Sources checked 10 November 2026. This page is education for companies that hold, or are considering holding, bitcoin. It separates facts, scheduled developments, proposals and uncertain scenarios, including setbacks. It is not a forecast of price, adoption or regulation, and it is not advice to buy, sell or hold.
Short answer
Bitcoin's rules are public, but they are not frozen. Some things are already known and dated: the subsidy schedule, past soft forks, the US and UK regulatory steps already taken. Others are only proposals, such as the draft quantum BIPs and US market structure bills. Many outcomes are genuinely uncertain, including setbacks. Companies should watch adoption evidence, regulation with named jurisdictions and dates, how payments scale, how miners are paid as the subsidy falls, quantum risk to signatures, and how protocol changes are proposed and activated. The useful response is a policy review cycle, not a forecast. Keep custody in multisig, keep liquidity plans current, and review the board policy when the evidence changes.
Four kinds of statement
| Kind | What it means | How this page treats it |
|---|---|---|
| Fact | Something already observable or published in a primary source. | Stated as fact, with a citation. |
| Scheduled development | A dated rule, gateway or statutory start that has been published. | Named with jurisdiction and effective date where known. |
| Proposal | A draft BIP, bill or consultation that is not activated law or consensus. | Labelled as a proposal. Outcome unknown. |
| Uncertain scenario | A path that could happen, including setbacks. | Described as uncertain. No probabilities dressed up as forecasts. |
Known developments, with dates
Each row below is taken from a primary source opened on 10 November 2026. Status words such as Draft and Deployed are the ones used in the BIPs repository.
| Area | Development | Date or status | Kind |
|---|---|---|---|
| Protocol | Fourth halving: subsidy fell to 3.125 BTC at block 840,000 | 20 April 2024 | Fact |
| Protocol | Next halving at block 1,050,000, subsidy to 1.5625 BTC | Around April 2028 (estimate) | Scheduled, date estimated |
| Protocol | Taproot (BIP 341) activated | Block 709,632, 14 November 2021 | Fact |
| Protocol | BIP 3, updated process for writing and tracking BIPs, replacing BIP 2 | Deployed | Fact |
| Quantum | NIST finalised its first post quantum standards | August 2024 | Fact |
| Quantum | BIP 360, Pay-to-Merkle-Root (P2MR) | Draft | Proposal |
| Quantum | BIP 361, post quantum migration and legacy signature sunset | Draft | Proposal |
| US | SEC order approving spot bitcoin exchange traded products | 10 January 2024 | Fact |
| US | GENIUS Act on payment stablecoins, Public Law 119-27; OCC final rule | OCC rule announced 21 October 2026 | Fact |
| US | CLARITY Act (H.R.3633): passed the House; Senate vote to proceed failed | House 17 July 2025; Senate 15 September 2026 | Proposal, stalled |
| UK | Retail access to crypto exchange traded notes | In force 8 October 2025 | Fact |
| UK | FCA gateway for the new cryptoasset regime opened | 30 September 2026; apply by 28 February 2027 | Fact |
| UK | New cryptoasset regime comes into force | 25 October 2027 (expected) | Scheduled |
Source: mempool.space: Block 840,000, the fourth halving (20 April 2024), Bitcoin Core: src/validation.cpp: GetBlockSubsidy, 50 BTC halved every 210,000 blocks, Bitcoin BIPs: BIP 341: Taproot, deployment section (activated at height 709632), mempool.space: Block 709,632, timestamp 14 November 2021 (Taproot activation height), Bitcoin BIPs: BIP 3: Updated BIP Process (status Deployed; replaces BIP 2), NIST: NIST releases first three finalised post quantum encryption standards (August 2024), Bitcoin BIPs: BIP 360: Pay-to-Merkle-Root (P2MR), status Draft, Bitcoin BIPs: BIP 361: Post Quantum Migration and Legacy Signature Sunset, status Draft (Informational), SEC: Release No. 34-99306 (January 10, 2024): order approving the listing and trading of spot bitcoin exchange-traded products, Congress.gov: S.1582, GENIUS Act (Public Law 119-27), OCC: News release 2026-92: final rule to implement the GENIUS Act, 21 October 2026, Congress.gov: H.R.3633, Digital Asset Market Clarity Act: all actions (House passage 17 July 2025; Senate cloture not invoked 15 September 2026), FCA: FCA opens retail access to crypto ETNs (in force 8 October 2025), FCA: FCA opens the gateway to regulated crypto, 30 September 2026 (apply by 28 February 2027; regime from 25 October 2027), FCA: A new regime for cryptoasset regulation (last updated 2 November 2026).
