US Crypto Enforcement in Focus: SEC, CFTC, OFAC, and DOJ Actions That Defined Q4 2021
The final quarter of 2021 confirmed what many compliance officers had suspected: the United States does not have a crypto regulation problem, it has a crypto jurisdiction problem. At least six federal agencies claimed authority over digital assets simultaneously, each operating under a different legal theory, and each willing to bring enforcement actions to defend that theory. For accounting firms, CFOs, and any professional advising clients with digital asset exposure, this period set a template for the enforcement environment that has intensified ever since. Understanding what each agency did, and why, is foundational for any firm that wants to stay on the right side of a very crowded regulatory landscape.
A Fragmented Regulatory Map
The "Wild West" characterisation of crypto has always been inaccurate. The real challenge in the US was never a lack of sheriffs; it was an excess of them. By the end of 2021, at least six distinct federal bodies had staked a claim over some dimension of the digital asset market.
Who Claims What
The Securities and Exchange Commission (SEC) treats most cryptoassets as securities subject to registration and disclosure requirements. The Commodity Futures Trading Commission (CFTC) classifies them as commodities and asserts jurisdiction over crypto derivatives. The Treasury's Financial Crimes Enforcement Network (FinCEN) treats them as a functional equivalent of money for anti-money-laundering purposes, a position it has held since 2013. The Internal Revenue Service (IRS), also sitting within Treasury, treats cryptoassets as property for tax purposes. The Federal Deposit Insurance Corporation (FDIC) has claimed authority over stablecoins and their issuers. And the Consumer Financial Protection Bureau (CFPB), responding to a rise in consumer complaints, signalled its own regulatory interest in the space.
The Financial Stability Oversight Council (FSOC) added another layer by proposing to designate certain stablecoin-related activities as systemically important payment, clearing, and settlement activities, with the potential to classify non-bank stablecoin providers as systemically important financial institutions under the Dodd-Frank Act. For any firm operating across this landscape, the compliance challenge is not one regulator but all of them at once.
FinCEN has historically been the exception. Since 2013 it has issued affirmative guidance and advisory opinions, giving firms a clearer sense of where the lines are. Most other agencies took the opposite route: what the period's analysis called "regulation by enforcement," using case-by-case actions rather than prospective rulemaking to define the boundaries of the law.
SEC Actions: Fraud First, Broader Ambitions Next
Through the latter part of 2021, the SEC focused its enforcement resources on what might be called the easier targets: straightforward fraud cases where cryptoasset trappings were used to mislead retail investors. Two cases illustrate the pattern clearly.
The Ginster and Auzins Cases
In November 2021, the SEC announced charges against Ryan Ginster for conducting two unregistered securities offerings that together raised more than $3.6 million in cryptoassets from retail investors. The SEC alleged that Ginster operated platforms that made false promises of high returns through crypto trading and advertising arbitrage, and that he misappropriated at least $1 million of the funds raised.
On 2 December 2021, the SEC charged Latvian national Ivars Auzins with securities law violations connected to a fraud scheme involving the Denaro initial coin offering and the Innovamine cloud mining platform. The civil complaint alleged that over roughly one year beginning in 2019, Auzins ran a series of fraudulent offerings that harmed hundreds of retail investors.
These two cases were part of more than 20 crypto-related enforcement actions the SEC brought across 2021. But the agency's public statements pointed well beyond fraud cases. In remarks to the Aspen Security Forum in August 2021, SEC Chair Gary Gensler stated directly that many crypto tokens may be unregistered securities, that this applied regardless of whether an asset is a stock token, a stable-value token backed by securities, or any other product giving synthetic exposure to underlying securities, and that all such products fall under existing securities laws. He reiterated his view that stablecoins may qualify as securities and investment company products, a position he repeated in Senate testimony in September 2021. A January 2022 interview confirmed the trajectory: to the extent firms are operating outside the regulatory perimeter when they should be inside it, the SEC would bring enforcement actions.
