The Digital Asset Regulatory Stack: Securities, Payments, and Compliance

There is no single body of law called “crypto regulation.”

Yet much of the discussion around digital assets still begins with questions such as whether a token is regulated, whether a blockchain business needs a license, or whether a particular jurisdiction is “crypto-friendly.”

Those questions collapse several separate regulatory problems into one.

A token may fall within securities law because of the rights it represents. The business issuing or distributing it may face additional rules because it moves money, holds customer assets, operates a marketplace, provides investment services, or intermediates transactions. Anti-money-laundering and sanctions requirements may apply across several of those activities. Then geography adds another dimension.

The issuer might be incorporated in one country, its technology provider located in another, its assets custodied somewhere else, and its customers spread across dozens of markets. The blockchain itself may have no meaningful geographic center at all.

A more useful way to understand digital-asset regulation is as a regulatory stack.

Each layer asks a different question:

• What is the asset?
• What financial function is being performed?
• Who intermediates or controls the transaction?
• What risks arise from that activity?
• Which jurisdiction has authority over it?

For companies building digital-finance products, those questions increasingly need answers while the product is being designed—not after it reaches the market.

‍

‍

THE DIGITAL ASSET REGULATORY STACK

Layer One: What Is the Asset?

The regulatory analysis begins with classification.

Before asking what rules apply, regulators and market participants first need to understand what the asset actually represents.

That can be less obvious than the technology makes it appear.

A blockchain token might represent:

• an ownership interest in a company;
• an interest in an investment fund;
• a claim on Treasury securities;
• a payment instrument;
• a redeemable claim against an issuer;
• a commodity-like digital asset;
• a contractual claim on another asset;
• or access to a digital service.

Two tokens that look nearly identical inside a wallet can therefore create entirely different legal relationships.

That becomes especially important as conventional securities and investment products move onto blockchain infrastructure.

In January 2026, three divisions of the U.S. Securities and Exchange Commission issued a staff statement on tokenized securities. It describes several structures through which securities can be tokenized, including securities tokenized by or on behalf of the issuer and structures created by unaffiliated third parties. The statement also emphasizes that those structures may give holders different rights. It is a staff statement rather than a Commission rule and carries no independent legal force, but its framework captures a central regulatory principle: the use of distributed-ledger technology does not by itself determine the legal nature of the instrument.

A tokenized share can still be a security.

A tokenized fund interest remains tied to the legal structure of the fund.

A digital representation of a Treasury security still derives its economic value and enforceable rights from the financial arrangement beneath it.

The technology determines how the asset may be recorded or transferred. The legal architecture of the tokenized asset  determines what the holder actually owns and can enforce.

That is the foundation on which the rest of the regulatory stack sits.

‍

Layer Two: When Does a Digital Asset Function as Money?

A different set of questions emerges when a digital asset begins performing monetary or payment functions.

Stablecoins illustrate the shift.

A payment stablecoin may resemble another blockchain token at the technical level, but its economic purpose is different. It is designed to maintain a stable value and serve as a means of holding, transferring, or settling value.

Regulators therefore need to ask questions that have little to do with the mechanics of token issuance:

• Who stands behind the instrument?
• What assets support it?
• Where are those reserves held?
• What redemption rights does the holder have?
• How quickly must redemption occur?
• What happens if the issuer fails?
• How are reserve assets protected?
• What information must be disclosed?
• Who supervises the issuer?

The United States' GENIUS Act, enacted in July 2025, brought many of these issues into a dedicated federal framework. The OCC's February 2026 proposed implementing regulations  address reserve assets, redemption, risk management, audits, supervision, custody, capital and operational backstops, among other requirements. A separate June proposal addresses Bank Secrecy Act, AML/CFT and sanctions compliance for issuers under OCC supervision. These remain part of the rulemaking and implementation process rather than a completed final regime.

The practical effect is that a stablecoin issuer cannot be evaluated simply as a software company that happens to publish tokens.

At institutional scale, it begins to resemble a piece of financial infrastructure.