The halving month is an estimate based on the 10 minute block target. See the halving guide for the live countdown and method.
Adoption
Facts. Bitcoin began with a public white paper and open source software. Companies, funds and individuals can hold bitcoin, run nodes and verify the chain without asking a central issuer for permission. In the US, the SEC approved the listing of spot bitcoin exchange traded products on 10 January 2024. In the UK, the FCA allowed retail access to crypto exchange traded notes from 8 October 2025. Both give companies one way to hold price exposure without managing keys. See custody: exchange traded products and small company treasuries.
Source: Satoshi Nakamoto: Bitcoin: A Peer-to-Peer Electronic Cash System (bitcoin.org PDF), SEC: Release No. 34-99306 (January 10, 2024): order approving the listing and trading of spot bitcoin exchange-traded products, FCA: FCA opens retail access to crypto ETNs (in force 8 October 2025).
Uncertain scenarios. Wider company use, narrower use, or long periods where treasury adoption stalls are all possible. Payments use, savings use and speculative trading can move in different directions. Some companies that adopted bitcoin may reduce or sell holdings. This page does not rank those outcomes, and new products or listings are not evidence of future price.
Scaling and payments
Facts. Base layer bitcoin settles in blocks with limited space. Fees rise when demand for that space is high. Secondary layers and payment networks, including the Lightning Network whose BOLT specifications are published, aim to move smaller or faster payments off the base chain while still anchoring to it. Taproot (BIP 341), which activated on 14 November 2021, aimed to improve the privacy, efficiency and flexibility of bitcoin's scripting, which matters for multisig.
Source: Lightning Network: BOLT specifications (Basis of Lightning Technology), Bitcoin BIPs: BIP 341: Taproot, deployment section (activated at height 709632), mempool.space: Block 709,632, timestamp 14 November 2021 (Taproot activation height).
Proposals and uncertain scenarios. Soft forks, new output types and wallet policies can change what is efficient to do on chain. Lightning and similar systems have their own operational and custody trade offs for a company: channel liquidity, hot keys on an online node, and backup of channel state. See Lightning for business payments. Setbacks such as buggy implementations, liquidity shortages in payment channels, or low merchant use are part of a balanced watch list. For a treasury, the practical point is that payment layers do not replace cold multisig custody for reserves.
Mining incentives, fees and the security budget
Facts. Miners are paid from the block subsidy plus fees. The subsidy halves every 210,000 blocks on a published schedule and is now 3.125 BTC per block. Difficulty adjusts so that block times stay near the design target as hash rate changes.
Source: Bitcoin Core: src/validation.cpp: GetBlockSubsidy, 50 BTC halved every 210,000 blocks, Bitcoin developer documentation: Mining: proof of work, difficulty and the block reward, Bitcoin BIPs: BIP 42: A finite monetary supply for Bitcoin.
A snapshot, not a forecast. Over the 2,016 blocks ending at height 975,286 (checked 10 November 2026, 10:40 UTC), mempool.space reported fees of 4,063,763,216 satoshis out of total miner revenue of 634,063,763,216 satoshis. That is about 0.64%. The rest is exactly 2,016 times the 3.125 BTC subsidy. Fee share changes with demand for block space, so one window says nothing about a future era.
