Crypto regulation timeline: 15 key milestones from 2013 to 2026

How we ranked the crypto regulation timeline

This crypto regulation timeline ranks 15 milestones by what changed in law, market access and day-to-day compliance. The method is chronological, but not passive: a milestone appears here only if it changed obligations for exchanges, token issuers, stablecoin issuers, DeFi users, custodians or self-custody in a way that still matters in 2026.

Our original filter is the 3-Gate Milestone Test: legal impact, market impact and 2026 relevance. A milestone needed at least two gates to qualify. We also scored the history of crypto regulation through a chokepoint lens. The pattern is clear: enforceable rules arrived first through AML, sanctions, banking access, stablecoins and overseas licensing, long before U.S. lawmakers settled token taxonomy.

2013-2015: bitcoin enters the regulatory perimeter

When did crypto regulation start? The first major U.S. milestone was March 18, 2013, when FinCEN said administrators and exchangers of convertible virtual currency can be money services businesses under federal AML rules (FinCEN, March 2013). That did not regulate every token activity, but it put exchanges inside the compliance perimeter.

1. 2013 FinCEN guidance: exchanges become money services businesses

The March 2013 FinCEN guidance made custodial crypto exchange activity a regulated financial service. Businesses converting bitcoin into dollars had to register, build AML programs, verify customers and file suspicious-activity reports. The key statistic is the date itself: March 18, 2013, because it is the first durable U.S. anchor in this timeline (FinCEN, March 2013).

This milestone made the list because it affected every serious exchange before token taxonomy became the main debate. Brian Armstrong, Coinbase co-founder and CEO, is a useful attribution point because Coinbase built during this compliance shift rather than after it. The same baseline still sits behind crypto money transmitter licensing in 2026.

2. 2013 China bank restriction: on-ramps become the first pressure point

In late 2013, China barred financial institutions and payment companies from dealing in bitcoin-related services. The move did not criminalise individual holding, but it showed that governments could pressure the market by cutting off banking rails. A useful market marker: BIS research later treated the 2013-2017 China episodes as early evidence that policy signals from large economies moved crypto markets (BIS, January 2019).

This milestone matters because it previewed a recurring tactic. Regulators often reach banks, processors and exchanges before they reach peer-to-peer users. That is why the bigger history of crypto regulation is not only about whether a token is a security. It is also about who can open bank accounts, clear payments and serve local customers.

3. 2015 CFTC action: bitcoin is treated as a commodity

In September 2015, the CFTC said in its Coinflip action that bitcoin and other virtual currencies are commodities under the CEA (CFTC, September 2015). The practical number is the year 2015: two years before the ICO boom, the U.S. commodities regulator had already claimed a lane over virtual-currency derivatives and fraud tied to commodity markets.

This milestone made the list because it gave bitcoin a different legal path from most later tokens. The SEC would later focus on investment contracts, while the CFTC focused on commodities and derivatives. That split remains central in 2026, especially for exchanges trying to list bitcoin, ether, staking products and smaller tokens under one compliance program.

2016-2018: ICOs force securities regulators to respond

The first era was about AML, banking rails and commodity treatment. The ICO era asked a harder question: when does selling a token look like selling a security? These milestones still define token launch planning, exchange listing review and investor eligibility.

4. 2017 DAO report: token sales enter securities law

On July 25, 2017, the SEC published its DAO report and applied the Howey test to a token sale. The report cited a raise of about $150 million in ether before the 2016 exploit (SEC, July 2017). The SEC did not need a new crypto statute to act. It used existing securities law.

This milestone made the list because it changed every serious token launch after July 2017. The question became whether buyers invested money in a common enterprise with an expectation of profit based on others work. For a deeper U.S. securities analysis, see our guide to how SEC securities rules apply to crypto.

