Notifications
Clear all
Topic starter
04/07/2026 10:16 pm
TL;DR: US crypto regulation now spans FinCEN registration, SEC and CFTC oversight, OFAC screening, and state licensing, while the GENIUS Act adds stablecoin-specific rules and the CLARITY Act could further reshape digital asset oversight, according to Sumsub. The core issue is fragmented compliance architecture, where federal and state obligations can diverge even when a business appears compliant on one side.
NHIMG editorial — based on content published by Sumsub: US crypto regulations in 2026, covering federal and state rules
By the numbers:
- Stablecoin usage has surged, with total supply reaching USD 208 billion in 2025, a 28% increase on the previous year.
- DeFi total value locked stood at roughly $72 billion in mid-June 2026, down from about $114 billion at the start of the year.
- The GENIUS Act takes effect 18 months after enactment, or 120 days after final regulations are issued, whichever comes first.
Questions worth separating out
Q: How should crypto teams align identity controls with federal and state regulation?
A: They should map every regulated workflow to the identities that can approve, execute, or override it, then tie those identities to the relevant federal and state obligations.
Q: When does crypto compliance become an access governance problem?
A: It becomes an access governance problem when regulated activity depends on who can operate wallets, verify customers, screen counterparties, or approve transactions.
Q: What breaks when state licensing is treated separately from IAM?
A: What breaks is the connection between legal scope and operational scope.
Practitioner guidance
- Map regulated actions to identity owners Create a control inventory that links customer onboarding, transfer approval, sanctions screening, and custody operations to named human and non-human identities.
- Separate federal and state operating scopes Build a jurisdiction matrix that ties each state licence requirement to the product functions, approval roles, and technical systems allowed to operate there.
- Bind approval rights to geographic authority Restrict production access, transfer limits, and admin privileges so only identities authorised for a given state or asset workflow can execute it.
What's in the full article
Sumsub's full article covers the operational detail this post intentionally leaves for the source:
- Federal agency-by-agency breakdown of which activities trigger FinCEN, SEC, CFTC, OFAC, and IRS obligations
- State licensing examples that matter for implementation teams, including New York, California, Connecticut, and Colorado
- Stablecoin issuance requirements and the compliance implications of monthly reserve disclosure
- DeFi-specific treatment of intermediary responsibility, front-end exposure, and reporting obligations
👉 Read Sumsub's guide to US crypto regulation, stablecoins, and state licensing →
US crypto regulation is changing fast. What should teams prepare for?
Explore further
04/07/2026 10:19 pm
Fragmented crypto regulation is also an identity governance problem. The article treats compliance as a legal mapping exercise, but the operating reality is that regulated actions are performed by specific human and machine identities. If access to customer verification, transfer approval, sanctions screening, and wallet custody is not aligned to the applicable regime, compliance becomes a role design issue rather than a policy issue. Practitioners should treat regulatory scope as an access model.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who should own compliance controls in a crypto business?
A: Ownership should be shared across legal, compliance, security, and platform teams, but the control evidence should sit in the identity layer. Each regulated process needs a named owner, an approval path, and a review cycle. If no identity can be held accountable for the action, the control is not operationally complete.
👉 Read our full editorial: US crypto regulation in 2026 is splitting federal and state control
