🔒 CRYPTOLAW INSIDER — PREMIUM CHECKLIST

Crypto Exchange Compliance Checklist 2026: US Federal Regulatory Requirements

Version: v2026.08 | Last Updated: August 2026

1 min read

[cryptolaw_insider_only]

Crypto Exchange Compliance Checklist 2026: US Federal Regulatory Requirements

Version: v2026.08 | Last Updated: August 2026

Jurisdiction: US Federal

This checklist is a working compliance instrument for operators of centralized cryptocurrency trading platforms, brokerage services, and custodial wallet businesses that serve United States persons. It is written for three readers: the founder or general counsel scoping a US launch, the BSA/AML officer building or auditing an existing program, and the outside attorney conducting a regulatory readiness review before a licensing application, financing, or examination.

US crypto exchange compliance is not governed by a single statute or a single regulator. A platform that takes custody of customer assets and matches orders can simultaneously be a money services business under the Bank Secrecy Act, an unregistered securities exchange or broker-dealer under the Securities Exchange Act of 1934, a futures commission merchant or designated contract market under the Commodity Exchange Act, a “broker” for IRS information-reporting purposes, and a money transmitter under the laws of 45+ states. These characterizations are independent and cumulative, and they do not resolve in the same direction. A token that is a security for Securities Act purposes may be a commodity for CFTC anti-fraud purposes and “convertible virtual currency” for FinCEN purposes — all at once, with no election available.

How to read this checklist

Every item carries three signals:

Phase tag — each item begins with [Pre-launch], [Pre-launch + Ongoing], [Ongoing], [Annual], or [Event-driven]. Work the pre-launch items in order before accepting a single US customer; calendar the recurring ones using the compliance calendar in the summary section.
Attorney review flag — items marked 🔍 involve legal characterization questions where a wrong answer creates criminal or strict-liability exposure. These are not items a compliance team should resolve internally.
Certainty marker — where an item’s legal basis is genuinely open, its note begins with UNSETTLED. Items without that marker rest on settled statutory or regulatory text. Do not treat the two categories the same way: settled items are audit findings waiting to happen; unsettled items are risk-allocation decisions requiring documented reasoning.

Scope

This document covers federal obligations only. State money transmitter licensing, the New York BitLicense (23 NYCRR Part 200), the NYDFS cybersecurity regulation (23 NYCRR Part 500), and state securities registration are referenced in jurisdiction notes but are not scoped here — see the companion state-by-state guide. Federal compliance without state licensing is not compliance; it is a federal felony predicate under 18 U.S.C. § 1960(b)(1)(A).

Legal environment note (August 2026)

Federal digital asset law remains in transition. The GENIUS Act (Pub. L. No. 119-27, enacted July 18, 2025) established a federal payment stablecoin regime with a phased implementation timeline; comprehensive market structure legislation has been under active congressional consideration. Separately, federal enforcement posture toward digital assets shifted materially during 2025 — but posture is not law. Agency discretion does not bind private plaintiffs, state securities regulators, or state attorneys general; it does not toll limitations periods; and it can reverse with an administration. Build to the statute, not to the current enforcement appetite. Verify the current status of every item in Sections 6 and 8, and every item marked UNSETTLED, before relying on it.

Disclaimer: This content is for educational purposes only and does not constitute legal advice. Using this checklist does not create an attorney-client relationship. Cryptocurrency regulation changes rapidly — consult a qualified attorney for advice specific to your situation. Seth Goettelman is licensed in Wisconsin and Florida.

Before You Begin

Prerequisites

A formed US legal entity, or a documented decision to operate through a foreign entity together with counsel’s written analysis of whether that structure avoids or merely relocates US obligations. It usually does not, and an offshore structure adopted after US exposure is identified can support an inference of intent to evade.
A complete written inventory of every product line: spot trading, custody, staking, lending, margin, derivatives, fiat on/off ramps, OTC desk, payment processing, launchpad, and token listing services. Regulatory characterization is product-by-product, not entity-wide.
A written list of every asset listed or planned for listing, with the issuer identity, distribution history, and any promotional, profit-sharing, or price-appreciation representations made by the issuer or by the platform.
A documented geographic scope: which US states will be served, whether US persons abroad will be served, and whether non-US customers accessing the platform from within the US will be accepted.
A named BSA/AML Compliance Officer with documented authority, seniority, budget, and board access — a specific individual, not a committee, a title, or a vendor.
A transaction monitoring and blockchain analytics vendor selection, or a documented plan and timeline. Several items below cannot be satisfied manually at any meaningful volume.
A compliance review gate in the product development process, with a hard stop held by the compliance officer, established before engineering begins on any new product.
Financial capacity to fund surety bonds, minimum net worth requirements, independent testing, and annual audit as recurring operating costs, not one-time launch costs.

Documents & Information Needed

Certificate of formation, operating agreement or bylaws, and a current organizational chart showing all affiliates, subsidiaries, and ultimate beneficial owners.
Employer Identification Number (EIN) and every d/b/a name used in any state.
Complete list of owners holding 25% or more of equity and all officers, directors, and control persons, with dates of birth, SSNs/ITINs, and residential addresses (required for federal registration and substantially all state license applications).
Draft or existing written AML/CFT program, including the enterprise risk assessment, customer identification procedures, monitoring scenarios, and escalation matrix.
OFAC sanctions compliance policy, screening procedures, fuzzy-matching threshold documentation, and vendor documentation for the screening and analytics tools in use.
Terms of service, customer agreement, privacy policy, fee schedule, and any custody or account control agreements — reviewed by bankruptcy counsel, not only regulatory counsel.
Token listing policy and the completed, dated legal analysis memorandum for each listed asset.
Information security program documentation, penetration test results, key management and cold storage policies, and a tested incident response plan.
Prior independent AML testing reports, examination correspondence, and any regulator inquiries, subpoenas, consent orders, or memoranda of understanding.
Audited or reviewed financial statements and a documented proof-of-reserves or customer-asset reconciliation methodology.
A regulatory characterization register: one row per product and per listed asset, showing the determination, the date, the reviewing attorney, and the refresh trigger.

Areas Requiring Attorney Review

Whether each listed or supported asset is an investment contract or other security under SEC v. W.J. Howey Co. and its progeny — the highest-consequence determination on this checklist.
Whether the platform’s order matching meets the Exchange Act definition of an ‘exchange’ under Rule 3b-16, and whether Regulation ATS or national securities exchange registration is required.
Whether any activity constitutes acting as a ‘broker’ or ‘dealer’ requiring Section 15(a) registration and FINRA membership.
Whether margin, leveraged, or financed retail transactions trigger CFTC jurisdiction under CEA § 2(c)(2)(D), and whether ‘actual delivery’ within 28 days is genuinely satisfied.
Whether the entity is a money transmitter under 31 CFR § 1010.100(ff)(5) or within an exemption, and whether any exemption theory survives FinCEN’s 2019 CVC guidance.
Criminal exposure under 18 U.S.C. § 1960, including the state-licensing prong, which requires no proof the operator knew a license was required.
Whether the entity is a ‘broker’ required to file Forms 1099-DA under 26 U.S.C. § 6045 and the digital asset broker regulations, and its backup withholding exposure.
Whether any stablecoin issued, distributed, or accepted in settlement falls within the federal payment stablecoin regime and its implementation timeline.
Whether customer agreement language places customer assets outside the bankruptcy estate, analyzed by bankruptcy counsel.
Cross-border structuring, including whether a non-US entity’s US-facing activity triggers registration and whether any territorial limitation is genuinely available.
Privilege structuring for the risk assessment, internal investigations, forensic engagements, and any remediation or lookback project.

1. Regulatory Status Determination and Entity Structuring

Every downstream obligation flows from characterization. Before registering anything, determine which regulatory identities the business actually carries — you will likely carry several simultaneously. This is not a paperwork exercise: operating an unlicensed money transmitting business is a federal felony under 18 U.S.C. § 1960, and the statute expressly dispenses with any requirement that the government prove the operator knew a state license was required. Document each determination in a written, dated memorandum. The absence of a contemporaneous analysis is itself an examination finding, and it eliminates the good-faith argument that most materially affects penalty calculation.