5. 2017-2018 ICO enforcement wave: fundraising becomes a compliance risk

The DAO report was the warning. Enforcement followed. The SEC brought actions against token issuers and paid promoters, including a December 2017 order tied to a $15 million token sale and a November 2018 promoter settlement release (SEC, November 2018). The distinguishing stat is not only dollar size. It is that enforcement reached both issuers and marketing channels.

This changed behaviour quickly. Exchanges reviewed listings more carefully, law firms used SAFT-style documents, and teams began geofencing U.S. users. Hester Peirce, SEC commissioner, has repeatedly argued that enforcement without a workable registration path leaves builders guessing. That criticism still explains why 2026 token launches spend so much time on structure before code goes live.

6. 2018-2019 FATF virtual-asset framework: AML becomes global

FATF revised its standards for virtual assets in 2018 and published expanded guidance in June 2019 (FATF, updated October 2021). The key number is the travel-rule threshold used by many jurisdictions: transfers around $1,000 or EUR 1,000 require originator and beneficiary information to move with the transaction.

This milestone made the list because it globalised crypto compliance. Exchanges could no longer think only in domestic registration terms. They needed customer due diligence, sanctions screening, counterparty exchange checks and secure data transfer. The operational burden landed on centralised exchanges first, then spread to wallets, custodians and some self-custody withdrawal flows.

2019-2021: stablecoins, banking access and national bans take center stage

After ICOs pulled in securities regulators, the next wave pulled in payment regulators, central banks, bank supervisors and national security officials. Stablecoins, custody and mining geography became the new pressure points.

7. 2019 Libra backlash: stablecoins become a policy priority

The June 2019 Libra proposal described a global payment token tied to a reserve basket and connected to a platform with billions of users. Policy makers reacted fast. The G7 warned that no global stablecoin should begin until legal, regulatory and oversight challenges were addressed (BIS and CPMI, October 2019).

This milestone made the list because it moved stablecoins from a crypto niche into payment-policy debate. Jeremy Allaire, Circle co-founder and CEO, has argued publicly that dollar stablecoins need clear reserve, redemption and issuer rules to compete at scale. The same debate also pushed governments to compare CBDCs versus crypto rather than treating all digital money as one category.

8. 2020-2021 OCC letters: banks test digital-asset custody

From July 2020 to January 2021, the OCC issued interpretive letters allowing national banks to provide crypto custody, hold reserves for certain stablecoin activity and use independent node verification networks. Bank supervisors then added caution through joint agency statements, including a November 23, 2021 statement on crypto-asset policy sprints (Federal Reserve, November 2021).

This milestone made the list because it exposed the banking chokepoint. Permission to custody digital assets did not automatically mean easy bank access for exchanges, stablecoin issuers or custodians. By 2023 and 2024, many firms treated banking relationships as a strategic risk, not a back-office task.

9. 2021 China mining and trading ban: hashrate moves abroad

China intensified mining restrictions in May and June 2021, then declared crypto transactions illegal in September 2021. Before the crackdown, China was often estimated at roughly 65% to 75% of global bitcoin hashrate. CCAF data showed the U.S. share rising to about 35.4% by early 2022 (CCAF, January 2022).

This milestone made the list because it was the largest jurisdictional shock to mining infrastructure. The contrarian read is important: bitcoin did not die. Hashrate recovered, but geography changed. Mining, liquidity and lobbying capacity moved toward the U.S., Kazakhstan, Russia and other venues, reducing one-country concentration while increasing regulatory competition.

2022: collapse, sanctions and enforcement reset the rulebook

In 2022, regulators stopped waiting for neat categories. Sanctions reached protocol infrastructure, and exchange failures turned custody into a consumer-protection issue.

10. Tornado Cash sanctions: OFAC targets protocol infrastructure

On August 8, 2022, OFAC sanctioned Tornado Cash and listed associated smart-contract addresses (U.S. Treasury, August 2022). The key number is the date, because it marks the first major U.S. sanctions action aimed at widely used on-chain privacy infrastructure rather than only a custodial company.

