Regulating operators means licensing and supervising the businesses that provide exchange, custody, or brokerage services. Regulating the public means trying to control every individual’s trading choice directly. In practice, most jurisdictions focus on operators because that is where consumer protection, disclosure, custody, and enforcement are most feasible. Public activity still carries risk outside the local jurisdiction.
Why regulators usually focus on operators, not every trader
The key difference is leverage. Regulating operators targets the firms that hold customer assets, route transactions, set account controls, and can be licensed, inspected, or sanctioned. Regulating the public would try to influence millions of individual decisions directly, which is harder to observe, harder to enforce, and much less effective when activity crosses borders or platforms.
That is why operator regulation usually becomes the practical center of gravity in crypto supervision. It allows authorities to require disclosures, segregation of assets, custody standards, recordkeeping, and complaint handling at the point where failures are most concentrated. Public-facing rules still matter, but they are usually narrower and rely more on market conduct, fraud, and consumer-protection law than on direct permissioning.
For the operator side of the picture, the strongest control model is a supervised intermediary rather than a fully decentralized retail population. That distinction also explains why NIST Cybersecurity Framework 2.0 is often a better governance lens than trying to treat individual traders as the primary control surface: the meaningful obligations sit with the entity that can actually be governed, monitored, and held accountable. Where custody and asset-handling are central, PCI DSS v4.0 is a useful comparator for how regulated intermediaries are expected to protect sensitive value-bearing environments.
What changes when the public is outside your enforcement perimeter
Once the public is the focus, the regulator loses many of the tools that make supervision effective. Individuals can self-custody, use offshore venues, move between apps, or trade through intermediaries outside the local jurisdiction. That means the practical job shifts from direct control to consumer warning, disclosure, anti-fraud enforcement, and cross-border coordination.
This also changes the risk profile. When activity is dispersed across many small actors, harmful conduct is easier to hide and harder to remediate. Misleading promotions, high-risk leverage, and weak platform controls can still affect the public even if the local authority has no direct control over each transaction. The result is a gap between formal legal scope and real-world market exposure.
Operator-focused oversight also improves enforcement timing. A regulator can stop a business, demand records, or require remediation far faster than it can influence scattered retail behavior. That is the same reason supervised custody models tend to be preferred over “regulate every user” approaches: the control point is observable, auditable, and capable of remediation. For a parallel lens on custody and control boundaries, ISO/IEC 27001:2022 Information Security Management frames how accountable entities should govern sensitive operations, while NIST Privacy Framework is useful when retail data handling and disclosure practices are part of the supervision problem.
Practitioner guidance for drawing the line
What to prioritise: Define the regulated object first. If a business controls custody, execution, brokerage, onboarding, or disclosures, treat it as the primary supervisory target; if the activity is purely individual and dispersed, rely more on conduct rules, fraud controls, and cross-border cooperation than on direct permissioning.
What to verify: Check whether the framework actually reaches the choke points that create harm, such as custody segregation, conflicts of interest, record retention, complaint handling, and asset recovery. If those are outside your reach, the regime is probably pointed at the wrong layer.
Practitioner takeaway: Crypto regulation is most effective when it targets the entity that can be licensed, audited, and sanctioned, because that is where consumer protection and enforcement are structurally achievable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 set the technical controls, while PCI DSS v4.0 and ISO/IEC 42001:2023 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV — Govern | Focuses governance on accountable crypto operators rather than dispersed traders. |
| PR.AA — Identity Management, Authentication, and Access Control | Applies where exchanges and custodians must control customer access and account authority. | |
| PR.DS — Data Security | Supports custody, disclosure, and protection of sensitive transaction and customer data. | |
| Recommendation — Assign supervisory duties to the regulated operator and monitor control effectiveness over time. Enforce access controls and authentication across customer and administrative crypto systems. Protect customer and custody data with segmentation, encryption, and retention controls. | ||
| PCI DSS v4.0 | 0 — Protect Cardholder Data Environment | Provides an operator-centric model for securing regulated value-handling environments. |
| Recommendation — Apply operator-level security controls to the systems that store, process, or transmit value. | ||
| ISO/IEC 42001:2023 | 0 — AI Management System | Not selected |
Related resources from NHI Mgmt Group
- What is the difference between attack surface management and NHI governance?
- What is the difference between reviewing human access and reviewing NHIs?
- What is the difference between role-based access and API key governance for NHI security?
- What is the difference between human IAM controls and NHI governance?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
