Last checked 29 October 2026. The rules in both countries are changing during 2026 and 2027. Dates are as published by the regulators and Congress on the date shown. If anything here conflicts with the linked source, the source wins.
A company that buys and holds bitcoin for its own treasury is a customer of regulated firms in both countries, not usually a regulated firm itself. What changes from country to country is how those firms are supervised, what protection exists and what is still only proposed.
The short version: UK
- Today, UK cryptoasset businesses are registered with the FCA for anti money laundering. They are not yet authorised in the way banks and investment firms are.
- A new FCA regime starts on 25 October 2027. Applications opened on 30 September 2026.
- For most cryptoassets there is no Financial Services Compensation Scheme cover and no route to the Financial Ombudsman.
- The FCA says cryptoassets are high risk investments and will remain high risk under its regime.
How the UK rules have developed
- Anti money laundering registration
Cryptoasset exchange providers and custodian wallet providers must register with the FCA.
Source: FCA: Cryptoassets: AML and CTF regime (registration, no FSCS or Ombudsman cover).
- Travel Rule
Firms must collect, verify and share information about cryptoasset transfers.
Source: FCA: Expectations for UK cryptoasset businesses complying with the Travel Rule.
- Financial promotions
Promotions of cryptoassets to UK consumers come under FCA rules.
- Regulations passed
Parliament passes the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026.
Source: FCA: FCA opens gateway for regulated crypto, 30 September 2026.
- Final FCA rules
Final rules and guidance for the new regime, including custody and prudential rules.
Source: FCA: Overview of our cryptoassets regime policy statements (30 June 2026).
- Gateway opens
Firms can apply for authorisation.
Source: FCA: FCA opens gateway for regulated crypto, 30 September 2026.
- Gateway closes
Firms that apply in time can keep operating while they are assessed.
Source: FCA: How the gateway will operate.
- New regime starts
Cryptoasset activities need FCA authorisation.
Source: FCA: Framework for cryptoasset regulation in the UK: what you need to know.
Hollow markers are dates still to come.
The UK rules today
Until the new regime starts, firms that exchange cryptoassets or hold them for customers by way of business in the UK must be registered with the FCA under the Money Laundering Regulations. The FCA checks their anti money laundering controls. It says registration is not a recommendation or endorsement, and firms must tell customers that the Financial Ombudsman and FSCS are unlikely to be available. Firms must also follow the Travel Rule and the financial promotions rules.
Source: FCA: Cryptoassets: AML and CTF regime (registration, no FSCS or Ombudsman cover), FCA: Expectations for UK cryptoasset businesses complying with the Travel Rule, FCA: Regulating financial promotions and adverts.
The new UK regime
The FCA published final rules on 30 June 2026. They cover how the FCA Handbook applies to cryptoasset firms, rules for specific activities such as trading platforms, dealing and safeguarding, stablecoin issuance, admissions and disclosures, market abuse, and prudential requirements. Firms that hold cryptoassets for customers will have to follow safeguarding rules. Existing registrations do not convert automatically: firms must apply, and those that apply within the window can keep operating while they are assessed. The FCA has also published guidance on where the regime's boundary sits.
Source: FCA: Overview of our cryptoassets regime policy statements (30 June 2026), FCA: Framework for cryptoasset regulation in the UK: what you need to know, FCA: How the gateway will operate, FCA: PS26/18: Cryptoasset perimeter guidance.
Source: FCA: Framework for cryptoasset regulation in the UK: what you need to know, FCA: PS26/18: Cryptoasset perimeter guidance.
Protection under the new regime is not the same as a guarantee. The FCA's consumer guidance says to be prepared to lose all the money you put into crypto.
Source: FCA: InvestSmart: crypto basics (high risk, be prepared to lose all the money).
The short version: US
- There is no single federal crypto regulator. FinCEN applies anti money laundering rules, the SEC oversees securities, and the CFTC oversees commodities markets.
- Since March 2026, a joint SEC and CFTC interpretation names bitcoin as an example of a digital commodity, not a security.
- The GENIUS Act, on payment stablecoins, is law and takes effect on 18 January 2027.
- The CLARITY Act, a market structure bill, is not law. It passed the House in July 2025 and stalled in the Senate in September 2026.
