Why the same crypto activity is legal in one country and not the next

People discuss crypto regulation as though it were a single thing arriving in different places at different speeds. It is not. The substantive disagreement is upstream of any rule: countries differ on what an asset is, and everything downstream follows from that classification.

Classification decides which rulebook applies

Most jurisdictions did not write crypto law from nothing. They asked which existing category an asset falls into, and the categories carry entirely different regimes with them.

Treated as a security, an asset attracts disclosure obligations, licensing for anyone facilitating trading, and restrictions on marketing. Treated as a commodity, a different regulator and a lighter set of conduct rules typically apply. Treated as property for tax but not as a financial instrument, much of the market-conduct apparatus does not attach at all. Treated as a payment instrument, the money-transmission and anti-money-laundering regime dominates.

These are not gradations of strictness. They are different bodies of law with different regulators, different thresholds and different penalties, and a country can reasonably arrive at any of them.

The same token can be several things at once

This is where intuition fails most often. Classification frequently attaches to the transaction rather than the object.

An asset sold to fund development, with the seller promising to build something that gives it value, has the structure of an investment contract in many legal systems. The same asset traded years later between strangers on a market, with no promoter making promises, may not. Nothing about the token changed; the circumstances did.

This is why blanket statements that a given asset “is” or “is not” a security are usually too strong. The honest formulation is that a particular transaction, in a particular jurisdiction, at a particular time, was or was not treated as one.

Where jurisdictions genuinely agree

Amid the divergence, one area has converged substantially: anti-money-laundering obligations on intermediaries.

Broadly, businesses that hold customer assets or exchange between crypto and conventional currency are expected to identify their customers, monitor for suspicious activity, and report it. The thresholds and documentation differ, but the principle is close to universal among jurisdictions with functioning financial regulation.

This is why identity verification is near-inescapable on custodial services regardless of where they operate, and why the requirements feel similar even between countries that disagree about everything else. Our glossary covers KYC and AML as concepts.

Which country’s rules apply to you

Two answers matter and they are frequently different. A service is regulated where it is established and licensed. A user is generally subject to the rules of where they reside.

A platform licensed in one jurisdiction and serving a customer in another may be operating lawfully at home while being unavailable, restricted, or unlawful to offer where the customer sits. This is why services geo-block, why terms of service list excluded territories, and why availability changes without the product changing.

The practical consequence for a reader is that “is this legal?” has no general answer. It has an answer for you, in your country, which is not the one written on most websites.

Registration is not endorsement

A registration or licence tells you a firm met a defined set of conditions. It does not tell you the firm is well run, that its product is suitable, or that your assets are protected in insolvency.

Registrations also vary enormously in what they require. Some involve capital adequacy, custody rules and regular reporting. Others amount to being recorded on a list for anti-money-laundering purposes and impose almost nothing about how customer assets are held. Both get described as “regulated” in marketing.

The useful question is not whether a firm is registered but what its specific registration actually obliges it to do — which is published, and rarely quoted.

Why this keeps moving

Classification decisions get revisited as products change and as courts rule. A framework designed around exchanges fits awkwardly around software that no company operates. New instruments arrive that fit no existing category cleanly.

Expecting a settled position is therefore the wrong frame. What is reasonably stable is the underlying logic: identify the classification, and the applicable regime follows. That approach survives changes in the specific answer, which a memorised list of country positions does not.

What we do and do not cover

We write about regulatory structure — what a category means, what an obligation entails, what a registration covers. We do not report enforcement actions we cannot source, and we do not offer legal advice, which is what a definitive answer about your circumstances would be. Where a rule matters to a decision you are making, the applicable regulator’s own guidance is the primary source, and it is usually published in plain language.

Why decentralisation complicates enforcement rather than removing it

A common assumption is that software with no operating company sits outside regulation entirely. The more accurate position is that regulators apply existing law to whoever they can identify, and the absence of a company redirects attention rather than removing it.

Attention tends to land on the points where the system touches conventional finance: the interfaces people actually use, the developers who published and maintain the code, the entities that market it, and the on- and off-ramps converting to conventional currency. Those are identifiable and located somewhere.

This is why front-ends restrict access by territory while the underlying contracts remain reachable by anyone able to interact with them directly. The protocol and the interface are not the same thing, and only one of them has an address.

Reading a consultation is more useful than reading coverage

Most substantial regulatory change is preceded by a published consultation setting out what a regulator is considering and inviting responses. These documents are long, plainly written, and read by almost nobody outside the industry.

They are considerably more informative than reporting about them, for a specific reason: coverage compresses a proposal into a verdict, and the proposal usually contains the reasoning, the scope, the thresholds, and the questions the regulator is genuinely uncertain about. The final rules are frequently visible in outline months before they arrive.

Where a rule matters to a decision, the consultation and the resulting policy statement are primary sources, freely available, and specific about who is caught.