Who Regulates Crypto? It Changes If Your Exchange Lends

The answer to who regulates crypto can change while the coin sits perfectly still. On 5 October the Commodity Futures Trading Commission published an advance notice on a 2010 law about retail trades made on credit.

Its reading reaches coins nobody borrowed.

At an exchange that offers retail customers margin, a bitcoin paid for in full stays under futures-style rules while it sits on the exchange's books. Move it to an address whose keys you hold, and the agency keeps only its power to police fraud and manipulation.

Ask who regulates crypto in the US and the usual answer is a map of labels. The SEC takes tokens that are securities. The CFTC takes commodities like bitcoin and their derivatives. States license the exchanges that sell coins for cash, FinCEN polices money laundering and the IRS taxes the gains. Nina had that map ready in São Paulo when her cousin in Florida forwarded the news. He added one line: do I need to move my bitcoin?

She checks money headlines before her family acts on them. This one said the CFTC had proposed crypto rules, and even the CFTC chairman's op-ed says "proposing". The CFTC's release calls the document an "Advanced Notice of Proposed Rulemaking", which asks for comment before any rule is proposed. It runs in the Federal Register on 13 October, and comments close on 14 December. Nothing in it binds anyone yet. The cousin's question survives the correction anyway. The notice ties his answer to two things the label map leaves out: what his exchange offers, and where his coin sits.

He keeps his bitcoin on the US exchange where he bought it. He paid in full and has never borrowed a cent there. That turns his question into a decision, and Nina brings it to two people who come back with opposite answers.

Soren's answer is to leave the coin where it is. If the exchange ever opts into the federal rulebook, even better. He has read the notice to the last footnote, and he says that is where agencies keep the parts they mean. His working life has gone into what happens to customer property when a firm fails. He trusts rules because each one was written after somebody's failure. "If the firm goes under, I want his coin in an account a rule makes somebody keep separate," he says.

Lilith wants him to take delivery. Twenty years in security taught her that attackers go wherever keys are pooled, and she has held her own ever since. In the same notice she has marked a different sentence, the one about what the agency gives up at delivery. "Soren's protections start with handing the coin to somebody," she says. "Mine start with not handing it over."

Eunha sits between them as the judge. Her field is how people decide while rules are still moving. Before anyone argues, she asks what the cousin is afraid of.

"Losing it," Nina says. "And breaking a rule nobody told him about."

Who regulates crypto you paid for in full?

Nina's first answer comes straight off the label map. "He paid cash, no loan, no margin, nothing borrowed. That makes it spot bitcoin, and spot is the states' business. So the CFTC can't touch it, right?"

"Ask what his exchange offered him, not what he did," Soren says. He reads her the clause the Dodd-Frank Act wrote into the Commodity Exchange Act on 21 July 2010. It covers a retail trade in any commodity "entered into, or offered (even if not entered into), on a leveraged or margined basis". Trades "financed by the offeror, the counterparty, or a person acting in concert" with them count too. Retail means anyone below the statute's "eligible contract participant" bar, which is set for institutions and large fortunes. Unless the trade results in actual delivery within 28 days, it is treated "as if" it were a futures contract. That is the label that picks the rulebook, and this one sends the trade to a CFTC-registered exchange.

"Congress wrote that parenthesis itself, and the CFTC has used it on crypto venues. Bitfinex paid $75,000 in June 2016 for financed retail trades off-exchange, the first time the clause reached a crypto exchange. Kraken paid $1.25 million in 2021."

The new part is how far the notice stretches the word "offer". A margin offer, it says, "attaches to all agreements, contracts, or transactions to which it is applicable". That holds "regardless of whether any individual transaction is entered into on one of those bases". It can sit in onboarding papers, an exchange's terms or margin documents. It can cover a whole exchange or a whole account. A coin bought fully paid there becomes "a fully paid, open CTX". CTX is the notice's shorthand for a crypto trade under the clause. It stays under futures-style rules while it "is only recorded on an internal book-entry of the exchange, prior to actual delivery".

"He never clicked anything about margin," Nina says.

"He didn't have to," Lilith says. "The exit is in the same sentence, and it's delivery: once the coin actually reaches him, the button stops mattering. Until then, a button nobody pressed decides who supervises a coin nobody borrowed against. That's a strange way to protect a customer."

"It protects him from a venue that offers credit on one screen and calls the rest spot on the next," Soren says. "Read 'offer' trade by trade and a margin desk books every loan as two trades. The clause becomes a formality." The notice gives Congress the same aim: stopping venues from evading the CFTC's reach over futures. Congress also meant not to "interfere with the legitimate spot market".

