On this page
Know-your-customer, AML & CFT: the rules that follow the money
Regulated crypto firms must perform KYC (verify customer identity), AML (detect and report money-laundering), and CFT (counter terrorist financing). In the US, FinCEN sets these duties for money services businesses; other countries have equivalent agencies. The Travel Rule (from the FATF) requires firms to pass originator and beneficiary information with transfers above a threshold.
Transacting with sanctioned individuals, entities, or jurisdictions can be illegal even if the chain itself allows it. OFAC maintains lists that firms screen counterparties against; self-custody users can face liability for interacting with sanctioned addresses.
Is it a security? The Howey test
In the US, the Howey test asks whether there is an investment of money in a common enterprise with an expectation of profit derived from the efforts of others. If yes, the token may be an investment contract — a security subject to SEC registration and disclosure rules. Tokens sold to fund a team that will "build the network" tend to look like securities; tokens that function primarily as a medium of exchange or governance tend not to (though facts and circumstances vary).
Other countries use similar frameworks. The distinction matters because it determines which regulator has jurisdiction and what offering/trading rules apply.
The Howey test, as four questions
Projects often raise funds from accredited investors (individuals/entities meeting income or net-worth thresholds) under exemptions like Reg D, avoiding full SEC registration. A SAFT (Simple Agreement for Future Tokens) is one such structure: investors buy rights to tokens delivered once the network is live, on the theory that a functional token is less likely to be a security. The legal status of these structures remains contested.