That is also why the stablecoin stack extends well beyond the blockchain itself. Reserve management, redemption, custody, compliance, banking relationships and distribution all become part of whether the instrument can operate reliably.

As stablecoins move further into payments, corporate treasury operations, tokenized markets and settlement, the regulatory inquiry expands from What is this token? to What monetary function is this system performing?

‍

Layer Three: What Financial Activity Is Being Performed?

Asset classification still does not tell the whole story. Regulation also follows activity.

A firm may not issue a security but may facilitate its trading. It may not issue a stablecoin but may custody one. It may not own the underlying asset but may operate the venue through which others exchange claims on it.

Traditional finance has long distinguished among functions such as issuance, brokerage, dealing, exchange operation, clearing, settlement, custody, transfer agency, investment management, lending and payment processing.

Blockchain can rearrange those functions. It does not necessarily make them disappear.

A decentralized network may remove one intermediary while introducing another. A smart contract can execute a transaction automatically, while a separate company operates the interface through which most users access it. An issuer might distribute a token directly, while investors still rely on a regulated custodian. A protocol can manage part of the settlement process while regulated institutions perform onboarding, identity verification or asset servicing.

A tokenized-securities platform might touch issuance, trading, custody and settlement at the same time.

The useful regulatory question is therefore rarely:

Is this a blockchain company?

It is: Which financial functions does the company, protocol, platform or intermediary actually perform?

This functional view helps explain why digital-asset regulation increasingly intersects with familiar financial regulation rather than developing as an entirely separate legal universe.

The technology changes how the activity is performed. Regulators still tend to care about what the activity does.

‍

Regulation frequently follows the financial function being performed, nit the technology used to perform it."

‍

Layer Four: AML, KYC, Sanctions and the Travel Rule

Some regulatory obligations cut across nearly every layer of the stack.

Financial systems need mechanisms for identifying customers, detecting illicit activity, enforcing sanctions and determining when identifying information must accompany transactions.

That brings several familiar frameworks into digital-asset markets:

Anti-money laundering (AML)
Processes designed to identify and prevent the movement of criminal proceeds.

Know Your Customer (KYC)
Requirements and controls used to establish and verify customer identity.

Countering the Financing of Terrorism (CFT)
Measures intended to identify and prevent the financing of terrorist activity.

Sanctions compliance
Restrictions involving designated individuals, entities, jurisdictions and transactions.

The Travel Rule
Requirements for certain identifying information to accompany qualifying transfers between regulated providers.

None of these concepts originated with cryptocurrency.

Blockchains simply create a different operating environment for them.

Public ledgers can provide unusually detailed transaction histories, yet a wallet address does not automatically identify the individual or organization controlling it. Assets can cross borders within minutes. A transaction may involve a centralized exchange, a self-hosted wallet, a decentralized protocol and several blockchain networks before reaching its destination.

The Financial Action Task Force has spent years adapting international AML/CFT standards to virtual assets and virtual-asset service providers. Its July 2026 targeted implementation review reported that 83% of surveyed jurisdictions had enacted legislation implementing the Travel Rule, up from 73% in 2025. FATF nevertheless continued to identify gaps between adopting the rules and implementing them effectively.

That implementation gap points toward one of the harder regulatory problems in decentralized finance.

Writing an obligation into law is one task. Identifying the actor responsible for carrying it out can be much harder.

Who performs customer due diligence when activity crosses several technical layers?

• The exchange?
• The wallet provider?
• The protocol interface?
• The issuer?
• The custodian?
• The DAO?
• A developer?

The answer depends on the architecture and the applicable law.

For companies trying to reach regulated markets, compliance infrastructure  therefore becomes part of product design. Identity, transaction monitoring, permissions and reporting cannot always be left to a compliance department operating downstream from the technology.

‍

Layer Five: Custody, Capital and Operational Risk

As regulated financial institutions hold or interact with digital assets, regulators encounter another set of concerns.

They need to know not only what the asset is, but whether the institution can manage the risks that come with controlling it.

This is the prudential layer.

