How crypto regulation will evolve in 2024

In their early days of existence, crypto service providers operated in a regulatory vacuum. Policymakers and regulators were just learning what crypto was, and few, if any, had formed any ideas on how to regulate it. This allowed the sector to grow and quickly develop new products and services to meet the growing demands and needs of its new users. But this also came with significant risks. Many operators craved regulatory certainty, and this presented economic opportunities for jurisdictions willing to take on the challenge of regulating these new crypto service providers. And thus, the regulation of crypto began.

In 2018, the Financial Action Task Force (FATF), the global standard setter for anti-money laundering and counter-terrorist financing (AML/CFT), clarified that its standards also applied to virtual assets (VA) and virtual asset service providers (VASPs). This was the catalyst for the wider adoption of crypto regulation as countries began to apply their AML/CFT laws to crypto, albeit very slowly. As of December 2023, less than half of the 209 members of the FATF network have applied AML/CFT regulation to crypto.

Yet, as we enter 2024, a former regulator is now head of the biggest crypto exchange in the world – and this, among other developments, highlights that regulation must be prioritised rather than ignored.

More comprehensive crypto regulation is on the horizon, and the industry will have to embrace it.

To date, few regulatory regimes have tailored provisions for crypto aimed at protecting customers, ensuring markets operate in a fair and orderly manner, and firms have enough money to operate and cover potential losses. In 2024, this will change. In an attempt to learn from and avoid repeating failures that dominated headlines in 2023, some of the world’s large economies will go live with more comprehensive regulatory regimes. These regimes will require crypto service providers to have policies and controls covering matters related to corporate governance, conflicts of interest, risk disclosures, the safeguarding and segregation of customer funds, cybersecurity and capital reserves.

This year, some jurisdictions will take more innovative approaches to crypto regulation and consider stablecoin regimes or regulating more novel aspects of the crypto industry like lending, borrowing and staking activities and decentralised finance (DeFi) or decentralised autonomous organisations (DAOs). Some will also look to regulate crypto derivatives products under dedicated, crypto-specific legislation.

The FATF will continue to put pressure on countries that have failed to bring VAs and VASPs into the scope of AML/CFT requirements. A FATF report is expected in April 2024 that will specifically call out countries that are behind on VA regime implementation. As a result, the pace of implementation will accelerate, especially in Latin America and Africa, where the use cases for crypto are unequivocal, but regimes are not yet in place.

Opportunities for regulatory arbitrage will reduce but not disappear as more countries implement their own regimes.  

Global elections have the potential to significantly shift crypto’s regulatory landscape.

2024 stands to be a pivotal year for global democracy, with over 40 countries holding national elections. This includes eight of the ten most populous countries in the world: Bangladesh, Brazil, India, Indonesia, Mexico, Pakistan, Russia, and the United States.

Taiwan, the UK, and the European Union are also scheduled for significant elections. The outcomes of these elections will have a profound impact on global cryptocurrency regulation and adoption.

US enforcement against crypto firms will continue, and businesses will find second homes.

According to data from VASPnet, the Securities and Exchange Commission (SEC) is only regulating 22 of 1,371 service providers that are likely offering virtual asset services in the United States^[1]. This situation will not change much in 2024, and the extensive array of enforcement actions taken against crypto firms by US authorities in the last year will continue.

Firms looking for the regulatory certainty needed for long-term business planning will continue to look for second homes for their non-US business outside the US. Countries in the Caribbean, Middle East and EU will continue to be attractive jurisdictions for US firms looking for a new or second home.

The European crypto market will consolidate, and the EU’s new crypto hub will emerge.

The EU’s Markets in Crypto-assets (MiCA) Regulation comes into effect in July for issuers of stablecoins and at the end of 2024 for crypto-asset service providers (CASPs). The increased cost of compliance will significantly consolidate the landscape of the 4,170 known entities domiciled in the EU that provide or have provided crypto services^[2]. By 2025, the EU’s centralised crypto market will be dominated by a few key players.

In general, the majority of EU CASPs are not prepared for MiCA, and many have been reluctant to act. The most popular jurisdictions in the EU have relatively light-touch registration regimes in place, and the gap between their existing regimes and MiCA is significant. Time is running out, and firms that underestimate the effort required to become MiCA compliant risk losing their licence and their ability to operate.

Becoming MiCA-ready presents an enormous challenge for regulators as well as the industry. Countries that have fewer resources and hundreds of CASPs registered for AML/CFT purposes will find it difficult to implement MiCA-compliant national regimes in 18 months by 30 June 2026, or MiCA’s maximum application date for existing CASPs. Regulators may be looking for reasons to reject applications in order to reduce the number of firms on their existing registers.

Jurisdictions such as France and Malta, that have moved to become MiCA-compliant before this date, will vie for international recognition as the EU’s leading crypto hub. Although France has attracted the attention of many international firms, it remains to be seen if they will willingly navigate the operational complexities and bear the expense that comes with making Paris their home. Each jurisdiction will take its own distinct approach, and in 2024, a few are likely to emerge as the most attractive centre for industry.

