Crypto regulation watch: licensing gains meet security and enforcement pressure

Crypto regulation is developing along several tracks rather than towards a single, settled framework. European licensing has opened routes for cross-border services, while US market structure legislation has faced political and banking-sector objections. Ireland has put gambling payments and crypto within its first national anti-money laundering strategy. Alongside those policy developments, enforcement cases and security incidents continue to expose risks that market access alone cannot resolve.

Today’s institutional developments sharpen that contrast. Canton Network and DTCC have opened access to $30 trillion in eligible securities through a development centred on blockchain tokenisation. Google MPC is targeting institutional crypto custody as a vulnerability in Fireblocks MPC draws attention to security risks. These are adoption and technology developments, not regulatory approvals, but they put custody and operational resilience alongside licensing in the wider debate over crypto’s expansion.

The Coinbase data breach and incidents involving Ledger add another dimension: self-custody does not address every aspect of crypto security. Banks face similar risks. For the regulatory picture, the distinction matters because control over assets and protection of customer information are different problems. Neither institutional participation nor offline storage should be confused with the elimination of exposure across a service’s operations.

What has changed is the practical availability of regulated expansion in some markets, even as uncertainty persists elsewhere. In October 2025, Revolut, Blockchain.com and Relai secured MiCA licences to expand European crypto services. Revolut said its licence would allow it to provide and market its comprehensive crypto-asset services across all 30 EEA markets. That offered a concrete route to expansion, rather than simply an expectation of future clarity.

The US legislative trajectory has been less straightforward. Crypto executives held Capitol Hill meetings in October 2025 to revive a delayed market structure bill. By May 2026, a committee vote on a crypto bill was scheduled for 14 May, but major obstacles remained. Banks were concerned about stablecoin yield provisions, while Democrats objected to the absence of ethics and conflict-of-interest safeguards. Those developments do not establish that the disputed provisions have since been resolved.

There have also been signs of commercial responses to regulatory conditions. In November 2025, dYdX was preparing a US launch as the climate shifted under the Trump administration. Separately, analysts linked USDC’s growth to regulatory clarity and institutional adoption: its market capitalisation had risen from approximately $43 billion in January to around $74 billion by that November report. Those historical figures illustrate the reported shift, rather than current market values.

Among jurisdictions to watch, Ireland stands out for the explicit inclusion of gambling payments and crypto in its first national anti-money laundering strategy, announced in August 2026. The development places both activities within a national policy focus. It does not, by itself, establish particular new obligations, implementation deadlines or penalties for firms, but it makes the intersection of payments, gambling and digital assets an important area to follow.

Japan offers a parallel example of innovation policy and tighter proposed oversight. On 7 November 2025, its Financial Services Agency unveiled the Payment Innovation Project within its FinTech Experimental Hub, alongside a stablecoin initiative and proposals for stricter crypto lending rules. The distinction between an initiative and proposed rules is important: support for payment experimentation does not mean lending standards are being relaxed.

The United States remains central both for legislation and access to financial infrastructure. Custodia lost its appeal over Federal Reserve access in November 2025, with the court confirming that the Fed was not obliged to provide the Wyoming-based institution with a master account. Singapore, meanwhile, froze $150 million in assets linked to alleged Bitcoin fraud kingpin Chen Zhi following a coordinated enforcement effort involving US and UK prosecutors.

For operators and crypto firms, these developments argue against treating regulatory progress as a blanket permission to expand. A licence enabling European services, access to central banking infrastructure and compliance with money transmission requirements are separate questions. The five-year sentence imposed on Samourai Wallet developer Rodriguez in November 2025, after his guilty plea to conspiracy to operate an unlicensed money transmitting business, demonstrates the potential consequences of licensing failures.

Gambling-facing businesses also have distinct conduct risks. The Missouri lawsuit brought by Stake.us user Justin Killham accused Drake and Adin Ross of promoting the site under allegedly fraudulent pretences. Those are allegations, not established findings. Read alongside Ireland’s policy focus, the case highlights why promotional conduct and payment-related scrutiny deserve separate attention rather than being absorbed into a general discussion of crypto regulation.

Security remains an operational issue regardless of jurisdiction. Warnings about DeFi attacks and sophisticated cross-border crypto and forex scams in Asia sit alongside the custody vulnerabilities now in focus. Firms also need to distinguish preventive maintenance from incident response: Coinbase said its November 2025 wallet migration was routine and was not triggered by a cybersecurity incident or external threat. That statement concerns that migration, not every subsequent security development.

The next developments to watch are therefore specific: whether US legislative disagreements are resolved, how Ireland’s strategy translates into action, and whether Japan’s proposed lending restrictions advance. European licensed expansion will remain an important comparison with those less settled processes. Institutional tokenisation and custody developments warrant attention too, particularly where broader access increases the importance of reliable controls. The central question is whether operational safeguards and enforceable standards keep pace with crypto’s expanding reach.