SEC-CFTC Taxonomy Locks Bitcoin, Ether as Commodities, Reshapes Crypto Enforcement
A joint SEC-CFTC interpretation formally classifies Bitcoin and Ether as non-security digital commodities, while the SEC pivots enforcement toward fraud and away from registration-theory cases. Stablecoin issuers face a bifurcated federal-state regime under the GENIUS Act, and Travel Rule obligations tighten for all VASPs.
The SEC and CFTC have drawn a line under a decade of classification uncertainty. Their March 17, 2026 interpretive release establishes a five-category token taxonomy — digital commodities, digital collectibles, digital tools, stablecoins, and digital securities — and explicitly classifies Bitcoin and Ether as non-security digital commodities [^claim_1986]. The CFTC committed to administering the Commodity Exchange Act consistently with these classifications [^claim_1986]. This is not a mere policy statement; it is a joint regulatory architecture that anchors the two largest crypto assets outside securities law.
The same interpretation clarifies how common on-chain activities interact with the Howey test. Airdrops, protocol mining, protocol staking, and wrapping of non-security crypto assets do not automatically make the underlying asset a security, but can bring it within an investment-contract analysis depending on structure [^claim_1987]. For DeFi protocols, this means the legal risk of a token depends on how it is distributed and used, not just its code.
Enforcement is shifting in kind. In fiscal year 2025, the SEC brought 456 enforcement actions and obtained orders for nearly $18 billion in monetary relief — $10.8 billion in disgorgement and $7.2 billion in penalties [^claim_1991]. The agency stated it will prioritize fraud and market manipulation over registration-only crypto actions [^claim_1991]. Since January 2025, the SEC has dismissed or closed at least a dozen crypto cases, including litigated actions against Binance, Coinbase, and Kraken where it had already received favorable court rulings [^claim_1992]. The message: the SEC is no longer suing exchanges for failing to register; it is going after scams and manipulation.
On the infrastructure side, the SEC’s Division of Trading and Markets issued an April 13, 2026 staff statement creating a broker-dealer registration exception for “Covered User Interface Providers” [^claim_1993]. This allows front-end teams, wallet UIs, and RPC middleware to support tokenized securities transactions without full broker-dealer registration, subject to conditions. For protocols building on-chain order flow or tokenized securities interfaces, this is a direct regulatory opening.
Stablecoin policy is crystallizing around size-based thresholds. The GENIUS Act sets an effective date that is the earlier of 18 months after enactment or 120 days after final regulations [^claim_1989]. Issuers with more than $10 billion in consolidated outstanding issuance face prudential supervision by the Federal Reserve (banks) or OCC (non-banks); those below may opt into a state framework that is “substantially similar” to the federal regime [^claim_1990]. California’s state-level regulations are slated to become effective July 1, 2026 [^claim_1995]. This creates a bifurcated market: large issuers must comply with federal standards, while smaller issuers can choose state-level oversight, but must navigate a patchwork of state regimes.
Travel Rule and Transfer of Funds Regulation obligations are hardening. Under the EU TFR and FATF’s 2026 guidance, all crypto transfers between CASPs must include full originator and beneficiary information regardless of value; the €1,000 de-minimis threshold applies only to transfers involving self-hosted wallets, which then trigger enhanced controls like wallet-address attribution and proof-of-ownership tests [^claim_1988]. When a counterparty VASP cannot receive Travel Rule data, originating firms must implement a documented fallback: delay, reject, or proceed with enhanced due diligence and senior-level approval [^claim_1994]. For DeFi gateways, custodians, and MEV-protected payment hubs, this makes address attribution and on-chain risk scoring de facto requirements.
The regulatory picture is now one of classification clarity, enforcement retrenchment, and operational compliance hardening. Protocols and issuers that align with the new taxonomy and Travel Rule infrastructure will face lower legal uncertainty; those that ignore the $10 billion threshold or the fallback documentation requirements will find themselves on the wrong side of a more targeted, but more effective, enforcement regime.
