Crypto adoption is broadening, but governance still lags

At a glance

What this is: Chainalysis shows crypto adoption broadening across regions and user types, with India first, the United States second, and APAC growing fastest.

Why it matters: For IAM, fraud, and governance teams, the signal is that crypto activity is becoming more mainstream while the control problem shifts to access, identity, and transaction oversight.

By the numbers:

• APAC emerged as the fastest-growing region for on-chain crypto activity, with a 69% year-over-year increase in value received.
• APAC crypto transaction volume grew from $1.4 trillion to $2.36 trillion in the 12 months ending June 2025.
• USDT routinely processed roughly $703 billion per month between June 2024 and June 2025, peaking at $1.01 trillion in June 2025.

Context

The governance challenge in crypto is no longer whether adoption exists, but whether institutions can control identity, access, and transaction risk as participation widens. The report shows a market that is moving from niche usage toward mainstream financial and cross-border activity, which makes oversight models built for smaller, less diverse user populations less reliable.

Methodology matters here because the index now includes institutional activity above $1 million and no longer treats retail DeFi as a standalone category. That adjustment reflects a broader market shift toward both retail and institutional rails, meaning security, compliance, and monitoring teams have to think in terms of who is transacting, on what rails, and under what governance assumptions.

Key questions

Q: How should organisations govern crypto activity when adoption spans retail and institutional users?

A: They should segment controls by user type, transaction size, and custody model rather than applying one policy across all activity. Retail flows need strong authentication and fraud monitoring, while institutional flows need approval, segregation of duties, auditability, and clear ownership for exception handling. The governance model should follow the rail, not the asset class.

Q: Why does adding institutional crypto activity change the compliance model?

A: Because institutional transfers are tied to different obligations, different failure modes, and different accountability expectations than consumer transactions. Once large-value transfers are included, governance has to cover custody, delegated authority, approval integrity, and reconciliation, not only user onboarding and wallet screening. That widens the control surface materially.

Q: Where do crypto governance models fail in practice?

A: They fail when teams treat all digital asset activity as one category and miss the differences between retail use, DeFi participation, institutional settlement, and cross-border value transfer. That leads to mismatched thresholds, weak exception handling, and controls that either over-block legitimate activity or under-protect high-risk flows.

Q: When should security teams treat stablecoin rails like payment infrastructure?

A: They should do so whenever stablecoins are used for settlement, remittance, treasury movement, or exchange funding at meaningful scale. In those cases, wallet identity, sanctions screening, transaction tracing, and approval governance matter as much as traditional payment controls. The operational question is not whether the token is a stablecoin, but how the rail is being used.

Technical breakdown

How the Global Crypto Adoption Index weights usage and scale

The index combines four sub-indices and ranks 151 countries with sufficient data before normalizing results to a 0 to 1 scale. It uses web traffic patterns to estimate transaction volumes across cryptocurrency services and protocols, then weights those rankings by population size and purchasing power so the result reflects relative adoption, not raw volume alone. The methodology is intentionally designed to distinguish broad participation from concentrated activity, which is why the report can produce very different results depending on whether it is adjusted by GDP per capita or population.

Practical implication: Practitioners should treat adoption indices as governance signals, not just market rankings, because weighting choices change where oversight pressure will emerge first.

Why the new institutional sub-index changes the control picture

The new institutional sub-index counts on-chain value received by large-scale entities and smart contract addresses estimated to belong to professional investors, custodians, hedge funds, and similar actors when transfers exceed $1 million. That means the report is no longer measuring only grassroots participation. It is now also capturing the operational footprint of larger entities whose access models, custody controls, and transaction approval processes are materially different from retail users, making identity assurance and transaction governance more central to the interpretation.

Practical implication: Teams that support institutional crypto flows should align approval, custody, and audit controls to the transaction size and entity type being processed.

Why retail DeFi no longer belongs in a standalone adoption signal

Removing retail DeFi as a separate sub-index reflects a measurement judgment that high-volume, low-frequency behaviour can overstate everyday adoption if it is treated like a primary category. The report argues that DeFi remains important globally, but it represents a narrower slice of user activity than centralized services. That is a useful reminder for control owners: a market can look large in volume terms while still being operationally concentrated in a small set of usage patterns, which changes how representative the risk signal really is.

Practical implication: Governance teams should avoid using a single activity class as a proxy for the whole market when they decide where monitoring and policy effort belongs.