☐
[Pre-launch] Prepare a written legal memorandum determining whether the entity accepts and transmits ‘convertible virtual currency’ and therefore meets the definition of a money transmitter, analyzing each product line separately rather than the entity as a whole.
(31 CFR § 1010.100(ff)(5); FinCEN Guidance FIN-2019-G001 (May 9, 2019)) 🔍 Attorney Review Required The federal MSB analysis is independent of every state money transmitter analysis. An entity can be a federal MSB but exempt in a given state, or exempt federally and licensable in a state.
☐
[Pre-launch] Analyze and document any claimed exemption — payment processor, integral-to-another-transaction, or unhosted wallet software provider — and confirm the theory survives FinCEN’s 2019 CVC guidance rather than relying on pre-2019 authority.
(31 CFR § 1010.100(ff)(5)(ii); FIN-2019-G001 §§ 4.2–4.5) 🔍 Attorney Review Required The payment processor exemption requires all four prongs, including a formal agreement with the seller. Partial satisfaction is not partial exemption.
☐
[Pre-launch + Ongoing] Apply the Howey investment-contract test to each listed and prospective asset, documenting investment of money, common enterprise, expectation of profits, and derivation of profits from the efforts of others; retain the memoranda under privilege.
(SEC v. W.J. Howey Co., 328 U.S. 293 (1946)) 🔍 Attorney Review Required State blue sky laws apply their own tests. Several states follow the broader risk-capital test, under which an asset that clears Howey may still be a security.
☐
[Pre-launch] Determine whether the platform brings together the orders of multiple buyers and sellers using established non-discretionary methods, such that it meets the functional definition of an ‘exchange.’
(17 CFR § 240.3b-16; 15 U.S.C. § 78c(a)(1)) 🔍 Attorney Review Required
☐
[Pre-launch] Determine whether the entity is ‘engaged in the business of effecting transactions in securities for the account of others’ (broker) or buying and selling securities for its own account as part of a regular business (dealer).
(15 U.S.C. § 78c(a)(4)–(5); 15 U.S.C. § 78o(a)) 🔍 Attorney Review Required
☐
[Pre-launch] Determine whether any offered product involves retail commodity transactions on margin, leverage, or financing that are regulated as if they were futures absent actual delivery within 28 days.
(7 U.S.C. § 2(c)(2)(D); CFTC Final Interpretive Guidance, 85 Fed. Reg. 37734 (June 24, 2020)) 🔍 Attorney Review Required
☐
[Pre-launch] Assess whether the entity is a ‘broker’ required to report gross proceeds from customer digital asset sales, and whether any non-custodial carve-out applies to any product line.
(26 U.S.C. § 6045(c)(1); 26 CFR § 1.6045-1(a)(1) (T.D. 10000)) 🔍 Attorney Review Required
☐
[Pre-launch] Document the corporate structure decision — including whether securities, money transmission, and derivatives activity sit in distinct legal entities — and confirm that intercompany agreements, books, personnel, and customer-facing disclosure support the separation in substance.
(31 CFR § 1010.100(ff); 15 U.S.C. § 78o(a)) 🔍 Attorney Review Required Entity separation existing only on paper is routinely disregarded by the SEC and by state regulators. Shared personnel, shared bank accounts, and undifferentiated customer disclosure collapse the structure.
☐
[Ongoing] Maintain a regulatory characterization register with one row per product and per listed asset, recording the determination, determination date, reviewing attorney, and the events that trigger re-analysis.
(31 CFR § 1022.210(d)(1) (internal controls); 31 CFR § 1010.430 (recordkeeping))

Key Reference:
FinCEN Guidance FIN-2019-G001: Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies

2. FinCEN MSB Registration and Ongoing Filing Obligations

Federal MSB registration is a discrete, deadline-driven obligation that is frequently missed or allowed to lapse silently. Registration is a notice filing, not a license: it confers no approval, no safe harbor, and no representation that FinCEN has reviewed the business. What it does confer is examination authority. FinCEN delegates BSA examination authority for MSBs to the IRS Small Business/Self-Employed Division, so the first federal examiner at the door will typically hold an IRS credential. Note that federal registration and state licensing are separate and cumulative obligations; satisfying one does nothing whatsoever for the other.

☐
[Pre-launch] File FinCEN Form 107 (Registration of Money Services Business) by the end of the 180-day period beginning on the day following the date the business is established.
(31 CFR § 1022.380(b)(1)(i))
☐
[Event-driven] Calendar and file the renewal registration by December 31 of every second calendar year following the initial registration year. Registration is not perpetual and lapses without agency notice.
(31 CFR § 1022.380(b)(2))
☐
[Event-driven] File an amended Form 107 within 30 days of any change in ownership, control, or other information required on the registration form.
(31 CFR § 1022.380(b)(3))
☐
[Annual] Prepare and maintain a current agent list containing each agent’s name, address, type of service, gross transaction amount, and depository institution information, and update it annually by January 1.
(31 CFR § 1022.380(d))
☐
[Ongoing] Retain a copy of the filed registration, the estimate supporting any figures reported, and all supporting documentation at a US location for five years from the date of registration.
(31 CFR § 1022.380(c); 31 CFR § 1010.430)
☐
[Pre-launch] If the entity is organized under foreign law but does business in whole or substantial part within the United States, designate a person residing in the United States to accept service of legal process, and reflect that designation in the registration.
(31 CFR § 1010.100(ff); 31 CFR § 1022.380(a)) 🔍 Attorney Review Required Foreign-organized platforms serving US customers fall within the MSB definition. There is no exemption based on entity domicile alone.
☐
[Pre-launch + Annual] Confirm in writing that no principal owner, officer, or control person is subject to a statutory disqualification or pending enforcement matter requiring disclosure on federal or state applications, and refresh the confirmation annually.
(31 CFR § 1022.380; 18 U.S.C. § 1960) 🔍 Attorney Review Required Nondisclosure of a disqualifying event on a state MTL application is independently actionable and is among the most common bases for license denial or later revocation.
☐
[Pre-launch] Determine whether the entity has beneficial ownership information reporting obligations under the Corporate Transparency Act, and confirm the current scope of the domestic-company exemption before concluding no filing is required.
(31 U.S.C. § 5336; 31 CFR § 1010.380) 🔍 Attorney Review Required UNSETTLED — FinCEN issued an interim final rule in March 2025 narrowing the reporting population substantially, with different treatment for foreign-formed entities. Confirm the final rule’s current scope; do not rely on either the original 2024 framework or the interim rule without verification.

Key Reference:
FinCEN — Money Services Business Registration

3. AML/CFT Program Design, Governance, and Testing

An MSB must develop, implement, and maintain an effective written anti-money laundering program reasonably designed to prevent the business from being used to facilitate money laundering and terrorist financing. The regulation specifies four pillars — internal controls, a designated compliance officer, training, and independent testing — with customer due diligence functioning as a fifth in examination practice. The operative word is ‘effective.’ FinCEN and the IRS assess whether the program is calibrated to the risks the business actually presents, not whether a policy document exists. The most frequently cited failure pattern in this sector is a well-drafted policy paired with an unstaffed alert queue.

☐
[Pre-launch] Adopt a board-approved written AML/CFT program commensurate with the risks posed by the location, size, nature, and volume of services provided.
(31 U.S.C. § 5318(h); 31 CFR § 1022.210(a)–(b)) 🔍 Attorney Review Required
☐
[Pre-launch + Annual] Complete a documented enterprise-wide risk assessment covering customer types, geographies, products (including privacy-enhancing assets, mixing services, cross-chain bridges, and DeFi exposure), delivery channels, and volumes; refresh at least annually and upon any material product change.
(31 CFR § 1022.210(d)(1); FinCEN National AML/CFT Priorities (June 30, 2021)) Conduct the risk assessment under privilege where feasible. It is the single most useful document to an adverse party in any enforcement or civil matter.
☐
[Pre-launch] Designate in writing, by name, a compliance officer responsible for day-to-day coordination and monitoring of the program, with documented authority, a direct reporting line to senior management or the board, and adequate staffing.
(31 CFR § 1022.210(d)(2)) Individual liability for BSA officers is an established enforcement theory. Confirm that indemnification and D&O coverage expressly extend to the designated officer before the appointment is accepted.
☐
[Pre-launch] Implement written customer identification and verification procedures sufficient to form a reasonable belief as to the true identity of each customer, including documentary and non-documentary methods and a defined process for customers who cannot be verified.
(31 CFR § 1022.210(d)(1)(i); 31 U.S.C. § 5318(l)) 🔍 Attorney Review Required The formal CIP rule at 31 CFR § 1020.220 applies to banks, not MSBs. MSBs must nonetheless implement risk-based identity procedures as a component of required internal controls, and examiners apply substantively comparable expectations.
☐
[Pre-launch] Establish beneficial ownership identification procedures for legal entity customers, including documented ownership-prong and control-prong collection and a certification form retained with the account record.
(31 CFR § 1010.230) 🔍 Attorney Review Required UNSETTLED — the CDD Rule’s beneficial ownership requirement applies to ‘covered financial institutions’ as defined at 31 CFR § 1010.605(e)(1), a definition that does not by its terms include MSBs. Confirm current applicability and the status of AMLA 2020 implementing rulemaking with counsel. Adopting equivalent procedures voluntarily is the conservative course and is expected by most banking partners.
☐
[Ongoing] Define and implement enhanced due diligence triggers and procedures for high-risk customers, including politically exposed persons, high-volume traders, entity customers in high-risk jurisdictions, and counterparties with elevated blockchain analytics risk scores.
(31 CFR § 1022.210(d)(1); 31 U.S.C. § 5318(i))
☐
[Pre-launch + Ongoing] Deploy transaction monitoring covering both fiat and on-chain activity, with documented, tuned, and periodically validated detection scenarios and an auditable alert-to-disposition workflow carrying defined service-level timelines.
(31 CFR § 1022.210(d)(1); 31 CFR § 1022.320)
☐
[Annual] Conduct and document AML training for all personnel with customer-facing, operations, engineering, or compliance responsibilities, at onboarding and at least annually thereafter, with role-specific content and retained attendance records.
(31 CFR § 1022.210(d)(3)) Engineering and product personnel are routinely omitted from AML training and are routinely the people who build the control gaps. Include them.
☐
[Annual] Arrange independent testing by a qualified party who is neither the compliance officer nor reporting to that officer, on a risk-based frequency (annually is the examination expectation at any meaningful scale), and document management’s remediation of every finding with named owners and due dates.
(31 CFR § 1022.210(d)(4))
☐
[Pre-launch + Annual] Establish written procedures for responding to FinCEN Section 314(a) information requests and, if electing to participate, for 314(b) voluntary information sharing — including filing the required 314(b) notice and re-filing annually.
(31 CFR §§ 1010.520, 1010.540) 🔍 Attorney Review Required The 314(b) safe harbor protects sharing only if the notice is on file and current. Sharing outside the safe harbor can create privacy and contractual liability.

