NFT Regulatory Landscape: AML, Securities, and Accounting Risks for Firms
No major regulator has yet issued NFT-specific rules, but that silence is not safety. The existing frameworks covering securities, commodities, anti-money laundering, and sanctions can each reach into the NFT space depending on how a token is designed and traded. For accounting firms, auditors, and CFOs using crypto accounting software to manage digital asset positions, understanding exactly where those frameworks overlap, and where they leave a gap, is now a material compliance question.
Why the Regulatory Silence on NFTs Is Misleading
Regulators in the US and at the international level have been deliberate about not rushing to create NFT-specific legislation. The practical effect is that NFTs sit inside a web of existing rules written for other asset types. Whether a given token triggers one framework, several, or none depends almost entirely on its economic substance rather than its label.
The core classification problem
NFTs are not monolithic. A one-of-a-kind digital artwork traded between collectors behaves very differently from a fractional NFT that pools buyer funds and distributes returns based on a project's commercial success. Regulators have signalled they intend to look through the "non-fungible" label and ask what the token actually does economically. That creates a classification risk that sits squarely inside the accounting and legal due-diligence workflow.
Why the gap matters right now
Enforcement actions rarely announce themselves in advance. The NBA Top Shot class action, filed in 2021, argued that "moments" sold on that blockchain collectibles platform were unregistered securities because their value tracked the success of the project itself. That case illustrated the Howey Test risk in concrete terms: if buyers purchase an NFT expecting profits generated by the efforts of others, a securities regulator has a credible basis to intervene. Firms that have not stress-tested their NFT holdings or client portfolios against that standard are carrying undocumented risk.
US Federal Framework: SEC, CFTC, FinCEN, and OFAC
Four federal bodies each have a plausible jurisdictional claim over some category of NFT. None has yet issued direct guidance, but each has published positions on adjacent assets that carry strong implications.
Securities and Exchange Commission
The SEC's core test for whether an asset is a security is the Howey Test: is there an investment of money in a common enterprise with an expectation of profits derived from the efforts of others? For a straightforward one-of-a-kind digital collectible, that test is unlikely to be satisfied. For fractional NFTs, or tokens where the issuer controls the platform and actively promotes value appreciation, the analysis is far less comfortable. Accounting teams recording NFT assets on client balance sheets need a documented rationale for why a given token is not a security. If that rationale cannot survive scrutiny, the accounting treatment and disclosure obligations may need to change.
Commodity Futures Trading Commission
The Commodity Exchange Act already covers cryptocurrencies such as Bitcoin and Ether as commodities. The CFTC has jurisdiction over derivatives and futures on commodities, and it has not excluded NFTs from that definition. Where an NFT has commodity-like characteristics, or where derivatives referencing NFT indices are traded, the CFTC's remit becomes relevant. Given that the CFTC is actively working to expand its retail crypto framework, firms should not treat this risk as remote. Our earlier coverage on FinCEN's withdrawal of the CVC mixing rule and what it signals for digital asset AML provides useful context on how quickly the federal regulatory balance can shift.
FinCEN and the Bank Secrecy Act
The Financial Crimes Enforcement Network has not addressed NFTs directly. Its substantial body of guidance on how the Bank Secrecy Act applies to cryptocurrency is, however, potentially extensible. The pivotal phrase in the BSA definition is "value that substitutes for currency." If FinCEN concludes that certain NFTs meet that standard, platforms facilitating their exchange could be classified as money service businesses and face registration, recordkeeping, and suspicious activity reporting obligations. For any firm operating a marketplace or custody service that touches NFTs, this is the AML trigger to watch.
OFAC and sanctions exposure
The Office of Foreign Assets Control has confirmed that US sanctions apply to cryptocurrencies on the same basis as traditional financial transfers. It has also published guidance specifically addressing the use of high-value art as a sanctions-evasion vehicle. NFT digital art sits precisely at the intersection of those two areas. A firm that processes an NFT transaction involving a sanctioned counterparty or jurisdiction has exposure regardless of whether OFAC has issued an NFT-specific advisory. For treasury and compliance teams, OFAC screening of NFT counterparties and smart contract addresses is no longer optional.
State-Level Considerations
No US state has enacted NFT-specific legislation. However, states with existing cryptocurrency licensing regimes offer a signal of what may come. New York's BitLicense, for example, covers businesses engaged in exchanging, transferring, or administering crypto assets. An NFT issuer or marketplace operator that regularly facilitates those activities could fall within that definition. Firms with operations in multiple states need a jurisdiction-by-jurisdiction review, because the threshold for triggering a money transmitter or virtual currency licence varies and is not harmonised nationally.
The risk of state-by-state divergence
If federal regulators continue to move slowly, states will fill the gap, and they will not do so consistently. A firm operating nationally could find itself subject to a patchwork of conflicting obligations. Robust crypto bookkeeping software that captures entity-level activity by jurisdiction is a practical prerequisite for managing that exposure. Without transaction-level data organised by state nexus, a compliance review becomes guesswork.
The FATF Position: The Clearest Line So Far
Among international standard-setters, FATF has gone furthest in sketching out where NFTs fit. Its guidance states that NFT collectibles are not generally considered virtual assets. The qualifier, though, is material: if an NFT is used for payment or investment purposes in practice, it may cross the threshold into virtual asset territory and become subject to the same AML and counter-financing-of-terrorism expectations that apply to cryptocurrencies.
