A breakout session at the 9th Global Conference on Criminal Finances and Cryptoassets gathered regulators, supervisors and experts from more than 20 jurisdictions to discuss practical approaches to regulating and supervising cryptoassets. The central aim was to provide hands-on guidance and tips for jurisdictions at early stages of regulating and supervising cryptoassets.

Structured around three key themes – building blocks for regulation, managing cross-border risks, and sustainable cooperation and peer support – the session captured actionable recommendations and insights from global best practices. A follow-up online meeting served to validate and enhance the draft practical recommendations below.

1 Base regulatory frameworks on a clear, in-depth understanding of risks

• Start with a comprehensive national risk assessment that accounts for domestic and cross-border threats, as well as geopolitical factors. Other factors to take into account include market structure, business models, and prudential, conduct, operational and outsourcing risks. 
• Prioritise quality over quantity in licensing or registration regimes and oversight models to ensure supervisors have adequate capacity to oversee all licensed/registered entities. 
• Consider providing pre-application consultations and enhanced guidance to parties wishing to be licensed as cryptoasset service providers.
• Use regulatory sandboxes to test innovative products and collect insights on emerging risks and technologies.

Advantages of regulatory sandboxes

• Test products and services in a real environment with real users.
• Conduct supervised testing to identify and prevent potential flaws or regulatory breaches before the product’s final rollout.
• Define new regulatory requirements or amend existing ones based on practical, real-world experience.

Why this matters: A risk-based approach ensures scarce supervisory resources are deployed where it matters the most, thus supporting risk mitigation. Such an approach helps ensure that frameworks evolve as risks and technologies develop.

2 Build strong coordination structures across government and sectors

• Set up structured working groups across relevant authorities, such as the central bank, tax authority, securities regulator, financial intelligence unit and law enforcement agencies, with the aim of enhancing internal coordination and building a common understanding. These groups can help ensure that policymakers integrate enforcement mechanisms at the policy design stage, for example in a stablecoin policy, the technical capability to freeze or block transactions as a condition for compliance. Within the main regulatory authority (such as the central bank), a formal arrangement such as a structured project framework can also enhance coordination. 
• Establish and/or engage in structured public-private partnerships, such as working groups and task forces combining industry practitioners, legal specialists and academic experts, to enhance information sharing and awareness of market developments. Take care however to respect data privacy and other relevant regulations. 
• Include wider policy goals like innovation, inclusion and economic resilience in regulatory design. 

Why this matters: Crypto markets cut across multiple policy domains. Whole-of-government coordination reduces gaps, aligns priorities and builds resilience against emerging risks.

3 Use phased and proactive supervisory engagement

• Engage directly with industry actors through workshops, compliance days and joint training. Clearly communicate expectations on governance standards, safeguarding of client assets, outsourcing arrangements and technology risk management during early engagement.
• Encourage compliance through education rather than enforcement alone. 
• Use structured questionnaires, interviews and audit reports to risk-rate firms before deciding on onsite or offsite inspections. 
• Integrate risk-based supervisory models aligned with Financial Action Task Force (FATF) Recommendations, applying proportional measures based on business models and risk profiles.

Why this matters: Early-stage regimes benefit from proactive, educative supervision that builds sector capacity and reduces systemic non-compliance.

4 Leverage data, traceability and technology

• Use blockchain analytics & intelligence, open-source intelligence and financial intelligence unit data to develop a comprehensive risk picture. Surveys of relevant market participants – including during on-site supervision – can contribute to a dashboard of aggregated sector data, such as total transaction volume, number of transactions, number of clients and their associated risk levels, as well as cross-border transaction counts and volumes. Common supervisory data also includes detailed information that enables reconciliation and further investigation, including wallet addresses, transaction amounts and ownership details.
• Promote interoperability and standardisation of blockchain analytics & intelligence tools for consistent supervision and risk monitoring. 
• Ensure existing cooperation channels and recovery mechanisms are suited for cryptoassets and adapt the regulatory framework and practice if needed. 
• Adopt risk-based due diligence, enhanced cooperation and common supervisory templates, ensuring consistency across jurisdictions.

Blockchain analytics & intelligence applications for regulators and supervisors

• Early-warning systems to identify suspicious transactions and typologies (sanctions evasion, ransomware, market manipulation…).
• Risk profiling that combines blockchain data with traditional supervisory information.
• Cross-agency data fusion linking financial intelligence units, law enforcement and market regulators.
• RegTech–SupTech integration for automated compliance monitoring.
• Creation of regional and global intelligence nodes for secure data exchange.

Why this matters: Blockchain analytics & intelligence enables supervisors to move from reactive investigation to proactive oversight. This facilitates earlier detection of cross-border risks and supports convergence with AML, prudential and conduct supervision.

5 Build capacity and invest in skills and research

• Invest in specialist training and staffing. Capacity building is not only about training; it can also be built through structured exchange between colleagues responsible for different aspects of cryptoassets, such as AML/CFT and prudential supervision.
• Scale supervisory capacity to market size and complexity. 
• Extend capacity building to cover tokenised assets and smart-contract-based services.
• Engage with academic institutions – for example through research partnerships, joint workshops, internships and secondments – to facilitate structured knowledge sharing, rigorous research and the development of evidence-based methodologies. 