Key Reference:
31 CFR § 1022.210 — Anti-money laundering programs for money services businesses

4. BSA Reporting, Recordkeeping, and the Travel Rule

Reporting and recordkeeping are the operational core of BSA compliance and the most frequently penalized area in digital asset enforcement. Unlike program deficiencies, missed filings are countable: each unfiled SAR or CTR is a discrete violation, and civil penalties are assessed per violation. The Recordkeeping and Travel Rules present particular difficulty for crypto platforms because required originator and beneficiary information must accompany transmittals to counterparty institutions, and the interoperability infrastructure for doing so remains fragmented across competing protocols. Build the recordkeeping architecture before launch — retrofitting five-year retention and travel rule messaging onto a live production system is materially harder and forces a period of operating out of compliance.

☐
[Ongoing] File a Suspicious Activity Report for any transaction conducted or attempted by, at, or through the business involving or aggregating funds of at least $2,000 that the business knows, suspects, or has reason to suspect involves illicit funds, is designed to evade the BSA, has no apparent lawful purpose, or facilitates criminal activity.
(31 CFR § 1022.320(a)(2)) The obligation reaches attempted transactions. A rejected onboarding or a blocked withdrawal can be SAR-reportable.
☐
[Ongoing] File each SAR no later than 30 calendar days after initial detection of facts constituting a basis for filing (extendable to 60 days where no suspect is identified), and record the detection date for every filing.
(31 CFR § 1022.320(b)(3)) ‘Initial detection’ means the date of the alert or referral, not the date the investigation concludes. Documenting a later detection date to extend the clock is itself a finding.
☐
[Pre-launch + Ongoing] Implement and train on SAR confidentiality controls prohibiting disclosure of a SAR or its existence to any person involved in the transaction, including access restrictions in the case management system and a protocol for responding to subpoenas seeking SARs.
(31 U.S.C. § 5318(g)(2); 31 CFR § 1022.320(e)) 🔍 Attorney Review Required A subpoena does not override SAR confidentiality. The correct response is to decline and notify FinCEN — route every such subpoena to counsel before responding.
☐
[Ongoing] File a Currency Transaction Report for each transaction in physical currency of more than $10,000 by, through, or to the business in one business day, applying the aggregation rules for multiple transactions by or on behalf of the same person.
(31 CFR §§ 1010.311, 1022.310; aggregation under 31 CFR § 1010.313; filing deadline under 31 CFR § 1010.306(a)(1)) The CTR trigger is physical currency, not crypto value. Platforms with cash on-ramps, kiosks, or in-person OTC desks are squarely in scope; purely digital platforms generally are not.
☐
[Ongoing] Implement detection and reporting for structuring — patterns of transactions designed to evade a reporting requirement — and train customer-facing staff on the prohibition against assisting a customer in structuring.
(31 U.S.C. § 5324; 31 CFR § 1010.314)
☐
[Pre-launch] Implement the Recordkeeping Rule for transmittals of funds of $3,000 or more, capturing and retaining the transmittor’s name and address, the amount, the execution date, payment instructions, the recipient’s financial institution, and recipient identifying information.
(31 CFR § 1010.410(e))
☐
[Pre-launch] Implement the Travel Rule so that required transmittor and recipient information travels to the next financial institution in the chain for qualifying transmittals, with a documented procedure for counterparty VASP identification and a defined policy for transfers to and from unhosted wallets.
(31 CFR § 1010.410(f); FIN-2019-G001 § 5.2) 🔍 Attorney Review Required UNSETTLED — the threshold is $3,000, but FinCEN and the Federal Reserve jointly proposed a $250 cross-border threshold in 2020 that was never finalized. Confirm no final rule has issued before configuring system thresholds.
☐
[Ongoing] Verify identity and retain records for any person who is not an established customer and who purchases or redeems monetary instruments with currency of $3,000–$10,000, applying the separate verification requirement for non-established customers effecting qualifying transmittals.
(31 CFR § 1010.415 (monetary instruments); 31 CFR § 1010.410(e)(2) (transmittals by non-established customers)) These are two distinct rules with different triggers. Do not implement them as a single control.
☐
[Ongoing] Retain all BSA records — customer identification records, transaction records, SAR supporting documentation, CTR copies, and travel rule data — for five years in a form retrievable and producible to examiners within a reasonable period.
(31 CFR § 1010.430(d)) ‘Retrievable’ is doing real work in this rule. Records held only in an archived production database that cannot be queried by customer or date range have been treated as not retained.
☐
[Event-driven] File Form 8300 for receipt of more than $10,000 in cash in one transaction or in related transactions in the course of a trade or business, and confirm with counsel whether digital assets are currently treated as ‘cash’ for this purpose.
(26 U.S.C. § 6050I; 31 CFR § 1010.330) 🔍 Attorney Review Required UNSETTLED — the Infrastructure Investment and Jobs Act amended § 6050I to include digital assets, but implementation guidance and constitutional litigation have affected practical scope. Verify current status; this provision carries felony exposure for willful failure to file.
☐
[Annual] File Reports of Foreign Bank and Financial Accounts where the entity or its officers hold or have signature authority over foreign financial accounts exceeding $10,000 in aggregate, and separately assess FATCA reporting exposure.
(31 CFR § 1010.350; 26 U.S.C. § 6038D) 🔍 Attorney Review Required UNSETTLED — FinCEN announced an intention to extend FBAR reporting to accounts holding only virtual currency but had not finalized that rule as of this version date. Accounts holding fiat at foreign institutions are reportable now regardless.

Key Reference:
31 CFR § 1010.410 — Records to be made and retained by financial institutions (Recordkeeping and Travel Rules)

5. OFAC Sanctions Compliance

OFAC sanctions compliance operates on strict liability. Unlike BSA violations, which generally require some degree of negligence or willfulness, civil penalties for sanctions violations can attach with no showing of knowledge or intent. There is no de minimis threshold, no safe harbor for small transactions, and no exemption for pseudonymous or decentralized counterparties. OFAC has designated specific digital asset addresses on the SDN List, sanctioned mixing services, and settled enforcement matters against exchanges that possessed IP data showing users in comprehensively sanctioned jurisdictions and simply did not use it. Screening must cover four vectors — names, physical addresses, IP and geolocation data, and blockchain addresses. Screening names alone is a known and repeatedly cited deficiency.