Uncertain scenarios. How large fee income will be relative to the falling subsidy, whether hash rate concentrates or disperses, and how those trends affect settlement security over decades, are open. Some argue fees will grow with use; others see a long-term security budget problem. Companies cannot control either path. A treasury policy should assume that network conditions can worsen as well as improve, and should not treat miner revenue as a company forecast. For the schedule, the history table and what a halving does and does not change for a company, see the bitcoin halving and the four-year cycle. If the company is thinking of mining itself, see should your company mine bitcoin?
Quantum risk
Facts. Bitcoin signatures today rely on elliptic curve cryptography. A large enough fault tolerant quantum computer running Shor's algorithm would threaten those signatures. NIST finalised post quantum signature standards in August 2024 (including ML-DSA and SLH-DSA). No post quantum bitcoin output type is active on the network today. BIP 360's authors write that it is unclear when or if such computers will become viable.
Source: NIST: NIST releases first three finalised post quantum encryption standards (August 2024), Bitcoin BIPs: BIP 360: Pay-to-Merkle-Root (P2MR), status Draft, Bitcoin Optech: Topic: quantum resistance.
Proposals. Two draft BIPs set out possible paths. Both have status Draft in the BIPs repository, which means neither is activated or agreed:
| Proposal | What it would do | Limits stated in the text |
|---|---|---|
| BIP 360: Pay-to-Merkle-Root (P2MR) | A new output type, added by soft fork, that works much like Taproot but with the key path spend removed, so coins are not left on a visible public key. | Resists only long exposure attacks, on keys visible for longer than it takes to confirm a spend. Protection against short exposure attacks may need post quantum signatures in a later proposal. |
| BIP 361: Post quantum migration and legacy signature sunset | Phase A would stop sends to quantum vulnerable addresses, about 160,000 blocks (around 3 years) after activation. Phase B, 2 years after Phase A, would restrict old style ECDSA and Schnorr spends behind a quantum safe rescue process. | Informational. It requires a post quantum signature BIP that does not exist yet ("TBD"). Coins whose owners never migrate would stay unspendable. |
Source: Bitcoin BIPs: BIP 360: Pay-to-Merkle-Root (P2MR), status Draft, Bitcoin BIPs: BIP 361: Post Quantum Migration and Legacy Signature Sunset, status Draft (Informational).
Uncertain scenarios include long delays before any migration, contentious activation debates, and coins left on exposed keys. BIP 361 in particular would restrict coins whose owners do not act, which raises questions beyond the technical ones. For company actions that make sense now (avoid address reuse, keep multisig hygiene, keep firmware and wallet software current, ignore unsolicited "quantum safe" migration offers), see bitcoin and quantum computing.
How protocol changes are made
Facts. Changes are discussed publicly. Bitcoin Improvement Proposals (BIPs) document designs, and BIP 3, now Deployed, sets out the current process for writing and tracking them, replacing BIP 2. A status such as Draft or Deployed records where a document stands. It is not a vote. Running node software enforces consensus rules. Users, miners, developers and businesses can support, reject or delay a change by what they run and what they accept. There is no single company that can push a rule change by decree.
Source: Bitcoin BIPs: Bitcoin Improvement Proposals repository and status table, Bitcoin BIPs: BIP 3: Updated BIP Process (status Deployed; replaces BIP 2).
How activation has worked. BIP 9 (version bits with timeout) and BIP 8 (version bits with lock in by height) describe ways miners can signal readiness for a soft fork. Taproot used a modified BIP 9 deployment with a 90% signalling threshold (1,815 of 2,016 blocks) and a minimum activation height, and it activated at block 709,632. Future changes may use a similar method or a different one. That choice is itself part of the debate.
