Institutional Bitcoin regulation mostly applies to the service providers a company uses, such as exchanges, brokers and custodians, rather than to a company that simply holds Bitcoin for itself. Those rules still shape a corporate holder's experience: who it can trade with, what information travels with each transfer, and how its banks and auditors view the activity. This overview reflects the position as of 2026; rules change often, so take local legal advice before acting.
How to read this institutional Bitcoin regulation overview
This is a map, not legal advice. It covers the frameworks a global CFO is most likely to meet. It does not cover every country, and it does not cover tax, which is addressed in how Bitcoin is taxed for companies.
Three layers are worth separating:
- Global standards. Set by bodies such as FATF and the Basel Committee. They are not law in themselves but are adopted by national regulators.
- Regional and national law. Licensing, conduct and disclosure rules that apply in a given market.
- Accounting standards. Set by FASB and the IASB. Not regulation in the strict sense, but they govern how holdings are reported.
Global AML standards: FATF and the Travel Rule
The Financial Action Task Force sets the global standards for anti-money laundering and counter-terrorist financing. Since 2019 its standards have explicitly covered virtual assets and virtual asset service providers (VASPs).
The key points for corporates:
- VASPs must be licensed or registered in the jurisdictions that implement FATF standards, and apply customer due diligence.
- The Travel Rule (Recommendation 16) requires originator and beneficiary information to accompany transfers between VASPs, as it does for bank wires.
- Implementation is uneven. Countries adopt the standards at different speeds and with different thresholds, and FATF publishes periodic updates on progress.
For a company, the practical effect is more information requests at onboarding and on transfers, particularly to or from wallets the company controls itself. See AML, KYC and the Travel Rule for what this looks like in practice.
The European Union: MiCA
MiCA, the EU's regulation for digital asset markets, creates a single licensing and conduct regime for digital asset service providers across member states. Its rules for service providers have applied since 30 December 2024, after earlier provisions covering stablecoins took effect in mid-2024.
What it means for a corporate buyer dealing with EU providers:
- providers need authorisation, and an authorisation in one member state can be used across the EU;
- there are rules on custody, segregation of client assets, conflicts of interest and complaints handling;
- some member states allowed existing providers a transitional period to continue operating while they obtained authorisation, so the provider landscape has been settling.
Alongside MiCA, the EU applied the Travel Rule to digital asset transfers through a separate transfer of funds regulation, from the same date.
The United States: a framework in motion
US regulation has developed through a mix of agency guidance, enforcement, court decisions and legislation, and has shifted noticeably over recent years. In general terms:
- Securities and commodities. Whether a given digital asset is a security or a commodity has been a central question. Bitcoin has generally been treated as a commodity in this debate.
- Spot Bitcoin ETFs. The SEC approved US spot Bitcoin exchange-traded products on 10 January 2024, giving institutions a regulated wrapper. See Bitcoin ETFs vs holding Bitcoin directly.
- Legislation and guidance. Congress and the agencies have continued to work on stablecoin rules, market structure and custody guidance for banks. The detail has been changing year to year.
- State regimes. Some states run their own licensing for digital asset businesses.
- Accounting. FASB ASU 2023-08 requires fair value measurement through net income for fiscal years beginning after 15 December 2024, with early adoption permitted.
Ask each provider which licences it holds, in which jurisdictions, and which entity in its group will contract with you. The licensed entity and the contracting entity are not always the same.
Banks: the Basel standard
In December 2022 the Basel Committee on Banking Supervision published a prudential standard for banks' exposures to digital assets. It places unbacked assets such as Bitcoin in Group 2, which carries much higher capital requirements than traditional assets, and sets limits on banks' total exposure to that group.
The standard applies to banks, not to corporates. It matters to a corporate holder because:
- banks may be cautious about lending against Bitcoin or holding it for clients;
- some banks apply extra scrutiny to payments to and from digital asset providers;
- the standard's implementation timetable and details have been kept under review by the Committee and national supervisors.
A summary for the board
| Framework | Who it applies to | Effect on a corporate holder |
|---|---|---|
| FATF standards and Travel Rule | Service providers, via national law | More onboarding and transfer information |
| MiCA (EU) | Providers serving EU clients | Authorised providers, client asset protections |
| US federal and state rules | Providers, issuers, funds | Shapes product availability and provider choice |
| Basel standard | Banks | Affects banking appetite and lending |
| ASU 2023-08 / IFRS | Reporting entities | Determines how holdings are reported |
Practical steps for a CFO
- Map your footprint. List where the company, its providers and its banks are located.
- Check provider status against the relevant regimes during counterparty due diligence.
- Review your own documents. Constitutional documents, financing agreements and investment policies may restrict the assets you can hold.
- Assign monitoring. Name an owner, usually legal or compliance, to track changes and report them to the board through the risk register.
- Re-check annually. What was true at the time of the board decision may not be true a year later.
This overview is general information as of 2026. Companies should take their own legal, regulatory and tax advice in each relevant jurisdiction.
How The Bitcoin World helps
We help finance teams map the regulatory status of the providers in their operating model and build monitoring into their governance, working alongside their legal advisers. This sits within our board advisory work. Execution and custody are carried out by licensed third-party institutions, and we do not provide legal advice.