☐
[Pre-launch] Adopt a written, management-endorsed sanctions compliance program addressing the five essential components: senior management commitment, risk assessment, internal controls, testing and auditing, and training.
(OFAC Framework for OFAC Compliance Commitments (May 2, 2019))
☐
[Ongoing] Screen all customers, beneficial owners, and known counterparties against the SDN List, the Consolidated Sanctions List, and the Sectoral Sanctions Identifications List at onboarding and on an ongoing basis, with re-screening triggered by every list update.
(31 CFR Part 501; 50 U.S.C. § 1701 et seq.)
☐
[Ongoing] Screen digital asset addresses against OFAC-designated addresses and apply blockchain analytics to detect indirect exposure to sanctioned entities, mixing services, and darknet markets, with documented risk thresholds distinguishing blocking from review.
(OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (Oct. 2021)) Set indirect-exposure thresholds in writing and apply them consistently. Ad hoc thresholds adjusted transaction-by-transaction read as pretextual in an OFAC review.
☐
[Pre-launch + Ongoing] Implement IP-based and geolocation-based controls to identify and block users located in comprehensively sanctioned jurisdictions, including detection of VPN and proxy circumvention, and document the control’s periodic testing and measured effectiveness.
(31 CFR Parts 515, 538, 541, 560, 588 (comprehensive programs); OFAC Virtual Currency Guidance § III) 🔍 Attorney Review Required Multiple OFAC settlements with digital asset platforms rested substantially on the platform collecting IP data and not screening it. Collecting the data and ignoring it is worse than not collecting it.
☐
[Pre-launch] Establish separate procedures to block property in which a designated person has an interest and to reject prohibited transactions that do not involve blockable property, with distinct workflows, distinct ledger treatment, and distinct reporting paths.
(31 CFR § 501.603 (blocked); 31 CFR § 501.604 (rejected)) 🔍 Attorney Review Required Blocked property must be held in an interest-bearing blocked account and may not be released without a license. Treating a blocking event as a rejection — and returning the assets — is itself a violation.
☐
[Event-driven] Report all blocked property to OFAC within 10 business days of the blocking.
(31 CFR § 501.603(b)(1))
☐
[Event-driven] Report all rejected transactions to OFAC within 10 business days of the rejection.
(31 CFR § 501.604) Rejected-transaction reporting is separately required and separately enforced. It is the more commonly missed of the two.
☐
[Annual] File the Annual Report of Blocked Property by September 30 each year, covering holdings as of June 30.
(31 CFR § 501.603(b)(2))
☐
[Ongoing] Retain full and accurate records of every transaction subject to OFAC regulations, and of all blocking and rejecting actions, for at least five years.
(31 CFR § 501.601) For blocked property, the five-year period runs from the date the property is unblocked, not the date it was blocked.
☐
[Event-driven] Establish an escalation and voluntary self-disclosure protocol requiring counsel involvement before any communication with OFAC, preserving eligibility for the substantial mitigation credit available to qualifying voluntary self-disclosures.
(31 CFR Part 501, App. A (Economic Sanctions Enforcement Guidelines)) 🔍 Attorney Review Required A disclosure loses voluntary status if OFAC or another agency learns of the conduct first. Speed matters, but so does privilege — engage counsel in the first 24 hours, not the first week.
☐
[Annual] Conduct independent testing of sanctions screening effectiveness, including fuzzy-matching threshold validation, false-negative testing against known designations and known sanctioned addresses, and a documented remediation plan.
(OFAC Framework for OFAC Compliance Commitments, Component 4)

Key Reference:
OFAC — Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021)

6. Securities and Commodities Market Structure

This section has the widest gap between market practice and formal legal requirement, and it is the section most affected by ongoing legislative and rulemaking change. The structural problem is that the Exchange Act’s registration framework was built for intermediated securities markets and maps imperfectly onto a venue that combines exchange, broker, clearing, and custody functions in one entity. Two cautions apply throughout. First, federal enforcement posture toward digital assets shifted materially during 2025, but posture is not law: agency forbearance does not bind private plaintiffs under Section 29(b) rescission or Rule 10b-5, does not bind state securities regulators, and does not toll limitations periods that outlast an administration. Second, the leading district court decisions in this area are not appellate precedent and are not binding anywhere. Every item in this section warrants counsel.

☐
[Pre-launch + Ongoing] Maintain a written token listing policy with defined legal, technical, market-integrity, and financial-crime criteria; a documented decision record for each listing; and a delisting procedure triggered by changed legal characterization.
(15 U.S.C. § 78c(a)(1); 17 CFR § 240.3b-16) 🔍 Attorney Review Required
☐
[Ongoing] For every listed asset, retain a dated Howey analysis memorandum, refreshed upon material changes to the issuer’s promotional conduct, token economics, governance, or degree of decentralization.
(SEC v. W.J. Howey Co., 328 U.S. 293 (1946)) 🔍 Attorney Review Required UNSETTLED — district courts have split on whether secondary-market transactions in a token carry the investment-contract character of the original distribution. Compare SEC v. Ripple Labs (S.D.N.Y. 2023) with SEC v. Terraform Labs (S.D.N.Y. 2023). Neither is binding precedent; no circuit has resolved the question.
☐
[Pre-launch] Confirm that no unregistered, non-exempt offer or sale of a security occurs on or through the platform, including primary distributions, launchpad or IEO activity, and airdrops conditioned on user conduct or investment.
(15 U.S.C. § 77e) 🔍 Attorney Review Required Section 12(a)(1) gives purchasers a rescission right for unregistered offerings that is independent of any regulator’s enforcement decision, and it does not require proof of scienter.
☐
[Event-driven] If any exempt offering is facilitated, confirm every condition of the claimed exemption is satisfied, including accredited investor verification, general solicitation limits, integration analysis, and Form D filing.
(17 CFR §§ 230.502, 230.503, 230.506) 🔍 Attorney Review Required
☐
[Pre-launch] Determine whether Regulation ATS is available and, if pursued, file Form ATS at least 20 days before commencing operations and comply with the ongoing fair access, systems, and reporting conditions.
(17 CFR §§ 242.300–242.304; Form ATS filing under 17 CFR § 242.301(b)(2)(ii)) 🔍 Attorney Review Required Operating an ATS requires the operator to be a registered broker-dealer and FINRA member. Form ATS is not a standalone path and confers no exemption from Section 15(a).
☐
[Pre-launch] If broker-dealer registration is required, file Form BD, obtain FINRA membership through the New Member Application process, and satisfy net capital, books and records, and supervisory requirements before commencing any securities activity.
(15 U.S.C. § 78o(a); 17 CFR § 240.15b1-1; 17 CFR § 240.15c3-1) 🔍 Attorney Review Required Budget 6–12 months for the NMA process. Digital-asset applicants have historically drawn extended review, particularly on custody and net capital treatment.
☐
[Ongoing] Implement market surveillance for wash trading, spoofing, layering, marking the close, and insider trading, and document compliance with the anti-fraud and anti-manipulation provisions that apply regardless of registration status.
(15 U.S.C. § 78j(b); 17 CFR § 240.10b-5; 7 U.S.C. § 9(1); 17 CFR § 180.1) 🔍 Attorney Review Required CFTC anti-fraud and anti-manipulation authority under CEA § 6(c)(1) reaches spot digital asset commodity markets even where no registration is required. This is the broadest federal hook over a spot-only platform.
☐
[Pre-launch + Ongoing] Adopt and enforce a written insider trading and material non-public information policy covering employee personal trading in listed assets and pre-announcement listing information, with periodic attestations and trade surveillance.
(15 U.S.C. § 78j(b); 17 CFR § 240.10b5-1) 🔍 Attorney Review Required Federal wire fraud charges have been brought and sustained for listing-related front-running independent of whether the assets involved were securities. The securities-status question is not a defense.
☐
[Pre-launch] For any margined, leveraged, or financed retail transaction, document how actual delivery is achieved within 28 days — including the customer’s ability to take possession and control and the absence of any lien or interest retained by the platform or an affiliate — or register the activity appropriately.
(7 U.S.C. § 2(c)(2)(D)(ii)(III)(aa); CFTC Final Interpretive Guidance, 85 Fed. Reg. 37734 (June 24, 2020)) 🔍 Attorney Review Required Book-entry credit on the platform’s internal ledger, without the customer’s ability to withdraw to an address of their choosing, does not constitute actual delivery under the guidance.
☐
[Pre-launch] If offering futures, options, or swaps on digital assets to US persons, confirm the venue is a designated contract market or swap execution facility and that intermediation runs through a registered FCM or introducing broker.
(7 U.S.C. §§ 6(a), 6d(a); 17 CFR Part 38) 🔍 Attorney Review Required
☐
[Pre-launch] Assess whether any yield, staking-as-a-service, or lending product constitutes an investment contract or a note requiring registration, and whether the product or the entity implicates the Investment Company Act or the Investment Advisers Act.
(15 U.S.C. § 77b(a)(1); 15 U.S.C. § 80a-3; Reves v. Ernst & Young, 494 U.S. 56 (1990)) 🔍 Attorney Review Required Retail yield products have drawn both SEC registration actions and parallel state securities enforcement. State actions have proceeded where federal enforcement did not.
☐
[Pre-launch + Ongoing] For any payment stablecoin issued, distributed, marketed, or accepted in settlement, confirm status under the federal payment stablecoin framework — permitted issuer requirements, reserve composition and disclosure, and the applicable compliance date.
(GENIUS Act, Pub. L. No. 119-27 (July 18, 2025)) 🔍 Attorney Review Required UNSETTLED — implementing regulations, permitted-issuer application procedures, and effective dates were still developing as of this version date. The statute also restricts who may offer a payment stablecoin to US persons, which affects listing decisions as well as issuance. Verify current requirements and any transition relief.