NHI Mgmt Group analysis

Crypto governance is now an identity problem as much as a market adoption problem. The report shows that usage is broadening across retail and institutional channels, which means the control challenge shifts from spotting isolated crypto activity to governing who is transacting, under what identity assurance, and through which delegated rails. In practice, that makes access governance and transaction governance inseparable for firms that touch crypto flows.

Method changes matter because they reshape what the market is telling security teams. By removing retail DeFi as a standalone category and adding institutional flows above $1 million, Chainalysis has moved the index closer to the way modern governance teams need to think about crypto. The signal is not simply growth, but diversification of actor types and control surfaces, which means one-size-fits-all oversight models will miss material risk.

Country rankings should be read as governance pressure indicators, not just adoption headlines. India, the United States, and APAC’s regional acceleration point to growing mainstream use, while population-adjusted rankings show how differently adoption manifests across countries. That split matters because control design should follow the use case, not the headline rank, especially where cross-border payments, custody, and regulated institutional activity overlap.

Stablecoin infrastructure is becoming part of the broader identity and transaction governance landscape. The dominance of USDT and USDC in the report shows that stablecoin rails are now operational infrastructure, not a side channel. That increases the importance of sanctioned-entity screening, wallet attribution, and transaction monitoring, because the governance failure is no longer limited to exchange access but extends into payment-like settlement behaviour.

Crypto adoption is no longer confined to the edges of the financial system. As more institutions, custodians, and end users operate through the same rail families, the compliance and IAM questions converge. The practical implication is straightforward: treat crypto governance as a control domain that spans identity verification, privileged approval, and transaction oversight rather than as a niche product or regional issue.

What this signals

Adoption breadth changes the control problem. When crypto participation expands across retail, institutional, and cross-border use cases, governance teams have to stop thinking in terms of a single crypto policy and start thinking in terms of actor-specific control layers. The operational implication is that identity assurance, transaction approval, and monitoring should be designed together, not as separate workstreams.

Stablecoin usage is now part of mainstream financial governance. The report’s treatment of stablecoins as a core infrastructure layer means compliance teams should expect wallet attribution, sanctions screening, and transaction monitoring to become more like payment controls than niche crypto controls. That is especially true where stablecoins are used for treasury, settlement, or remittance functions rather than speculation.

For practitioners

• Map crypto workflows by actor type Separate retail, institutional, custodial, and delegated service activity in your control inventory so approval, monitoring, and escalation paths match the risk profile of each flow.
• Reassess transaction approval thresholds Set different review, step-up, and exception thresholds for low-value consumer activity and high-value institutional transfers, especially where smart contract or custody operations are involved.
• Tighten identity assurance for high-value rails Require stronger identity proofing and authorization checks where crypto activity crosses regulated thresholds or involves outsourced custody and payment functions.
• Review stablecoin monitoring coverage Expand transaction surveillance to cover stablecoin settlement patterns, wallet attribution, and cross-border flows that may function like payment infrastructure rather than speculative trading.

Key takeaways

• Crypto adoption is broadening, but the governance model must now distinguish between retail use, institutional flows, and cross-border payment behaviour.
• The methodology change to include institutional transfers above $1 million shows how much the market has shifted toward mainstream financial participation.
• Security and compliance teams need actor-based controls, stronger transaction governance, and better wallet oversight as crypto becomes operational infrastructure.

Key terms

• Crypto adoption index: A crypto adoption index measures how widely cryptocurrency is used across countries or regions, usually by combining transaction activity, service usage, and demographic weighting. In this report, the index is designed to reflect grassroots participation rather than just raw trading volume, which makes methodology choices central to interpretation.
• Institutional activity sub-index: An institutional activity sub-index estimates large-scale cryptocurrency usage by professional investors, custodians, and other entities moving high-value transactions. It is useful because institutional flows behave differently from retail behaviour, and they create different governance, access, and monitoring requirements for security and compliance teams.
• Centralized Services: Cryptocurrency platforms that intermediate transactions, custody, or exchange activity rather than allowing users to transact entirely peer to peer. In adoption studies, they often serve as a proxy for how much activity is flowing through managed market infrastructure.
• Stablecoin Rail: A stablecoin rail is the payment infrastructure used to move value using tokenised assets rather than traditional card or bank settlement. In governance terms, it shifts control from intermediary-heavy processing to wallet, key, and policy management, which creates a stronger need for privileged access oversight.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners align identity controls with modern access and delegation models across complex environments.