Beyond the SEC: Mapping US Crypto Enforcement in 2026

It’s Not Just the SEC

Every time a crypto exchange gets sued, settles, or walks away clean in the United States, the story gets filed under one name: the SEC. That shorthand is doing more work than it can actually support. The Securities and Exchange Commission is the loudest regulator in the room and the one crypto Twitter argues about most, but it shares the floor with at least five other authorities that can each, independently, end a company or send a founder to prison. Treating SEC enforcement as a stand in for US crypto enforcement misses most of the actual risk.

The Commodity Futures Trading Commission polices derivatives and, increasingly, spot markets. The Department of Justice brings criminal charges that can put someone behind bars regardless of what the SEC decides to do civilly. The Financial Crimes Enforcement Network, a bureau of the Treasury Department, writes and enforces the anti-money-laundering rules that almost every exchange operates under. The Office of Foreign Assets Control, also housed at Treasury, can freeze an entire protocol’s usability overnight with a sanctions designation, no court case required first. And beneath all of that sits a patchwork of state regulators, New York’s Department of Financial Services chief among them, licensing and fining crypto businesses on an entirely separate timeline.

No case illustrates this better than Binance, touched by four federal agencies in a single coordinated resolution, sued separately by a fifth, and then pardoned by the president of the United States. That case, alongside Terraform Labs’ civil settlement and Do Kwon’s fifteen-year prison sentence, and the unresolved fight over Tornado Cash, is the throughline for what follows: a map of who actually enforces crypto law in the United States, how the pieces fit together, and where the seams still show.

What the SEC Actually Does, and Where Its Authority Stops

The SEC’s jurisdiction comes from the Securities Act of 1933 and the Securities Exchange Act of 1934, and it only reaches conduct that qualifies as a security, typically measured against the Howey test. Under Chair Paul Atkins, who took over from Gary Gensler in April 2025, the Commission has narrowed how often it reaches for that label. A March 2026 interpretive release sorted crypto assets into five categories (digital commodities, digital collectibles, digital tools, payment stablecoins, and digital securities) and said outright that most tokens do not belong in the last bucket.

The numbers back up the shift. Fiscal year 2025 saw only 13 crypto-related enforcement actions against 33 the year before, a 60 percent drop, according to the SEC’s own FY2025 enforcement results. The Commission also voted to end its case against Coinbase in early 2025, one of roughly seventeen dismissals, settlements, or closed investigations that year.

What the SEC cannot do is put anyone in prison. Its penalties are civil: fines, disgorgement of profits, injunctions barring someone from the industry. Fraud itself is not the SEC’s exclusive territory either, and it keeps prosecuting straightforward fraud even as its registration theories retreat, including a mid-2026 case against a fake AI trading bot scheme. For everything beyond fines and industry bans, the government reaches for a different agency entirely.

The CFTC’s New Seat at the Table

The Commodity Futures Trading Commission has always had a claim on crypto, just a narrower one than most people assume. Bitcoin and Ether are legally commodities, which gives the CFTC anti-fraud and anti-manipulation authority over their spot markets, but the agency lacked a full registration and disclosure regime for spot crypto trading the way the SEC has for securities. Its clearest jurisdiction has always been derivatives: futures, swaps, and, as of the past two years, prediction markets.

The CFTC already had a crypto enforcement record before any of the 2025-2026 policy shift. In November 2023 it settled its own civil case against Binance over illegally operating an unregistered digital asset derivatives exchange, part of the same coordinated global resolution described later in this piece, years before its current chair ever arrived.

What changed the agency’s profile more than any single case was that new chair. Michael Selig, previously chief counsel of the SEC’s own Crypto Task Force and a senior advisor to Atkins, was nominated in October 2025, confirmed by the Senate in December, and sworn in as the sixteenth CFTC chairman that same month. Selig has pushed hard for the pending market structure bill in Congress, calling it a path to make the United States the “gold standard” for digital asset regulation, adding that “the goal is just to get some clarity. It’s been too long with these markets just languishing, and they’ve fled offshore.” Under Selig, the CFTC has also signaled its own rulemaking plans for DeFi and prediction markets, expanding its footprint well past its historical derivatives lane.

March 2026: The Regulators Try to Stop Colliding

For most of the past decade, the SEC and CFTC operated as rivals as much as partners, each occasionally suggesting in public that the other was overreaching or under-reaching on the same asset class. That changed, at least on paper, in March 2026. On March 11, Atkins and Selig signed a formal memorandum of understanding committing the two agencies to regular meetings, shared data, cross-trained staff, and advance notice before either brought an action touching the other’s turf.