Key Reference:
SEC — Framework for ‘Investment Contract’ Analysis of Digital Assets (staff guidance, April 2019)

7. Custody, Asset Safeguarding, Cybersecurity, and Consumer Protection

Customer asset safeguarding is where compliance failure becomes existential. The 2022–2023 exchange failures produced two durable lessons: commingling of customer and corporate assets is treated as presumptively fraudulent, and ambiguity about who owns customer assets in bankruptcy converts a liquidity event into total customer loss. Federal custody rules for digital assets remain incomplete outside the broker-dealer context, so much of this section is driven by state permissible-investment requirements, contract law, and bankruptcy risk rather than a single federal rule. That is a reason to build to the highest applicable standard, not the minimum — the absence of a federal rule is not the absence of liability.

☐
[Pre-launch + Ongoing] Segregate customer digital assets and customer fiat from corporate operating assets at the wallet, account, and ledger level, with daily reconciliation and retained evidence of segregation.
(State MTL permissible investment requirements; 17 CFR § 240.15c3-3 (where broker-dealer registered)) 🔍 Attorney Review Required UNSETTLED — there is no single federal segregation rule for non-broker-dealer spot crypto custody. Segregation obligations arise from state money transmitter permissible-investment rules, the customer agreement, and fraud principles.
☐
[Pre-launch] State unambiguously in the customer agreement whether the platform holds customer assets in a custodial or bailment capacity for the customer’s benefit, and have bankruptcy counsel confirm how that language operates in an estate-property analysis.
(11 U.S.C. §§ 541, 542) 🔍 Attorney Review Required Ambiguous terms-of-service language has been construed to place customer assets in the bankruptcy estate, converting customers into unsecured creditors. Regulatory counsel alone will not catch this.
☐
[Pre-launch + Ongoing] Hold customer fiat in FDIC-insured accounts titled for the benefit of customers, and confirm all marketing states accurately that FDIC insurance does not cover digital assets and does not cover the platform’s own insolvency.
(12 CFR Part 328, Subpart B (false advertising of deposit insurance)) 🔍 Attorney Review Required The FDIC has issued multiple cease-and-desist letters to crypto firms over misleading deposit-insurance representations, including statements made by third parties on the firm’s behalf.
☐
[Pre-launch + Annual] Implement documented key management controls including multi-party computation or multi-signature architecture, defined cold storage ratios, geographic key-share distribution, dual control for withdrawals, and a tested key-recovery procedure.
(16 CFR § 314.4(c) (GLBA Safeguards Rule access controls)) New York-licensed entities face the more prescriptive requirements of 23 NYCRR Part 200 and 23 NYCRR Part 500, including annual CISO reporting and certification.
☐
[Pre-launch + Annual] Establish a written information security program with a designated qualified individual, a written risk assessment, access controls, encryption of customer information in transit and at rest, multi-factor authentication, penetration testing, continuous monitoring, and annual written reporting to the board.
(16 CFR § 314.4) 🔍 Attorney Review Required UNSETTLED — applicability of the FTC Safeguards Rule turns on whether the business is a ‘financial institution’ under 16 CFR § 314.2(h). Confirm with counsel; the conservative course is to comply.
☐
[Event-driven] Implement a security incident notification procedure covering the federal obligation to notify the FTC of a notification event involving the unencrypted customer information of 500 or more consumers, as soon as possible and no later than 30 days after discovery.
(16 CFR § 314.4(j)) 🔍 Attorney Review Required All 50 states maintain independent breach notification statutes with differing triggers and deadlines, some as short as 30 days. A single incident typically requires parallel multi-state notification. If broker-dealer registered, Regulation S-P’s amended incident response and customer notification requirements apply in addition.
☐
[Ongoing] Review all customer-facing marketing, yield representations, safety claims, and risk disclosures against the prohibition on unfair, deceptive, or abusive acts and practices, and retain substantiation for every performance, security, or insurance claim before publication.
(15 U.S.C. § 45(a); 12 U.S.C. § 5531) 🔍 Attorney Review Required State UDAP statutes and state attorney general authority operate independently of federal enforcement and are frequently the first mover in this sector.
☐
[Pre-launch] Assess whether any product involves an electronic fund transfer from a consumer asset account triggering error resolution, disclosure, and liability-limitation obligations, including the remittance transfer rules for cross-border transfers.
(12 CFR Part 1005 (Regulation E); 12 CFR § 1005.30 et seq.) 🔍 Attorney Review Required UNSETTLED — application of Regulation E to digital asset accounts has been the subject of CFPB interpretive activity that has shifted with administrations. Confirm the current position; the error-resolution obligations are operationally significant if they apply.
☐
[Ongoing] Before publishing any proof-of-reserves attestation, solvency representation, or insurance claim, confirm the scope of what was actually tested — including whether liabilities were verified, not only assets — and that the public description does not overstate the engagement.
(15 U.S.C. § 45(a); 15 U.S.C. § 78j(b) (where securities are involved)) 🔍 Attorney Review Required An asset-only attestation described publicly as proof of solvency is a misrepresentation. Accounting firms have withdrawn from this work specifically over how their reports were characterized.

Key Reference:
16 CFR Part 314 — FTC Standards for Safeguarding Customer Information

8. Tax Information Reporting

Digital asset information reporting moved from voluntary to mandatory with the Infrastructure Investment and Jobs Act and the Treasury regulations defining digital asset brokers (T.D. 10000). Custodial trading platforms are squarely within the definition. Form 1099-DA gross proceeds reporting began for transactions in the 2025 calendar year, with adjusted basis reporting phasing in thereafter. Note separately that the regulations extending broker reporting to certain decentralized front-end service providers were disapproved under the Congressional Review Act in April 2025 — this narrows the reporting perimeter but does not affect custodial platforms. Backup withholding is the highest-dollar operational risk in this section: failure to withhold makes the platform directly liable for the tax it should have withheld, and that liability is not practically recoverable from customers after the fact.

☐
[Pre-launch] Determine whether the platform is a broker effecting sales of digital assets for customers, documenting the analysis separately for trading, swaps, staking, and payment processing.
(26 U.S.C. § 6045(c)(1); 26 CFR § 1.6045-1(a)(1)) 🔍 Attorney Review Required
☐
[Ongoing] Collect a valid Form W-9 from each US customer at onboarding and a valid Form W-8 series certification from each foreign customer, with a documented solicitation and cure procedure for missing, expired, or invalid forms.
(26 CFR § 31.3406(h)-3; 26 CFR § 1.1441-1(e)) Require a valid certification before enabling withdrawals, not before enabling deposits. Collecting after the customer has funded and traded is where the gaps accumulate.
☐
[Ongoing] Implement TIN matching and B-notice procedures, and apply backup withholding at the statutory rate where a TIN is missing, obviously incorrect, or the subject of an IRS notice of incorrect TIN.
(26 U.S.C. § 3406) 🔍 Attorney Review Required The payor is directly liable for amounts that should have been withheld, plus penalties and interest. Because the liability attaches per payment across the customer base, it compounds faster than any other item on this checklist.
☐
[Annual] Report gross proceeds from each digital asset sale on Form 1099-DA, furnish payee statements to customers, and file with the IRS by the applicable deadlines.
(26 U.S.C. § 6045(a); 26 CFR § 1.6045-1(d)(2)(i))
☐
[Ongoing] Implement adjusted basis tracking and reporting for covered digital assets — acquisition date, cost basis, and holding period — consistent with the phase-in dates in the regulations.
(26 U.S.C. § 6045(g); 26 CFR § 1.6045-1(d)(2)(ii)) 🔍 Attorney Review Required UNSETTLED — confirm the current phase-in schedule and any transition penalty relief. Effective dates and relief for basis reporting have been subject to repeated administrative adjustment.
☐
[Ongoing] Support customer wallet-by-wallet and account-by-account basis identification, and provide the records customers need to make specific-identification elections consistent with the applicable safe harbor.
(Rev. Proc. 2024-28, 2024-31 I.R.B.)
☐
[Annual] Report other reportable payments to US persons — staking rewards, referral bonuses, promotional payments, and airdrops with ascertainable value — on the appropriate information return, applying the correct character, timing, and threshold analysis.
(26 U.S.C. § 6041; IRS Notice 2014-21; Rev. Rul. 2023-14) 🔍 Attorney Review Required Rev. Rul. 2023-14 addresses income inclusion on gaining dominion and control over staking rewards. The reporting character of platform-distributed rewards is a distinct question from the customer’s inclusion timing.
☐
[Pre-launch] Assess withholding and reporting obligations for foreign account holders under Chapter 3 and Chapter 4, including FATCA registration if the entity qualifies as a foreign financial institution.
(26 U.S.C. §§ 1441, 1471–1474) 🔍 Attorney Review Required

Key Reference:
IRS — About Form 1099-DA, Digital Asset Proceeds From Broker Transactions

9. Program Governance, Change Management, and Examination Readiness

Sections 1 through 8 describe what to comply with. This section describes how to keep complying — which is what actually distinguishes programs that survive an examination from those that do not. Regulators evaluate compliance as a governed, resourced, and continuously maintained function, not as a set of documents produced once. Two failure modes dominate. The first is drift: the program was accurate at launch and no one updated it when the product changed. The second is discoverability: the obligations were met but the evidence cannot be produced on a 10-day document request. Both are avoidable at low cost and expensive to remediate after a finding.

