US Crypto Regulation After Atkins: Who Actually Regulates What? | Bitcoin Index

US crypto regulation is a multi-agency puzzle where the answer to “who regulates this?” depends less on what an asset is and more on how it’s sold. The SEC regulates securities, the CFTC handles commodities and derivatives, FinCEN enforces anti-money laundering rules, the OCC oversees banks, and states impose their own licensing. Miss any piece and you’re in regulatory quicksand.

Under Paul Atkins, sworn in as SEC Chair in April 2025, the tone has shifted from Gary Gensler’s enforcement-heavy approach to collaborative rulemaking. But the fundamental legal tests remain unchanged. Understanding the jurisdictional boundaries is critical for anyone building, investing, or operating in crypto.

Who is Paul Atkins and what actually changed?

Paul S. Atkins was confirmed by the Senate on April 9, 2025, and sworn in as SEC Chair on April 20, 2025. He’s not new to the Commission. Atkins served as an SEC Commissioner from 2002 to 2008 and later founded Patomak Global Partners, a regulatory consulting firm. Notably, he served on the advisory board of Securitize, Inc., a cryptocurrency firm, signaling his crypto-friendly stance.

The Gensler era: enforcement first, questions later

Gary Gensler’s tenure (2021-2025) was defined by aggressive enforcement. The SEC pursued 125 cryptocurrency-related enforcement actions between April 2021 and December 2024, collecting $6.05 billion in penalties, nearly four times the prior administration.

Gensler’s position was simple: most crypto assets are securities and must comply with existing law. No new tailored rules needed. His approach leaned heavily on enforcement rather than clear regulatory guidance. Notable cases included the Kraken staking settlement ($30M, February 2023), lawsuits against Coinbase and Binance for operating unregistered exchanges, and the ongoing Ripple case.

Gensler defended this as necessary to combat fraud, citing FTX’s collapse and widespread investor harm. Critics, including current Commissioners Hester Peirce and Mark Uyeda, argued it relied too heavily on enforcement without adapting to innovation.

The Atkins shift: collaboration over litigation

Atkins has called Gensler’s approach a “failed opportunity” and a “big missed opportunity.” His changes include:

Project Crypto: Initially launched as an SEC-only initiative in August 2025, it became a joint SEC-CFTC effort on January 29-30, 2026. The goal is to harmonize federal oversight of digital asset markets, clarify jurisdictional lines, and remove duplicative compliance requirements.

Reduced enforcement aggression: The SEC under Atkins is expected to pursue less aggressive enforcement against crypto companies, focusing instead on traditional fraud cases and clear regulatory frameworks.

Innovation exemptions: Atkins has signaled intent to formalize an innovation exemption by the end of 2025 or early 2026, allowing compliant projects to operate within a streamlined framework.

Congressional optimism: Atkins expects bipartisan legislation clarifying US crypto market structure in 2026, reducing uncertainty without stifling innovation.

Historic engagement: Atkins became the first sitting SEC Chair to speak at a Bitcoin conference (Bitcoin 2026), signaling a shift in tone.

What did NOT change: The Howey test, the legal framework for securities, and the SEC’s fundamental mandate to protect investors. Atkins is not abandoning securities law. He’s seeking to apply it more predictably.

The Howey test: why a 1946 orange grove case still matters

The Howey test comes from the 1946 Supreme Court case SEC v. W.J. Howey Co., which involved orange groves in Florida. Investors bought land parcels and leased them back to Howey Co., which managed the groves and shared profits. The Court ruled this was an investment contract, a type of security, even though no stock certificates were issued.

The four prongs

An investment contract exists when:

Investment of money: A person invests money or something of value
Common enterprise: The investment is pooled with others or tied to a promoter’s efforts
Expectation of profits: Investors expect financial returns
Derived from the efforts of others: Profits depend on the entrepreneurial or managerial efforts of a third party, not the investor’s own work

All four prongs must be satisfied.

