The US Tokenization Regulatory Map: Federal Agencies, 50 States, and Every Rule That Matters

The United States does not have a single digital asset regulator. Unlike the United Kingdom (FCA), Singapore (MAS), or the European Union (with MiCA establishing a single framework), the US has distributed digital asset oversight across seven federal agencies with overlapping and sometimes conflicting jurisdiction, plus 50 state regulators with their own licensing regimes. The result is the most legally complex environment for tokenized assets in any major financial jurisdiction — and paradoxically, one where sophisticated operators have found workable paths under existing law for years before comprehensive legislation was enacted.

Understanding this map is a prerequisite for any institutional tokenization project. The compliance burden flows from the jurisdictional analysis: wrong classification of your token as a commodity rather than a security, or vice versa, can result in regulatory action from the wrong agency — action that the right agency would not have taken. The money transmitter licensing question can determine whether your stablecoin business needs one license or 47. The custody question can determine whether your fund’s assets are properly held under the Investment Advisers Act.

Federal Level: The Seven Agencies

1. SEC (Securities and Exchange Commission)

Primary jurisdiction: Digital assets that qualify as securities under the Howey Test — investment contracts where investors provide capital with expectation of profits from others’ efforts.

Key rules applicable to tokenization:

• Securities Act of 1933: All security token offerings must be registered with the SEC or qualify for an exemption (Reg D, Reg A+, Reg S, Reg CF)
• Securities Exchange Act of 1934: Security token secondary trading platforms must register as national securities exchanges or operate as registered broker-dealers on registered ATSs
• Investment Advisers Act of 1940: Investment advisers managing tokenized fund assets must be registered with the SEC (if over $110M AUM) and maintain client assets with Qualified Custodians
• Investment Company Act of 1940: Tokenized investment funds with more than 100 investors (Section 3(c)(1)) or institutional-only investors (Section 3(c)(7)) must register under the Act or qualify for exemption

Key SEC guidance on digital assets:

• The DAO Report (2017): Established that the Howey Test applies to token offerings
• SEC v. Ripple Labs (2023): District court held XRP was not a security when sold to retail investors on exchanges but was a security when sold to institutional investors — a nuanced ruling with broad implications
• Staff Accounting Bulletin 121 (2022, reversed 2025): Required banks to record client crypto as balance sheet liabilities
• No-action letters to TurnKey Jet and Pocketful of Quarters (2019): The SEC’s only two guidance documents acknowledging that specific tokens could be non-securities

Enforcement posture: The SEC has been the most active federal enforcer in digital assets, bringing actions against unregistered token offerings, exchanges, lending programs, and influencer promoters. Post-2024, the SEC’s enforcement posture toward the industry has moderated somewhat, with the new administration pursuing a more engagement-oriented approach.

ATS regulation: Alternative Trading Systems for digital securities operate under SEC Regulation ATS. Securitize Markets, tZERO, and INX are SEC-registered ATSs. ATS operators must file Form ATS with the SEC, maintain fair access policies, and comply with record-keeping and reporting requirements.

2. CFTC (Commodity Futures Trading Commission)

Primary jurisdiction: Digital assets classified as commodities — primarily Bitcoin (explicitly classified as a commodity by CFTC chair testimony and court rulings) and Ether (classified as a commodity by the SEC’s approval of spot Ether ETFs, which implicitly relies on non-security status).

Key rules applicable to tokenization:

• Commodity Exchange Act (CEA): Governs all commodity derivatives, including crypto futures, options, and swaps
• CFTC jurisdiction over spot crypto: Statutory jurisdiction is over derivatives, but the CEA’s anti-fraud and anti-manipulation provisions apply to spot commodity markets, giving CFTC enforcement authority over spot Bitcoin and Ether fraud
• FIT21 provisions: The pending FIT21 legislation would expand CFTC jurisdiction over “digital commodities” and provide a regulatory pathway for spot market oversight

Key CFTC actions:

• CFTC has brought fraud and manipulation cases against Binance, BitMEX, and other crypto derivatives platforms
• CFTC has consistently asserted Bitcoin and Ether are commodities, creating jurisdictional tension with the SEC over Ether in particular
• FIT21’s decentralization test: under the House-passed bill, a digital asset can become a “digital commodity” under CFTC jurisdiction once its underlying blockchain achieves sufficient decentralization

Tokenization relevance: The CFTC’s jurisdiction is most relevant for tokenized commodity instruments (tokenized gold, oil futures, agricultural commodities) and for digital asset derivatives overlay strategies used by institutional tokenization funds.

