Regulatory Roundup #24

Summary

Treasury has settled on an unusual tool for Iran policy: a Russian money laundering statute. FinCEN’s order cutting MEXC Global off from US financial institutions covers crypto transfers expressly, though it has yet to take effect. Binance has started declining withdrawals to MEXC anyway. In Paris, the National Assembly voted to make holders declare large self-hosted wallets, then rejected the budget’s entire revenue section the next day, taking the measure with it. Quick work. The UK confirmed that disposals of qualifying stablecoins by individuals and trustees will escape capital gains tax, which makes buying a coffee with one considerably less exciting for HMRC. Korea answered Binance’s $6.3 billion hack by asking exchanges for more cold storage, without saying how much more. And Nigeria has told the world’s dollar stablecoins that serving Nigerians now requires a Nigerian license.

🔦 Spotlight

🇺🇸 A Russia order, Iranian talking points

On 6 November, FinCEN told every covered US financial institution to stop "...any transmittal of funds from or to MEXC Global.” Fairly categoric, as instructions go.

MEXC is not an obscure crypto backwater. According to FinCEN the exchange held roughly 9% of global CEX market share at the end of 2025, facilitated more than $1 billion a day in transactions and held reserves of around $5 billion. FinCEN also says it shifted $16.7 billion connected to Russian illicit finance and other illicit activity between May 2021 and May 2026. The ban comes into force on 10 December, 30 days after its publication in the Federal Register on 10 November.

The order is underpinned by section 9714(a) of the Combating Russian Money Laundering Act, and defines MEXC as “of primary money laundering concern in connection with Russian illicit finance.” In Treasury’s press release, Secretary Bessent focused elsewhere:

“Either you support the Iranian regime, or you have access to the U.S. financial system.”

Iran and North Korea do both feature in the findings, and the action forms part of “Operation Economic Outcast”, but the order itself focuses on Russia. 

MEXC has plenty of Russia exposure. FinCEN assigns nearly $1.5 billion in direct and indirect exposure to Russian sanctions evasion, including $232 million in direct transactions with US, EU and UK-sanctioned entities, about $129 million with Garantex, and almost $200 million tied to the ruble-backed A7A5 token. Iranian exposure runs to nearly $2 billion, which is where Secretary Bessent had his sights trained.

In fairness to him, the two are less separate than the order might imply. A7A5 is the settlement coin of A7, Russia’s sanctions-dodging payment network, and regular readers may remember it from Issue 1. The order calls A7 a conduit for illicit activity linked to the IRGC, its Quds Force and DPRK-affiliated actors, citing TRM’s investigation into A7. So the Russia hook comes with an Iranian add-on.

Bitzlato, but bigger

FinCEN has done this before. In January 2023 it named Bitzlato, a Hong Kong-registered exchanger, as a primary money laundering concern, in tandem with the Justice Department’s arrest of its founder. PM2BTC, a Russia-linked exchanger, followed in 2024 (announced in September, effective October 11), and last month FinCEN used the same statute to propose cutting off sub-agents of A7, the Russian payment network behind A7A5, which FinCEN says runs hundreds of front companies across dozens of countries.

Bitzlato and PM2BTC were niche operations, and Bitzlato was already being taken apart. MEXC operates in more than 170 countries and is still open for business. It says it is “reviewing” the order, and has commissioned an independent review of its AML and sanctions controls.

The machinery is the same. Like Bitzlato’s, MEXC’s order defines “transmittal of funds” to include convertible virtual currency (CVC), displacing the usual definition in 31 CFR 1010.100(ddd). Both orders accept that institutions have limited ability to reject incoming CVC before it lands. Both also allow some discretion where sending it back is impracticable, for instance coins that have sat in an unhosted wallet for an extended period, or where returning them carries unacceptable risk. Sending stray coins back to a cut-off exchange is, after all, a transmittal to it.

The size of the target is what’s new. A tool built for niche exchangers now has to work against a venue with roughly 9% of the market. And for anyone wondering whether El Salvador offers a way out, the order confirms that bitcoin counts as CVC “despite its legal tender status in at least one jurisdiction.”

This means that the front line is the deposit address, not the correspondent bank. A US exchange, OTC desk or custodian that lets a customer withdraw to a MEXC deposit address is the transmitting institution. Compliance therefore depends partly on knowing which addresses belong to MEXC, and keeping up as that attribution shifts. That is a different job from screening a wire. SAR and OFAC obligations are unchanged, and willful violations carry civil and criminal penalties.