Six days later, on March 17, 2026, the agencies followed up with a joint interpretive release laying out the five-category token taxonomy referenced above. Atkins called it overdue: “After more than a decade of uncertainty, this interpretation will provide market participants with a clear understanding of how the Commission treats crypto assets under federal securities laws.” Selig struck a similar note: “For far too long, American builders, innovators, and entrepreneurs have awaited clear guidance on the status of crypto assets under the federal securities and commodity laws.”

The practical effect is narrower than the rhetoric. A memorandum of understanding is not a statute, and either agency can walk away from it under a future chair. Congress’s own attempt to make the SEC-CFTC jurisdictional split permanent, the CLARITY Act, remains stuck in the Senate as of mid-2026. But for now, a company building a token or running an exchange has a somewhat clearer sense of which of the two agencies to call first.

When Enforcement Becomes a Crime: The Justice Department’s Parallel Track

Everything described so far is civil. The Department of Justice operates on an entirely different track, prosecuting crimes under Title 18 of the federal criminal code, the Bank Secrecy Act, and sanctions statutes like the International Emergency Economic Powers Act. Where the SEC has to prove its case by a preponderance of the evidence and can only take money or issue bans, DOJ has to prove guilt beyond a reasonable doubt and can take someone’s liberty.

The two tracks are legally independent. When the SEC drops a civil case, as it did with Coinbase, Kraken, and more than a dozen others in 2025, that decision says nothing about whether the same underlying conduct could still be prosecuted as fraud, money laundering, or sanctions evasion by DOJ. In practice the two agencies often coordinate, and Binance is the clearest example, but a defendant should never read an SEC dismissal as blanket immunity from a criminal referral. The two case studies below show exactly how differently the same set of facts can be treated once a second, or third, or fourth agency gets involved.

Case Study: Binance, One Company, Four Agencies, and a Pardon

On November 21, 2023, Binance and its founder Changpeng Zhao pleaded guilty in a single coordinated resolution that the Justice Department itself described as covering four separate federal actions. Zhao personally pleaded guilty to a Bank Secrecy Act violation for failing to maintain an effective anti-money-laundering program at Binance. Binance itself pleaded guilty to Bank Secrecy Act conspiracy, operating an unlicensed money transmitting business, and violating the International Emergency Economic Powers Act, the same statute that underpins OFAC’s sanctions authority.

Add up the pieces and the total came to roughly $4.3 billion. Treasury’s FinCEN collected the largest settlement in its history, about $3.4 billion, for the anti-money-laundering failures. The CFTC, discussed above, layered its own civil penalties over the unregistered derivatives exchange on top. Zhao agreed to a personal $50 million fine, stepped down as CEO, and was sentenced to four months in prison in April 2024, the harshest personal outcome anywhere in this piece.

None of that involved the SEC, which had filed its own separate civil suit against Binance back in June 2023. That case ran on its own clock and was dismissed with prejudice in May 2025, almost two years after the DOJ, FinCEN, and CFTC matters had already been resolved. Then, in a final twist, President Trump pardoned Zhao on October 23, 2025, wiping away the conviction itself. Senator Elizabeth Warren called the move corrupt, warning that “if Congress does not stop this kind of corruption in pending market structure legislation, it owns this lawlessness.” One company, one set of underlying facts, and five different institutions (DOJ, FinCEN, the CFTC, the SEC, and the presidency itself) each wrote a different ending.

Case Study: Terraform’s Civil Settlement and Do Kwon’s Criminal Sentence

Terraform Labs and its founder Do Kwon show the civil-criminal split from a different angle: the same core fraud, prosecuted twice, by two agencies, with two completely different kinds of punishment. A jury found Terraform and Kwon liable in a civil trial in April 2024, and the SEC’s case ultimately settled for a combined $4.47 billion in disgorgement, interest, and penalties, covering the roughly $40 billion collapse of the TerraUSD stablecoin in May 2022.

That was the civil side. Separately, Kwon faced a criminal case in the Southern District of New York. He pleaded guilty in August 2025 to conspiracy to commit securities fraud, commodities fraud, and wire fraud, plus a substantive wire fraud count, and agreed to forfeit more than $19 million. In December 2025, Judge Paul Engelmayer sentenced Kwon to 15 years in prison, calling the scheme fraud on an “epic, generational scale” and estimating roughly a million victims.

The SEC’s $4.47 billion is a number on a balance sheet, aimed mostly at Terraform’s corporate entity. The 15-year sentence is a number attached to one person’s life, and it came from an entirely separate prosecutor’s office working from an entirely separate legal theory. That is the civil-criminal split in miniature: money from one agency, time from another.