3. OCC (Office of the Comptroller of the Currency)

Primary jurisdiction: National banks and federal savings associations and their activities in digital assets.

Key OCC actions on tokenization:

• Interpretive Letters 1170, 1172, 1174 (2020–2021): Clarified that national banks can custody crypto assets for customers, hold stablecoin reserves, and participate as nodes in blockchain networks
• Interpretive Letter 1179 (2021): Clarified that banks must receive non-objection before engaging in certain crypto activities — creating a more cautious supervisory posture
• Anchorage Digital national bank charter (2021): First OCC-approved national bank charter for a crypto-native institution, establishing that crypto companies can operate as federally regulated banks
• Wyoming SPDI regulatory relationship: OCC has not formally opposed Wyoming SPDI charters but has not resolved the Federal Reserve master account question for SPDIs

Tokenization relevance: Banks using OCC charters to offer digital asset custody, payment, and trust services. The OCC’s guidance on permissible bank activities in digital assets defines what BNY Mellon, JPMorgan, State Street, and other national bank custodians can legally offer.

4. FinCEN (Financial Crimes Enforcement Network)

Primary jurisdiction: Anti-money laundering (AML) compliance for all US financial institutions, including digital asset businesses classified as Money Services Businesses (MSBs).

Key rules applicable to tokenization:

• Bank Secrecy Act (BSA): Requires MSBs (including “money transmitters,” “virtual currency exchangers,” and “administrators of convertible virtual currency”) to register with FinCEN, implement AML programs, file Suspicious Activity Reports (SARs), and maintain records of transactions above $10,000
• Customer Due Diligence (CDD) Rule: Requires covered financial institutions to identify and verify beneficial owners of legal entity customers
• Travel Rule (31 CFR 1010.410): Requires financial institutions transmitting funds of $3,000 or more to include originator and beneficiary information with the transfer. FinCEN has confirmed the Travel Rule applies to digital asset transactions for covered institutions
• Currency Transaction Reports (CTRs): Required for cash transactions above $10,000

MSB classification for digital asset businesses: Businesses that exchange digital assets for fiat or other digital assets are generally classified as money transmitters (a category of MSB) subject to FinCEN registration. The distinction between custodial and non-custodial activities, and between administrators and exchangers, creates important nuances in MSB classification.

Tokenization relevance: Any platform that enables exchange of tokenized assets for fiat currency, facilitates secondary trading with fiat settlement, or provides digital asset custody with money transmission functionality will face FinCEN MSB registration requirements and full BSA compliance obligations.

5. FINRA (Financial Industry Regulatory Authority)

Primary jurisdiction: Self-regulatory oversight of SEC-registered broker-dealers and their registered representatives.

Key FINRA rules applicable to tokenization:

• FINRA Rule 4370 (Communications with Public): Governs marketing materials for digital securities — member firms must ensure communications about digital securities are fair, balanced, and not misleading
• FINRA Rule 3310 (AML Compliance Program): Member firms must maintain AML programs compliant with FinCEN BSA requirements, applied to digital security transactions
• FINRA regulatory notices on digital assets (2018, 2021, 2023): Providing guidance on member firm obligations when dealing in digital assets
• FINRA and ATS: Most digital securities ATS operators are FINRA members; FINRA conducts examinations of ATS operations for compliance with regulatory requirements

Tokenization relevance: Any platform facilitating digital securities transactions for retail or institutional investors through broker-dealer relationships requires FINRA membership and compliance with FINRA rules.

6. Federal Reserve

Primary jurisdiction: Bank holding companies, state-chartered banks that are Federal Reserve members, foreign banks operating in the US, and the US payment system broadly.