CFTC: Tether, Bitfinex, and Polymarket
The CFTC's Q4 2021 activity made clear that geographic distance from the United States is not, on its own, a compliance defence.
Settlements with Tether and Bitfinex
In October 2021, the CFTC announced separate settlements with Bitfinex and Tether, both on a neither-admit-nor-deny basis. The Bitfinex order related to the timing and implementation of the company's prohibition on US customers; Bitfinex agreed to pay $1.5 million and to strengthen its US customer restrictions. Both are foreign-incorporated companies that do not operate directly in the US market, yet the CFTC asserted jurisdiction over their activities, a signal that regulators view the reach of US commodity law as extending well beyond US borders when US persons or markets are affected.
The Tether order is worth examining carefully because it is frequently mischaracterised. The CFTC made no finding that USDT was not fully backed at all times. What the order addressed was the composition of those reserves: they were not always held entirely in cash, and not always in a bank account titled in Tether's name. The CFTC made no finding of a violation after February 2019, when Tether updated its public disclosures on reserve composition. Tether agreed to pay $41 million to resolve the matter, and maintained in the order that it had always held adequate reserves and had never failed to honour a redemption request.
For firms that hold, issue, or account for stablecoins, this case carries a lasting lesson. Disclosure precision matters. The gap between "fully backed" as a marketing statement and the specific composition and custodial arrangement of those reserves can itself become the basis for regulatory action.
Polymarket and Binary Options on a Blockchain
In January 2022, the CFTC announced a settlement with New York-based Polymarket, ordering a $1.4 million civil penalty. From June 2020, Polymarket had offered event-based binary options through smart contracts deployed on a public blockchain, allowing users to bet on yes/no outcomes for real-world events. The CFTC took the position that these contracts constituted swaps that can only legally be offered on a registered exchange. Polymarket was also required to wind down all markets deemed non-compliant with the Commodity Exchange Act. The case is notable because the infrastructure was entirely on-chain; the regulator's analysis treated the smart contract as the instrument, not as a technical novelty that placed the activity outside existing law.
OFAC: The SUEX Precedent
On 21 September 2021, the Treasury's Office of Foreign Assets Control took its first-ever step of imposing economic sanctions on a virtual currency exchange. SUEX OTC, S.R.O. was added to the Specially Designated Nationals and Blocked Persons List after OFAC concluded it had facilitated financial transactions tied to ransomware attacks. All SUEX assets subject to US jurisdiction were blocked, and US persons were prohibited from any business dealings with the exchange.
What the SUEX Action Means for Compliance Teams
Alongside the designation, OFAC released an updated advisory on the sanctions risks of facilitating ransomware payments. The advisory highlighted the legal exposure that arises even for victims who pay ransoms without first screening the recipient against sanctions lists, and it encouraged cooperation with law enforcement before any payment is made.
For accounting firms and CFOs, the SUEX action has a direct operational implication. Any entity that processes crypto transactions on behalf of clients needs a sanctions-screening workflow capable of checking counterparty wallet addresses against OFAC's SDN list in near real time. A transaction with a sanctioned entity is not simply a compliance failure; it is itself a potential violation regardless of intent. This is precisely the kind of exposure that robust crypto bookkeeping software and integrated compliance tooling is designed to surface before settlement, not after.
For broader context on how AI-driven tools are now being embedded into supervisory frameworks to address exactly this kind of risk, see our coverage of how US crypto regulation is being rewritten in 2026.
DOJ: The BitConnect Guilty Plea
On 1 September 2021, Glenn Arcaro of Los Angeles pleaded guilty to fraudulently inducing investment of more than $2 billion in BitConnect, making it one of the largest criminal cryptoasset cases to that point. A US District Judge for the Southern District of California ordered the liquidation of $56 million in seized assets as part of the proceedings. The scale of the loss underscored that criminal exposure in crypto fraud is not limited to regulatory fines; it extends to asset forfeiture and personal criminal liability at a level comparable to the largest traditional financial fraud cases.