☐
[Ongoing] Establish a defined compliance reporting cadence to the board or an independent board committee, with a standing agenda covering SAR volume and aging, alert queue age, sanctions screening exceptions, regulatory change items, and open remediation findings, and retain the minutes.
(31 CFR § 1022.210(b) (program approval and oversight)) Board minutes showing the compliance officer raised an issue that management declined to fund are protective of the officer and damaging to the institution. Both effects are intended.
☐
[Ongoing] Implement a documented regulatory change management process assigning named ownership for monitoring FinCEN, OFAC, SEC, CFTC, IRS, and FTC issuances, with a defined impact-assessment and implementation workflow and an audit trail from issuance to control change.
(31 CFR § 1022.210(d)(1) (internal controls))
☐
[Event-driven] Route every new product, listed asset, geographic market, and material feature change through a documented compliance and legal review gate before engineering work begins, with a hard stop held by the compliance officer and a written approval record.
(31 CFR § 1022.210(d)(1); 31 U.S.C. § 5318(h)) 🔍 Attorney Review Required This is the single highest-leverage control on this checklist. Characterization determines architecture, and architecture is far cheaper to get right than to retrofit.
☐
[Ongoing + Annual] Maintain a third-party risk management program covering analytics vendors, screening providers, custody technology, banking partners, and KYC vendors, with documented due diligence, contractual audit and information rights, and annual performance review.
(31 CFR § 1022.210(d)(1); OFAC Framework for OFAC Compliance Commitments) Outsourcing a control does not outsource the obligation. A vendor’s screening failure is the institution’s violation.
☐
[Pre-launch + Ongoing] Prepare for examination by maintaining an indexed evidence repository mapping each regulatory obligation to its controlling policy, the responsible owner, the system of record, and a sample of retained evidence, tested by a mock document request at least annually.
(31 CFR § 1010.430 (record retrievability); 31 U.S.C. § 5318(a)(2)) 🔍 Attorney Review Required IRS BSA examinations of MSBs typically open with a document request on a short turnaround. Inability to produce is treated as a recordkeeping failure independent of whether the underlying obligation was met.
☐
[Ongoing] Version-control the AML, sanctions, and information security policies with effective dates, approval records, and change logs, and retain superseded versions for five years so that the policy in force on any past date can be reconstructed.
(31 CFR § 1010.430(d); 31 CFR § 501.601) Conduct is assessed against the policy in force at the time. A repository containing only the current version cannot establish what the standard was.
☐
[Pre-launch] Establish an internal reporting channel for AML and sanctions concerns with documented anti-retaliation protections, and confirm that personnel policies do not restrict protected disclosures to regulators.
(31 U.S.C. § 5323 (AML whistleblower program and anti-retaliation)) 🔍 Attorney Review Required The AML Act of 2020 created a whistleblower award program with substantial award ranges and anti-retaliation remedies. Confidentiality provisions in employment or separation agreements that appear to restrict regulator contact have themselves been charged as violations.
☐
[Event-driven] Adopt a written protocol for responding to a discovered systemic control failure, addressing engagement of counsel before forensic vendors, privilege structuring, scoping of any lookback review, and the decision framework for self-disclosure.
(31 CFR Part 501, App. A; 31 U.S.C. § 5321 (penalty mitigation)) 🔍 Attorney Review Required Remediation documents are discoverable. Their framing, sequencing, and privilege posture materially affect both penalty exposure and civil litigation risk — decide the protocol before you need it.
☐
[Annual] Require an annual written compliance certification from the compliance officer and relevant business heads, attesting to program operation, identified deficiencies, and remediation status, and retain it with the board reporting record.
(31 CFR § 1022.210(b), (d)(4)) New York-licensed entities are subject to an express annual certification requirement under 23 NYCRR Part 504 and Part 500; treat those as the drafting model.

Key Reference:
FinCEN — BSA/AML Examination Resources and MSB Compliance Guidance

Common Pitfalls

⚠️ Treating federal FinCEN MSB registration as satisfying state money transmitter licensing.

Consequence: Operating without required state licenses is both a state offense and a predicate for federal criminal liability under 18 U.S.C. § 1960(b)(1)(A), which expressly does not require proof that the operator knew a license was required. Platforms have been shut down and principals prosecuted on precisely this basis.

Prevention: Run a 50-state licensing analysis before launch, geofence unlicensed states at the account-opening layer rather than the transaction layer, and maintain a licensing status matrix reviewed quarterly by the compliance officer.

⚠️ Letting FinCEN MSB registration lapse by missing the December 31 biennial renewal.

Consequence: Registration expires with no agency notice. Operating on a lapsed registration is a BSA violation and is typically identified in the first hour of an IRS BSA examination, which colors the examiner’s assessment of everything that follows.

Prevention: Set a calendar reminder for October 1 of every renewal year, assign a named backup owner, and verify status against the FinCEN MSB Registrant Search at each quarterly compliance review.

⚠️ Buying a transaction monitoring platform and treating deployment as compliance, without tuning scenarios or staffing the alert queue.

Consequence: Alert backlogs produce late or unfiled SARs. Because penalties are assessed per violation, a six-month backlog at a mid-size platform routinely converts into hundreds of countable violations plus a consent order requiring a lookback review that costs more than the original program would have.

Prevention: Establish alert-disposition service-level agreements, report queue age weekly as a board metric, document scenario tuning decisions with the underlying data, and validate the model annually through independent testing.

⚠️ Screening customer names against the SDN List but not screening IP addresses, geolocation data, or blockchain addresses.

Consequence: Sanctions liability is strict. Multiple OFAC settlements with digital asset platforms rested on the platform possessing IP data showing users in comprehensively sanctioned jurisdictions and not acting on it. Penalties are assessed per transaction, and the transaction counts in this sector are large.

Prevention: Screen across all four vectors — name, physical address, IP/geolocation, and on-chain address — and require the annual independent sanctions test to include false-negative exercises against known designations and known sanctioned addresses.

⚠️ Reporting blocked transactions to OFAC but not rejected ones.

Consequence: Rejected-transaction reporting under 31 CFR § 501.604 is a separate obligation with its own 10-business-day deadline. Firms that build a blocking workflow and route rejections through customer support generate unreported rejections at volume, each an independent violation.

Prevention: Build two distinct workflows with distinct ledger treatment and distinct reporting queues, and include rejected-transaction reporting completeness in the annual independent test.

⚠️ Relying on a single generic legal opinion that ‘our tokens are not securities’ rather than maintaining per-asset, dated analyses.

Consequence: Characterization changes as issuer conduct changes. Without a contemporaneous, asset-specific record and a delisting trigger, the platform cannot demonstrate a good-faith process — which affects the scienter analysis, the penalty calculus, and the availability of a due diligence defense in private litigation.

Prevention: Maintain a per-asset legal file with a dated analysis, a defined refresh cadence, a documented process for monitoring issuer conduct, and a delisting procedure that has been exercised at least once in practice.

⚠️ Reading the 2025 shift in federal enforcement posture as a change in the underlying law.

Consequence: Agency forbearance binds no private plaintiff, no state securities regulator, and no state attorney general; it does not toll limitations periods; and it can reverse with an administration while the conduct remains within the limitations window. Firms that dismantled controls on the strength of posture face exposure from parties whose incentives never changed.

Prevention: Build to the statute. Document enforcement-posture reliance, if any, as an explicit risk-acceptance decision approved at board level with a stated review trigger — not as a legal conclusion.

⚠️ Commingling customer and corporate assets, or using ambiguous terms-of-service language about who owns customer deposits.

Consequence: In insolvency, ambiguity is resolved against the drafter and customer assets may be swept into the bankruptcy estate, converting customers into unsecured creditors. Commingling is independently treated as a deceptive practice and, where paired with misrepresentation, as fraud.

Prevention: Segregate at the wallet, account, and ledger level; reconcile daily; state custody and title unambiguously in the customer agreement; and have bankruptcy counsel — not only regulatory counsel — review the language before launch.