What "in practice" means for compliance teams
FATF's "in practice" language shifts the analytical weight from the token's technical design to its actual use. A collectible that is regularly used as collateral for loans, traded on liquid secondary markets, or bundled into yield-generating products starts to look like a virtual asset even if its smart contract does not say so. Compliance teams need to monitor secondary-market behaviour, not just onboarding documentation. This aligns with the broader AML-by-substance approach that is becoming the default globally, as seen in the tightening expectations covered in our piece on how South Korea's exchange-blocking order tightens AML expectations globally.
Accounting and Audit Implications for Firms
The regulatory ambiguity translates directly into accounting complexity. Under current standards, most NFTs held by a business are classified as intangible assets and measured at cost less impairment. That treatment works for a static collectible but becomes strained when the token generates ongoing revenue streams, represents a fractional interest in underlying assets, or is routinely traded as a liquid instrument.
Classification and measurement challenges
Firms need to assess each NFT position individually against the following questions. Does the token represent an ownership interest in another asset? Does it carry contractual cash flows? Is it held for trading or strategic purposes? The answers drive whether the asset is better characterised as an intangible, a financial instrument, or inventory. Getting that wrong creates misstatements that an auditor using digital asset accounting software will need to surface during fieldwork.
Disclosure and controls
Even where the accounting treatment is defensible, disclosure adequacy is a separate question. Investors and counterparties need enough information to assess the regulatory risk embedded in an NFT position, including the possibility that it could be reclassified as a security or subject to AML reporting obligations. Firms that treat NFTs as a residual footnote item rather than a substantive risk disclosure are likely to face challenge from auditors as regulatory scrutiny increases.
AML controls in practice
For firms that issue, custody, or transact in NFTs, the control framework needs to address at minimum: customer due diligence at onboarding, transaction monitoring for unusual volumes or counterparty patterns, OFAC screening at the wallet address level, and a documented policy for suspicious activity reporting. These are not hypothetical requirements; they are the standard that FinCEN's existing BSA guidance already points toward for analogous digital asset activity.
Practical Steps for Accounting Firms and CFOs
The absence of explicit NFT regulation does not reduce the compliance burden; it increases it, because firms must map existing frameworks onto a novel asset class without definitive guidance. The following steps reflect the current state of the law and the direction regulators appear to be moving.
Build a classification register
Every NFT position in a client portfolio or on a corporate balance sheet should be documented with a classification rationale addressing the Howey Test, the BSA "value substitution" question, and the FATF "payment or investment" threshold. This register becomes the foundation for both accounting treatment and regulatory reporting decisions.
Stress-test against enforcement scenarios
Work through what happens if the SEC decides a particular NFT is a security, or if FinCEN determines the platform through which it was acquired is an unregistered MSB. Identify which positions carry the highest reclassification risk and ensure those are either hedged, disclosed, or restructured before a regulator makes the decision for you.
Review vendor and counterparty AML status
Firms transacting in NFTs should confirm that their counterparties, whether marketplaces, custodians, or issuers, have documented AML programmes. A firm's own compliance posture can be compromised by association with a counterparty that has not met BSA or FATF standards. This is especially relevant for firms operating across multiple jurisdictions where the regulatory baseline differs.
Keep documentation audit-ready
When regulators do issue guidance, enforcement typically looks back at prior conduct. Firms that can demonstrate they applied a principled, documented approach, even in the absence of specific NFT rules, are in a far stronger position than those that treated the silence as permission to ignore the question. Crypto compliance reporting standards point firmly in this direction.
Source: TRM Labs
Frequently Asked Questions
Could an NFT be treated as a security under US law?
Yes, depending on its structure. The SEC applies the Howey Test: if a buyer acquires an NFT with an expectation of profits generated by the efforts of others, it may qualify as an investment contract and therefore a security. Fractional NFTs and tokens tied to project revenue carry the highest risk of that classification.
Does FinCEN's Bank Secrecy Act apply to NFT platforms?
Not explicitly yet, but FinCEN's existing guidance on cryptocurrency uses the phrase "value that substitutes for currency" as the key trigger. If FinCEN concludes certain NFTs meet that standard, the platforms facilitating their exchange could be treated as money service businesses with registration and AML reporting obligations.
What is FATF's current position on NFTs?
FATF's guidance states that NFT collectibles are not generally virtual assets, but carves out tokens used for payment or investment purposes in practice. That carve-out means secondary-market behaviour and actual use cases matter as much as the token's technical design when assessing AML obligations.
How should NFTs be accounted for on a corporate balance sheet?
Under current standards, most NFTs held by a business are classified as intangible assets measured at cost less impairment. However, that default treatment may not apply where the token generates cash flows, represents a fractional interest in underlying assets, or is held as inventory for sale. Each position requires individual assessment against the relevant accounting framework.
What AML controls should a firm have in place for NFT activity?
At minimum: documented customer due diligence at onboarding, ongoing transaction monitoring, OFAC screening at the wallet address level, a suspicious activity reporting procedure, and a written policy explaining how the firm has assessed its BSA and FATF obligations. These controls should be reviewed whenever secondary-market usage patterns for a held NFT change materially.