FATF will crack down on jurisdictions that have failed to undertake NRAs, implement the Travel Rule.

Last year, the FATF clearly highlighted the need for countries to undertake National Risk Assessments (NRAs) to assess their exposure to the crypto sector and its unique underlying risks. Even jurisdictions that have banned crypto are required to undertake an NRA in order to adequately police their perimeter. In 2024, the private sector will continue its effort to supply countries with better data so that policymakers can understand the risks and develop regimes that adequately and proportionately mitigate them.

As they begin to better understand their exposure to crypto, countries will publish more comprehensive lists warning of firms that are not regulated in their jurisdiction. This will help individuals and the private sector avoid doing business with firms that are unregulated or engaged in illicit activities.

Another notable area of focus for the FATF this year is the implementation by national authorities of the Travel Rule, or the requirement for VASPs to exchange specific information with each crypto-asset transfer. To date, worldwide adoption has been sluggish.

At the end of 2024, the EU’s Transfer of Funds Regulation (ToFR), or Europe’s version of the Travel Rule, is slated to come into effect. This development will subject CASPs to stricter AML/CFT requirements and will notably bring firms outside of Europe that choose to do business with EU CASPs within the scope of certain requirements.

Other jurisdictions will move to implement the Travel Rule over the next 12 to 18 months. More are likely to follow the example of the UK, Hong Kong, Japan, Korea, the Philippines and Singapore and move to explicitly require financial institutions to undertake proper due diligence on counterpart VASPs.

International standardisation is unlikely, but some jurisdictions will develop cross-border regulatory silos for compliant firms.

The International Organization of Securities Commissions (IOSCO), the Financial Stability Board (FSB) and other intergovernmental standard setters took big strides last year in developing global standards for crypto regulation. Greater harmonisation of regulatory approaches is desirable, but there is still an impossibly long way to go before there is any meaningful universal consensus.

If the world’s countries are still not fully aligned on many aspects of TradFi regulation after decades of effort by standard-setting bodies, what is the likelihood that all relevant national authorities will soon agree on one standard approach to crypto regulation? The sector has not even reached an agreement on a consistent terminology for virtual, digital, crypto-assets, or cryptocurrencies.

The fragmentation of varied international approaches to crypto regulation will not be remedied in 2024. A single rulebook is not going to happen, nor would it necessarily be a good thing. Regulatory innovation and competition are arguably positive things for the sector and its clients.

Nevertheless, pockets of cross-border harmonisation are already coming into effect, and this is a trend that will likely continue. For example, certain jurisdictions are currently developing arrangements wherein firms that adhere to similar sets of regulatory requirements may passport their services. It is inevitable as the sector matures, that other jurisdictions will create passporting and equivalency mechanisms, particularly the international financial centres.

Regulators will crack down on HyFi projects with accountable individuals.

Not all DeFi is created equal. That fact will become even more glaringly obvious in 2024. Most projects have certain elements of centralised control and exist somewhere on the spectrum between centralised finance (CeFi) and true DeFi, where there exists no person or entity to hold accountable. Projects on this spectrum can be considered Hybrid Finance (HyFi).

To date, regulators and international standard setters have largely focused on CeFi, explicitly carving out DeFi from regulatory regimes. Thus far, it’s been easy for HyFi parading as true DeFi to fall under the radar and outside regulatory scope.

But over time, regulators have built a better understanding of the crypto and DeFi landscapes. This year, they will begin to critically assess which DeFi activities are caught by existing regulatory frameworks. HyFi projects with key identifiable and accountable individuals are likely to come into the spotlight, particularly in the US.

True DeFi will continue to remain outside of the regulatory perimeter, as it cannot be regulated under the existing regulatory paradigm. We will likely see more and more crypto projects falling within regulatory scope or moving to becoming truly decentralised, and not only in name.

Conclusion

Regulators are finally moving on from pure AML/CFT considerations and are scrutinising how VASPs treat their customers and what constitutes a true DeFi arrangement. This represents a significant milestone in the maturation of the sector.

However, industry is still reacting slowly to these regulatory changes, and it is likely that many ill-prepared firms will be caught out this year by MiCA’s coming into effect.

Jurisdictions with authorities that have been less proactive, to date, will scramble to fulfil their regulatory mandates in the wake of the upheavals of 2023. Those policymakers that achieve regimes that balance innovation and stability will continue incentivising firms to relocate, cooperate and act within sensible parameters to achieve good regulatory outcomes.

Overall, a boost in regulatory clarity and cross-border consistency will invigorate development and improve public perception of the sector in 2024. Improving client confidence in the crypto sector, and ensuring that that confidence is justified, now appears to be a goal that is shared by many industry participants and national authorities.

‍^‍

^{[1] Verified by VASPnet, November 2023.}

^{[2] As reported by VASPnet, 15 December 2023.}