BitBullNews Crypto Policy & Regulation Watch – July 21-28: Perimeter Hardens

Crypto regulation moved closer to products and business models this week.

Related article

BitBullNews Crypto Policy & Regulation Watch – July 14-21: The Implementation Gap Crypto policy moved in two different directions this week. International coordination accelerated. The United States and United Kingdom published a shared framework for cross-border…

The United States still lacks a completed digital-asset market-structure law. The CLARITY Act remained short of a Senate floor vote through July 27. Yet the absence of legislation did not stop regulators from defining where existing rules may apply.

SEC Commissioner Hester Peirce turned attention to crypto vaults and onchain lending. Her July 22 statement drew a line between software that executes a fixed strategy and managers who select assets, set lending terms or redirect user funds. The more discretion a product contains, the harder it becomes to argue that the arrangement is simply autonomous software.

FINRA reached a different milestone. Its July 24 information-request deadline required every member firm to disclose current and planned crypto activities, including direct access provided through affiliates or external companies. The exercise is not a licensing decision, but it gives FINRA a detailed map of how broker-dealers are entering the market.

Europe and the United Kingdom are further into implementation. ESMA refreshed its MiCA register on July 24, while the FCA confirmed a defined authorization window ahead of the UK regime’s October 2027 commencement. Nexo’s European structure provided a live example of what implementation now looks like: one consumer-facing platform, several regulated service providers and separate products sitting outside the cited authorization scope.

The message across jurisdictions is consistent. Crypto regulation is becoming less concerned with labels and more concerned with functions, counterparties and control.

Weekly Regulatory Scorecard

Sources: SEC, U.S. Senate, FINRA, ESMA, FCA, company legal disclosures and the U.S. Treasury.

The SEC Moved From Tokens To Control

Peirce’s statement did not create a new rule. It did something more useful for product teams: it identified the features most likely to pull a vault or lending strategy inside the federal securities-law perimeter.

Her starting point was straightforward. Moving an activity onchain does not remove legal obligations that would apply to the same economic activity offchain. Tokenized securities remain securities, and a smart contract does not neutralize the role of a manager who decides where user capital goes.

Crypto vaults can sit anywhere on a wide spectrum. At one end, an immutable contract follows a fixed allocation without ongoing human decisions. At the other, a curator selects protocols, reallocates funds, changes risk limits or appoints another party to manage those decisions.

The second model carries more regulatory exposure because users may depend on the managerial efforts of an identifiable operator.

SEC Vault And Lending Perimeter

This table summarizes regulatory questions raised by Commissioner Peirce. Her statement is not a Commission rule, order or definitive legal classification of any specific product.

The Word “DeFi” Does Not Set The Legal Perimeter

The industry often treats decentralization as a binary condition. The SEC statement points toward a functional test instead.

A product may execute through smart contracts while still relying on a small group to:

• Select the available strategies.
• Change collateral requirements.
• Set borrowing costs.
• approve upgrades.
• control emergency functions.
• receive performance-linked compensation.

Those facts can matter more than whether the interface uses the words “vault,” “protocol” or “DeFi.”

For compliance teams, the immediate task is not to decide whether a product is decentralized in the abstract. It is to map every decision right.

Who can change the code? Who selects protocols? Who receives fees? Who can freeze withdrawals? Who decides when an asset becomes unacceptable collateral? Those answers reveal where managerial reliance and regulatory responsibility sit.

The statement also matters for tokenized funds. A vault that automatically allocates into tokenized securities may still resemble an investment company or separately managed account, even when portfolio execution occurs entirely onchain.

CLARITY Remained Stuck Between Committee And The Floor

The Senate Banking Committee advanced the CLARITY Act by a 15–9 vote on May 14, sending the bill toward the Senate floor. The official Senate roll-call record through July 27 showed votes on nominations and another resolution, but no floor vote on the digital-asset market-structure bill.

That distinction matters. Committee passage shows that a bill has enough support to continue. It does not establish final language, a floor coalition or an enactment date.

The negotiation also moved beyond the original division of responsibility between the SEC and CFTC.

New crypto ethics language was released on July 22. Senate Banking Committee minority staff issued a sharply critical fact sheet arguing that the proposal contained enforcement and conflict-of-interest loopholes. That document represents the minority staff’s political and legal analysis, not a neutral regulatory determination. Its existence nevertheless confirms that public-official ethics remains part of the legislative negotiation.

The unresolved package now includes several distinct debates:

• SEC and CFTC jurisdiction.
• Treatment of decentralized protocols and software developers.
• Stablecoin rewards and yield products.
• Anti-money-laundering obligations.
• Customer-asset protections.
• Ethics and conflicts involving government officials.
• The relationship between a future statute and ongoing agency interpretations.