Source: Bitcoin BIPs: BIP 9: Version bits with timeout and delay (status Deployed), Bitcoin BIPs: BIP 8: Version bits with lock-in by height (status Complete), Bitcoin BIPs: BIP 341: Taproot, deployment section (activated at height 709632).
Setbacks that have happened, and ones that could
A balanced view includes the bad days. Two documented examples show the kind of event a company should plan around:
- March 2013 chain split. BIP 50 records that a block accepted by Bitcoin 0.8 nodes was rejected by some older nodes, splitting the chain. Mining pools downgraded so the chain without the large block won, and the split resolved.
- CVE-2018-17144. Bitcoin Core disclosed in September 2018 that a bug fixed in versions 0.16.3 and 0.17.0rc4 included a critical inflation vulnerability as well as a denial of service issue. The project said it was unaware of any attempt to exploit it.
- Regulation can stall. The CLARITY Act passed the House on 17 July 2025, but on 15 September 2026 the Senate did not invoke cloture on the motion to proceed (49 to 50). A bill that looks close can stop.
Source: Bitcoin BIPs: BIP 50: March 2013 chain fork post-mortem, Bitcoin Core: Disclosure of CVE-2018-17144 (fixed in 0.16.3 and 0.17.0rc4, September 2018), Congress.gov: H.R.3633, Digital Asset Market Clarity Act: all actions (House passage 17 July 2025; Senate cloture not invoked 15 September 2026).
Uncertain scenarios a company should not rule out: a contentious soft fork with temporary split risk, a serious software bug, long periods of high fees or of very low fee income, a custodian or exchange failure, banking access tightening, slow progress on quantum migration, and adoption going backwards. None of these is predicted here. Each is a reason to keep keys in multisig, test recovery, run or use a node you trust, and keep a written plan for selling or pausing activity. See the recovery drill, continuity and security lessons.
Regulation is jurisdiction specific. Choose your country for dated developments.
The short version: UK
- The FCA opened a gateway for the future cryptoasset authorisation regime on 30 September 2026. Firms that want to keep operating should apply by 28 February 2027.
- The new regime is expected to come into force on 25 October 2027. Authorisation is not automatic.
- A company that only holds its own bitcoin is not automatically a cryptoasset service provider; the firms it uses face new authorisation timelines.
- Watch promotions, reporting and provider status as October 2027 approaches.
UK: scheduled regulation
Scheduled developments. On 30 September 2026 the FCA announced that it had opened the gateway for firms preparing for the new cryptoasset regime, and said firms intending to continue operating in the UK should apply by 28 February 2027, ahead of the regime coming into force on 25 October 2027. Separate FCA materials explain how the gateway operates and set out perimeter guidance in PS26/18. For what that means for a company that only holds its own bitcoin, use the dedicated page rather than this summary: UK crypto regime from October 2027.
Source: FCA: FCA opens the gateway to regulated crypto, 30 September 2026 (apply by 28 February 2027; regime from 25 October 2027), FCA: A new regime for cryptoasset regulation (last updated 2 November 2026), FCA: How the gateway will operate, FCA: PS26/18: Cryptoasset perimeter guidance.
Company implications. Revisit which providers you rely on for buying, custody or payments; check whether they are on a path to authorisation; keep board policy language aligned with "own account" versus "service to others"; and do not assume today's FCA AML registration map is the permanent end state. See also US and UK rules compared.
The short version: US
- The GENIUS Act (Public Law 119-27) addresses payment stablecoins; the OCC announced a final rule implementing it on 21 October 2026.
- The CLARITY Act passed the House on 17 July 2025. On 15 September 2026 the Senate did not invoke cloture on the motion to proceed. It is not law.
- Securities, commodities, banking and tax rules still apply on their own terms.
- Check each bill's actual status on Congress.gov before a board paper relies on it.
US: published statutes and open bills
Scheduled and enacted pieces. The GENIUS Act is Public Law 119-27. The OCC announced a final rule implementing it on 21 October 2026. That package is about payment stablecoins, not a rewrite of bitcoin's consensus rules, but it changes the wider US digital asset compliance landscape banks and payment firms operate in.
