SIRRUNA. The Study →
The Study · Institutional

Regulation: What Actually Matters

The regulatory landscape is complex, evolving, and often misunderstood. Here's what serious investors actually need to know.

By Hakima · Senior Analyst12 min readPDF ↓

Regulation is crypto's Rorschach test. Bulls see inevitable legitimisation that will unlock trillions in institutional capital. Bears see existential threat — governments slowly strangling an industry they can't control. The reality, as usual, is more nuanced. Regulation is neither uniformly good nor bad. It's a patchwork of rules, enforcement actions, and political dynamics that varies by jurisdiction and evolves constantly. Understanding it requires moving past headlines to grasp what actually matters for investors.

The Fundamental Tension

Crypto was designed to operate outside government control. Regulation exists to bring financial activity under government oversight. This creates inherent tension that won't resolve cleanly:

What governments want: Tax compliance, anti-money laundering enforcement, investor protection, financial stability, and the ability to sanction bad actors. These are legitimate goals that predate crypto.

What crypto enables: Pseudonymous transactions, cross-border value transfer without intermediaries, censorship-resistant finance, and self-custody outside the banking system. These capabilities directly challenge regulatory frameworks designed for traditional finance.

The question isn't whether regulation will exist — it will — but where the boundaries settle. Some crypto activity will clearly fall under existing rules. Some will operate in grey zones. Some will remain genuinely beyond government reach, for better or worse.

"Regulation doesn't ask whether something should exist. It asks how something that exists should be governed. Bitcoin exists. The question is how governments respond."

The US Landscape

The United States remains the most important regulatory jurisdiction for crypto, both because of market size and because US enforcement actions have global implications:

SEC (Securities and Exchange Commission): Focused on whether crypto assets are securities. If they are, they must be registered, issuers must make disclosures, and exchanges must be licensed. The SEC has argued most tokens (excluding Bitcoin) are securities, leading to enforcement actions against exchanges and projects.

CFTC (Commodity Futures Trading Commission): Treats Bitcoin and Ethereum as commodities, giving it jurisdiction over derivatives and spot markets for these assets. Generally viewed as more crypto-friendly than the SEC.

The turf war: SEC and CFTC have overlapping claims on crypto jurisdiction. Congress has proposed various bills to clarify boundaries, but legislation remains stalled. The resulting uncertainty benefits neither industry nor regulators.

State level: States like New York require BitLicenses for crypto businesses. Wyoming has created crypto-friendly banking frameworks. Texas welcomes miners. The patchwork adds compliance complexity.

Key Insight
The SEC's "regulation by enforcement" approach means rules are established through lawsuits rather than clear guidance. Projects discover what's illegal when they're sued. This creates uncertainty that particularly harms US-based innovation while having less impact on decentralised protocols that have no company to sue.

Europe's Approach: MiCA

The European Union took a different path — comprehensive legislation rather than case-by-case enforcement:

Markets in Crypto-Assets (MiCA): Implemented in 2024, MiCA creates a unified framework across 27 EU countries. It defines categories of crypto assets, licensing requirements for service providers, and rules for stablecoin issuers.

What MiCA covers: Exchanges, custodians, and other crypto service providers must be licensed. Stablecoin issuers face reserve requirements. Market manipulation rules apply. Disclosure requirements exist for token issuers.

What MiCA doesn't cover: DeFi remains largely outside scope (for now). NFTs are partially addressed but not comprehensively. The regulation focuses on centralised intermediaries.

The effect: Clearer rules enable institutional participation. Major exchanges have obtained MiCA licenses. Banks are entering crypto services. The certainty that US lacks exists in Europe — though some argue the rules are too restrictive.

Asia's Divergence

Asian jurisdictions span the full spectrum from ban to embrace:

Singapore: Positioned as a crypto hub with clear licensing frameworks. The Monetary Authority of Singapore (MAS) has established rules for exchanges while maintaining openness to innovation. Many projects have relocated here.

Hong Kong: Reversed previous restrictions to compete with Singapore. Now licensing exchanges and promoting itself as Asia's crypto gateway. The China connection creates both opportunity and uncertainty.

Japan: Early adopter of crypto regulation following the Mt. Gox collapse. Licensed exchanges operate under Financial Services Agency oversight. Conservative but clear framework.

China: Comprehensive ban on crypto trading and mining since 2021. However, China holds Bitcoin in seized assets and continues blockchain development for state purposes. The ban pushed mining to US, Kazakhstan, and elsewhere.

South Korea: Strict rules on exchanges and real-name requirements for accounts. Active retail trading market continues despite regulatory friction.

What Enforcement Actions Mean

High-profile enforcement actions dominate headlines but require careful interpretation:

Exchange actions: Binance's $4.3 billion settlement, Coinbase's ongoing SEC lawsuit, and FTX's criminal prosecution address different issues. Binance settled AML violations. Coinbase fights securities classification. FTX was outright fraud. Conflating them misses the point.

