What the CLARITY Act means for crypto compliance teams

The Digital Asset Market Clarity Act cleared the Senate Banking Committee on May 14, 2026 in a 15-9 bipartisan vote – the furthest any comprehensive crypto market structure bill has ever advanced in Congress. For compliance teams at VASPs, exchanges, and financial institutions with digital asset exposure, the bill is not just a regulatory framework. It creates specific, enforceable obligations that will require operational changes.

The bill extends Bank Secrecy Act requirements to digital asset intermediaries, mandates risk management programs that explicitly reference blockchain analytics tools, introduces the first federal registration framework for crypto kiosks, and gives Treasury new authority to act against foreign jurisdictions that pose money laundering risks involving digital assets.

The bill now moves to the full Senate floor, where it will need 60 votes to advance. Negotiations on ethics provisions and law enforcement concerns continue, and the bill must still be reconciled with the House version passed in July 2025. But the direction is set. Compliance teams that wait for final enactment to begin preparing will be behind.

Key points

• The CLARITY Act extends BSA obligations – including AML/CFT programs, suspicious activity monitoring, customer identification, and sanctions compliance – to all digital asset brokers, dealers, and exchanges

• Digital asset intermediaries interacting with DeFi protocols must implement risk management programs using tools such as blockchain analytics to detect money laundering, sanctions evasion, and fraud

• Crypto kiosk operators face mandatory registration with requirements for fraud detection, compliance officers, holding periods, and withdrawal limits – responding to $389M in reported kiosk fraud losses in 2025

• A new Special Measure 6 authority allows Treasury to act against foreign jurisdictions, institutions, or transaction types that pose money laundering concerns involving digital assets

• The bill creates a pilot program for private sector entities to share illicit finance intelligence with federal law enforcement

What AML and sanctions obligations does the CLARITY Act create?

The bill brings digital asset intermediaries fully under the Bank Secrecy Act. Digital commodity brokers, dealers, and exchanges must maintain AML and CFT programs, monitor and report suspicious activity, implement customer identification programs, and comply with sanctions laws administered by OFAC. For organizations building or reviewing their crypto compliance programs, these requirements formalize what many already follow under FinCEN guidance – but now with statutory enforcement behind them.

The bill also requires risk-based examination standards for any financial institution interacting with crypto, meaning BSA compliance will be tested through formal examination – not just self-certification.

Separately, the CLARITY Act designates certain digital assets as monetary instruments. This gives financial institutions that transact with self-hosted wallets clear guidance on their BSA and sanctions obligations – closing an area of regulatory ambiguity that has made compliance planning difficult.

What are the new requirements for crypto kiosks?

Section 205 creates the first federal registration framework for digital asset kiosks – crypto ATMs and similar physical access points. Operators must register with regulators and meet a detailed set of requirements: customer warning notifications, transaction receipts, anti-fraud policies, risk monitoring, a designated compliance officer, fraud detection capabilities, holding periods, and withdrawal limits for new customers.

This matters because kiosk-based transactions are disproportionately associated with fraud. According to FBI data reported by AARP, crypto kiosks accounted for $389M in reported fraud losses in 2025 across more than 13,000 complaints – a 58% increase year on year. Kiosks involve cash-to-crypto conversion, often serve customers with limited compliance documentation, and can function as entry points for illicit funds. The bill recognizes this by setting a higher compliance bar than for standard digital asset intermediaries.

For compliance teams, the practical question is visibility. Monitoring kiosk activity requires the ability to identify cash desk and exchange point exposure within transaction flows – and to distinguish kiosk-originated activity from standard exchange transactions. This is an area where entity attribution depth matters. Crystal’s database of 110,000+ attributed entities includes cash desk and best change services that other providers do not cover – giving compliance teams the ability to flag kiosk-related exposure before it becomes a regulatory finding.

How does the bill address foreign jurisdiction risk?

The CLARITY Act gives Treasury a new tool – Special Measure 6 – to act against foreign jurisdictions, institutions, or transaction types that pose a primary money laundering concern involving digital assets. This mirrors existing authorities under Section 311 of the USA PATRIOT Act but is specifically tailored to digital asset flows.

The bill also requires Treasury to produce annual reports identifying top foreign jurisdictions by digital asset trading volume, assessing each jurisdiction’s compliance with US-aligned AML and CFT standards, and detailing enforcement actions against deficient jurisdictions. A separate GAO study will examine the risks posed by foreign digital asset intermediaries in lightly regulated jurisdictions that serve US persons.