Source: Congress.gov: S.1582, GENIUS Act (Public Law 119-27), OCC: News release 2026-92: final rule to implement the GENIUS Act, 21 October 2026.
Proposals. H.R.3633, the Digital Asset Market Clarity Act, passed the House by 294 to 134 on 17 July 2025. The Senate Banking Committee reported it with a substitute amendment on 1 June 2026. On 15 September 2026 cloture on the motion to proceed was not invoked, by 49 to 50, and a motion to reconsider was entered the same day. Until enacted and effective, treat it as a proposal. Agency guidance from the SEC, CFTC, FinCEN, OCC, FDIC and Federal Reserve can change with new releases. Verify dates on the primary pages before a board paper relies on them.
Company implications. Watch banking access, custodian supervision, exchange traded product rules and tax information reporting (including Form 1099-DA timelines) rather than headlines. See rules and insurance, Form 1099-DA and company tax (US).
What companies should watch in practice
| Watch item | Where to look | What it should trigger |
|---|---|---|
| Protocol proposals that touch your script type | BIPs repository status table, Bitcoin Optech | A check that your wallet software and signing devices support any change before you rely on it. |
| Quantum migration proposals | BIP 360, BIP 361, Optech topic page | Address hygiene now; a migration plan only once a post quantum output type is active. |
| Fee conditions | Live fees on the market context page | Timing of consolidations and sales; no change to the allocation rule. |
| UK regime and provider status | FCA regime pages and register | Provider due diligence before 25 October 2027. |
| US bills and agency rules | Congress.gov all actions pages, agency releases | An update to the board paper only when status actually changes. |
| Software security advisories | Bitcoin Core security advisories, signer vendor notices | Patching and a recovery test where relevant. |
- Custody: keyholder continuity, recovery drills, steel backups and whether a proposed soft fork affects your script type. Prefer multisig for company funds. Never rely on single signature custody.
- Liquidity: how you would sell or rebalance under policy if fees spike, an exchange pauses withdrawals, or banking rails slow.
- Policy review: a yearly board review that asks what changed in regulation, custody providers, tax reporting and network conditions.
- Monitoring: primary sources (FCA, Congress.gov, IRS, BIPs, Optech) over social media claims. See methodology and sources.
Common questions
Is a quantum upgrade already scheduled?
No. BIP 360 and BIP 361 both have status Draft. No post quantum output type is active, and BIP 361 depends on a post quantum signature BIP that has not been written yet.
Can one company or developer change bitcoin's rules?
No. A proposal can be written by anyone, but a consensus change only takes effect if the software people run enforces it. Past soft forks, such as Taproot, needed wide signalling and node upgrades.
Will fees replace the block subsidy?
That is an open question, not a forecast. Recent windows have shown fees as well under 1% of miner revenue, but fee share varies. See the security budget section of the halving guide.
Is the CLARITY Act law?
No. It passed the House in July 2025, but the Senate did not invoke cloture on the motion to proceed on 15 September 2026. Check Congress.gov for any later action.
Does the UK regime affect a company that just holds bitcoin?
Holding your own bitcoin is not, by itself, providing a cryptoasset service. The firms you buy from or store with are the ones that need authorisation. See the UK regime page.
Should the policy change because of any of this?
Only when the evidence changes, and through the normal review. Write the review cycle into the treasury policy so a headline does not become a decision.
Common mistakes
- Treating a draft BIP or a bill that passed one chamber as settled.
- Buying or selling because of a forecast about adoption, regulation or the halving.
- Answering unsolicited "quantum safe" migration offers, or moving coins to a scheme that promises protection.
- Assuming a provider will be authorised under the UK regime without checking.
- Ignoring software advisories for wallets, nodes and signing devices.
- Reading one week's fee share as a forecast of network security.