Provenance ledger
10 claims web-citedEvery claim below cites a source URL, and each URL was checked for validity before publish. The excerpt shown is the researcher's own summary of the page — it is not re-derived from the source, so it is not a verified verbatim quote. Follow the link to confirm any claim against the original. Citation markers in the text jump here.
[1] The SEC’s March 17, 2026 interpretive release creates a five‑category token taxonomy (digital commodities, digital collectibles, digital tools, stablecoins, and digital securities) and explicitly classifies Bitcoin and Ether as non‑security digital commodities, with the CFTC committing to administer the Commodity Exchange Act consistently with these classifications. web-cited
“The Interpretation takes effect upon publication in the Federal Register… As of the March 17, 2026, Interpretation, both Bitcoin and Ether are expressly classified as non-security digital commodities under a new five-category crypto taxonomy… The CFTC joined the Interpretation to confirm it will administer the Commodity Exchange Act (CEA) consistent with the SEC's securities law conclusions.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[2] The SEC’s March 17, 2026 interpretation formally clarifies that airdrops, protocol mining, protocol staking, and wrapping of non‑security crypto assets do not automatically make the underlying asset a security, but can bring a non‑security crypto asset within an investment‑contract analysis depending on how those activities are structured. web-cited
“The Commission interpretation: … Clarifies the application of federal securities laws to airdrops, protocol mining, protocol staking, and the wrapping of a non-security crypto asset. … Addresses how a ‘non-security crypto asset’… may become subject to, and how it may cease to be subject to, an investment contract.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[3] Under the FATF’s revised Interpretive Note to Recommendation 16 and the EU Transfer of Funds Regulation in 2026, all crypto transfers between CASPs/VASPs must include full originator and beneficiary information regardless of value, while a €1,000 de‑minimis threshold applies only to transfers involving self‑hosted wallets, which then trigger additional verification and enhanced controls such as wallet‑address attribution and proof‑of‑ownership tests. web-cited
“Under the EU Transfer of Funds Regulation (TFR), **all** crypto transfers between CASPs must carry full originator and beneficiary information, regardless of value. The €1,000 de-minimis threshold only applies to transfers involving self-hosted wallets — and even then, additional verification is required above that amount. … require enhanced controls above €1,000 — typically wallet-address attribution, proof of ownership (e.g. Satoshi test, signed message), and screening against on-chain risk i
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[4] The GENIUS Act stablecoin law sets an effective date that is the earlier of (i) 18 months after enactment or (ii) 120 days after primary federal payment stablecoin regulators issue final implementing regulations, after which only permitted payment stablecoin issuers approved by an appropriate regulator may lawfully issue payment stablecoins in the US. web-cited
“Effective Date of the Act: The Act and its amendments will generally take effect on the earlier of two dates: 18 months after the date of enactment of the Act, or 120 days after the primary federal payment stablecoin regulators issue any final regulations implementing the Act. After this date, issuers of payment stablecoins in the US must abide by the obligations in the Act, most importantly being approved by an appropriate regulator to issue payment stablecoins. … Section 3(a) makes it unlawfu
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[5] For stablecoin issuers with more than $10 billion in consolidated total outstanding issuance, prudential supervision will be by the Federal Reserve (for bank issuers) and the OCC (for non‑bank issuers), while issuers below that threshold may opt into a state regulatory framework that is “substantially similar” to the federal regime. web-cited
“Stablecoin issuers whose stablecoins have more than $10 billion in consolidated total outstanding issuance will be regulated by the Federal Reserve (for banks) and the Office of the Comptroller of the Currency (‘OCC’) (for nonbanks); issuers below that threshold will have the option of being regulated by their state’s own regulatory framework … if the state’s regulatory framework is ‘substantially similar’ to its federal counterpart.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[6] In fiscal year 2025 the SEC brought 456 enforcement actions (including 303 standalone actions) and obtained orders for nearly $18 billion in monetary relief, comprising $10.8 billion in disgorgement and prejudgment interest and $7.2 billion in civil penalties, while stating it will prioritize cases involving fraud and market manipulation over registration‑only crypto actions. web-cited