Counterparties of counterparties

Strictly, the order binds only covered US financial institutions. Binance has decided not to test the word “strictly.” A month before the order takes effect, it announced that it is declining withdrawals to MEXC and temporarily holding incoming MEXC deposits for compliance review.

Binance has its own reasons to be careful. Section 311 measures against banks have tended to reach further than their legal perimeter, as counterparties choose to cut ties rather than risk becoming the indirect route. We would expect other offshore venues to reach the same conclusion.

Section 9714 was written for Russian money laundering. Treasury has now used it, with no rulemaking or comment period (none is required), for an action it chose to sell as Iran policy, just as FinCEN billed its A7 proposal in October. That’s three exchanger orders in under four years, plus a proposed rule aimed at A7’s sub-agents last month, which starts to look like a habit.

For now, the sector has 30 days to work out which of its counterparties are fairly described as MEXC’s.

🌎 Global Developments

🇺🇸 United States

🪙 Canton Coin: who decides who gets paid?

SEC staff have granted no-action relief treating Canton Coin, the native token of the Canton Network, as a digital commodity, and covering minting by Super Validators, Validators and application providers without registration under Section 5 of the Securities Act or Section 12(g) of the Exchange Act. The letter highlights two representations: Canton Coin's value derives from the network's programmatic operation and from supply and demand, rather than from the essential managerial efforts of others, and there is no central party. Canton's announcement adds that there was no ICO or pre-mine sale, and that tokens were initially earned only by running infrastructure and applications.

This is a concrete application of the "digital commodity" interpretation the SEC issued with the CFTC in March 2026. It remains a staff no-action position, not a Commission determination, and it rests on the requester's representations. A day earlier, Corporation Finance updated its crypto FAQs on governance groups, control over network participation and the difference between functionality and decentralization. Read together, staff seem to care less about whether a token has a foundation behind it than about whether anyone can still decide who gets paid.

📈 Back to the futures (security, 2000 vintage)

On November 3, CFTC Chairman Michael Selig announced that perpetual futures on individual equities can now trade on designated contract markets that are also notice-registered with the SEC as national securities exchanges for security futures. The legal route is the Commodity Futures Modernization Act of 2000, which created security futures as a jointly regulated product. SEC Chairman Atkins described the previous position as a "no man's land" created by poor coordination between the agencies.

In May, the CFTC said equity-linked perpetual contracts should be submitted for review under Rule 40.3. Instead of waiting for a new framework, the agencies have now reached back a quarter of a century and run the product through the one channel where they already share jurisdiction. Venues offering these contracts will answer to both regulators, which is a slightly ironic home for a product that grew up on offshore crypto venues.

🇪🇺 European Union

🛡️ Commission launches a Crypto Sanctions Task Force

Commissioner Albuquerque's statement on the tenth High-Level Meeting on Sanctions, held on November 5, announced a task force to detect and tackle sanctions circumvention through cryptoassets. The statement was published on November 6, the same day as FinCEN's MEXC order. As far as we know the two were not coordinated, but they point the same way. Membership and mandate have yet to be set out in detail.

🇫🇷 France

🗳️ Now you see it

On November 3, the Assemblée nationale adopted an amendment to the 2027 finance bill requiring taxpayers to declare self-hosted wallets holding at least €100,000 at year-end. The amendment sought a separate declaration of directly held wallets, supplementing DAC8's reporting of cryptoasset transactions by service providers. A separate amendment adopted in October would have ended the tax deferral on certain crypto-to-stablecoin conversions.

Neither survived the week.

On the evening of November 4, deputies rejected the bill's entire revenue section by 458 votes to none, with two abstentions. Under French budget procedure, a rejected first part sends the bill to the Senate in the government's original text, so every deputy amendment falls with it.

Both measures could return. The Senate begins its examination on November 20, and senators can reintroduce amendments. After that come a joint committee, possibly Article 49.3 and, if the constitutional deadline passes, the untested option of a budget adopted by ordinance. For now, the self-custody declaration is a stated preference of the lower house rather than law, though it is a preference worth noting.

🇬🇧 United Kingdom

💷 Budget takes stablecoins out of capital gains tax

The October 28 Budget confirmed that the Finance Bill will carry the cryptoasset tax measures HMRC published in draft on L-day in July. Here is who gets what, and when:

Crypto lending and liquidity pools get no gain/no loss treatment for qualifying disposals by individuals and trustees. That covers moving tokens into and out of a qualifying lending arrangement. For qualifying liquidity pools, it applies to the extent the investor receives back the same types and quantities of cryptoassets originally invested, and any quantity difference gives rise to a gain or loss by reference to that difference. Getting back an asset with materially different rights is an economic disposal. Borrowers are treated as acquiring at market value and disposing at the same value on repayment, and collateral is disregarded.