FinCEN and the Anti-Money-Laundering Backbone

The Financial Crimes Enforcement Network rarely makes headlines the way the SEC or DOJ do, but its rules sit underneath a surprising share of the cases in this piece. FinCEN administers the Bank Secrecy Act, which requires crypto exchanges and custodians to register as money services businesses, run anti-money-laundering programs, file suspicious activity reports, and comply with the travel rule requiring identifying information to move alongside a transaction above certain thresholds.

FinCEN itself typically works through referrals and consent orders rather than standalone headline actions, but its statute is the legal basis prosecutors reach for constantly. Zhao’s personal guilty plea was a Bank Secrecy Act violation. Roman Storm’s conviction, discussed below, was for conspiring to operate an unlicensed money transmitting business, also a Bank Secrecy Act flavored charge even though DOJ brought it. Stablecoins now sit partly outside FinCEN’s traditional lane too: the GENIUS Act, signed into law in July 2025, created a dedicated federal framework for payment stablecoins with its own reserve and disclosure rules, separate from both securities and commodities law. HOGE Wire has covered how that stablecoin framework collides with payment rails that were live long before Washington’s rulebook was ready.

OFAC, Sanctions, and the Limits of Blacklisting Code

The Office of Foreign Assets Control does not sue anyone. It designates. Once OFAC adds an address, entity, or protocol to its Specially Designated Nationals list, US persons are generally barred from transacting with it, no court case required first. That is exactly what happened to Tornado Cash in August 2022, sanctioned over its role laundering more than $455 million tied to North Korea’s Lazarus Group, the same hacking outfit behind a long list of bridge exploits that fed stolen funds into the mixer.

That designation did not survive court scrutiny intact. In November 2024, the Fifth Circuit ruled in Van Loon v. Treasury that OFAC had exceeded its authority, since Tornado Cash’s immutable smart contracts could not be treated as property under the sanctions statute. Treasury delisted Tornado Cash in March 2025.

Delisting the protocol did not end the story for the people who built it. Roman Storm, a Tornado Cash co-founder, went to trial separately on DOJ’s criminal track, charged with money laundering conspiracy, sanctions violations conspiracy, and conspiracy to operate an unlicensed money transmitting business. In August 2025, a jury convicted Storm on the unlicensed money transmitting count but deadlocked on the other two. Amanda Tuminelli, chief legal officer at the DeFi Education Fund, called the outcome “incredibly disappointing,” arguing that “it is now the Trump DOJ, not the Biden DOJ, who has a decision to make, and they absolutely can and should choose NOT to allow SDNY to pursue this case further.” Prosecutors disagreed, and have said they intend to seek a retrial on the deadlocked counts. OFAC and DOJ can move in opposite directions on the same protocol at the same time, one lifting a blacklist while the other keeps building a criminal case against the person who wrote the code.

The Fifty-State Layer: New York’s BitLicense and Beyond

Federal agencies are not the only regulators with teeth. New York’s Department of Financial Services runs the BitLicense regime, one of the oldest and strictest state-level crypto licensing systems in the country, and it enforces its own rules on its own timeline regardless of what is happening in Washington. Its first-ever crypto enforcement action, in August 2022, was a $30 million fine against Robinhood Crypto over anti-money-laundering and cybersecurity failures.

The state has stayed active since. In 2025, NYDFS settled with Paxos Trust Company for $48.5 million over alleged failures to adequately vet its former partner on the BUSD stablecoin: Binance, the same company that anchors the case study above. New York is also considering going further. State Senator Zellnor Myrie’s CRYPTO Act, introduced in January 2026, would make operating an unlicensed virtual currency business a crime in New York, ranging from a misdemeanor up to a Class C felony carrying five to fifteen years, depending on the amount transmitted. The bill remains in committee, but if it passes, New York would join roughly eighteen other states that already criminalize unlicensed money transmission.

The US Crypto Enforcement Map at a Glance

The table below lines up the six layers described so far: what each is legally allowed to do, and a recent example of it actually doing that.

Where the Map Still Has Holes

None of this adds up to a finished system. DeFi protocols with no clear custodian remain the sharpest open question: Storm’s conviction shows that publishing code can carry criminal exposure even without control over user funds, and that fight is headed for a retrial rather than a resolution. Restaking sits in a similar gray zone. The SEC’s staking safe harbors, a May 2025 statement covering solo staking, delegated staking, and custodial staking, extended to liquid staking receipt tokens that August, stop well short of the restaking and liquid-restaking layer built on top, which HOGE Wire has covered as its own emerging category. None of the 2025-2026 guidance mentions restaking by name, and none of it binds a court.