Key Federal Reserve actions on tokenization:

• Master account access for SPDIs: The Federal Reserve’s denial of Custodia Bank’s (a Wyoming SPDI) master account application in January 2023 significantly limited the practical utility of Wyoming’s SPDI framework, as SPDIs without master accounts cannot access the Fed’s payment system directly
• Regulation II and III: Federal Reserve regulations on debit interchange and reserve requirements that apply to bank-issued stablecoin payment systems
• FedNow: The Federal Reserve’s instant payment service (launched July 2023) provides a potential settlement layer for tokenized asset transactions that settle in fiat currency

Payment stablecoin oversight: The Federal Reserve, alongside the OCC and state bank regulators, is expected to share oversight of bank-issued and non-bank payment stablecoins under the GENIUS Act framework, should that legislation be enacted.

7. Treasury Department and OFAC

Primary jurisdiction: Sanctions enforcement (OFAC), tax policy (IRS), and overall financial system oversight.

Key Treasury actions on tokenization:

• OFAC sanctions on Tornado Cash (2022): Established that decentralized protocols and smart contract addresses can be sanctioned, requiring digital asset businesses to screen against OFAC SDN list for sanctioned protocol addresses
• IRS Notice 2014-21 and Revenue Ruling 2023-14: Digital assets are property for US tax purposes; staking rewards are taxable income in the year received; wash sale rules do not apply to crypto assets (though legislation to extend wash sale rules has been proposed)
• Financial Stability Oversight Council (FSOC): Treasury chairs FSOC, which has designated certain digital asset market activities as potential financial stability risks and recommended regulatory responses

State Level: The Critical Variations

New York: The Strictest US State

New York’s BitLicense (issued by the New York Department of Financial Services, NYDFS) is the most restrictive state digital asset license in the US. Required for any company engaging in digital asset activities (exchange, custody, transfer) with New York residents or from New York. BitLicense requirements include:

• Detailed disclosure of business activities, financial condition, and officers
• Capital requirements (minimum capital varies by activity)
• Cybersecurity requirements (23 NYCRR 500, among the strictest US cybersecurity regulations)
• Consumer protection obligations
• Annual examination by NYDFS
• Ongoing approval requirements for material changes

The compliance cost of a BitLicense is substantial — $500,000–$2M+ in initial compliance setup and $200,000–$500,000 annually in ongoing compliance costs. Several major crypto platforms (Bittrex, Shapeshift) have at various times chosen to exit the New York market rather than bear BitLicense costs. Coinbase, Kraken, Gemini, and a limited number of other platforms have obtained BitLicenses.

New York also has the New York Limited Purpose Trust Company charter, which Coinbase Custody and other institutional custodians use for their New York operations.

Wyoming: The Innovation Leader

Wyoming’s blockchain-specific legislative framework, covering 26+ statutes enacted 2018–2025, includes:

• SPDI (Special Purpose Depository Institution) charter: State banking license designed for digital asset activities, providing money transmitter license preemption and 100% reserve banking structure
• DAO LLC statute: Legal entity framework for decentralized autonomous organizations
• Smart contract enforceability: Explicit legal recognition of blockchain-based contracts
• Digital asset property law: Legal framework for blockchain-based property transfers
• Utility token exemption: Narrowly applies to specific token categories

The SPDI framework’s utility is constrained by the Federal Reserve master account question. Wyoming has been the most proactive state in creating a digital asset legal framework, though the practical implementation challenges of SPDI federal access have limited adoption.

Texas: The Mining and Light-Touch State

The Texas Virtual Currency Law (2023) provides:

• Exemption of decentralized digital currencies from Texas money transmission regulation
• Legal recognition of smart contracts
• Consumer disclosure requirements without full licensing burden

Texas hosts approximately 25% of US Bitcoin mining hash rate, driven by low electricity costs and ERCOT’s renewable energy surplus. The regulatory posture has been deliberately accommodating of digital asset infrastructure while maintaining traditional financial regulation for custodians and broker-dealers.