"On the statute, Soren has the text," Eunha says. "The parenthesis is Congress's. The CFTC has enforced the clause on crypto venues at least twice. The account-wide reading of 'offer' is something else. It's a preliminary belief in an advance notice, binding on nobody until a proposed rule and a final one follow. It also reaches only an exchange that offers retail margin, which is why paying cash isn't the test, Nina. It's what his exchange offers."

That makes the menu a jurisdiction.

Whoever drafts an exchange's terms decides which regulator stands over every coin kept there. The customer accepts it with one click at sign-up. The exchange can also decline the whole arrangement. The CFTC's chairman, Michael Selig, said so in an op-ed on the day of the notice. The rules "wouldn't require crypto assets to trade on CFTC-registered platforms", he wrote, adding: "We don't have the authority to impose such a requirement without congressional action." An exchange that offers no retail margin stays with the states. The notice even asks whether that is "a commercially viable avenue".

Do state licences protect coins as well as federal rules would?

"So if his exchange opted in, his bitcoin would sit under futures rules until he withdrew it," Nina says. "Is that bad news for him?"

"It's the best news in the notice," Soren says. It sketches a "crypto asset market", a new kind of CFTC-registered exchange where the coin itself is what trades. A futures commission merchant would hold the coin and a clearinghouse would clear the trade, so the work would split between a broker, an exchange and a clearinghouse, each under its own rules. Soren's case for that arrangement is a bankruptcy. When FTX collapsed in November 2022, 130 of its affiliates went into bankruptcy. Its CFTC-registered entity kept its customers' property apart. The notice quotes the CFTC's chairman at the time telling the Senate that the property "remained exactly where it should be, segregated and secure. This is regulation working."

"Now the state side," Soren says. "Voyager held money transmitter licences in 13 states. It pooled its customers' coins in one account and lent them to institutions. Three Arrows Capital borrowed 15,250 bitcoin, and Voyager went bankrupt anyway." The notice adds a detail from Iowa, where Voyager was licensed. Its code let money transmitters hold up to half of the investments behind customer balances in riskier assets, listed stocks among them. The federal rule limits an FCM or clearinghouse to "an enumerated set of low-risk instruments" for customer funds.

Lilith has found a footnote of her own. It quotes a former CFTC chairman, Timothy Massad, on New York's state licence. "One could even question," he wrote, "whether its licensing requirement has given a false sense of legitimacy to those that have bothered to register." "That works on any licence," she says. "A state licence such as California's attaches to the venue, and so does a federal registration. Neither one attaches to his coin."

"I'd sign that footnote myself. A licence isn't a place, it's paper on a wall. Segregation says where the coins sit on the morning a firm fails, and the federal rule spells that out."

"Your registered FTX entity held, and that part of the rulebook worked," Lilith says. "Only while the coin sat on its books, though. And your best rulebook still tells him in writing that nobody covers him if the firm in the middle goes under." After delivery, the notice itself says, the CFTC "no longer has jurisdiction with respect to such asset, aside from its anti-fraud and anti-manipulation authority". The same federal regime makes an FCM disclose "that customer funds are not insured against intermediary insolvency".

Her other objection is to the line itself. The CFTC proposed a meaning for "actual delivery" in 2017 and made it guidance in 2020. On 11 December 2025 its acting chairman withdrew that guidance as "outdated and overly complex guidance that penalizes the crypto industry and stifles innovation". In October 2026 a new chairman floated a different reading. "That's a busy decade for a word that means handing someone a thing. He'd be parking his coin behind a line that moves whenever the chair does."

"The definition has moved, and I won't pretend otherwise," Soren says. "Segregation hasn't. An FCM has had to keep customer funds apart from its own under every chairman you just named."

To Eunha, they have been arguing about two different things. "On keeping customer property separate, the record favors Soren. FTX's registered entity kept its customers' assets while 130 affiliates went bankrupt. Voyager lent pooled coins while holding thirteen state licences. On how long that protection lasts, Lilith is right. It covers a coin on the books and ends at delivery. Since 2017 the agency has proposed, finalized, withdrawn and redrawn what delivery means. Neither regime insures him against the firm in the middle. The federal one makes the firm say so."

Segregation is not a promise that nothing fails, but a promise about whose property stays out of the wreckage when something does. It covers only coins still inside the firm.

A key makes the opposite trade: nobody is left to fail, and nobody is left to call.

Where should a coin sit while the rule is being written?

Nina has been scrolling through the screenshots her cousin sent of his exchange app. She thinks she has found the way out. "He doesn't need to move anything. His bitcoin is already in a wallet, and the app has a tab for it."

