How Does FinCEN Regulate Cryptocurrency Businesses?
Long before crypto existed, federal regulators built a framework for tracking money as it moves through the financial system to prevent laundering and other financial crime. Rather than writing an entirely new rulebook, regulators largely fit crypto businesses into that existing structure.
The short answer
The Financial Crimes Enforcement Network, an arm of the Treasury Department, generally treats businesses that exchange, transmit, or administer cryptocurrency as money services businesses under the Bank Secrecy Act. That classification requires registration with FinCEN, a written anti-money-laundering program, ongoing customer identification procedures, and the filing of reports on suspicious or large transactions. The rules focus on tracking and reporting activity rather than on the technology itself.
Who counts as a money services business
FinCEN’s guidance generally applies to businesses that provide crypto exchange or transmission services to others, such as platforms that let customers convert between currencies or move funds on their behalf. This typically does not extend to someone simply using crypto for personal transactions, or to software developers who build tools without themselves administering funds for customers. The distinction turns on whether a business is acting as a financial intermediary handling other people’s funds, which is the same basic test FinCEN applies to traditional money transmitters.
The core obligations
Once a crypto business falls under FinCEN’s money services business rules, several requirements typically follow under the Bank Secrecy Act framework.
- Registration. The business must register with FinCEN and keep that registration current, along with any state-level money transmitter licenses that may separately apply.
- A written AML program. Businesses must maintain a documented anti-money-laundering program, including internal controls, employee training, and independent testing.
- Customer identification. Know-your-customer procedures require verifying a customer’s identity before or while providing services, similar to what banks and brokerages already do.
- Suspicious activity reports. Businesses must file reports when they detect transactions that appear designed to evade reporting requirements or that otherwise look suspicious, regardless of the dollar amount involved.
- Currency transaction reports. Transactions above certain thresholds generally require separate reporting, mirroring the cash-reporting rules that apply to traditional banks.
Why this matters for someone using a platform
These requirements are a major reason legitimate crypto exchanges ask for identification, proof of address, and sometimes source-of-funds information before allowing a new account to trade freely. A platform that skips these steps entirely is either operating outside FinCEN’s registration requirements or ignoring them, which is itself a warning sign worth weighing when evaluating whether a platform is legitimate. Compliance obligations also mean that account activity is recorded and can be shared with law enforcement under appropriate legal process, which matters for anyone assuming crypto transactions are anonymous by default.
Where FinCEN’s authority ends
FinCEN’s rules focus on anti-money-laundering and financial reporting obligations rather than on investment products, trading practices, or consumer protection more broadly, areas that fall to other agencies depending on how a particular token or platform is classified. Whether a specific crypto exchange or asset is regulated by the SEC, the CFTC, or another body is a separate and sometimes unsettled question, layered on top of FinCEN’s money-transmission rules rather than replacing them. A business can be fully compliant with FinCEN’s requirements and still face separate regulatory questions from other agencies.
The takeaway
FinCEN’s approach to crypto businesses largely extends decades-old anti-money-laundering rules to a new kind of financial intermediary, requiring registration, identity verification, and transaction reporting rather than regulating the underlying technology. For anyone using a crypto platform, understanding that this compliance layer exists helps explain both the paperwork involved in opening an account and the limits of privacy that come with using a regulated service.