The Crypto Exchange Compliance Playbook: SEC, CFTC, and MiCA in One Stack

The Three-Framework Matrix

Understanding the Overlap

The SEC, CFTC, and MiCA each regulate different aspects of the same activity. A crypto exchange that lists both securities-classified tokens and commodity-classified tokens while serving EU residents must comply with all three frameworks simultaneously.

SEC jurisdiction covers tokens classified as securities (investment contract tokens, security tokens, and any token that meets the Howey test). Requirements include registration as a broker-dealer or alternative trading system, securities-grade KYC and AML, and ongoing reporting.

CFTC jurisdiction covers tokens classified as digital commodities (BTC, ETH, SOL, XRP, and 12 others as of the March 17 interpretive release). Requirements include registration for derivatives trading, commodity-grade onboarding, and position reporting.

MiCA jurisdiction covers all crypto-asset services provided to EU residents, regardless of token classification. Requirements include CASP authorization, EU-grade KYC/AML, Travel Rule compliance, and stablecoin-specific provisions.

The Token Classification Decision Tree

Every token on your exchange must be classified. The March 2026 SEC/CFTC interpretive release provides the taxonomy:

Digital commodities — Tokens whose value derives from the operation of a functional blockchain system and supply-and-demand dynamics, not from expectations of profit. The 16 named tokens (BTC, ETH, SOL, XRP, ADA, LINK, AVAX, DOT, MATIC, ATOM, UNI, AAVE, LTC, BCH, XLM, ALGO) are explicitly classified. Others meeting the criteria are presumed commodities.

Securities — Tokens that meet the Howey test: an investment of money in a common enterprise with an expectation of profit from the efforts of others. ICO tokens, governance tokens with profit-sharing mechanisms, and tokens tied to investment returns remain securities.

Payment stablecoins — Tokens designed as payment instruments, pegged to fiat currency, backed by reserves. Under the GENIUS Act, these are neither securities nor commodities — they are regulated under a dedicated stablecoin framework.

For each token you list, document the classification, the regulatory framework that applies, and the specific KYC/AML obligations triggered by that classification.

KYC Requirements by Framework

SEC Requirements (Securities Tokens)

For tokens classified as securities, KYC obligations align with existing securities law requirements. Customer identification must verify full legal name, date of birth, address, and a government-issued identification number (SSN for US persons). Document verification must use reliable, independent sources. Enhanced due diligence applies to accounts over specified thresholds and to customers in higher-risk categories.

The SEC's Regulation S-P (Privacy of Consumer Financial Information) additionally requires safeguarding customer information, with compliance deadlines in June 2026 for smaller entities.

CFTC Requirements (Commodity Tokens)

For digital commodity trading, KYC requirements are less prescriptive than securities-grade but still mandatory. Customer identification at account opening, risk disclosure, and ongoing suitability assessment apply. The CFTC's approach is evolving rapidly — the "Future-Proof" initiative is reviewing and modernizing existing rules to accommodate digital asset markets.

MiCA Requirements (All EU Activity)

MiCA's KYC requirements are the most comprehensive. All CASPs must verify customer identity using reliable, independent sources before providing any service. Risk-based CDD applies to all customers, with enhanced measures for higher-risk categories. Records must be maintained for at least five years. The upcoming AMLR (July 2027) adds a €1,000 threshold for identity verification of hosted wallet transactions.

Pull quote

“The exchange that builds verification infrastructure capable of satisfying all three frameworks through a single integration has a structural cost advantage over every competitor maintaining parallel compliance stacks.”

The Unified Compliance Stack

Architecture Principles

Building three separate compliance systems — one for SEC, one for CFTC, one for MiCA — is the most expensive possible approach. The unified approach identifies the highest common denominator across all three frameworks and implements to that standard.

In practice, MiCA's KYC requirements are the most stringent. A system that satisfies MiCA also satisfies SEC and CFTC requirements (with minor additions). Build to MiCA standard, add the SEC-specific and CFTC-specific requirements as configuration layers, and operate a single compliance infrastructure.

The Integration Checklist

Travel Rule Implementation

The FATF Travel Rule requires VASPs to collect and transmit originator and beneficiary information for qualifying transfers. Implementation varies by jurisdiction.

EU (MiCA/TFR): All crypto transfers above €1,000 from hosted wallets require originator name, account number, and address or national ID number. Below €1,000, basic information must still be collected (though verification thresholds are higher). Unhosted wallet transfers require additional risk-based measures.

US: FinCEN's rules apply the $3,000 BSA threshold to certain crypto transfers. The CLARITY Act and GENIUS Act implementing rules (due July 2026) may modify these thresholds.

Interoperability: Your Travel Rule solution must be compatible with counterparty VASPs' systems. Multiple interoperability protocols exist — evaluate based on the counterparties you transact with most frequently.

The July 2026 Deadline Map