How it applies to crypto

Bitcoin and Ethereum: Both are generally considered commodities under CFTC jurisdiction because they are decentralized. There’s no central promoter whose efforts drive value. A July 2024 federal court order confirmed Bitcoin and Ethereum are commodities within CFTC jurisdiction.

ICO tokens and altcoins: Most tokens sold in Initial Coin Offerings (ICOs) are securities because investors pay money, funds are pooled for project development, investors expect price appreciation, and the founding team’s efforts drive value. All four Howey prongs satisfied.

Staking-as-a-service: The SEC’s 2023 Kraken settlement established that centralized staking programs are securities. Kraken pooled customer crypto assets, staked them on behalf of users, and offered advertised annual returns. This satisfied all four Howey prongs. Kraken paid $30M and shut down US staking operations.

Stablecoins: Fiat-backed stablecoins like USDC are generally not securities under Howey or the Reves test for notes, so long as they are not marketed as investment contracts. Algorithmic stablecoins with yield-generating mechanisms may be securities.

The “efforts of others” prong in practice

This prong is the most nuanced. Does decentralization matter? Yes. If a project becomes sufficiently decentralized, with no central team controlling outcomes, it may no longer meet prong 4. However, the SEC has not formally defined “sufficient decentralization.”

Marketing matters. Promoting a token as an investment or emphasizing team efforts to drive value strengthens the SEC’s case. If the founding team continues to develop, market, or operate the network, prong 4 is satisfied.

SEC v. Ripple (2023 ruling): Judge Analisa Torres drew a controversial distinction. XRP sold directly to hedge funds and institutions qualified as securities (all Howey prongs met). XRP sold on exchanges to retail buyers did not qualify as securities (prong 3 not met because retail buyers on exchanges didn’t have a reasonable expectation tied to Ripple’s efforts).

The SEC appealed this ruling in October 2024. It remains under appeal, and the Atkins SEC has not indicated whether it will continue the appeal.

SEC jurisdiction: securities and investment contracts

The SEC regulates securities: stocks, bonds, notes, investment contracts, and securities-based swaps. For crypto, this means:

Investment contracts involving crypto: Tokens sold via ICO, staking-as-a-service, crypto lending products (if structured as securities)
Crypto exchanges trading securities: Platforms offering unregistered securities must register as exchanges, broker-dealers, or alternative trading systems (ATSs)
Disclosure and fraud: The SEC enforces disclosure rules and anti-fraud provisions, even for assets that aren’t securities if fraud is involved

Registration requirements

If a crypto asset is a security, issuers must register the offering with the SEC (via Form S-1 or claim an exemption like Reg D or Reg A+). Exchanges listing securities must register as national securities exchanges or ATSs. Broker-dealers facilitating trades must register and comply with capital, custody, and reporting requirements.

CFTC jurisdiction: commodities and derivatives

The CFTC regulates commodities (physical goods like oil, gold, wheat) and virtual currencies like Bitcoin and Ethereum (officially designated as commodities since 2015). It also regulates derivatives: futures, options, and swaps based on commodities.

The CFTC has anti-fraud authority over retail commodity markets, even spot trades, but only for commodities, not securities. It also oversees Designated Contract Markets (DCMs), CFTC-registered futures exchanges like CME and Coinbase Derivatives.

Bitcoin and Ethereum are commodities

The CFTC has consistently treated Bitcoin and Ethereum as commodities. In March 2014, the CFTC first acknowledged Bitcoin could be regulated as a commodity. Since 2015, its official position has been that Bitcoin is a commodity under the Commodity Exchange Act (CEA). A July 2024 federal court confirmed Bitcoin and Ethereum are commodities within CFTC jurisdiction. In December 2025, the CFTC issued guidance allowing Bitcoin, Ethereum, and USDC as collateral in derivatives markets.

Spot crypto trading on CFTC exchanges

In August 2025, the CFTC’s “Crypto Sprint” announced plans to allow spot cryptocurrency trading on CFTC-registered futures exchanges (DCMs) for the first time. Previously, DCMs could only list futures and derivatives. This move aims to provide federal oversight of spot crypto markets without SEC registration, for commodities only.