Why this matters: Skilled human capital is critical to interpret complex data and manage the diversity of crypto business models.

6 Take early action and make full use of existing legislation

• Leverage existing legal frameworks (e.g. taxation, banking supervision, reporting obligations) to mitigate risks, in addition to and even prior to developing specific legislation. 
• Circulate inquiries to all already-regulated financial institutions to assess their interactions with crypto-asset markets and to understand their future plans.
• Set supervisory expectations to guide financial institutions’ engagement with cryptoassets and services. It may help to communicate the guiding principle of “same activity, same risk, same regulation”, i.e. crypto activities should be subject to the same regulatory standards and supervisory expectations as traditional financial activities when they present similar risks.
• Conduct public awareness campaigns and wide consultations to shape proportionate frameworks before full regulation is enacted. 

Why this matters: Early actions increase transparency, guide market behaviour and reduce risk prior to formal frameworks taking effect.

7 Strengthen management of cross-border risks and unregulated providers

• Integrate guidance from the FATF, Financial Stability Board (FSB) and International Organization of Securities Commissions (IOSCO) into national regulatory and supervisory frameworks. 
• Develop cooperation protocols for inspections and enforcement, including for providers outsourcing critical functions abroad. 
• Assess risks from regulatory arbitrage and passporting and close enforcement gaps that could be exploited, especially by multi-function crypto intermediaries (MCIs). 
• Issue official communications to inform consumers about market-related risks that may arise over time, for example, about the dangers of dealing with unregistered cryptoasset service providers.

Why this matters: Cryptoassets operate globally; common standards and cooperative oversight reduce loopholes and prevent unregulated entities from evading supervision.

8 Build structured and formalised peer-learning and cooperation channels

• Consider establishing or participating in supervisory colleges, taskforces and peer-learning networks for information exchange on cryptoasset regulation and supervision. 
• Use study visits, secondments and technical peer support to accelerate knowledge transfer. 
• Create secure forums for supervisors to share typologies and risk mitigation strategies.

Supervisory colleges for cryptoasset supervision

A “crypto supervisory college” brings together home/host supervisors of major cryptoasset service providers and issuers to coordinate oversight and conduct joint risk assessments, exchange information securely and prepare for coordination in a crisis. Additional members may include competent authorities for AML/CFT, data protection and cybersecurity, as well as third-country authorities. 

Why this matters: Structured cooperation fosters practical learning, mutual trust and consistent supervisory approaches across jurisdictions.

9 Engage international institutions and build shared knowledge infrastructure

• Collaborate with international and regional centres of expertise such as the World Bank, FATF-style regional bodies, Organization for Security and Co-Operation in Europe (OSCE) and Basel Institute on Governance for training, research and other resources. 
• Pool resources for joint studies, typologies and tool development. 
• Contribute to international standard-setting and interoperability initiatives to enhance the quality of blockchain analytics and supervisory data.

Why this matters: Global collaboration enhances consistency, strengthens intelligence-led oversight and ensures technology is harnessed responsibly for the public good.

10 Recommended resources

Essential texts for jurisdictions seeking to develop and enhance their cryptoasset regulation. Consider establishing a crypto knowledge hub for your authority or working group, where staff and members can contribute relevant articles, research, news and resources.

Practical guidance:

AML/CFT National Risk Assessment on Virtual Assets and Virtual Asset Service Providers: Guidance Manual (updated October 2025) and related tool – The World Bank. A practical tool and guidance to help countries assess money laundering and terrorist financing risks linked to virtual asset activities and virtual asset service providers in line with FATF Recommendation 15.

Best Practices on Travel Rule Supervision – Financial Action Task Force (FATF). A set of good practices to help jurisdictions supervise and implement the FATF Travel Rule to enhance payment transparency and mitigate money laundering, terrorist financing and proliferation financing risks.

Guidelines on supervisory practices to prevent and detect market abuse under MiCA – European Securities and Markets Authority (ESMA). Guidelines to promote consistent and effective supervisory practices under MiCA for preventing and detecting market abuse in cryptoassets, including insider dealing, unlawful disclosure of inside information and market manipulation.

Trends and progress:

Thematic Review on FSB Global Regulatory Framework for Crypto-asset Activities – Financial Stability Board (FSB). A review of global progress and remaining gaps in implementing the FSB’s 2023 regulatory framework for cryptoasset activities and stablecoins, with recommendations to strengthen consistent and resilient regulation.

Thematic Review Assessing the Implementation of IOSCO Recommendations for Crypto and Digital Asset Markets – International Organization of Securities Commissions (IOSCO). An assessment of how selected jurisdictions are implementing IOSCO’s 18 policy recommendations for regulating crypto and digital assets to support market integrity and investor protection.

Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers – Financial Action Task Force (FATF). An update on progress and continuing challenges in implementing FATF Recommendation 15 for virtual assets and virtual asset service providers, including insights on emerging risks.

Advancing in tandem – results of the 2024 BIS Survey on Central Bank Digital Currencies and Crypto - Bank for International Settlements (BIS). A summary of the 2024 BIS survey showing how central banks are advancing work on retail and wholesale CBDCs alongside growing regulation of stablecoins, rising use of cryptoassets and increasing interest in tokenisation.