⚠️ Failing to implement backup withholding for customers with missing or mismatched taxpayer identification numbers.

Consequence: The platform becomes directly liable for amounts it should have withheld, plus penalties and interest. Because liability attaches per payment across the entire customer base, it compounds rapidly and is effectively uncollectible from customers after the fact.

Prevention: Require a valid W-9 or W-8 before enabling withdrawals, use the IRS TIN Matching program before the first reportable payment, and automate the B-notice and withholding workflow rather than handling it by exception.

⚠️ Appointing a BSA/AML compliance officer without genuine authority, budget, or board access.

Consequence: Deficiencies compound because the officer cannot force product changes or halt onboarding. Regulators assess the officer’s actual authority, and individual liability — including personal civil penalties and industry bars — has been imposed on compliance officers in this sector.

Prevention: Document the officer’s authority in a board resolution, provide a direct reporting line to the board or a board committee, fund the function as a line item, and confirm in writing that D&O coverage and indemnification expressly extend to the role.

⚠️ Assuming a non-US entity structure removes US regulatory obligations for US-facing activity.

Consequence: The MSB definition reaches foreign-located businesses doing business in whole or substantial part in the United States, and securities and commodities antifraud authority reaches conduct with US effects. The structure typically adds cost and complexity without removing exposure, and a restructuring undertaken after exposure is identified supports an inference of intent to evade.

Prevention: Have cross-border counsel analyze the structure before implementation. If US persons are excluded, implement and periodically test genuine exclusion controls rather than a click-through attestation.

⚠️ Meeting every obligation but being unable to produce the evidence on a short-turnaround document request.

Consequence: Records held only in an archived production database that cannot be queried by customer or date range have been treated as not retained. The examination finding is a recordkeeping violation regardless of whether the underlying obligation was satisfied.

Prevention: Maintain an indexed obligation-to-evidence map with named owners and systems of record, and run a mock document request annually against a realistic deadline.

When to Seek Legal Counsel

Consider consulting a qualified attorney if you encounter any of the following situations:

Before listing, delisting, or supporting any asset whose securities status is not clearly settled — including any asset with an identifiable promoter, ongoing development funded by token sales, or marketing referencing price appreciation.
Before launching any product involving margin, leverage, financing, yield, lending, staking-as-a-service, or derivatives exposure for retail customers.
Before concluding that any FinCEN exemption applies to the business model, and before relying on any ‘we are not a money transmitter’ theory in a bank onboarding questionnaire or investor diligence response.
Immediately upon discovering a potential OFAC sanctions violation — before any communication with OFAC and before any remedial customer contact. Voluntary self-disclosure credit and privilege positioning both turn on how the first 72 hours are handled.
Upon receipt of any subpoena, civil investigative demand, examination notice, document request, or informal inquiry from the SEC, CFTC, FinCEN, IRS, DOJ, a state regulator, or a state attorney general.
Before responding to any law enforcement request for customer records, including apparently routine ones, to confirm the legal basis and preserve SAR confidentiality.
Upon discovery of a material security incident, unauthorized withdrawal, or shortfall in customer assets — engage counsel before the forensic vendor, so the investigation is conducted under privilege from the first hour.
Before entering any new US state market, and before any change to geofencing or customer-eligibility controls.
Before any change of control, material equity financing, or acquisition. Most state money transmitter licenses require prior regulatory approval for changes of control, and closing without it can void the license.
Before implementing any cross-border structure, offshore entity, or arrangement intended to limit the applicability of US regulation.
When internal or independent testing identifies a systemic program deficiency — before drafting the remediation plan, because remediation documents are discoverable and their framing matters.
Before issuing, distributing, marketing, or accepting in volume any stablecoin, given the developing federal payment stablecoin framework and its restrictions on who may offer such instruments to US persons.
Before publishing any proof-of-reserves attestation, solvency representation, or insurance claim in marketing materials.
Before terminating, disciplining, or entering a separation agreement with any employee who has raised an AML or sanctions concern, given the AML Act whistleblower and anti-retaliation provisions.
Before adjusting or removing any control in reliance on a perceived change in enforcement posture rather than a change in the governing statute or regulation.

Checklist Summary

Crypto Exchange Compliance Checklist v2026.08 — Section Summary (US Federal)
#	Compliance Category	Primary Regulator(s)	Items	🔍 Attorney	Dominant Timing	Core Authority
1	Regulatory Status Determination & Entity Structuring	FinCEN / SEC / CFTC / IRS	9	8	Pre-launch	31 CFR § 1010.100(ff); 15 U.S.C. § 78c
2	FinCEN MSB Registration & Ongoing Filings	FinCEN (examined by IRS SB/SE)	8	3	Pre-launch + biennial	31 CFR § 1022.380
3	AML/CFT Program Design, Governance & Testing	FinCEN / IRS	10	4	Pre-launch + annual	31 U.S.C. § 5318(h); 31 CFR § 1022.210
4	BSA Reporting, Recordkeeping & Travel Rule	FinCEN / IRS	11	4	Ongoing	31 CFR §§ 1022.320, 1010.311, 1010.410
5	OFAC Sanctions Compliance	OFAC (Treasury)	11	3	Ongoing + annual	31 CFR Part 501; 50 U.S.C. § 1701 et seq.
6	Securities & Commodities Market Structure	SEC / CFTC / FINRA	12	12	Pre-launch + ongoing	15 U.S.C. §§ 77e, 78c, 78o; 7 U.S.C. § 2(c)(2)(D)
7	Custody, Safeguarding, Cybersecurity & Consumer Protection	FTC / CFPB / FDIC / State	9	8	Pre-launch + ongoing	16 CFR Part 314; 15 U.S.C. § 45(a); 11 U.S.C. § 541
8	Tax Information Reporting	IRS	8	5	Ongoing + annual	26 U.S.C. §§ 6045, 3406; 26 CFR § 1.6045-1
9	Program Governance, Change Management & Exam Readiness	All (cross-cutting)	9	4	Ongoing + annual	31 CFR § 1022.210(b), (d); 31 U.S.C. § 5323
Total			87	51	—	—

Federal Compliance Calendar — Recurring Deadlines

Extract this table into your compliance calendar. Deadlines are federal only; state filings are additional.
Deadline	Obligation	Frequency	Authority
January 1	Update MSB agent list for the prior calendar year	Annual	31 CFR § 1022.380(d)
September 30	Annual Report of Blocked Property (holdings as of June 30)	Annual	31 CFR § 501.603(b)(2)
December 31	FinCEN Form 107 registration renewal	Every 2nd calendar year	31 CFR § 1022.380(b)(2)
Per IRS schedule	Form 1099-DA payee statements and IRS filing	Annual	26 U.S.C. § 6045(a)
April 15 (auto-extended)	FBAR filing, if applicable	Annual	31 CFR § 1010.350
Firm-set date	Independent AML program testing	Annual (risk-based)	31 CFR § 1022.210(d)(4)
Firm-set date	Sanctions screening independent testing	Annual	OFAC Framework, Component 4
Firm-set date	Enterprise AML risk assessment refresh	Annual + on material change	31 CFR § 1022.210(d)(1)
Firm-set date	AML training for all covered personnel	Annual + at onboarding	31 CFR § 1022.210(d)(3)
Firm-set date	Section 314(b) participation notice re-filing	Annual	31 CFR § 1010.540
Firm-set date	Information security program board report	Annual	16 CFR § 314.4(i)
Firm-set date	Mock document request / exam readiness test	Annual	31 CFR § 1010.430
30 days from detection	SAR filing (60 if no suspect identified)	Event-driven	31 CFR § 1022.320(b)(3)
15 days from transaction	CTR filing	Event-driven	31 CFR § 1010.306(a)(1)
10 business days	OFAC blocked property report	Event-driven	31 CFR § 501.603(b)(1)
10 business days	OFAC rejected transaction report	Event-driven	31 CFR § 501.604
30 days from change	Amended Form 107 (ownership/control change)	Event-driven	31 CFR § 1022.380(b)(3)
30 days from discovery	FTC notification of qualifying security event (500+ consumers)	Event-driven	16 CFR § 314.4(j)