In December 2025, the CFTC permitted listing of perpetual futures on BTC and ETH, a regulatory milestone. Coinbase Derivatives self-certified compliance and began offering these products.

CFTC vs. SEC: the jurisdictional line

If it’s a commodity (Bitcoin, Ethereum), the CFTC regulates derivatives and spot trading on DCMs. If it’s a security (most ICO tokens), the SEC regulates all sales, exchanges, and derivatives. If it’s both (security-based swap on a commodity), joint SEC/CFTC jurisdiction applies.

The Project Crypto initiative (January 2026) aims to harmonize this boundary and eliminate duplicative compliance.

FinCEN jurisdiction: anti-money laundering and money services businesses

The Financial Crimes Enforcement Network (FinCEN), part of the Treasury Department, enforces the Bank Secrecy Act (BSA) and anti-money laundering (AML) rules. FinCEN does not regulate whether an asset is a security or commodity. It regulates who transmits value.

Key definitions

FinCEN defines virtual currency as a “medium of exchange that operates like a currency in some environments, but does not have all the attributes of real currency.” Any business that transmits money or virtual currency must register with FinCEN as a Money Services Business (MSB), unless exempted.

Who must register as an MSB

Administrators and exchangers of virtual currency must register. This includes crypto exchanges (Coinbase, Kraken, Binance.US), payment processors accepting crypto, and DeFi protocols with centralized control (contested; FinCEN has hinted but not finalized rules).

Users of virtual currency (people who buy and hold crypto) are not MSBs.

AML obligations for MSBs

MSBs must implement a Customer Identification Program (KYC) to verify customer identities, file Suspicious Activity Reports (SARs) for suspicious transactions, file Currency Transaction Reports (CTRs) for cash transactions over $10,000, and comply with the Travel Rule (sharing sender/receiver info for transactions over $3,000). Under the GENIUS Act (signed into law in 2025), FinCEN is updating this for crypto.

Exemptions

Banks (regulated by the OCC), SEC-registered entities (broker-dealers, exchanges), and CFTC-registered entities (DCMs, swap dealers) are exempt from MSB registration.

OCC jurisdiction: banks and custody services

The Office of the Comptroller of the Currency (OCC) charters and supervises national banks and federal savings associations. It does not regulate crypto assets directly, but it regulates banks that custody or transact in crypto.

OCC guidance on crypto

In July 2020, the OCC confirmed national banks may provide cryptocurrency custody services for customers, treating crypto keys like traditional custody assets. In September 2020, the OCC clarified banks may hold stablecoin reserves for issuers. In January 2021, the OCC stated banks may use blockchains and stablecoins for payment activities and participate as nodes in blockchain networks. In 2025-2026, the OCC updated guidance to confirm banks may act as agents to execute and settle digital asset trades for customers, when done safely.

Bank charters vs. crypto licenses

National banks with OCC charters can offer crypto services without separate state money transmitter licenses or FinCEN MSB registration (banks are exempt). This is why some crypto firms (Anchorage, Paxos, Protego) pursued OCC bank charters instead of state-by-state licensing.

However, obtaining an OCC charter is expensive and requires meeting strict capital, governance, and risk management standards.

State-level regulation: money transmitter licenses and BitLicense

Most US states require money transmitter licenses for businesses that transmit fiat currency or virtual currency on behalf of customers. This includes crypto exchanges, payment apps, and wallet services.

Each state has its own requirements: capital reserves (varies by state), surety bonds, compliance officers, AML programs, and audits and reporting. Federal MSB registration (FinCEN) does not exempt you from state licensing. You need both.

New York BitLicense

New York’s BitLicense (established 2014) is the most stringent state-level crypto regulation in the US. It requires a separate license from the money transmitter license (though both are issued by the NY Department of Financial Services), capital reserves, cybersecurity standards, consumer protection rules, and approval for each coin/token listed.