The market should therefore treat CLARITY as a legislative asset with uncertain duration, not as an enacted framework.

FINRA Built A Broker-Dealer Crypto Map

FINRA’s July 24 deadline marked a shift from policy discussion to supervisory inventory.

The regulator asked all member firms to report their current and planned crypto activities. FINRA said it intends to use the information to adapt regulatory programs, modernize oversight, support compliance and identify industry trends. Firm-specific responses will remain private, although FINRA may publish anonymized aggregate findings.

The request also clarified several definitions that firms had interpreted inconsistently.

Allowing clients to buy crypto ETFs does not, by itself, mean a broker provides direct crypto trading or custody. Providing access to Bitcoin or Ether through an affiliate does fall within FINRA’s third-party activity question. Making an ETF available to customers also does not make the broker an authorized participant; that term applies to firms that create and redeem fund shares directly in the primary market.

FINRA Crypto Activity Map

A firm’s FINRA submission should match its board materials, product roadmap, affiliate agreements, public marketing and vendor inventory. A business unit describing an arrangement as “ETF access” while another document describes direct crypto execution could create a credibility problem during examination.

The same applies to plans. FINRA asked about both current and intended activity. A firm that later launches a crypto service omitted from its response may need to explain when the plan changed and how compliance reviewed it.

The register contains five separate datasets covering non-stablecoin white papers, asset-referenced-token issuers, e-money-token issuers, authorized crypto-asset service providers and non-compliant entities. ESMA publishes updates weekly using information supplied by national competent authorities and the European Banking Authority.

The weekly schedule creates a practical limitation. A national authorization or withdrawal may appear in a domestic register before it reaches ESMA’s central files. Companies, counterparties and journalists should therefore check both the ESMA register and the relevant national regulator when timing matters.

The register also does not approve the contents of listed crypto-asset white papers. ESMA states that responsibility remains with the issuer or offeror. Inclusion proves that a document has been notified and recorded; it does not function as an investment endorsement.

The more difficult issue is service scope.

A group may operate a recognized brand while several legal entities provide custody, execution, transfer, derivatives or lending. Saying that a platform is “MiCA-aligned” does not identify which company is regulated or which services fall within its permission.

The Nexo example illustrates a model likely to become more common in Europe.

A consumer may experience one interface, account history and brand relationship. Behind that interface, different regulated entities perform different functions. This allows a platform to maintain distribution while outsourcing regulated execution or custody to authorized specialists.

The model can accelerate market access, but it creates additional counterparty and disclosure risk.

The fourth question is the most important. Nexo’s own disclosure separates Earn and Borrow from the MiCA and MiFID authorizations cited for custody, trading and futures. It also states that those products are not covered by deposit-guarantee or investor-compensation schemes.

This does not mean the separate products are unlawful. It means the regulatory protection attached to one service should not be assumed to cover another.

Sources: FCA crypto-regime and authorization-gateway guidance.

The application form was still being finalized when the FCA published its gateway guidance, but the regulator had already released an information document and financial-data template showing the expected scope of submissions.

Waiting until the gateway opens would leave firms only five months to assemble a full application.

The SEC’s focus moved toward vaults, lending strategies and managerial control. Commissioner Peirce’s statement was not binding rulemaking, but it made the analytical direction clear: putting an investment or lending process inside a smart contract does not remove federal securities-law questions.

CLARITY remained unfinished. The Senate Banking Committee had already advanced the bill, but the official floor record showed no vote through July 27. Ethics language added another contested issue to a negotiation already covering agency jurisdiction, DeFi, stablecoin rewards and customer protection.

FINRA moved faster than Congress. Its information request gave the regulator a firm-by-firm inventory of direct crypto access, affiliate models, third-party custody and planned activity. That data can shape future supervision before the statutory market-structure framework is complete.

Europe is operating on a different timetable. ESMA’s MiCA register now provides a regularly updated authorization and non-compliance record. The Nexo structure shows what this means in practice: one interface, regulated custody and execution partners, and separate lending and yield products outside the authorizations cited for other services.

The UK has gone further in implementation planning. Its gateway opens in September, closes in February and leads toward an October 2027 regime. Firms know when to apply and what happens if they apply late or not at all.

OFAC supplied the final warning. Regulatory openness and sanctions enforcement can advance at the same time. Legal crypto activity is gaining clearer routes into financial markets. Networks tied to illicit finance are being mapped across exchanges, wallets, affiliates and settlement providers.

The winning compliance model will not rely on a license headline. It will show, service by service, who controls the product, who holds the assets, who executes the transaction and which regulator stands behind each activity.

Methodology

https://bitbullnews.com/wp-content/uploads/2026/06/BitBullNews_Crypto_Policy_Regulation_Watch_Methodology.pdf