The GENIUS Act goes live on January 18, 2027, at the latest. The law sets its own effective date as the earlier of that day or 120 days after regulators finish the implementing rules. With three months to go, not one of those rules is final. Issuers, banks and exchanges are getting a hard start date and a rulebook that is still in draft.

The statute gave regulators a year from its July 2025 signing to write the regulations. That deadline lapsed in July. What exists now is a stack of proposals from five agencies, with comment periods that close weeks before the law starts to bite.

Kalshi and Polymarket built their entire identities around being each other’s opposite. Kalshi is the “regulated from the inside” exchange, holding the first federal license the CFTC ever granted an event-contract platform and pitching itself to lawmakers and institutions as the safe, onshore choice. Polymarket built the opposite brand, crypto-native and historically offshore, technically off-limits to American users even as VPN access made that limit porous, before working toward a US re-entry through its QCEX acquisition. Neither company’s survival argument works without the other looking like the risk.

At Taiwan’s Legislative Yuan on April 29, a policy discussion that might have once seemed fringe was given formal institutional visibility when Legislator Dr. Ko Ju-Chun presented a report advocating for the inclusion of Bitcoin in Taiwan’s national reserve strategy. The session took place during a formal interpellation and included direct engagement with Premier Cho Jung-tai and the governor of the Central Bank of the Republic of China (Taiwan), Yang Chin-long. The report, produced by the Bitcoin Policy Institute, was not simply tabled as an academic exercise but actively introduced into executive-level consideration, which is part of what made the moment feel unusually weighty in tone.

New York enacted a two-year moratorium on new cryptocurrency mining permits in 2022 — the first state-level action of its kind in the United States — while directing regulators to evaluate the environmental effects of proof-of-work mining operations. The policy was a direct response to the strain that mining companies had placed on the state’s electricity infrastructure after initially clustering around cheap hydroelectric power from the New York Power Authority’s St. Lawrence River facility.

In January 2024, the U.S. Energy Information Administration obtained emergency clearance from the Office of Management and Budget to collect electricity consumption data from cryptocurrency mining facilities. In February 2024, it issued a formal request for comments on extending the data collection. On March 1, 2024, it withdrew the effort entirely — the result of a legal challenge from Bitcoin mining companies and a negotiated settlement in which EIA agreed to destroy the data it had already gathered.

Decentralized finance and the traditional financial system both offer lending, trading, and asset management services. The similarity largely ends at the product description. The underlying structures — how participants are identified, how transactions are authorized, how risk is managed, and who bears it — diverge in ways that carry significant implications for regulation, access, and stability.

The most fundamental difference is intermediation. Traditional finance is built on institutions that stand between parties to a transaction, holding assets, processing orders, underwriting loans, and taking on counterparty risk in exchange for fees and regulatory compliance. A bank borrower is not a direct counterparty to a depositor; both are clients of an institution that intermediates. Even in securities trading, where buyers and sellers are nominally matched, brokers, exchanges, and clearinghouses layer between the transaction and its settlement. Each of those intermediaries is licensed, regulated, supervised, and legally accountable.

Decentralized finance has operated for years in a regulatory environment that is, by any honest assessment, unresolved. No overarching legislative or regulatory framework specifically governs defi. Existing laws — the Bank Secrecy Act, securities statutes, commodities regulations — were written before the technology existed and have been applied to it through guidance, enforcement actions, and legal interpretations that have shifted substantially depending on the administration in office.

The Financial Crimes Enforcement Network established in 2019 guidance that money transmitter regulations apply to decentralized applications when those apps perform money transmission, stating that the rules apply “regardless of label.” A small number of defi entities have registered with any federal regulator, and Treasury acknowledged in a 2023 report that there is likely limited compliance with BSA/AML requirements across the sector. The gap between stated regulatory obligation and actual compliance is not ambiguous — it is documented.

The Markets in Crypto-Assets regulation came into full effect in the European Union at the end of 2024, completing a legislative process that began in 2020. MiCA is, by any measure, the most comprehensive crypto regulatory framework enacted by any major jurisdiction. It is also, by the assessment of most practitioners who have spent the past year implementing compliance against it, a framework with genuine strengths, notable gaps, and implementation details that will be litigated for years.

The history of enterprise blockchain in trade finance is a useful corrective to the cycles of enthusiasm and dismissal that characterize coverage of distributed ledger technology. Neither the enthusiasts who projected that blockchain would eliminate trade finance friction within five years nor the skeptics who declared enterprise blockchain categorically pointless have been vindicated. What happened was messier, slower, and more instructive than either camp anticipated.

The high-profile failures are well documented. IBM and Maersk’s TradeLens platform — the most ambitious attempt to put global shipping documentation on a blockchain — shut down in 2022 after failing to achieve the network effects that made it valuable. We.Trade, a European trade finance platform backed by major banks, went into administration in 2022 as well. Marco Polo, another bank-backed network, faced similar difficulties.

Every major blockchain application eventually collides with an identity problem. DeFi lending protocols that want to offer uncollateralized loans need to assess creditworthiness without holding custody of user data. DAO governance systems that want to prevent sybil attacks — one person controlling many wallets to accumulate disproportionate voting power — need to verify personhood without requiring real names. Regulatory compliance frameworks that require KYC create friction that is incompatible with the permissionless design of public blockchains.

Cryptocurrency legislation in the United States has been promised, debated, drafted, amended, shelved, redrafted, and promised again so many times that the industry had largely stopped treating legislative progress as meaningful until a bill reached the floor. The Digital Asset Market Clarity Act’s passage out of committee with bipartisan support is a different moment. It does not guarantee enactment, but it represents the closest the United States has come to a comprehensive crypto regulatory framework since the asset class became economically significant.

For most of the past decade, crypto companies operating in the United States have been navigating regulatory uncertainty using a combination of legal creativity, jurisdictional arbitrage, and optimism that clarity would eventually arrive. The SEC’s enforcement-first approach — pursuing actions against specific actors rather than publishing comprehensive guidance — left the industry in the position of learning the rules from the outcomes of cases it was not party to.

The taxonomic guidance that the SEC published in early 2026 does not resolve every question. It resolves enough of them to allow compliance functions to make decisions they have been deferring for years.

The word permissionless has been doing a lot of work in DeFi. It carries a promise: that financial infrastructure can be built and accessed without gatekeepers, without identity verification, without the approval of a regulator or a bank. Smart contracts execute automatically. Code is law. The system does not care who you are.

Regulators have spent the past three years methodically dismantling this framing, and they are not wrong to do so.