For a bank or another regulated institution, the relevant questions may include:

• How much capital is required against the exposure?
• What liquidity risk does it create?
• How is customer property segregated?
• Who controls the private keys?
• How are transactions authorized?
• How would the institution respond to a blockchain outage, fork or smart-contract failure?
• What cybersecurity controls are in place?
• How are exposures reported?
• Can the institution recover control after an operational failure?

These questions become more consequential as digital assets connect with banks, asset managers, payment firms and market infrastructure.

The Basel Committee's framework for bank cryptoasset exposures took effect on January 1, 2026. It covers the prudential treatment of cryptoasset exposures and incorporates requirements involving capital, market and credit risk, operational risk, liquidity, leverage and supervisory review. Separate disclosure standards require banks to report information about cryptoasset exposures and related capital and liquidity requirements.

A tokenized financial asset can therefore preserve much of the economic exposure of its conventional counterpart while creating a different operational dependency structure.

Consider a tokenized bond.

The borrower's credit risk may be unchanged.

But the infrastructure surrounding that exposure may now include blockchain networks, smart contracts, digital custody, cryptographic key management, tokenization platforms, bridges oracles, and new settlement processes.

Institutional custody of tokenized assets  has to account for both kinds of risk: the financial claim itself and the system used to control and transfer it.

Tokenization does not replace prudential supervision. It expands the set of systems prudential supervision has to understand.

‍

The Stack Is Not Neat—and That Is the Point

The regulatory stack is useful as a framework, but real products do not move through it one layer at a time.

The layers overlap.

Take a stablecoin.

At the asset layer, the question is what legal claim the holder possesses.

At the payments layer, regulators examine reserves, issuance and redemption.

At the intermediary layer, requirements may apply to exchanges, custodians and payment providers.

At the AML layer, identity, transaction monitoring and sanctions controls enter the picture.

At the prudential layer, banks interacting with the instrument may face capital, liquidity and operational requirements.

And surrounding every one of those issues is jurisdiction.

Tokenized securities produce the same overlap. A tokenized fund can implicate securities law, fund regulation, custody rules, market-structure requirements, AML obligations, operational-resilience expectations and cross-border distribution restrictions.

For that reason, asking whether a product is simply “regulated” is rarely enough.

A better question is: Which regulatory layers attach to this combination of asset, activity, intermediary and market?

‍

THE REGULATORY EXPOSURE TEST

Four questions determine much of the regulatory map:

Questions & What to examine:

1. What is it?

Security, payment instrument, fund interest, commodity-like asset, contractual claim

2. What does it do?

Issue, trade, custody, lend, settle, transfer, manage, pay

3. Who does it?

Issuer, exchange, broker, custodian, protocol, interface, bank, wallet

4. Where does it happen?

Entity location, customer location, issuance, custody, distribution, market access

The same token can encounter a different regulatory stack when the activity, intermediary or jurisdiction changes.

‍

Decentralization Creates an Attachment Problem

Traditional financial regulation generally knows where to look.

• Banks have charters.
• Broker-dealers have registrations.
• Payment companies have legal entities.
• Custodians control customer property.
• Exchanges operate identifiable marketplaces.
• Decentralized systems can separate functions that once sat inside a single institution.

A protocol may execute transactions without a conventional corporate operator. One group may develop the software while another manages governance. Users may reach the protocol through interfaces run by independent companies. Validators process transactions without necessarily knowing the parties involved. Tokenholders may vote on selected protocol parameters. A foundation might support development while exercising limited formal control over the network itself.

The regulatory problem is not merely that the system is decentralized.

It is deciding where the legal obligation attaches.

• To the developer?
• The protocol?
• The DAO?
• Governance participants?
• The frontend operator?
• A validator?
• The wallet provider?
• The end user?

There is no universal answer, and different jurisdictions can draw those boundaries differently.

But the policy problem is recognizable: regulatory systems built around identifiable institutions have to determine how obligations should operate when technology distributes institutional functions among several participants.

That attachment problem is likely to remain one of the central questions in DeFi regulation.

‍

‍

Jurisdiction Surrounds the Entire Stack

Every layer discussed so far operates within another constraint: geography.

Financial regulation remains jurisdictional even when financial networks are global.

