TRM Labs Q3 2026 Policy Roundtable: What Firms Must Know
TRM Labs' quarterly policy roundtable for Q3 2026, published on 26 October 2026, pulled together its global policy leads for a structured sweep of the regulatory developments that defined the summer and early autumn. The picture that emerged is one of a market caught between statutory gaps in the US and rapid rule-making in Europe and Asia. For accounting firms, auditors, and CFOs who rely on crypto accounting software to track obligations across jurisdictions, the velocity of change in this quarter makes a structured compliance review urgent before year-end.
United States: Legislation Stalls, Regulators Step In
The headline from Washington was the failure of the CLARITY Act to clear a cloture vote. TRM's Ari Redbord, who leads the firm's policy work, said most observers in the policy community now expect no further congressional action on digital asset market structure before the midterm elections. If the midterms shift the composition of Congress, any draft legislation would likely return to the drawing board.
Regulatory Gap-Filling by the CFTC and SEC
Regulators did not wait. Within 36 hours of the failed cloture vote, the Commodity Futures Trading Commission published new guidance and opened a 60-day comment period on retail crypto trading rules. The SEC, separately, announced a five-year innovation exemption covering onchain trading of tokenized stocks. Redbord's assessment is that the agencies are effectively resolving the SEC/CFTC boundary themselves, which brings near-term market clarity but leaves that clarity exposed to changes in political leadership because it rests on guidance rather than statute.
Stablecoins: The One Area with Statutory Footing
Stablecoins are the exception to the legislative drought. The GENIUS Act is already enacted, and Treasury alongside the Office of the Comptroller of the Currency are now in the rule-writing phase. For firms issuing or holding stablecoins, the compliance architecture is taking shape in real time. Teams should be tracking the Treasury and OCC rulemaking process closely, since the implementing rules will determine reserve, reporting, and AML obligations under the Act.
Token Taxonomy: Guidance, Not Law
An audience question at the roundtable drew Redbord into the definitional debate. Without enacted legislation, there is no statutory answer to what makes a token a security. He pointed to the SEC's token taxonomy, published in March, which organises digital assets into five categories: digital commodities, digital collectibles (including NFTs), digital tools, stablecoins, and digital securities. The taxonomy is guidance, not a rule with the force of law, so courts will still apply the Howey test when disputes reach litigation. Firms classifying tokens for balance sheet or AML purposes should document their reasoning with reference to both the SEC taxonomy and the underlying legal test, since the two may not always produce the same answer.
Europe: MiCA 2.0 Consultation and the Authorisation Crunch
Isabella Chase, TRM's head of European policy, took the roundtable from Washington to Brussels and London. The summer was dense with consultations, and their outcomes will set the regulatory architecture for the next several years.
MiCA 2.0: What the Extended Consultation Covered
The European Commission's formal review of the Markets in Crypto-Assets Regulation closed its consultation on 30 September, a month later than originally planned. The extension reflected the volume of responses. The Commission is required to publish a report with proposals for new rules by 30 June 2027. The 86 questions in the consultation addressed token classification, the stablecoin regime, CASP authorisation, and the areas MiCA's original text left out: DeFi, staking, lending, borrowing, prediction markets, and perpetual futures. These product categories were not central to everyday crypto activity when MiCA was drafted, so their omission was always temporary.
Early submissions from ESMA and the EBA signal a preference for preserving the existing framework and making it more precise rather than rebuilding it. Both bodies also addressed stablecoins, including the specific question of whether issuers should be able to freeze coins linked to illicit activity. For teams working through what the end of MiCA's transitional period means for CASPs, the MiCA 2.0 timeline adds a second layer of planning: firms need to comply with today's rules while preparing for a 2027 revision.
The Authorisation Gap
Chase noted that roughly 281 CASPs held authorisation at the end of MiCA's grandfathering period, against approximately 1,300 firms identified as operating across Europe during that window. The gap is significant. Firms that operated under grandfathering and did not reach authorisation are now outside the regulatory perimeter unless they exit the market or secure a licence under existing national frameworks pending MiCA 2.0.
UK FCA: The Authorisation Window Is Open
In the UK, the Financial Conduct Authority opened its authorisation gateway on 30 September. It remains open until 28 February 2027. Any firm that wants to operate from the UK under the incoming regime must be authorised before the new rules take effect in October 2027. The FCA finalised its rules on 30 June, which left firms relatively little time between receiving the final text and the gateway opening. The FCA has indicated that the final details on the regulatory perimeter will follow in early 2027, meaning firms are being asked to apply against a framework that is not yet fully complete. Chase noted that the FCA applies a "same risk, same regulatory outcome" principle to definitions, which provides a conceptual anchor even where specific rules remain outstanding. On sanctions, both the UK and the EU made significant crypto-related designations this quarter, with both authorities moving beyond designated countries and entities to focus on the networks that enable sanctions evasion.
Asia-Pacific: Scaling Frameworks and the Race for Interoperability
Ziqing Ang joined the roundtable for the first time and covered the Asia-Pacific region, drawing on her attendance at Token2049 in Singapore the week prior. The dominant question she heard across conversations at the event was not whether frameworks exist but how the region scales digital assets now that they do.
Singapore's Stablecoin Consultation
The Monetary Authority of Singapore opened its stablecoin consultation on 1 September, with a closing date of 16 October. The proposal introduces a dedicated issuance licence, full reserve requirements, redemption obligations, and quarterly stress tests. The provision attracting the most industry attention would restrict issuers from using customer funds, or the yield earned on them, to materially finance their own operations. MAS drew the concept from e-money regulation and has acknowledged its effect on issuer commercial viability, so Ang expects further calibration before rules are finalised.
