfers involving self-hosted (unhosted) wallets.

The broader AML package — the AML Regulation (EU) 2024/1624 (AMLR) and the 6th AML Directive (2024/1640) — has been adopted but applies from 10 July 2027, so it is not yet binding on firms. From that date, banks and CASPs will be barred from keeping anonymous crypto accounts and from servicing anonymity-enhancing "privacy" coins, and an EU-wide €10,000 cash payment limit will apply. A €1,000 threshold will trigger customer due diligence on occasional crypto transactions and on dealings with self-hosted wallets.

The EU Anti-Money-Laundering Authority (AMLA), based in Frankfurt, has been operational since mid-2025 and took over the EBA’s AML/CFT mandates on 1 January 2026. It is ramping up gradually and begins direct supervision of selected high-risk firms in 2028; for now it coordinates and harmonises AML/CFT supervision across the EU.

United States — Federal Framework

US policy shifted markedly in a pro-crypto direction across 2025 and 2026. The GENIUS Act, the first federal payment-stablecoin law, was signed on 18 July 2025: it requires 100% reserve backing, monthly reserve disclosures, licensed issuers, and full AML/Bank Secrecy Act obligations. Its operative regime takes effect in early 2027 once rules are finalised. Separately, the IRS "DeFi broker" reporting rule was repealed (signed into law on 10 April 2025) — DeFi front-ends are not treated as brokers, and the rule cannot be reissued.

On securities and derivatives, the SEC under Chair Paul Atkins issued an interpretive release and a crypto token taxonomy on 17 March 2026, with the CFTC aligning to it. Proposed "startup" and "fundraising" exemptions and a more favourable stance toward self-custody and DeFi are under consideration but not yet enacted. The CFTC oversees crypto derivatives, and a market-structure bill — the CLARITY Act — passed the House and advanced in the Senate during 2026 but is not yet law. At the state level, money-transmitter licensing still applies alongside federal registration.

United Kingdom — FCA

The UK has now legislated a comprehensive framework. The FSMA 2000 (Cryptoassets) Regulations 2026 were enacted on 4 February 2026, and the FCA published its final rules on 30 June 2026, covering trading platforms, intermediaries, custody, stablecoin issuance, and staking. The live mandatory regime is future-dated: the FCA authorisation gateway opens on 30 September 2026, and the mandatory regime comes into force on 25 October 2027. Firms should prepare for authorisation well ahead of those dates.

Asia-Pacific Region

Singapore’s Digital Token Service Provider (DTSP) regime under the Monetary Authority of Singapore (MAS) took effect on 30 June 2025: providers serving only overseas clients must now be licensed, a bar MAS deliberately set high, while domestic licensing continues under the Payment Services Act.

Hong Kong operates SFC licensing for virtual-asset service providers alongside a Stablecoins Ordinance effective 1 August 2025, with the first stablecoin licences granted in April 2026. The regime combines investor-protection standards with a defined path for regulated issuers.

Japan’s amended Payment Services Act takes full effect on 13 June 2026, and a 2026 reform reclassifies crypto as "financial instruments" under the FIEA, phasing toward 2027. A flat 20% crypto tax has been proposed as part of the same reform package.

Compliance Requirements Matrix

Despite regional differences, four compliance areas are universal: authorisation and licensing, anti-money laundering, consumer protection, and market integrity. Requirements vary in specifics but converge on common principles.

DeFi & a Risk-Based Approach

Truly decentralised protocols remain largely out of scope, but regulators increasingly scrutinise real control points — admin keys, upgrade rights, and front-ends. The dominant approach is to regulate access points such as front-ends, custodians, stablecoin issuers, and on/off-ramps rather than the smart contracts themselves. No binding MEV-specific rule exists yet.

A practical strategy classifies jurisdictions and services by risk. High-priority jurisdictions requiring near-term compliance include the EU, the US, the UK, and Singapore; medium-priority ones to monitor include Japan, Canada, Australia, and Switzerland. Centralised exchanges, custody services, and fiat on/off-ramps require full compliance; decentralised exchange interfaces, yield-farming platforms, and cross-chain bridges require selective compliance; purely decentralised protocols and open-source software fall into a lower-risk monitoring category.