Sources & References

31 U.S.C. § 5318 — Compliance, exemptions, and summons authority (Bank Secrecy Act)
— Statutory basis for the AML program requirement, suspicious activity reporting, SAR confidentiality, special due diligence, and customer identification program authority.
31 U.S.C. § 5323 — Whistleblower incentives and protections (AML Act of 2020)
— Award program for original information on BSA violations and anti-retaliation protections; relevant to internal reporting channels and to the drafting of employment and separation agreements.
31 CFR § 1010.100(ff) — Definition of money services business
— Defines money transmitter and the enumerated MSB categories, including the exemptions on which most ‘we are not an MSB’ arguments depend.
31 CFR § 1022.380 — Registration of money services businesses
— 180-day initial registration deadline, biennial renewal, 30-day amendment requirement, agent list obligations, and registration recordkeeping.
31 CFR § 1022.210 — Anti-money laundering programs for money services businesses
— The four-pillar AML program requirement: internal controls, designated compliance officer, training, and independent testing.
31 CFR § 1022.320 — Reports by MSBs of suspicious transactions
— SAR filing obligation, the $2,000 threshold, the 30-day deadline, supporting documentation retention, and confidentiality.
31 CFR §§ 1010.311, 1010.313, 1010.306 — Currency transaction reports, aggregation, and filing deadlines
— CTR filing trigger for physical currency transactions exceeding $10,000, the multiple-transaction aggregation rule, and the 15-day filing deadline.
31 U.S.C. § 5324 — Structuring transactions to evade reporting requirements
— Prohibition on structuring and on assisting a customer in structuring; the basis for structuring detection and staff training obligations.
31 CFR § 1010.410 — Records to be made and retained by financial institutions
— The Recordkeeping Rule at subsection (e) and the Travel Rule at subsection (f), governing transmittals of funds of $3,000 or more.
31 CFR § 1010.430 — Nature of records and retention period
— Five-year retention requirement and the obligation that records be retrievable and producible to examiners within a reasonable period.
FinCEN Guidance FIN-2019-G001, Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (May 9, 2019)
— Controlling interpretive guidance applying the MSB rules to exchanges, wallet providers, mixers, DApps, and mining operations; the analytical starting point for any status determination.
18 U.S.C. § 1960 — Prohibition of unlicensed money transmitting businesses
— Federal criminal statute reaching businesses operating without required state licensing or federal registration, expressly without a knowledge element as to the state licensing requirement.
31 CFR Part 501 — Reporting, Procedures and Penalties Regulations (OFAC)
— Blocked property reporting (§ 501.603), rejected transaction reporting (§ 501.604), five-year recordkeeping (§ 501.601), and the Economic Sanctions Enforcement Guidelines at Appendix A.
OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021)
— OFAC’s stated expectations for digital asset businesses: geolocation controls, blockchain analytics, address screening, and the components of a risk-based sanctions program.
OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019)
— The five essential components of a sanctions compliance program and the root causes OFAC identifies most frequently in enforcement matters.
SEC v. W.J. Howey Co., 328 U.S. 293 (1946)
— Establishes the investment contract test governing whether a digital asset transaction is a securities transaction under federal law.
Reves v. Ernst & Young, 494 U.S. 56 (1990)
— The family resemblance test for when a note is a security; the controlling framework for lending and fixed-return yield products that do not fit Howey.
SEC v. Ripple Labs, Inc., 682 F. Supp. 3d 308 (S.D.N.Y. 2023)
— District court summary judgment distinguishing institutional sales from programmatic exchange sales. Persuasive only — not binding precedent in any circuit, and in tension with other district court decisions.
15 U.S.C. § 78o — Registration and regulation of brokers and dealers
— Section 15(a) registration requirement for brokers and dealers effecting securities transactions and the associated supervisory framework.
17 CFR § 240.3b-16 — Definitions of terms used in Section 3(a)(1) of the Act
— The functional test for whether a trading venue constitutes an ‘exchange’ requiring registration or reliance on Regulation ATS.
17 CFR §§ 242.300–242.304 — Regulation ATS
— Conditions for operating an alternative trading system in reliance on the Rule 3a1-1 exemption, including the 20-day advance Form ATS filing and fair access requirements.
7 U.S.C. § 2(c)(2)(D) — Retail commodity transactions
— Extends CFTC futures-like jurisdiction to leveraged, margined, or financed retail commodity transactions absent actual delivery within 28 days.
CFTC, Retail Commodity Transactions Involving Certain Digital Assets, 85 Fed. Reg. 37734 (June 24, 2020)
— Final interpretive guidance on what constitutes actual delivery of a digital asset, including possession, control, and the absence of any retained lien or interest.
26 CFR § 1.6045-1 — Returns of information of brokers and barter exchanges (T.D. 10000)
— Digital asset broker reporting regulations governing Form 1099-DA gross proceeds and adjusted basis reporting and their phase-in schedule.
26 U.S.C. § 3406 — Backup withholding
— Requires withholding on reportable payments where the payee’s TIN is missing or incorrect, and makes the payor directly liable for amounts not withheld.
IRS Rev. Proc. 2024-28
— Safe harbor for allocating unused digital asset basis on a wallet-by-wallet or account-by-account basis; relevant to the customer basis records a platform must support.
IRS Notice 2014-21 and Rev. Rul. 2023-14
— Foundational property characterization of virtual currency and the income inclusion rule for staking rewards upon gaining dominion and control.
16 CFR Part 314 — Standards for Safeguarding Customer Information (GLBA Safeguards Rule)
— Written information security program requirements including encryption, MFA, access controls, penetration testing, annual board reporting under § 314.4(i), and the 30-day FTC security event notification under § 314.4(j).
12 CFR Part 328, Subpart B — False Advertising, Misrepresentation of Insured Status, and Misuse of the FDIC’s Name or Logo
— Prohibits misrepresenting the scope of federal deposit insurance; the basis for FDIC actions against crypto firms over deposit-insurance marketing claims.
11 U.S.C. §§ 541, 542 — Property of the estate and turnover of estate property
— Determines whether customer-deposited digital assets are estate property or held for the customer’s benefit — the provision that decided customer recoveries in the 2022–2023 exchange bankruptcies.
GENIUS Act, Pub. L. No. 119-27 (July 18, 2025)
— Federal payment stablecoin framework establishing permitted issuer categories, reserve and disclosure requirements, and restrictions on offering payment stablecoins to US persons. Implementing rules and effective dates require independent verification.
SEC, Framework for ‘Investment Contract’ Analysis of Digital Assets (April 2019)
— SEC staff guidance applying Howey to digital assets. Non-binding staff guidance rather than law, and issued under a prior enforcement posture, but still the most detailed articulation of the factors staff weigh.

This checklist is for educational purposes only and does not constitute legal advice.
Using this checklist does not create an attorney-client relationship.
Cryptocurrency regulation changes rapidly — consult a qualified attorney for advice
specific to your situation. Seth Goettelman is licensed in Wisconsin and Florida.

[/cryptolaw_insider_only]

Crypto Exchange Compliance Checklist 2026: US Federal Regulatory Requirements

Crypto Exchange Compliance Checklist 2026: US Federal Regulatory Requirements

How to read this checklist

Scope

Legal environment note (August 2026)

Before You Begin

Prerequisites

Documents & Information Needed

Areas Requiring Attorney Review

1. Regulatory Status Determination and Entity Structuring

2. FinCEN MSB Registration and Ongoing Filing Obligations

3. AML/CFT Program Design, Governance, and Testing

4. BSA Reporting, Recordkeeping, and the Travel Rule

5. OFAC Sanctions Compliance

6. Securities and Commodities Market Structure

7. Custody, Asset Safeguarding, Cybersecurity, and Consumer Protection

8. Tax Information Reporting

9. Program Governance, Change Management, and Examination Readiness

Common Pitfalls

⚠️ Treating federal FinCEN MSB registration as satisfying state money transmitter licensing.

⚠️ Letting FinCEN MSB registration lapse by missing the December 31 biennial renewal.

⚠️ Buying a transaction monitoring platform and treating deployment as compliance, without tuning scenarios or staffing the alert queue.

⚠️ Screening customer names against the SDN List but not screening IP addresses, geolocation data, or blockchain addresses.

⚠️ Reporting blocked transactions to OFAC but not rejected ones.

⚠️ Relying on a single generic legal opinion that ‘our tokens are not securities’ rather than maintaining per-asset, dated analyses.

⚠️ Reading the 2025 shift in federal enforcement posture as a change in the underlying law.

⚠️ Commingling customer and corporate assets, or using ambiguous terms-of-service language about who owns customer deposits.

⚠️ Failing to implement backup withholding for customers with missing or mismatched taxpayer identification numbers.

⚠️ Appointing a BSA/AML compliance officer without genuine authority, budget, or board access.

⚠️ Assuming a non-US entity structure removes US regulatory obligations for US-facing activity.

⚠️ Meeting every obligation but being unable to produce the evidence on a short-turnaround document request.

When to Seek Legal Counsel

Checklist Summary

Federal Compliance Calendar — Recurring Deadlines

Sources & References

🔒 CryptoLaw Insider Content

Crypto Exchange Compliance Checklist 2026: US Federal Regulatory Requirements

CryptoLaw.blog

Related Articles

Similar Posts

Leave a Reply Cancel reply

How We Use Cookies

Essential Cookies

Analytics Cookies

Marketing Cookies

Your Choices