- States regulate too. New York's BitLicense is a well known example.
- Bitcoin is not covered by FDIC deposit insurance, and SIPC does not protect digital assets that are not securities.
How the US rules have developed
- FinCEN guidance
Exchangers and administrators of virtual currency are money transmitters under the Bank Secrecy Act. Users are not.
Source: FinCEN: FIN-2013-G001: persons administering, exchanging or using virtual currencies, 18 March 2013.
- New York BitLicense
New York's virtual currency regulation, 23 NYCRR Part 200, takes effect.
Source: New York DFS: Virtual currency businesses and the BitLicense (23 NYCRR Part 200), Cornell LII: 23 NYCRR 200.3: licence requirement and exemptions.
- FinCEN consolidated guidance
FinCEN sets out how its rules apply to common business models using convertible virtual currency.
Source: FinCEN: FIN-2019-G001: business models involving convertible virtual currencies (PDF).
- Bank regulators change course
The OCC confirms crypto custody is permissible for national banks. The FDIC and the Federal Reserve follow in March and April.
Source: OCC: Interpretive Letter 1183 on bank crypto activities, 7 March 2025, FDIC: FIL-7-2025: process for banks to engage in crypto related activities, 28 March 2025, Federal Reserve Board: Withdrawal of guidance on crypto asset and dollar token activities, 24 April 2025.
- CLARITY Act passes the House
A market structure bill passes the House of Representatives by 294 votes to 134. It is not law.
- GENIUS Act becomes law
A federal framework for payment stablecoins, Public Law 119-27.
Source: Congress.gov: S.1582, GENIUS Act (Public Law 119-27).
- SEC and CFTC interpretation
A joint interpretation takes effect. It names bitcoin as an example of a digital commodity, not a security.
- CLARITY Act stalls in the Senate
A Senate vote to proceed to the bill fails by 49 to 50. A motion to reconsider was entered.
- OCC final rule under the GENIUS Act
The OCC issues its final rule for the stablecoin issuers it supervises.
Source: OCC: OCC issues final rule implementing the GENIUS Act, 21 October 2026.
- GENIUS Act takes effect
The Act and the OCC rule take effect, according to the OCC.
Source: OCC: OCC issues final rule implementing the GENIUS Act, 21 October 2026.
Hollow markers are dates still to come.
Who does what at federal level
| Body | Role for bitcoin | What it means for a company holder |
|---|---|---|
| FinCEN | Applies the Bank Secrecy Act. Businesses that exchange or transmit virtual currency for others are money transmitters and must register and run anti money laundering programmes. | Your provider must check the company. A user acting on its own behalf is not a money transmitter. |
| SEC | Oversees securities. Its March 2026 interpretation, issued with the CFTC, names bitcoin as a digital commodity rather than a security. | Bitcoin held directly is not treated as a security under that interpretation. Shares in an exchange traded product that holds bitcoin are a different thing and are securities. |
| CFTC | Oversees commodity futures and other derivatives markets. In spot markets, where bitcoin is bought for cash, it has authority in cases of fraud or manipulation. | How oversight of spot markets is split between the CFTC and the SEC is what the CLARITY Act would set out. |
| Bank regulators (OCC, FDIC, Federal Reserve) | Supervise banks, including any crypto custody they offer. | Since 2025, banks need no prior approval to offer permissible crypto activities. |
Source: FinCEN: FIN-2013-G001: persons administering, exchanging or using virtual currencies, 18 March 2013, FinCEN: FIN-2019-G001: business models involving convertible virtual currencies (PDF), SEC: Release 33-11412: application of the federal securities laws to certain types of crypto assets, March 2026, SEC: Release No. 34-99306 (January 10, 2024): order approving the listing and trading of spot bitcoin exchange-traded products, CFTC Whistleblower Program: Jurisdiction over spot markets: CFTC has authority in fraud or manipulation cases, Congress.gov: H.R.3633, CLARITY Act: all actions, OCC: Interpretive Letter 1183 on bank crypto activities, 7 March 2025, FDIC: FIL-7-2025: process for banks to engage in crypto related activities, 28 March 2025.
The SEC interpretation is an agency interpretation, not a statute. An agency can revise an interpretation, so check the current position before relying on it.