This milestone made the list because it changed DeFi compliance overnight. Front ends blocked addresses, stablecoin issuers froze affected funds, and infrastructure providers had to decide how to screen wallets. Erik Voorhees, ShapeShift founder, has argued publicly that sanctioning open financial infrastructure threatens neutral software. The compliance tension is why we maintain a separate guide to crypto privacy versus regulation.

11. 2022 FTX and lender failures: custody risk becomes visible

FTX filed for bankruptcy on November 11, 2022 (Reuters, November 2022). Later proceedings and reporting described an estimated multibillion-dollar customer shortfall, commonly cited around $8 billion in the immediate aftermath (Reuters, November 2022). Other lending failures in the same year pushed yield products and rehypothecation into regulatory focus.

This milestone made the list because disclosure alone did not protect customers. The issues were commingling, conflicts between exchange and trading affiliates, weak governance and no mandatory proof-of-reserves rule. After 2022, custody segregation, exchange licensing and reserve attestations moved from industry talking points to policy workstreams.

2023-2024: market-structure laws arrive outside the U.S.

While U.S. agencies fought over existing statutes, other jurisdictions wrote licensing regimes. The most important lesson from 2023 and 2024 is that practical rulebooks arrived first outside Washington.

12. 2023 EU MiCA adoption: the first major market-structure rulebook

MiCA entered into force on June 29, 2023 (EUR-Lex, June 2023). Stablecoin titles applied from June 30, 2024, and broader service-provider rules applied from December 30, 2024. Key thresholds include 1 million daily transactions or EUR 200 million in daily volume for certain non-euro asset-referenced tokens (EUR-Lex, June 2023).

This milestone made the list because MiCA became the reference model for global compliance teams. It set rules for white papers, capital, authorisation, reserve management and redemption. Jeremy Allaire, Circle co-founder and CEO, has pointed to clear stablecoin rules as a condition for credible payment-scale adoption.

13. 2023 U.S. exchange lawsuits and criminal settlements: agency lines stay blurry

In June 2023, the SEC sued major crypto platforms, alleging unregistered exchange, broker and securities activity (SEC, June 2023). In November 2023, U.S. authorities announced a Binance-related resolution that included more than $4.3 billion in penalties and forfeiture (DOJ, November 2023).

This milestone made the list because it showed two separate enforcement tracks. Securities questions remained contested, while AML and sanctions failures produced concrete penalties. For exchanges, the lesson is practical: token classification matters, but BSA controls, sanctions screening and governance failures can trigger action even when market-structure legislation is unfinished.

14. 2024 spot bitcoin ETFs: institutional access changes shape

On January 10, 2024, the SEC approved spot bitcoin exchange-traded products after years of denials (SEC, January 2024). By January 2025, U.S. spot bitcoin ETFs held tens of billions of dollars in assets, with public issuer data and market trackers frequently placing the group above $50 billion in assets (SEC approval context, January 2024).

This milestone made the list because it separated asset exposure from exchange custody. Investors could hold regulated brokerage products without opening crypto exchange accounts. It did not settle the status of other tokens, but it confirmed that bitcoin had gained a regulated wrapper acceptable to the U.S. securities market.

2025-2026: stablecoin laws, CLARITY debates and the current U.S. status

As of August 2026, the current status of crypto legislation in the U.S. is split: agencies already enforce AML, sanctions, tax, commodities and securities rules, while Congress continues to debate broader stablecoin and market-structure bills. No reader should treat a bill as final without checking the enrolled text or official bill record.

15. 2025-2026 stablecoin and market-structure push: Congress tries to codify rules

Stablecoins became the easier legislative starting point because reserve assets, redemption rights and issuer supervision map onto payment and banking rules. Bill records in the 119th Congress, including stablecoin proposals such as S.394 and market-structure proposals, should be checked directly for current status (Congress.gov, accessed August 2026). The key number is 119, because this Congress became the main venue for the latest federal push.