Accounting and Tax Implications for Firms
The Q4 2021 enforcement wave carries several practical implications for firms using digital asset accounting software and advising clients on crypto positions.
Record-Keeping Must Support Multi-Regulator Scrutiny
Because the SEC, CFTC, IRS, and OFAC can each independently examine the same transaction from a different legal angle, transaction records must be granular enough to answer questions from all of them. That means timestamped records of every acquisition, disposal, and transfer; clear identification of counterparties; and documentation of the economic substance of each transaction. A record adequate for IRS property-tax purposes may be insufficient for CFTC commodity reporting or for OFAC sanctions screening.
Stablecoin Reserve Accounting Requires Specificity
The Tether settlement reinforces that the accounting treatment of stablecoin reserves must reflect the actual composition and custodial arrangement of the assets, not just a high-level "fully backed" assertion. Firms holding or auditing stablecoin positions should document the specific asset classes held in reserve, their custodian, and whether they are segregated in accounts titled appropriately. Any mismatch between public disclosure and actual reserve composition is a regulatory risk, not merely an accounting one. This connects directly to evolving classification standards; our article on SEC and CFTC pro-crypto rule durability covers how these standards are continuing to develop.
On-Chain Contracts Are Not Outside the Law
The Polymarket case signals that regulators will look through the technical delivery mechanism of a financial product to its economic substance. If a smart contract performs the economic function of a regulated instrument, it will be treated as one. Firms that have structured products or client-facing services around on-chain contracts should review whether those instruments fall within the scope of existing commodity, securities, or derivatives regulations, and document that analysis.
Sanctions Screening Is Non-Negotiable
The SUEX designation confirmed that OFAC's sanctions regime applies to crypto transactions with the same force as it does to traditional wire transfers. Firms processing crypto payments, managing client wallets, or operating any settlement function must have documented, auditable sanctions-screening procedures. The updated OFAC ransomware advisory also places the burden on the payer to screen before making any payment, even under duress.
Frequently Asked Questions
Did the CFTC find that Tether (USDT) was not fully backed?
No. The CFTC's October 2021 order made no finding that USDT was not fully backed at all times. The order addressed the composition and custodial arrangement of the reserves, specifically that they were not always held entirely in cash or in accounts titled in Tether's name. The CFTC made no finding of a violation after February 2019, when Tether updated its disclosures.
Why did the CFTC have jurisdiction over Bitfinex and Tether if they are foreign companies?
The CFTC takes a broad view of its jurisdictional reach, asserting authority where US persons or US markets are affected by conduct, regardless of where the company is incorporated or headquartered. Both the Bitfinex and Tether settlements proceeded on a neither-admit-nor-deny basis.
What does the SUEX OFAC designation mean for firms that process crypto payments?
It means that sanctions screening of crypto wallet addresses is a legal obligation, not an optional best practice. Any US person or firm subject to US law that transacts with a designated entity, knowingly or not, risks a sanctions violation. Firms should have documented, auditable screening procedures that check counterparty addresses against OFAC's SDN list before settlement.
Are smart-contract-based financial products subject to CFTC regulation?
The Polymarket settlement indicates that regulators will look at the economic substance of a product rather than its technical delivery mechanism. If a smart contract performs the function of a swap or other regulated derivative, the CFTC treats it as one. Firms building or advising on on-chain financial products should conduct and document a regulatory classification analysis.
How should accounting firms approach multi-agency crypto compliance for clients?
Firms should maintain transaction records granular enough to satisfy the distinct requirements of the IRS (property), CFTC (commodity), SEC (securities), and OFAC (sanctions) simultaneously. This typically requires robust digital asset accounting software that captures timestamps, counterparty data, asset classification, and a full audit trail for every on-chain event. A single ledger entry is rarely sufficient across all four frameworks.
Source: Elliptic