- Letting a watch list replace basic custody discipline. Multisig, tested recovery and a written policy matter more than any single future development.
Open points
- Which, if any, post quantum bitcoin proposals will activate, and on what timeline.
- How fee markets will behave across future subsidy eras.
- Final shape and timing of UK authorised cryptoasset services after the gateway.
- Whether US market structure bills beyond the GENIUS Act are enacted, revived or rewritten.
Read next
- The halving and the four-year cycle, subsidy, fees and why a four-year price cycle is a weak basis for decisions.
- Bitcoin and quantum computing, exposed keys and draft BIPs.
- Should your company mine bitcoin?, mining as an operating activity.
- UK crypto regime from October 2027, own account versus providers.
- US and UK rules compared, side by side.
- Running your own node, verify the chain.
- Treasury policy, write the review cycle down.
Sources
Primary sources only. Each link was checked on 10 November 2026. Rules change, so confirm the current version with your adviser.
- mempool.spaceBlock 840,000, the fourth halving (20 April 2024)
- Bitcoin Coresrc/validation.cpp: GetBlockSubsidy, 50 BTC halved every 210,000 blocks
- Bitcoin BIPsBIP 341: Taproot, deployment section (activated at height 709632)
- mempool.spaceBlock 709,632, timestamp 14 November 2021 (Taproot activation height)
- Bitcoin BIPsBIP 3: Updated BIP Process (status Deployed; replaces BIP 2)
- NISTNIST releases first three finalised post quantum encryption standards (August 2024)
- Bitcoin BIPsBIP 360: Pay-to-Merkle-Root (P2MR), status Draft
- Bitcoin BIPsBIP 361: Post Quantum Migration and Legacy Signature Sunset, status Draft (Informational)
- SECRelease No. 34-99306 (January 10, 2024): order approving the listing and trading of spot bitcoin exchange-traded products
- Congress.govS.1582, GENIUS Act (Public Law 119-27)
- OCCNews release 2026-92: final rule to implement the GENIUS Act, 21 October 2026
- Congress.govH.R.3633, Digital Asset Market Clarity Act: all actions (House passage 17 July 2025; Senate cloture not invoked 15 September 2026)
- FCAFCA opens retail access to crypto ETNs (in force 8 October 2025)
- FCAFCA opens the gateway to regulated crypto, 30 September 2026 (apply by 28 February 2027; regime from 25 October 2027)
- FCAA new regime for cryptoasset regulation (last updated 2 November 2026)
- Satoshi NakamotoBitcoin: A Peer-to-Peer Electronic Cash System (bitcoin.org PDF)
- Lightning NetworkBOLT specifications (Basis of Lightning Technology)
- Bitcoin developer documentationMining: proof of work, difficulty and the block reward
- Bitcoin BIPsBIP 42: A finite monetary supply for Bitcoin
- mempool.spaceMining reward stats for the 2,016 blocks ending at 975,286 (checked 10 November 2026, 10:40 UTC)
- Bitcoin OptechTopic: quantum resistance
- Bitcoin BIPsBitcoin Improvement Proposals repository and status table
- Bitcoin BIPsBIP 9: Version bits with timeout and delay (status Deployed)
- Bitcoin BIPsBIP 8: Version bits with lock-in by height (status Complete)
- Bitcoin BIPsBIP 50: March 2013 chain fork post-mortem
- Bitcoin CoreDisclosure of CVE-2018-17144 (fixed in 0.16.3 and 0.17.0rc4, September 2018)
- FCAHow the gateway will operate
- FCAPS26/18: Cryptoasset perimeter guidance
One email. The whole library.
Policy checklist, board paper, recovery drill record, document pack and the rest, in one send. Then one short Thursday lesson for small companies in the UK and the US.
Free. One email with the whole template library, then one short lesson each Thursday. Unsubscribe at any time. See our privacy notice.
This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.
Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.
Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.