Law and proposals: keep them apart
| Item | Status at 29 October 2026 | What it does |
|---|---|---|
| Bank Secrecy Act and FinCEN rules | In force | Registration and anti money laundering duties for money transmitters, including virtual currency businesses. |
| GENIUS Act (S.1582) | Law, Public Law 119-27 of 18 July 2025. Takes effect 18 January 2027. | A federal framework for issuing payment stablecoins. It is about stablecoins, not bitcoin. Further rules, including anti money laundering rules, are still to come. |
| SEC and CFTC interpretation, Release 33-11412 | In effect from 23 March 2026, as an agency interpretation. | Explains how the securities laws apply to types of crypto asset, and names bitcoin as a digital commodity. |
| CLARITY Act (H.R.3633) | Proposed, not law. Passed the House 17 July 2025. Reported by the Senate Banking Committee 1 June 2026. A Senate vote to proceed failed on 15 September 2026. | Would set out how oversight of digital asset markets is split between the SEC and the CFTC. |
| Digital Asset Tax Certainty Act (H.R.10357) | Proposed, not law. Introduced 14 September 2026 and ordered reported by the Ways and Means Committee. | A tax bill, including the wash sale rule for digital assets. See selling or rebalancing. |
| State regimes such as the BitLicense | In force, and different in each state. | State licensing of virtual currency businesses and money transmitters. |
Source: FinCEN: FIN-2019-G001: business models involving convertible virtual currencies (PDF), Congress.gov: S.1582, GENIUS Act (Public Law 119-27), OCC: OCC issues final rule implementing the GENIUS Act, 21 October 2026, SEC: Release 33-11412: application of the federal securities laws to certain types of crypto assets, March 2026, Congress.gov: H.R.3633, CLARITY Act: all actions, Congress.gov: H.R.10357, Digital Asset Tax Certainty Act: all actions, New York DFS: Virtual currency businesses and the BitLicense (23 NYCRR Part 200).
State rules
New York's BitLicense, in force since 24 June 2015, requires a licence for virtual currency business activity involving New York or a New York resident, including holding or controlling virtual currency on behalf of others. It exempts merchants and consumers that use virtual currency solely to buy or sell goods or services or for investment purposes. Other states have their own money transmitter and virtual currency laws, which differ. This site has not checked every state.
Source: New York DFS: Virtual currency businesses and the BitLicense (23 NYCRR Part 200), Cornell LII: 23 NYCRR 200.2: definitions, including virtual currency business activity, Cornell LII: 23 NYCRR 200.3: licence requirement and exemptions.
Source: FinCEN: FIN-2014-R001: virtual currency mining operations (a user for its own purposes is not an MSB), FinCEN: FIN-2019-G001: business models involving convertible virtual currencies (PDF), Cornell LII: 23 NYCRR 200.3: licence requirement and exemptions.
What insurance can and cannot cover
In neither country does a government scheme protect bitcoin in the way it protects bank deposits. In the UK, there is usually no FSCS cover. In the US, FDIC deposit insurance does not cover crypto assets, and SIPC does not protect digital assets that are not securities.
Source: FCA: Cryptoassets: AML and CTF regime (registration, no FSCS or Ombudsman cover), FDIC: Fact sheet: what the public needs to know about FDIC deposit insurance and crypto companies, SIPC: What SIPC protects (not digital assets that are not securities).
Insurance is the main way to transfer some risks. Specialist cover for cryptoassets is usually written in the crime and fidelity market or the specie market, which also insures items such as bullion and fine art. A broker, Lockton, says custody insurance for cold storage will "typically provide protection for the following risk exposures":
- "Physical destruction of devices that store private keys (or parts of keys) by fire, flood, windstorm, earthquake, and other natural perils";
- "Theft of devices, by employees or third parties at sites that store private keys (or parts of keys)";
- "Theft or copying of private keys by employees or third parties while in transit from their place of custody".
The same broker says this cover can suit firms that hold digital assets for their own interests as well as for others, and lists the controls insurers look for, including multisig such as 2 of 3, withdrawal allow lists, physical security and telling insurers when signers change.