"Whose keys?" Lilith asks.

A tab like that usually isn't a wallet at all. It's a view of the exchange's own ledger. The coins sit at addresses the exchange controls, and his balance is an entry against them. The notice draws its line right there. Under Monex, a 2019 appeals ruling, delivery needs "some meaningful degree of possession or control". For a crypto asset, the CFTC "preliminarily believes" possession and control "may require possession of the credentials (e.g., private key(s))". Coins bought through onchain protocols, it adds, are "typically delivered directly to the purchaser's digital wallet", not held through "an internal book-entry".

"His app calls a ledger entry a wallet," Nina says, and deletes a line from the reply she has been drafting.

"The agency's exit test is mine," Lilith says. "Hold the key or hold an IOU. If somebody else votes your coin or takes a cut of its staking, they still have it." For staking and governance tokens, the notice says much the same. Delivery there may require the capacity to vote "directly and on a disintermediated basis", or to stake "without being subject to fees charged by an intermediary".

"Then be honest about what a key costs," Soren says. "It fails in ways no rulebook reaches. He loses the device and the backup in one house move. He signs on a fake page that looked like his exchange. Somebody learns what he holds and stands over him until he opens it. There's no segregated account for a seed phrase on a card in a drawer. No bankruptcy court can hand back what he signed away himself."

"Those are all failures he can prevent himself. A withdrawn definition isn't."

"Look how sure the agency is of its own test," Soren says. "If he's counting on delivery to get him out of the rulebook, he's counting on a test the agency hasn't finished writing." In one section the notice says actual delivery "may occur where a lien or security interest remains outstanding", so a coin bought with an onchain loan could still count as delivered. In a later section, citing the same 2019 ruling, it says delivery "may not occur where a lien or security interest remains outstanding".

"Which is why I'd never borrow against a coin I want delivered. Paid in full and sitting at his own address, it isn't a close call under either sentence."

"On what counts as leaving the CFTC's rulebook, the notice sides with Lilith," Eunha says. "Its own test runs through the private keys. A tab inside an app doesn't pass it. On where his coin is safer, it's unsettled, and I'd have to invent a number to rule otherwise. It turns on whether he can run a key. That means guarding the backup, refusing signatures he doesn't understand and keeping quiet about what he holds. And the test itself is a preliminary belief that hedges on loans in both directions."

The rulebook ends where the key begins, and so does every promise the rulebook makes.

Who regulates crypto in your account, and for how long?

Nina reopens the reply she started an hour ago. It says "CFTC, apparently", and she deletes it. What she types instead asks about the exchange, not the agency. Does your exchange offer margin or financing to anyone, anywhere in its terms? And is your bitcoin at an address whose keys you hold, or is it a balance on the exchange's books? "He asked me for an agency. He's getting questions back, and the agency falls out of his answers. So what does each answer get him?"

"You each sell him the end of a worry," Eunha tells the two of them. "Soren's ends in a rulebook that keeps his coin apart from the firm's. Lilith's ends in a key that keeps it off everyone's books. Both are real. Neither covers where he actually is: a balance in an app whose terms he hasn't read, under a reading nobody has finalized."

Then she gives Nina the version to send. "Under this reading, paying in full doesn't keep the CFTC out if the venue offers margin. Where it does reach, federal segregation has the better record for coins on the books. That protection ends the day he withdraws. Off the books he's outside the rulebook by the agency's own test. He's safer there only if he can run a key."

Before sending it, Nina asks them what she asks every source she checks: "What would make you give him the other answer?"

Soren names a sentence that hasn't been written yet. "A final rule that lets the FCM lend out fully paid customer coins, the way Voyager lent its customers'. That day I'd tell him to take delivery."

Lilith's is about where the definition lives. "Put delivery's meaning into a final rule, through notice and comment. That way the next chair can't withdraw it with a press release. For coins he trades every week, the federal books would be a place I could live with."

Comments on the notice close on 14 December. A proposed rule, then a final one, would have to follow before any of it binds, and until then the label on a coin answers only part of who regulates crypto.

The rest sits in two places: the exchange's paperwork, which the holder can only read, and the coin's address, which the holder can change.

Set up two $500 bitcoin tickets in the simulator, one a spot buy paid in full and the other a 5x short on the perpetual. Only the second shows a funding rate and a liquidation price, the point where borrowed money starts making decisions for you. A perpetual is a derivative, not one of the notice's CTXs. The line between your two tickets is still the line the CFTC is drawing.

Start free →