“Brought 456 enforcement actions, including 303 standalone actions… Obtained orders for nearly $18 billion in monetary relief, including $10.8 billion in disgorgement and prejudgment interest… and $7.2 billion of civil penalties. The SEC said these enforcement actions demonstrate the Commission’s prioritization of cases that directly harm investors and the integrity of the US securities markets, including offering frauds, market manipulation…”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[7] Between January 2025 and early 2026 the SEC dismissed or closed at least one dozen crypto‑related cases, including litigated cases against Binance, Coinbase, and Kraken where it had already received favorable court rulings, signaling a retrenchment from registration‑theory enforcement against major exchanges. web-cited
“Specifically, since January 2025, the SEC has dismissed or closed at least one dozen crypto-related cases, including meritorious litigated cases against Binance, Coinbase, and Kraken, in which it had received favorable rulings from the courts.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[8] The SEC’s Division of Trading and Markets April 13, 2026 staff statement creates a broker‑dealer registration exception for certain “Covered User Interface Providers,” allowing them to build interfaces that let users prepare and submit transactions in crypto asset securities without registering as broker‑dealers, subject to defined conditions. web-cited
“SEC issues broker-dealer registration exception for crypto user interfaces. On April 13, 2026, the SEC's Division of Trading and Markets issued a staff statement providing that it would not object to certain technology providers – referred to as ‘Covered User Interface Providers’ – creating and operating software interfaces that allow users to prepare and submit transactions in crypto asset securities without registering as broker-dealers.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[9] Under the EU Transfer of Funds Regulation and FATF’s 2026 guidance, when a counterparty VASP cannot receive Travel Rule data, originating firms must implement a documented fallback decision process that either delays, rejects, or proceeds with the transfer subject to enhanced due diligence and senior‑level approval. web-cited
“Where a counterparty VASP cannot receive Travel Rule data — whether for technical, regulatory or jurisdictional reasons — firms must have a documented fallback: delay, reject, or proceed with enhanced due diligence and senior approval.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[10] California’s state‑level stablecoin regulations under the GENIUS Act framework are slated to become effective July 1, 2026, with California currently exercising rule‑making authority to implement supervisory, examination, and enforcement powers over state‑licensed stablecoin issuers, and an option for these powers to be ceded to the Federal Reserve. web-cited
“In July 2025, the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act… State regulators would have supervisory, examination, and enforcement authority over all state issuers. The Act allows state regulators to cede these authorities to the Federal Reserve… California’s rule-making authority will have regulations effective on July 1, 2026, and is currently in the rule-making process.”
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
Sources
- https://www.jdsupra.com/legalnews/a-potential-turning-point-in-crypto-1993475/
- https://www.sec.gov/newsroom/press-releases/2026-30-sec-clarifies-application-federal-securities-laws-crypto-assets
- https://forex-marketing.com/news/the-fatf-travel-rule-in-2026-what-actually-changed-5a4257cf
- https://www.morganlewis.com/pubs/2025/07/genius-act-passes-in-us-congress-a-breakdown-of-the-landmark-stablecoin-law
- https://www.omm.com/insights/alerts-publications/landmark-stablecoin-bill-passes-senate-with-overwhelming-bi-partisan-support/
- https://www.ey.com/content/dam/ey-unified-site/ey-com/en-us/technical/accountinglink/documents/ey-sec30654-261us-04-16-2026.pdf
- https://democrats-financialservices.house.gov/uploadedfiles/01.14.2026_ltr_sec_rfcryptoe.pdf
- https://www.dlapiper.com/en-us/insights/publications/blockchain-and-digital-assets-news-and-trends/2026/blockchain-and-digital-assets-news-and-trends-q1-2026
- https://klrd.gov/2026/03/02/briefing-book-2026-stablecoin-tracking-the-new-policy-approach/