Offshore exchanges serving US customers through thin geographic fencing remain a persistent gap that no single agency has closed, since enforcement generally requires proving a platform actually reached US persons, a fact-heavy question that can take years to litigate. And the underlying architecture holding this whole map together got shakier in mid-2026: the Supreme Court’s Trump v. Slaughter decision, issued June 29, 2026, overturned the 1935 precedent that shielded independent agency heads from at-will presidential removal. The ruling was nominally about the FTC, but it applies just as directly to SEC and CFTC commissioners, meaning the coordination described in this piece rests on personnel who now serve at the president’s pleasure rather than behind the old statutory firewall. Congress’s attempt to settle the SEC-CFTC boundary by statute, the CLARITY Act, would not fix that particular problem even if it eventually passes.

Major Multi-Agency Cases, Side by Side

The individual sections above can blur together, so here are the same four cases lined up by which agencies actually showed up and what each one did.

What This Means If You Build, Trade, or Invest in Crypto

Reading across every agency at once changes the practical advice, depending on which side of the table you sit on.

• Token issuers: an SEC dismissal against a competitor is not a green light. The Howey analysis and the new five-category taxonomy still apply, and the Regulation Crypto rulemaking the SEC has queued up for 2026 is still a proposal working through a lengthy comment process, not law.
• Exchanges and custodians: AML and Bank Secrecy Act obligations never went anywhere even as SEC registration theories retreated. FinCEN’s rules apply regardless of which party controls the White House, and state licensing regimes like New York’s BitLicense operate on their own separate clock.
• DeFi developers: Storm’s prosecution is the sharpest live warning that writing and publishing code can carry personal criminal risk that no SEC statement, however friendly, actually resolves.
• Traders and investors: sanctions compliance around mixers and blacklisted addresses does not bend to intent the way fraud statutes do. Interacting with a sanctioned address can be a problem independent of what you believed you were doing at the time.

The throughline across every case here is that fraud enforcement never actually paused. Whatever administration is in Washington, and whatever the SEC’s mood toward token registration happens to be that quarter, wire fraud, money laundering, and sanctions evasion stay fully prosecutable, by an agency that was never part of the 2025-2026 truce in the first place.

Frequently Asked Questions

Does the SEC regulate all cryptocurrency in the United States?

No. The SEC only has jurisdiction over crypto assets and transactions that qualify as securities under the Howey test. Derivatives and much of spot-market fraud fall to the CFTC, criminal conduct like fraud and money laundering is prosecuted by the Justice Department, anti-money-laundering compliance runs through FinCEN, sanctions enforcement sits with OFAC, and individual states like New York license and fine crypto businesses separately through regimes like the BitLicense.

What is the difference between SEC and CFTC crypto enforcement?

The SEC’s authority covers securities, generally token sales and arrangements where investors expect profit from someone else’s efforts. The CFTC’s authority covers commodities and derivatives, meaning futures and swaps, plus fraud and manipulation in spot markets for assets like Bitcoin and Ether. The two agencies signed a memorandum of understanding in March 2026 to coordinate rather than compete on overlapping cases, though the underlying statutory boundary between them is still not fully settled by Congress.

Can crypto enforcement actions lead to criminal charges, not just fines?

Yes. The SEC and CFTC can only impose civil penalties such as fines, disgorgement, and industry bans. Criminal charges, which can carry prison time, come from the Department of Justice under statutes like the Bank Secrecy Act and general fraud law. Changpeng Zhao’s four-month sentence and Do Kwon’s fifteen-year sentence both came from DOJ prosecutions running alongside, and separate from, civil cases brought by the SEC or CFTC.

Why was Tornado Cash removed from the US sanctions list?

A federal appeals court, the Fifth Circuit, ruled in Van Loon v. Treasury that the Treasury Department’s Office of Foreign Assets Control exceeded its legal authority when it sanctioned Tornado Cash’s smart contracts, since immutable code cannot be treated as property of a foreign national under the sanctions statute. Treasury delisted Tornado Cash in March 2025, but that did not end related criminal cases against the individual developers who built it.

Do individual US states also regulate cryptocurrency companies?

Yes. New York’s Department of Financial Services runs one of the strictest state licensing regimes, the BitLicense, and has fined companies including Robinhood Crypto and Paxos Trust Company independently of any federal action. Other states have their own money-transmitter licensing rules, and New York lawmakers have proposed making unlicensed virtual currency activity a criminal offense on top of existing civil penalties.

Reported by the HOGE Wire regulation desk.