As of 2025, 40+ companies hold BitLicenses, including Coinbase, Gemini, Kraken, Circle, and MoonPay. Many smaller firms avoid New York entirely due to compliance costs.

California DFAL (effective July 2026)

California’s new Digital Financial Assets Law (DFAL) takes effect in July 2026, requiring licensing for crypto businesses operating in California. This will be the second major state-level crypto licensing regime after New York.

Project Crypto: SEC-CFTC coordination

Project Crypto was initially launched by the SEC under Atkins in August 2025 as an internal initiative to modernize digital asset oversight. On January 29-30, 2026, it became a joint SEC-CFTC initiative, announced at a joint regulatory forum.

Goals

The initiative aims to:

Define which assets are securities, commodities, or both
Clarify jurisdictional lines and reduce overlap
Remove duplicative compliance requirements
Support congressional legislation

Key statements

SEC Chair Paul Atkins (January 29, 2026): “There is no one that I would rather have at the helm of the CFTC as our markets move on-chain. And that is why I am so pleased that Project Crypto will now proceed as a joint initiative between our two agencies.”

CFTC Chair Michael Selig (January 30, 2026): “Coordination and harmonization between the CFTC and SEC will advance a clear crypto asset taxonomy, clarify jurisdictional lines, remove duplicative compliance requirements, and reduce regulatory fragmentation.”

Both agencies are pushing for bipartisan legislation in 2026 to formalize crypto market structure.

Practical examples: which agency regulates what?

Scenario	Agency	Reason
Bitcoin spot trading on Coinbase	CFTC (for commodity oversight), FinCEN (for AML/KYC)	Bitcoin is a commodity; exchanges are MSBs
Buying an ICO token promising future platform revenue	SEC	Likely an investment contract (Howey test satisfied)
Trading Bitcoin futures on CME	CFTC	Futures on commodities are CFTC-regulated
Staking ETH on Coinbase (if centralized staking returns)	SEC	Kraken precedent: staking-as-a-service = investment contract
Running a Bitcoin mining operation	None (federal level)	Mining is not securities issuance or money transmission
Offering USDC stablecoin to customers	FinCEN (for AML), State MTLs (if transmitting value), potentially OCC (if issuer is a bank)	Not a security (if purely fiat-backed), but money transmission rules apply
Custodying Bitcoin for institutional clients (bank)	OCC	Banks are OCC-regulated; crypto custody is permissible
Listing a new token on a DEX with no central team	Unclear	If sufficiently decentralized, may not be a security; if team is involved in ongoing development/marketing, likely SEC jurisdiction
Running a crypto exchange in New York	NY DFS (BitLicense), FinCEN (MSB), SEC (if listing securities), CFTC (if listing commodity derivatives)	Multi-agency coordination required

Key takeaways

The Howey test is the SEC’s playbook. Four prongs: investment of money, common enterprise, expectation of profits, derived from others’ efforts. If all are met, it’s a security.

Bitcoin and Ethereum are commodities. The CFTC regulates derivatives and spot trading on DCMs. The SEC does not claim jurisdiction over spot BTC/ETH (unless sold as part of an investment contract scheme).

Most ICO tokens are securities. Marketing, team involvement, and promises of future value creation mean the Howey test is satisfied.

FinCEN regulates who transmits value, not what the value is. Crypto exchanges, wallets, and payment processors must register as MSBs and comply with AML/KYC rules.

The OCC oversees banks. National banks can custody crypto, hold stablecoin reserves, and facilitate trades, but must meet strict safety and soundness standards.

State licensing is mandatory. Federal MSB registration does not exempt you from state money transmitter licenses. New York’s BitLicense is the most demanding.

Project Crypto is a framework, not a law. The SEC and CFTC are coordinating, but congressional legislation is needed for clear, durable rules.

Atkins shifted tone, not law. The Howey test still applies. The SEC is less enforcement-aggressive, but securities law remains the same.

Sources

Published March 2, 2026