For compliance teams, this shifts the burden. Foreign jurisdiction risk is no longer something you monitor as a best practice – it becomes something regulators will actively measure and act on. Compliance programs that rely primarily on domestic intelligence, or that treat all foreign exposure as equivalent, will have gaps. Effective coverage requires intelligence sourced from high-risk jurisdictions themselves – not just whether an entity appears on a sanctions list, but how crypto infrastructure actually functions in those markets. Crystal’sblockchain intelligence platform provides this depth. Crystal’s analysis of sanctions evasion through crypto exchanges in high-risk jurisdictions has been cited in major international investigations – the kind of jurisdictional intelligence that Special Measure 6 now makes a statutory compliance requirement.

What does the bill require for DeFi risk management?

Section 308 mandates that digital asset intermediaries assess risks related to DeFi trading protocols before routing or conducting trading activity through them. The requirements are specific: intermediaries must analyze and mitigate money laundering, sanctions evasion, fraud, market manipulation, and operational and cyber risks.

The provision explicitly references “tools (such as blockchain analytics)” as part of how intermediaries should detect and respond to these risks. This is the first time US legislation has named blockchain analytics as a compliance tool in statutory language.

Compliance teams at intermediaries that interact with DeFi protocols will need to demonstrate that they have risk management programs in place, that those programs include blockchain analytics capabilities, and that they are making risk-based decisions about whether to execute, reject, or suspend DeFi-related transactions.

What other provisions should compliance teams watch?

The bill includes several additional measures with compliance implications. A pilot program under Section 203 allows private sector entities to partner with federal law enforcement to share information about illicit finance violations and emerging threats. FinCEN receives authorized funding of $30M per year through 2031, with retention incentives for specialist staff – signaling a long-term enforcement build.

The bill also mandates studies on digital asset mixers and tumblers, illicit finance risks, cybersecurity vulnerabilities, and national security threats. While these are reporting requirements rather than immediate obligations, they indicate the direction of future rulemaking. Compliance teams should expect mixer and tumbler exposure to become a formal compliance consideration once Treasury completes its review.

A separate provision creates a safe harbor for digital asset service providers to temporarily pause suspicious transactions at the request of law enforcement – providing legal cover for a practice that many firms already follow informally.

Frequently asked questions

Does the CLARITY Act apply to non-US companies?

Yes, if they serve US persons or interact with US-regulated entities. The bill’s foreign jurisdiction provisions – including Special Measure 6, annual jurisdiction assessments, and the GAO study on foreign intermediaries – all focus on non-US entities that touch the US market. Third-country VASPs with US customers or counterparties should review their exposure to these requirements.

When will these requirements take effect?

The bill cleared the Senate Banking Committee on May 14, 2026 in a 15-9 vote and now moves to the full Senate floor, where it needs 60 votes. It must also be reconciled with the House version passed in July 2025. The White House has targeted July 4, 2026 for a presidential signature. Some provisions take effect immediately upon enactment; others include rulemaking timelines. Compliance teams should begin gap analysis now rather than waiting for a final effective date.

Does the bill cover decentralized platforms?

Yes. The bill requires centralized intermediaries that interact with DeFi protocols to implement risk management standards. It also includes a tailored rulemaking for intermediaries that are not truly decentralized. Software developers who publish or maintain code without controlling customer funds are explicitly protected.

What is Special Measure 6?

Special Measure 6 is a new authority allowing the Treasury Department to prohibit or place conditions on certain fund transfers involving foreign jurisdictions, institutions, or transaction types that Treasury designates as a primary money laundering concern involving digital assets. It extends the logic of existing PATRIOT Act authorities to digital asset flows specifically.

How does this relate to the GENIUS Act?

The GENIUS Act, enacted in 2025, created a regulatory framework for stablecoins. The CLARITY Act addresses the broader digital asset market structure – including how stablecoins are traded and used across regulated platforms. The two are complementary. The CLARITY Act also includes provisions restricting passive yield on stablecoin balances unless tied to specific user activity.

What compliance teams should do now

The CLARITY Act represents the most detailed set of crypto compliance obligations proposed at the federal level in the US. It moves digital asset regulation from guidance to statute – with specific requirements for AML programs, kiosk operations, DeFi risk management, and foreign jurisdiction monitoring.

For compliance teams, the operational takeaway is clear. Review your AML and sanctions programs against BSA requirements. Assess your visibility into kiosk and cash desk exposure. Evaluate whether your blockchain analytics capabilities cover foreign jurisdiction risk with the depth that Special Measure 6 and the annual jurisdiction assessments will demand. And ensure your DeFi risk management framework meets the standard the bill sets – including the explicit requirement for blockchain analytics tools.

Crystal’s blockchain intelligence platform is built for this perimeter. Real-time transaction monitoring and SAR/STR export to FinCEN. OFAC and sanctions screening on every flow. Safe-harbor pause workflows with built-in chain-of-custody evidence. Jurisdictional and intermediary risk scoring across 330+ blockchains, with field-sourced intelligence from high-risk jurisdictions where other providers have limited or no coverage. And readiness for the FinCEN info-sharing pilot the bill establishes.