The CLARITY debate is broader. It aims to define when a digital asset falls under securities oversight and when a more commodity-style regime should apply. Hester Peirce, SEC commissioner, has long argued for a clearer path for compliant token projects. Until Congress settles the line, exchanges still manage legal risk asset by asset.

Who regulates crypto in America in 2026?

Overlapping jurisdiction is not a bug. It is the U.S. system applied to a new asset class. The agency map is best read by activity, not by token label:

• SEC: The SEC polices securities offerings, exchange registration, investment advisers and disclosures when a crypto asset or product is treated as a security.
• CFTC: The CFTC oversees derivatives, futures and fraud or manipulation tied to digital commodities such as bitcoin.
• FinCEN: FinCEN applies AML duties to money services businesses, including many custodial exchanges and hosted-wallet providers.
• OFAC: OFAC enforces sanctions rules that can affect wallets, protocols, mixers, issuers and platforms with U.S. exposure.
• OCC: The OCC supervises national banks that seek to custody digital assets or support certain stablecoin activities.
• FDIC: The FDIC examines insured banks for crypto-related safety, soundness and deposit-insurance risks.
• Federal Reserve: The Federal Reserve supervises bank holding companies and payment-system risk linked to crypto activity.
• CFPB: The CFPB can address consumer-protection issues in crypto payment products and retail financial services.
• DOJ: The DOJ prosecutes criminal fraud, money laundering, sanctions evasion and asset-forfeiture cases involving crypto.
• State regulators: State regulators issue money-transmission licences, enforce consumer rules and maintain state regimes such as the N.Y. BitLicense.

What is still unresolved?

Several questions remain open in 2026. Token classification still depends heavily on facts and litigation. DeFi front-end liability is not settled. Staking treatment differs across tax, securities and platform contexts. Privacy tools remain contested after OFAC action. Stablecoin issuers still track federal and state paths. Cross-border equivalence between MiCA firms and U.S. platforms remains incomplete.

For operators, the practical rule is simple: follow the chokepoints first. Banking access, sanctions screening, AML registration, custody segregation and consumer disclosures often matter before a final security-versus-commodity answer arrives. That is why how blockchain surveillance works is now part of compliance planning, not only forensic analysis.

What the timeline means for investors, builders and exchanges

For investors: regulation changes access, not just price

Investors often watch price first, but regulation changes what can be bought, where it can be held and how quickly liquidity disappears. Delistings, exchange exits, stablecoin reserve doubts, tax reporting and sanctions screens all affect access. IRS digital-asset reporting rules remain an essential source for U.S. taxpayers (IRS, accessed August 2026).

The practical signal is to track enforcement actions, banking notices and stablecoin licensing updates before they show up in price. A liquid token on Monday can become difficult to trade after a regulator names it, an exchange delists it or a banking partner withdraws service.

For builders: compliance starts before launch

Builders should treat legal design as product design. Entity structure, token distribution, geofencing, custody model, sanctions controls and disclosures should be resolved before a public launch. Retrofitting compliance after users arrive is usually more expensive than limiting the first release.

The lesson from this timeline is direct: teams that ignored 2017 securities warnings, 2019 AML standards or 2022 sanctions risk later paid for it. Read our guide on how to start a compliant crypto business before testnet marketing turns into a public offering problem.

For exchanges and custodians: chokepoints are clearer than labels

Exchanges often want Congress to settle token labels, but regulators already act through chokepoints: bank accounts, money-transmission licences, sanctions lists, consumer disclosures, custody rules and tax reporting. That is why compliance teams cannot wait for a single statute.

Custody is the decisive split. Hosted wallets, exchange custody and non-custodial software carry different risk profiles under FinCEN, MiCA and state rules. Our guide to self-custody wallet rules explains why the label on the service can matter as much as the label on the token.