A digital-asset company may therefore need to answer several questions at once:

• Where is the company incorporated?
• Where are its customers?
• Where is the asset issued?
• Where is customer property held?
• Where are the people controlling the business located?
• Which markets are being actively solicited?
• Where are regulated services actually being performed?
• Which securities, payments, AML, consumer-protection and tax rules apply?

Jurisdictions do not answer these questions in the same way.

Some have created comprehensive digital-asset regimes. Others have extended existing securities, banking and payments frameworks. Some use specialized licensing categories. Others regulate primarily according to the financial activity taking place.

A business that can operate legally in one market may need a different product structure, license, distribution strategy or customer base in another.

And digital distribution makes those decisions arrive quickly. A software product can reach international customers long before the company has built an international legal or compliance organization.

Jurisdiction therefore shapes more than legal exposure.

It can influence token design, customer onboarding, custody arrangements, product availability, distribution and the economics of entering a market.

The final article in this series will examine how major jurisdictions are making those choices—and how those choices are becoming part of the competition to attract digital-asset markets.

‍

From Compliance Checklist to Compliance-by-Design

Once the layers are viewed together, a broader design problem becomes visible. Compliance cannot always be added after the technology is finished.

Consider a company that designs a tokenized financial product and postpones the regulatory analysis until launch.

• A securities-law review may reveal that participation has to be restricted to eligible investors.
• AML requirements may require identity information that the product was never designed to collect.
• Custody rules may conflict with the wallet structure.
• Cross-border restrictions may make unrestricted transfer impossible.
• Stablecoin reserve rules may alter the proposed economics.
• Reporting obligations may require data that the system was not built to preserve.

Each issue can potentially be addressed later. Doing so may also require redesigning the product, rebuilding workflows or limiting markets that the company expected to serve.

Compliance-by-Design takes the opposite approach.

Regulatory requirements become one input into product architecture from the beginning.

In practice, that can mean:

• designing identity controls into onboarding;
• building wallet eligibility or transfer restrictions into relevant workflows;
• defining investor rights through an enforceable legal structure;
• making reserve and redemption processes auditable;
• structuring custody around segregation and control requirements;
• retaining the data required for monitoring and reporting;
• and determining which jurisdictions the product will serve before global distribution begins.

Compliance-by-Design does not imply that every blockchain system should become permissioned, nor that regulation should dictate every technical decision.

It recognizes something more practical:

When a product is intended to operate inside regulated financial markets, its legal architecture, compliance architecture and technical architecture cannot be designed independently.

[PULL QUOTE 2 — PLACE HERE]

“In regulated digital finance, legal architecture, compliance architecture, and technical architecture increasingly have to be designed together.”

‍

Regulation Is Becoming Part of the Infrastructure

The earliest debates around digital-asset regulation often revolved around a boundary question:

Is this activity inside or outside the regulated financial system?

That framing fits the market less comfortably today. Stablecoins increasingly connect with payment and settlement systems. Tokenized securities connect blockchain infrastructure with conventional capital markets. Banks provide digital-asset services. Asset managers distribute traditional financial exposures through tokenized structures.

Custodians are building systems for assets whose control depends on cryptographic infrastructure. As those connections deepen, regulation becomes less of an external perimeter around digital assets and more of the infrastructure through which they enter institutional markets.

The regulatory stack helps make sense of that environment. Asset and securities law determine the rights being created and distributed. Payments rules govern instruments functioning as money.

Market-structure rules govern the institutions and venues through which assets move.

AML and sanctions frameworks shape access and transaction monitoring.

Prudential regulation governs how financial institutions assume and manage risk. Jurisdiction determines where those obligations apply. No single layer captures the whole system.

A better starting point than Is this token regulated? is a sequence of more concrete questions:

• What is the asset?
• What function does it perform?
• Who provides or controls that function?
• What risks follow from it?
• Where is the activity taking place?

For companies building digital-financial infrastructure, the answers affect far more than the legal department.

They shape what can be built, how it must operate, which institutions can participate, where it can be distributed—and ultimately which markets the product can reach.

‍