Stay informed with free updates
Simply register at Cryptocurrencies myFT Digest – delivered straight to your inbox.
The writer is a partner at Sullivan & Cromwell
Financial regulators look for safety and soundness, good conduct and consumer protection. But crypto assets are borderless. A national supervisor cannot control a protocol that can be written anywhere and used everywhere. Take Tether for example: now based in El Salvador, the world’s largest stablecoin issuer is placed further from the reach of major supervisory jurisdictions. Still, he plans a U.S.-regulated dollar stablecoin, for which he seeks the commercial imprimatur that comes with U.S. oversight.
This juxtaposition reflects the political paradox. It is impossible to order crypto from the center, but market participants themselves need strict regulation.
Large legislative code architectures do not work well in this context. They tend to associate overprescription with vague generalities. They frequently attempt to regulate their activities extraterritorially. Their sprawling orientation can breed bureaucracy rather than security. Activity tends to migrate towards more targeted regimes.
A better approach begins with spontaneous order and market discipline. Policymakers should reverse their usual sequence: first, ask what credible private actors are already doing; then ask yourself what regulated businesses need to do to manage the risks that reach their jurisdiction. Start with behavior on the ground; intervene only where there is a proven risk; and use clear, forward-looking rules that people can plan around.
This approach is based on five practical principles. First, regulate the crypto exchange and other interfaces, not the code. Oversee domestic gateways and touchpoints, including custodians, wallet providers, fiat on-ramps, stablecoin issuers and distributors operating under local law, and regulated financial institutions that manage crypto. The approach should, wherever possible, apply regardless of technology or provider, whether bank or non-bank. Rule books should impose clear obligations that companies can meet and supervisors can enforce.
Second, put accountability where it belongs: on boards. Regulated companies should identify, quantify and govern crypto exposures using an auditable taxonomy of financial risks. Boards should determine whether controls match these risks and validate this through stress testing and scenario analysis.
However, regulators should refrain from designing risk management systems for companies. When rules attempt to do the work of management, companies simply check boxes and remove individual judgment. The trap is thinking that someone who follows all the rules must be safe.
Third, default to “yes, if…”. The policy that oscillates between a green light and an outright ban is fragile. Granting conditional authorization is stronger. Where regulation clearly adds value, the market will seek approval. Following the collapse of Sam Bankman-Fried’s FTX crypto exchange in 2022, companies are seeking regulatory jurisdictions with clearer, credible frameworks and visible checks and balances. Singapore and the ADGM financial zone in Abu Dhabi are among them. Both report robust growth in regulated digital asset activity.
Fourth, ensure international coordination, but in a realistic manner. Supervisors have different national mandates and legal methods; global protocols do not fit neatly into a single rulebook. Instead, cooperate to share your concerns and data; seek mutual recognition of stablecoin reserve standards and custody practices; and aligning with outcomes such as segregation and redemption. This reduces the friction of finding the right thing in multiple places at once.
Fifth, be frugal with the main principles. Unlimited legal obligations, such as “good faith” and “best interests,” without precise definition, invite after-the-fact reasoning that chills useful activity and rewards slavish adherence to wooden interpretations. Principles are important, but they should limit discretion, not expand it. Essential tasks require clear lines.
By moving into El Salvador, Tether highlights the limits of jurisdictional reach in a world of portable codes and capital. However, by preparing a US-regulated stablecoin, it also shows that regulatory value can be real.
The message for policy makers is simple. Regulate interfaces with narrow and clear rules; insist that companies think rigorously about their risks; measure results; and enforce harshly when promises are not kept. Markets will reward countries that combine discipline and humility. Markets will just as surely circumvent those who attempt to control the uncontrollable.