Under the current rules each of these steps can crystallize a gain, which made paying for something with a stablecoin a capital gains event. The new rules tax what users actually gain rather than how often their tokens move. HMRC has outlined eligibility and withholding treatment, though the detail will need examining once the clauses are final, and transitional provisions apply to existing holdings, so previously accrued gains do not simply disappear.

🇰🇷 South Korea

🔐 More cold storage, please. How much? Unspecified

Binance said its hot wallets were compromised at around 20:05 UTC on October 29, losing "approximately $6.3B USD worth of token assets," which it said it would cover from its SAFU fund and corporate treasury. In its November 4 update, Binance said it had replenished approximately 98% of the affected assets from its own resources, which is not the same as recovering what was stolen. 

On November 2, the Korean Financial Services Commission convened an emergency meeting with the FSS, the Financial Security Institute, the DAXA self-regulatory body and the major local exchanges, according to Korean press reports. Exchanges were asked to raise the share of assets in cold storage, monitor deposits and withdrawals continuously with extra response staff, report and share abnormal access attempts promptly, and set aside additional reserves. No numerical cold-storage target was set. The statutory minimum remains 80%.

Asking exchanges already above 80% to do more, without saying what more means, is supervisory pressure rather than a new rule. The more interesting thread is one Yonhap reports: the ban on exchanges arbitrarily restricting withdrawals. An exchange's own hack is already a recognized justification. Industry participants instead sought clarity on whether an exchange may restrict withdrawals because of a security incident at another platform, where the legal basis is less explicit. The question is whether a security incident at another exchange can justify precautionary restrictions on customer withdrawals before the local exchange itself has suffered a breach.

Separately, the government said on November 5 that it will seek to delay its crypto gains tax again, from 2027 to 2029, with loss-carryforward measures attached. The National Assembly must agree. Korean investors could be forgiven for treating the start date as a recurring rumor rather than a deadline.

🇳🇬 Nigeria

💵 Dollar stablecoins need a Nigerian passport

The Central Bank of Nigeria has issued Regulations for the Operations of Non-Security Virtual Assets in Nigeria, effective November 5. The rules split stablecoins into naira-referenced tokens (Class 1) and foreign-currency-referenced tokens (Class 2). A Class 2 token "shall be issued only by a Nigerian-incorporated entity holding a valid Foreign Currency Issuer Licence," and none can be issued before the CBN grants Token Approval. Algorithmic stablecoins and fiat-referenced tokens backed mainly by other crypto are banned outright.

The scope is broad, with the rules including activity "directed at persons in Nigeria" whether or not the provider has a physical presence there, and a foreign license or approval does not substitute for a Nigerian one. Continued issuance to Nigerian users requires a Nigerian-incorporated, CBN-licensed Class 2 issuer, with ₦15 billion in capital under section 15.2, and approval for the token. Foreign issuers may associate with such an issuer under section 11.2 rather than build their own subsidiary, but the Nigerian entity carries full responsibility. Platform-facilitated P2P trading, a major channel for dollar stablecoins in Nigeria, is in scope too, with no standalone P2P license.

The legal basis includes a 2026 Presidential Executive Order on Virtual Assets Coordination. Existing operators reportedly have 180 days to apply. Having spent years keeping crypto at arm's length from its banks, Nigeria has now asked dollar stablecoins to come onshore.