The design also creates a two-tier market. Coins that meet the standard earn a MAS-regulated label. Coins that do not can still be distributed but are treated as digital payment tokens, with different regulatory consequences. MAS proposes to recognise foreign stablecoins from substantially equivalent jurisdictions, which opens a path to cross-border interoperability. It also reserves the right to designate any stablecoin as systemic regardless of where it is issued, a provision with significant extraterritorial reach.
Tokenised Money and Settlement Infrastructure
Banks across the region are accelerating work on tokenised money and stablecoins but are waiting for the full rulebook before committing capital, particularly on the question of how crypto assets held on permissionless blockchains are treated for regulatory capital purposes. In April, MAS consulted on allowing banks to classify such assets as Group 1, with lower risk weights than the standard 1,250% treatment, provided the institution can demonstrate it manages the specific risks of public chains.
Settlement infrastructure is the other constraint. Hong Kong's tokenisation pilot settles tokenised money market transactions using tokenised deposits, but the cash leg still runs through systems that do not operate around the clock. Regulators are examining tokenised central bank money on a continuous basis precisely because faster settlement rails offer limited benefit if the cash side remains subject to cut-off times.
AI Risk Management: MAS Sets the Standard
Ang noted that questions about AI in the region have become operational rather than theoretical. Institutions are being asked what AI systems they run, what evidence supports their outputs, and whether they can reconstruct a decision trail after the fact. On 7 October, MAS published its final AI risk management guidelines, built around three principles: oversight should scale with the risk of the use case; every AI application must be documented with clear roles and responsibilities assigned; and institutions must demonstrate ongoing model monitoring rather than rely on static documentation prepared at deployment. Oversight expectations apply from October 2027 and lifecycle controls from October 2028, with a separate consultation on agentic AI planned for next year.
Licensing Timelines Across the Region
Taiwan passed its Virtual Asset Service Act on 30 June, with the earliest reported effective date in the first quarter of 2027. In Korea, the Digital Asset Basic Act has not yet been introduced, and stablecoins remain the primary legislative sticking point. The roundtable discussion of Korea's framework reflects a broader regional pattern: stablecoin classification is the contested boundary that is holding up broader digital asset legislation in multiple jurisdictions simultaneously.
What This Means for Accounting Firms and CFOs
The Q3 2026 roundtable surfaced a compliance landscape that is simultaneously more detailed and more fragmented than it was a year ago. The GENIUS Act gives stablecoin issuers and their counterparties a statutory framework in the US, but the implementing rules are still being written. MiCA 2.0 will expand the EU perimeter to cover DeFi, staking, and lending products, but the proposals will not be final until mid-2027 at the earliest. The UK gateway is open now, with an October 2027 deadline. Singapore's stablecoin licence is in consultation. Taiwan's regime starts in early 2027. Korea's is still being negotiated.
For teams using digital asset accounting software to manage multi-jurisdictional positions, the immediate priorities are: confirm whether each entity in the group is within or outside each applicable regulatory perimeter; identify which products, particularly stablecoins, DeFi positions, and staking rewards, will be captured by incoming rules that do not yet have final text; and document token classification decisions with reference to both the applicable local guidance and the underlying legal tests, since guidance can shift. The SEC token taxonomy and the MiCA 2.0 questions both signal that classification will face increased regulatory scrutiny across all major jurisdictions.
The sanctions dimension also deserves attention. Both the UK and the EU have signalled a shift toward targeting enabler networks rather than just primary actors. For AML teams, that means transaction monitoring programmes need to extend beyond direct counterparty screening to cover the infrastructure and intermediary layers. This connects directly to the Senate's scrutiny of stablecoin-related payments, which illustrates how quickly secondary relationships can attract regulatory attention.
Source: TRM Labs
Frequently Asked Questions
What is the current status of the CLARITY Act in the US?
The CLARITY Act failed to clear a cloture vote and most policy observers do not expect further congressional action on digital asset market structure before the midterm elections. The CFTC and SEC are issuing guidance to fill the gap, but that guidance does not carry the same durability as enacted legislation.
What does the GENIUS Act require from stablecoin issuers?
The GENIUS Act is enacted law, and Treasury together with the OCC are now writing the implementing rules. The specific reserve, reporting, and AML requirements will emerge from that rulemaking process. Issuers and firms holding stablecoins should monitor the rulemaking closely because the details will determine operational obligations.
How many CASPs are authorised under MiCA at the end of the grandfathering period?
TRM Labs reported approximately 281 CASPs held authorisation at the close of the grandfathering period, against roughly 1,300 firms identified as operating across Europe during the transition. Firms that did not reach authorisation are now outside the MiCA perimeter.
When does the UK FCA's authorisation window close?
The FCA's gateway opened on 30 September 2026 and closes on 28 February 2027. Firms that want to operate from the UK under the new regime must be authorised before the regime starts in October 2027. Final details on the regulatory perimeter are expected in early 2027.
What does the MAS AI risk management guidance require of financial institutions?
MAS published its final AI risk management guidelines on 7 October 2026. They require institutions to scale oversight proportionally to the risk of each AI use case, document every application with assigned roles and responsibilities, and demonstrate ongoing model monitoring. Oversight requirements apply from October 2027 and lifecycle controls from October 2028.