From Code to Institutions: How Regulators Responded

The Bitcoin whitepaper describes a system in which no institution is needed to issue money or to approve payments. Yet the system did not exist in a world without institutions. People who wanted to use it mostly did so through businesses that exchanged it for ordinary currency or held it on their behalf. Those businesses had bank accounts, offices and customers, and therefore regulators. The story of the regulatory response is largely the story of how law found these points of contact.

First, the reports

The first official reactions were studies rather than rules. In October 2012 the European Central Bank published a report titled “Virtual Currency Schemes”, which described Bitcoin among other examples and asked whether such schemes raised risks for central banks’ responsibilities. A follow-up report appeared in 2015. In July 2014 the European Banking Authority issued an opinion setting out the risks it saw and advising national supervisors to discourage banks from dealing with virtual currencies until a regulatory regime was in place.

The tone of these early documents was cautious and somewhat puzzled. They were written for officials who had to place a genuinely new thing into existing categories: was it money, a commodity, a payment system, or something else?

Applying old rules to new businesses

The first binding responses used existing laws. In March 2013 the Financial Crimes Enforcement Network of the US Treasury, known as FinCEN, issued guidance stating that businesses that exchanged virtual currency for ordinary money, or administered such currencies, were money transmitters and had to follow anti-money-laundering rules. Ordinary users were not covered.

Other jurisdictions created new regimes. New York introduced a licence for virtual currency businesses, often called the BitLicense, in 2015. Japan amended its Payment Services Act, with changes taking effect in April 2017, to require exchange providers to register with its Financial Services Agency.

The international standard-setters

Money laundering rules are coordinated internationally through the Financial Action Task Force, an intergovernmental body whose recommendations most countries follow. In October 2018 FATF amended its standards to cover what it called virtual asset service providers, such as exchanges and custodians. In June 2019 it adopted an interpretive note and guidance requiring such providers to collect and pass on information about the senders and recipients of transfers, the requirement commonly known as the travel rule. Updated guidance followed in October 2021.

Bank supervisors also took a position. In December 2022 the Basel Committee on Banking Supervision, which sets international standards for bank capital, published a standard on how banks should treat their exposures to crypto-assets, generally requiring them to hold substantial capital against the riskier categories.

Securities law and promotions

A second line of response used securities law. Many tokens sold to the public in the 2010s were offered with promises that their value would grow through the work of the team behind them. In the United States, the Securities and Exchange Commission applied the long-standing test, derived from a 1946 Supreme Court case known as Howey, that asks whether people have handed over money to a common enterprise expecting gains from the efforts of others. In July 2017 the SEC published a report concluding that tokens issued by one such project, known as The DAO, were securities, and that US securities law therefore applied.

The United Kingdom chose a different tool: rules on advertising. From 8 October 2023, firms promoting crypto-assets to UK consumers became subject to the financial promotions regime, which requires promotions to be clear, fair and not misleading, to carry prominent risk warnings, and to be made or approved by an authorised firm or one registered with the Financial Conduct Authority. Regulators in many countries reached the same conclusion: whatever crypto-assets were in theory, in practice they were often sold to ordinary people, and the selling could be regulated.

Europe’s anti-money-laundering step

In the European Union, the first legislative step was the Fifth Anti-Money Laundering Directive, Directive (EU) 2018/843. It brought providers of exchange services between virtual and ordinary currencies, and custodian wallet providers, within the scope of anti-money-laundering law. Member states had to apply it from January 2020. The United Kingdom, which was leaving the EU at the time, introduced a registration regime for crypto-asset businesses under its anti-money-laundering rules from the same month.

MiCA: a framework of its own

Anti-money-laundering law answered one question, about crime, but not others, about consumer protection, market integrity and financial stability. In September 2020 the European Commission proposed a comprehensive regulation for crypto-assets not already covered by existing financial law. After negotiation, the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, usually called MiCA, was published in the Official Journal on 9 June 2023.

Three kinds of token

MiCA distinguishes three broad categories. Asset-referenced tokens aim to keep a stable value by referring to another value or right, or a combination, such as several currencies or commodities. E-money tokens aim to keep a stable value by referring to a single official currency. All other crypto-assets fall into a residual category. Issuers of the first two categories face strict requirements, including authorisation and rules on the reserves backing the tokens. These provisions began to apply on 30 June 2024.

Who supervises

Most supervision under MiCA is carried out by national authorities in each member state, which authorise issuers and service providers and monitor their conduct. Two European bodies have central roles. The European Securities and Markets Authority coordinates the national authorities, maintains a public register of authorised firms and white papers, and issues detailed technical standards. The European Banking Authority directly supervises issuers of asset-referenced tokens and e-money tokens that become significant, judged by criteria such as the number of holders and the scale of their use. In this way, the largest stable-value tokens in the Union are treated less like software projects and more like payment institutions, with supervisors to match.

Service providers and the white paper

The rest of the regulation applied from 30 December 2024. It requires crypto-asset service providers, such as platforms and custodians, to be authorised by a national authority, after which they may offer services across the EU. It sets rules on how they hold clients’ assets, manage conflicts of interest and handle complaints, and it introduces rules against market abuse. Transitional arrangements allow some existing firms to continue operating for a limited period while they seek authorisation.

There is a striking historical echo in MiCA. Issuers offering most crypto-assets to the public must publish a crypto-asset white paper, a disclosure document with prescribed content, and notify it to the authorities. The genre that began with a nine-page paper by an anonymous author on a mailing list has become, in Europe, a regulated legal document with liability attached.

What MiCA does not cover

The regulation leaves some things outside its scope. Crypto-assets that are unique and not fungible with others are generally excluded, and services provided in a fully decentralised manner without any intermediary are not covered. Crypto-assets that qualify as existing financial instruments remain under the older financial rules.

The travel rule in Europe

Alongside MiCA, the EU adopted Regulation (EU) 2023/1113, which extends to crypto-asset transfers the obligation to send information about the originator and beneficiary that already applied to bank transfers. It applies from 30 December 2024, the same day as MiCA’s full application. With it, the FATF travel rule became binding law across the Union.

What the response tells us

It is tempting to tell this story as a contest between code and law, but that misses its shape. Regulators did not, on the whole, try to regulate a protocol. They regulated people and firms: those who issued tokens to the public, exchanged them for ordinary money, held them for customers or promoted them. In this they followed a very old pattern. From the Lydian mint to the Bank of England, the institutions that stood between money and the public were where trust was concentrated, and where rules were applied.

The cypherpunk ambition of money entirely outside institutions has not disappeared, and the debates about it continue. But for most people in Europe today, any contact with crypto-assets passes through firms that are licensed, supervised and obliged to know their customers. Whatever one thinks of that outcome, it is now part of the history this site sets out to tell.