🔎 Things to Watch

• 🇺🇸 MEXC order: effective December 10, following Federal Register publication on November 10. Watch for FinCEN FAQs, which accompanied the Bitzlato order, and for which exchanges follow Binance in restricting transfers early.
• 🇺🇸 CLARITY Act: after September's failed 49-50 cloture vote, the bill must pass in the lame-duck session. Unfinished legislation does not carry over into the next Congress and would need reintroduction after January 3, 2027. House Democrats are reportedly preparing an SEC-led alternative for the next Congress, built on Maxine Waters' Crypto Investor and Consumer Bill of Rights. No text has been published.
• 🇺🇸 OIRA queue: the SEC's crypto broker-dealer financial responsibility proposal (RIN 3235-AN48) and the Labor Department's final rule on fiduciary duties in selecting designated investment alternatives are both under White House review. Neither puts crypto into anyone's 401(k) yet.
• 🇺🇸 Senate oversight: Senator Blumenthal has given Binance, Tether, World Liberty Financial and Fight Fight Fight until January 4, 2027 to hand over outstanding records. These are information requests, not findings, though a Democratic majority in January may give them more weight.
• 🇬🇧 FCA: GC26/7 (DeFi operational resilience and financial crime guidance) and CP26/36 (cryptoasset perimeter guidance) close on November 18. Final guidance is due in January 2027.
• 🇪🇺 EBA: supervision of USDC's own funds, reserves, liquidity and recovery plans passes from the ACPR to the EBA on November 12. USDC is the first of the EU's 45 e-money tokens to be classed as significant.
• 🇫🇷 French budget: the Senate takes up the finance bill on November 20, with a vote due on December 9. Senators could reintroduce the self-custody declaration.
• 🇰🇷 Digital Asset Basic Act: the government's bill is due this month according to Korean press, with ruling-party lawmakers targeting passage in December. The proposed tax delay to 2029 also needs the National Assembly.
• 🇯🇵 FSA: the digital finance study group has heard from JPYC, SBI VC Trade and the Japanese Bankers Association on stablecoins. The FSA notes that participants' views are not its own.

Coming into view:

• 🇺🇸 GENIUS Act: the OCC's final rule takes effect January 18, 2027. Final FinCEN and OFAC AML and sanctions rules for stablecoin issuers are still outstanding; both proposals would apply 12 months after finalization.
• 🇬🇧 HMRC CARF reporting: the portal will not be ready on January 1, 2027, but the first reporting deadline of May 31, 2027, covering 2026, stands.
• 🇬🇧 Stablecoin tax changes apply from April 1, 2027 for companies and April 6, 2027 for individuals and trustees. The separate cryptoasset loans and liquidity pools CGT relief applies to individuals and trustees from April 6, 2027, subject to the Finance Bill.
• 🇬🇧 FCA authorization gateway: the application period tied to the continuity arrangements ends February 28, 2027, ahead of the regime going live on October 25, 2027.
• 🇳🇬 Nigeria: existing operators reportedly have 180 days from November 5 to apply for licenses.
• 🇰🇪 Kenya: the one-year transition under the VASP Act ended on November 4, with no public register of licensed providers yet.
• 🇨🇦 OSFI's crypto-asset exposures guideline now applies to banks with October year-ends, with December year-ends following in January.
• 🇬🇷 Greece: implementing guidelines for the 10% gains tax expected "in the coming weeks."
• 🇦🇺 Digital Assets Framework Act commences in April 2027.
• 🇯🇵 FIEA amendments: the main provisions commence on a date set by Cabinet Order within one year of promulgation. Some provisions have separate commencement dates, and some took effect in August.

‍

^{DISCLAIMER: The views and opinions expressed herein are those of the author(s) and do not necessarily reflect the views of Talos Global, Inc. or its affiliates (collectively, "Talos") and summarizes information and articles with respect to cryptocurrencies or related topics. This material is for informational purposes only and is only intended for sophisticated institutional investors, and is not (i) an offer, or solicitation of an offer, to invest in, or to buy or sell, any interests or shares, or to participate in any investment or trading strategy, (ii) intended to provide accounting, legal, or tax advice, or investment recommendations, or (iii) an official statement of Talos. No representation or warranty is made, expressed or implied, with respect to the accuracy or completeness of the information or to the future performance of any digital asset, financial instrument or other market or economic measure. The information is believed to be current as of the date indicated and may not be updated or otherwise revised to reflect information that subsequently became available or a change in circumstances after the date of publication. Talos and its employees do not make any representation or warranty, expressed or implied, as to accuracy or completeness of the information or any other information transmitted or made available. Investing in cryptocurrency comes with risk. Certain statements in this document provide predictions and there is no guarantee that such predictions are currently accurate or will ultimately be realized. Prior results that are presented here are not guaranteed and prior results do not guarantee future performance. Recipients should consult their advisors before making any investment decision. Talos may have financial interests in, or relationships with, some of the assets, entities and/or publications discussed or otherwise referenced in the materials. Certain links that may be provided in the materials are provided for convenience and do not imply Talos's endorsement, or approval of any third-party websites or their content. Any use, review, retransmission, distribution, or reproduction of these materials, in whole or in part, is strictly prohibited in any form without the express written approval of Talos.}