Source: Lockton (insurance broker): Cryptocurrency insurance: best practices for custodians.
| Situation | What insurance may cover | What it usually will not |
|---|---|---|
| Company self custody in a 2 of 3 multisig | Some specialist policies cover theft or destruction of key devices and backups, if the insurer accepts the controls. Availability, limits and price vary widely. | Losses from the company's own mistakes, such as sending to a wrong address or losing too many keys, unless the policy says otherwise. |
| Bitcoin held by a custodian | The custodian may hold its own crime or specie policy. That policy belongs to the custodian, has a limit, and may be shared across all its customers. | A fall in price, and any loss outside the policy wording. The custodian's insurance is not a promise that your coins are covered in full. |
| Any arrangement | Only the events named in the policy. | Market falls. Insurance covers loss events, not changes in value. |
Points of uncertainty: policy wordings are private and vary, so this page cannot say what any particular policy covers. Do not assume an existing office, cyber or crime policy covers bitcoin. Ask in writing.
Questions to put to a broker or custodian
- Which events are covered, and which are excluded? Ask for the wording, not a summary.
- What is the limit, is it per claim or in total, and is it shared with other customers?
- Is the company a named insured or beneficiary, or is the cover only the custodian's?
- Does it cover keys and backups in all the places the company keeps them, and in transit?
- Which controls must be in place, and what must be reported when signers or locations change?
- In the UK: is the custodian registered with the FCA today, and has it applied for authorisation under the new regime?
- In the US: is the custodian a bank or trust company, or a licensed money transmitter, and in which states?
Read next
- Custody guide: multisig, collaborative custody and custodians compared.
- Using a custodian
- Board meeting checklist: questions for directors.
- Security lessons: documented incidents as practical lessons.
Sources
Primary sources only. Each link was checked on 29 October 2026. Rules change, so confirm the current version with your adviser.
- FCACryptoassets: AML and CTF regime (registration, no FSCS or Ombudsman cover)
- FCAExpectations for UK cryptoasset businesses complying with the Travel Rule
- FCARegulating financial promotions and adverts
- FCAFCA opens gateway for regulated crypto, 30 September 2026
- FCAOverview of our cryptoassets regime policy statements (30 June 2026)
- FCAHow the gateway will operate
- FCAFramework for cryptoasset regulation in the UK: what you need to know
- FCAPS26/18: Cryptoasset perimeter guidance
- FCAInvestSmart: crypto basics (high risk, be prepared to lose all the money)
- FinCENFIN-2013-G001: persons administering, exchanging or using virtual currencies, 18 March 2013
- New York DFSVirtual currency businesses and the BitLicense (23 NYCRR Part 200)
- Cornell LII23 NYCRR 200.3: licence requirement and exemptions
- FinCENFIN-2019-G001: business models involving convertible virtual currencies (PDF)
- OCCInterpretive Letter 1183 on bank crypto activities, 7 March 2025
- FDICFIL-7-2025: process for banks to engage in crypto related activities, 28 March 2025
- Federal Reserve BoardWithdrawal of guidance on crypto asset and dollar token activities, 24 April 2025
- Congress.govH.R.3633, CLARITY Act: all actions
- Congress.govS.1582, GENIUS Act (Public Law 119-27)
- SECRelease 33-11412: application of the federal securities laws to certain types of crypto assets, March 2026
- OCCOCC issues final rule implementing the GENIUS Act, 21 October 2026
- SECRelease No. 34-99306 (January 10, 2024): order approving the listing and trading of spot bitcoin exchange-traded products
- CFTC Whistleblower ProgramJurisdiction over spot markets: CFTC has authority in fraud or manipulation cases
- Congress.govH.R.10357, Digital Asset Tax Certainty Act: all actions
- Cornell LII23 NYCRR 200.2: definitions, including virtual currency business activity
- FinCENFIN-2014-R001: virtual currency mining operations (a user for its own purposes is not an MSB)
- FDICFact sheet: what the public needs to know about FDIC deposit insurance and crypto companies
- SIPCWhat SIPC protects (not digital assets that are not securities)
- Lockton (insurance broker)Cryptocurrency insurance: best practices for custodians
One email. The whole library.
Policy checklist, board paper, recovery drill record, document pack and the rest, in one send. Then one short Thursday lesson for small companies in the UK and the US.
Free. One email with the whole template library, then one short lesson each Thursday. Unsubscribe at any time. See our privacy notice.
This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.
Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.
Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.