Colorado: The Utility Token State

Colorado’s Digital Token Act (2019, amended 2021) provides an exemption from Colorado securities registration for tokens that are:

• Primarily used for consumptive purposes (access to a product/service) rather than investment
• Available for use on a functioning network
• Not marketed primarily as investments

This utility token exemption has been used by token issuers to avoid Colorado state securities registration. The boundaries are narrow and fact-specific.

Delaware: The Corporate Law Default

Delaware provides no digital asset-specific legislation but remains the dominant corporate incorporation state for digital asset companies due to:

• Court of Chancery: Specialized business court with sophisticated case law
• LLC and corporation law: Most flexible and investor-familiar in the US
• VC and institutional investor preference: Standard investment documents assume Delaware entities
• No state income tax for holding companies

Delaware has updated its corporate law to recognize electronic records, which provides some foundation for blockchain-based corporate governance, but there is no specific DAO statute, no digital asset banking license, and no smart contract enforceability provision.

California: Regulatory Development in Progress

California’s Department of Financial Protection and Innovation (DFPI) has been developing a digital financial assets regulatory framework. The California Digital Financial Assets Law, as of early 2026, remains in development with licensing requirements for digital asset businesses anticipated. California’s large market (the world’s fifth-largest economy if a country) means DFPI licensing will be important for any digital asset business with California operations.

Jurisdictional Comparison Table

International Context: Where US Stacks Up

The US regulatory framework, for all its complexity, is not uniquely burdensome compared to other major jurisdictions.

European Union (MiCA): More legally certain for crypto-asset service providers covered by MiCA, but the DLT Pilot Regime’s €6 billion per-operator cap and the separation between MiCA (crypto assets) and MiFID II (security tokens) creates its own complexity. MiCA’s full implementation across 27 national competent authorities is still working through completion.

Singapore (MAS): Clear sandbox framework and progressive regulatory engagement, but a small domestic market and limited legislative basis for institutional tokenization at scale relative to US market size.

United Kingdom (FCA): Post-Brexit regulatory development has been cautious. The UK’s financial promotions regime for crypto marketing, implemented in 2023, is notably strict. The UK does not yet have MiCA-equivalent comprehensive legislation.

UAE (ADGM, DIFC): The Abu Dhabi Global Market and Dubai International Financial Centre have developed purpose-built digital asset regulatory frameworks for their financial free zones, creating notable regulatory clarity in a small but well-capitalized market.

By most measures, the US remains the largest and most liquid institutional tokenization market despite — and partially because of — its regulatory complexity. The sophistication of US lawyers and compliance professionals in navigating the SEC’s exemption framework has created a workable, if imperfect, operating environment for compliant tokenization.

The Practical Compliance Checklist

For any US-based tokenization project, the regulatory analysis should proceed in this order:

1. Token classification: Is the token a security (SEC jurisdiction), a commodity (CFTC jurisdiction), a payment token/stablecoin (multiple agencies), or a utility token (potentially exempt)?

2. Offering structure: If a security, which exemption? (Reg D 506(c) for accredited investors; Reg A+ for retail; Reg S for international investors)

3. Platform registration: Transfer agent registration (SEC), ATS registration (SEC, if secondary trading), FINRA membership (if broker-dealer)

4. Custody: Qualified Custodian selection (SEC Investment Advisers Act); OCC guidance compliance (if bank custodian); trust company charter verification (if crypto-native custodian)

5. AML/KYC: FinCEN MSB registration (if applicable); BSA AML program; Travel Rule implementation; OFAC screening

6. State licensing: New York BitLicense (if serving NY customers); state-by-state money transmitter analysis (or Wyoming SPDI consideration); state securities blue sky (preempted for most Reg D and Reg A+ Tier 2 offerings)

7. Tax: IRS property treatment; state tax analysis; fund-level tax structuring

8. Ongoing compliance: SEC reporting (Form D, Form 1-K if Reg A+); FinCEN SAR filing; FINRA rules compliance; state examination readiness

The regulatory map is complex but navigable. The institutional tokenization market in 2026 demonstrates that compliant operations are possible — but only with counsel that understands all layers of this framework simultaneously.