How should regulators approach crypto oversight without stifling industry growth?

What a risk-based crypto rulebook should do

Crypto oversight works best when regulators define the activity they are supervising, then tailor obligations to the risk that activity creates. That means focusing more heavily on custody, operational resilience, conflicts, disclosures, and market abuse than on blanket product bans. A good regime should be understandable enough for firms to build against, but flexible enough to accommodate new structures and use cases.

That balance matters because crypto markets mix payment-like use, investment-like speculation, and infrastructure-like dependencies. If regulators regulate only for the worst-case abuse, they can freeze legitimate services. If they regulate too lightly, they leave consumers and market integrity exposed.

Why consistency matters more than volume

Growth is usually slowed less by regulation itself than by uncertainty. When firms face different interpretations across agencies or repeated changes in supervisory posture, they spend more on legal arbitrage, restructuring, and duplicative controls. Consistent expectations make it easier to launch products, price compliance, and explain obligations to counterparties and customers.

Regulators should therefore prefer plain rules, published supervisory priorities, and predictable enforcement thresholds. Clear expectations do not remove judgment, but they reduce the space where only the best-resourced firms can operate safely. That is especially important in markets where trust, custody, and settlement risk can move quickly across platforms and jurisdictions.

How cross-border coordination supports both safety and growth

Crypto is inherently cross-border, so fragmented rules often create the very risks regulators are trying to avoid. Firms may route activity through weaker jurisdictions, users may encounter inconsistent protections, and supervisors may lose sight of where risk is actually being concentrated. A more convergent approach helps close regulatory gaps without forcing every jurisdiction to copy the same legal model.

For that reason, regulators should coordinate on baseline standards for disclosures, governance, custody, and incident handling, while still leaving room for local market structure and policy choices. Cross-border convergence is not about uniformity for its own sake, it is about making oversight portable enough that legitimate firms can scale without rebuilding compliance for every border they cross.

Risk and Threat Considerations

Overly rigid oversight can push activity into unregulated venues, while overly loose oversight can normalise leverage, opacity, and weak custody practices. The practical risk is not just non-compliance, but migration of activity to places where consumers, counterparties, and supervisors have less visibility into who controls assets and how failures are contained.

Failure mechanism: Fragmented or poorly calibrated rules create regulatory arbitrage, inconsistent controls, and supervisory blind spots. Firms and users then route activity toward the easiest regime, not the safest one, which can concentrate loss, fraud, and operational failure in less visible parts of the market.

Impact: The result is weaker consumer protection, higher systemic exposure, and more difficulty sustaining responsible innovation at scale. Markets may still grow, but they do so in a less orderly way, with more breakdowns, more disputes over responsibility, and greater pressure for abrupt intervention later.

Practitioner Guidance

What to prioritise: Start with the highest-risk functions, custody, leverage, settlement, disclosures, and operational resilience, rather than trying to regulate every token or use case the same way. That is where a rulebook most directly affects loss containment and market confidence.

What to verify: Test whether the regime produces the same supervisory expectation for the same risk, regardless of firm size or jurisdiction. If firms cannot explain the rules to a compliance team in plain language, the regime is probably too ambiguous to scale well.

Decision rule: If a proposal increases safety only by making legitimate activity harder to offer, tighten it; if it increases clarity, comparability, and resilience without excluding lawful competition, it is more likely to support growth.

Practitioner takeaway: The best crypto oversight is not lighter oversight, it is sharper oversight, meaning clear guardrails, risk-based scope, and enough consistency that compliant firms can build durable businesses instead of navigating uncertainty.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.