DeFi immunity (so far): Truly decentralised protocols have largely avoided enforcement. The SEC sued Uniswap Labs but not the Uniswap protocol itself — because protocols don't have legal entities to sue. This distinction matters enormously.

Individual liability: Founders and executives face personal liability when projects violate securities laws. This risk affects token design, marketing, and where projects incorporate.

The Rory Sutherland Take
Regulation creates a paradox: the more decentralised something is, the less regulable it becomes. A company can be sued, fined, or shut down. A protocol running on thousands of computers worldwide cannot. This is why regulators focus on intermediaries — exchanges, custodians, fiat on-ramps — rather than protocols themselves. They're regulating what they can reach. Bitcoin and Ethereum will exist regardless of what any government decides. The question is whether you can easily convert them to dollars.

Stablecoins: The Regulatory Priority

If any crypto sector faces imminent comprehensive regulation, it's stablecoins:

Why regulators care: Stablecoins look like money. They're used for payments. Large stablecoins could theoretically compete with central bank currencies. A stablecoin collapse could affect financial stability. These concerns attract serious regulatory attention.

Reserve requirements: MiCA requires stablecoin issuers to hold liquid reserves matching 100% of outstanding tokens. US proposals have suggested similar requirements, potentially limiting issuance to banks.

USDC vs. USDT: Circle (USDC) has pursued regulatory compliance, holding reserves in treasuries and regulated banks. Tether (USDT) has faced persistent questions about reserves and has moved offshore. The market currently doesn't price this difference significantly.

CBDCs: Central Bank Digital Currencies represent governments' response to private stablecoins. China has piloted the digital yuan. Europe is developing the digital euro. Whether CBDCs will compete with or complement private stablecoins remains unclear.

Tax: The Unavoidable Reality

Whatever else remains uncertain, taxes are increasingly unavoidable:

Capital gains: Most jurisdictions treat crypto as property. Selling, trading, or spending crypto triggers capital gains tax. This includes crypto-to-crypto trades in many jurisdictions.

Income recognition: Staking rewards, airdrops, and mining income are typically taxable as income when received. The complexity of tracking this across DeFi protocols is substantial.

Reporting requirements: Exchanges increasingly report user activity to tax authorities. The US requires exchanges to issue 1099 forms. Europe's DAC8 directive will require similar reporting. The days of tax anonymity through crypto are ending.

Practical reality: If you're using regulated exchanges, assume tax authorities know about your activity. Plan accordingly. Work with tax professionals who understand crypto.

What Actually Matters for Investors

Cutting through regulatory noise, here's what sophisticated investors should focus on:

Jurisdiction of your access points: Where is your exchange based? What regulatory framework do they operate under? These determine your actual protections and risks.

Custody structure: Self-custody removes most regulatory intermediary risk but creates personal responsibility. Exchange custody means you're subject to whatever happens to that exchange — including regulatory actions.

Asset classification: Bitcoin and Ethereum have effective regulatory clarity in most jurisdictions. Other tokens may not. This affects where they can be listed, who can offer them, and what disclosures exist.

Your own compliance: Regardless of what industry does, you're responsible for your own tax reporting and legal compliance. Ignorance isn't defense.

The Long-Term Trajectory

Stepping back from daily regulatory headlines, the trajectory seems clear:

Legitimisation continues: ETF approvals, bank custody services, and institutional adoption all depend on regulatory frameworks. These frameworks are being built, imperfectly and slowly, but built.

Intermediaries face rules: Centralised exchanges, custodians, and fiat on-ramps will increasingly operate under frameworks similar to traditional finance. This adds cost and friction but also legitimacy.

Protocols remain free: Truly decentralised protocols are largely beyond regulatory reach. They'll continue operating regardless of what governments decide. Access to them may become more or less convenient depending on jurisdiction.

Fragmentation persists: There won't be global regulatory harmonisation. Arbitrage between jurisdictions will continue. Projects will incorporate where rules suit them. Users will access services where they're available.

"Crypto's regulatory future isn't uniform adoption or uniform banning. It's permanent tension — some activities absorbed into regulated finance, others remaining outside it, and constant negotiation about where the boundary sits."

Navigating Uncertainty

For investors, regulatory uncertainty is a persistent feature, not a temporary bug. The appropriate response:

Don't assume clarity is coming: Regulatory frameworks will evolve over years, not months. Make decisions based on current rules, not hoped-for future clarity.

Use regulated on-ramps: Major licensed exchanges provide compliance infrastructure and legal clarity. The premium is worth paying.

Diversify jurisdiction exposure: Don't concentrate everything in one regulatory environment. Geographic diversification is regulatory diversification.

Separate signal from noise: Most regulatory headlines don't affect most investors. SEC suing a specific project rarely matters unless you hold that project. Focus on rules that actually affect your activity.

Regulation isn't going away. Neither is crypto. Learning to navigate their interaction is simply part of participating in this market. The investors who succeed will be those who understand rules well enough to operate confidently within them — not those who pretend rules don't apply.