Track 6 · Organisations, law and finance · Module 27

The rules: acts and regulators

Cayman's VASP Act, EU MiCA, the US agencies, FATF and sanctions.

Lessons: 7
Reading: 60 min
Quiz: 15 questions
Pass mark: 80%

1Why crypto is regulated, and by whomWhy is crypto regulated, and who sets the rules?8 min
2FATF and Recommendation 15What does FATF Recommendation 15 ask countries to do about crypto?8 min
3The EU's MiCA regulationWhat is MiCA, and what does it require of crypto firms in the EU?9 min
4The United States: who does whatWhich US agencies regulate crypto, and what does each one cover?10 min
5The Cayman Islands' VASP ActWhat does the Cayman Islands' VASP Act require, and who needs a licence?9 min
6Sanctions and cryptoHow do sanctions apply to crypto, and what happened with Tornado Cash?9 min
7Brindlecove's map: questions, not answersHow can a crypto company map which rules might apply to it in different countries?7 min

The case used in this module

The Brindlecove Labs case (made up)

Brindlecove Labs is a made-up company set up in the Cayman Islands, with a made-up token, BRDL. It keeps its day-to-day cash at Pellowmark Bank, a made-up bank. Its made-up finance lead, Maya, is planning a made-up app for customers in the European Union, the United States and the Cayman Islands. The app would:

sell newly made BRDL to the public for the first time, for euros and US dollars;
swap customers' crypto for other crypto, using Brindlecove's own money;
hold customers' crypto for them, with Brindlecove keeping the private keys; and
send customers' crypto to any address they choose.

Maya's job is not to decide what the law says. It is to list the questions each set of rules raises, so that Brindlecove's lawyers in each place can answer them. Some quiz questions ask about the app. None of this is legal advice.

Each module tells its own made-up Brindlecove story, so details can differ from one module to the next.

Key words

FATF (Financial Action Task Force): An independent inter-governmental body whose Recommendations are recognised as the global standard against money laundering and terrorist financing.¹
Virtual asset: FATF's term for a digital representation of value that can be digitally traded or transferred and used for payment or investment. It does not include digital versions of fiat money or securities.²
VASP (virtual asset service provider): A person or company that, as a business and for others, exchanges, transfers or keeps virtual assets, or provides financial services for a token sale.²
Risk-based approach: Understanding the money laundering risks you face and making your measures proportionate to them.³
Travel Rule: The rule that a sending VASP must collect sender and receiver details for a crypto transfer and pass them to the receiving VASP.³
Grey list: The name often used for FATF's list of jurisdictions under increased monitoring, which are working with FATF to fix strategic weaknesses.⁴⁵
MiCA: The EU's Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114. It sets uniform EU market rules for crypto-assets.⁶⁷
CASP (crypto-asset service provider): Under MiCA, a firm whose business is providing crypto-asset services to clients professionally, and that is allowed to do so under Article 59.⁸
Crypto-asset white paper: The disclosure document MiCA requires before most crypto-assets are offered to the public in the EU. No authority approves it in advance.⁹
E-money token: Under MiCA, a crypto-asset that aims to keep a stable value by referencing the value of one official currency.⁶
Investment contract (Howey test): In US law, an investment of money in a common enterprise with an expectation of profits from the efforts of others. It is a security.¹⁰¹¹
Money transmitter: In US federal rules, a business that accepts currency, funds or value that substitutes for currency from one person and transmits it to another location or person.¹²
BitLicense: New York's licence for virtual currency business activity, under regulation 23 NYCRR Part 200 (issued June 2015).¹³
CIMA: The Cayman Islands Monetary Authority, which registers and licenses virtual asset service providers under the VASP Act.¹⁴¹⁵
SDN List: OFAC's Specially Designated Nationals and Blocked Persons List. Since 2018 some entries include crypto addresses.¹⁶
Strict liability: A legal standard under which a person can be held liable for a violation even without knowing, or having reason to know, about it.¹⁶

Sources

Updated Guidance for a Risk-Based Approach: Virtual Assets and Virtual Asset Service Providers. Financial Action Task Force (FATF), October 2021.
The FATF Recommendations: Recommendation 15 and the glossary. Financial Action Task Force (FATF), updated June 2026, February 2012, updated June 2026.
The FATF Recommendations: Interpretive Note to Recommendation 15 (new technologies). Financial Action Task Force (FATF), updated June 2026, updated June 2026.
"Black and grey" lists. Financial Action Task Force (FATF).
High-risk and other monitored jurisdictions. Financial Action Task Force (FATF).
Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA): Articles 2 and 3, scope and definitions. European Parliament and Council of the European Union, Official Journal L 150, 9 June 2023 (read on EUR-Lex; the original text, not later amendments), 31 May 2023.
Markets in Crypto-Assets Regulation (MiCA). European Securities and Markets Authority (ESMA), read 22 October 2026.
Regulation (EU) 2023/1114 (MiCA): Article 3(1), points 15 to 26, crypto-asset services. European Parliament and Council of the European Union, Official Journal L 150, 9 June 2023 (read on EUR-Lex; the original text, not later amendments), 31 May 2023.
Regulation (EU) 2023/1114 (MiCA): Articles 4 to 9, offers to the public and white papers. European Parliament and Council of the European Union, Official Journal L 150, 9 June 2023 (read on EUR-Lex; the original text, not later amendments), 31 May 2023.
Securities and Exchange Commission v. W. J. Howey Co., 328 U.S. 293. Supreme Court of the United States (Library of Congress copy of the United States Reports), 27 May 1946.
Application of the Federal Securities Laws to Certain Types of Crypto Assets and Certain Transactions Involving Crypto Assets (Release No. 33-11412). US Securities and Exchange Commission, with guidance from the Commodity Futures Trading Commission, 17 March 2026, effective 23 March 2026.
Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-G001). Financial Crimes Enforcement Network (FinCEN), US Department of the Treasury, 9 May 2019.
Virtual Currency Business Licensing. New York State Department of Financial Services (read 22 October 2026).
Virtual Asset (Service Providers) Act (2024 Revision): sections 2 and 3, definitions. Cayman Islands Government, legislation.gov.ky (revised as at 31 December 2023), 15 February 2024.
Amendments to the Virtual Asset (Service Providers) Act in Effect 1 April 2025. Cayman Islands Monetary Authority (CIMA), supervisory circular, 1 April 2025.
Sanctions Compliance Guidance for the Virtual Currency Industry. Office of Foreign Assets Control (OFAC), US Department of the Treasury, October 2021.