The SEC has begun preparing a regulatory route that could let qualified platforms trade tokenized U.S. stocks 24 hours a day, seven days a week.

The U.S. Securities and Exchange Commission is working on an “innovation exemption” that could give selected firms temporary relief to test tokenized securities under defined conditions while the agency develops permanent rules.

SEC Chair Paul Atkins has supported using exemptive authority to bring more financial activity onto blockchain networks without removing tokenized stocks from federal securities oversight. Under the proposal, approved platforms could offer digital versions of U.S.-listed shares and process transactions outside the operating hours used by traditional exchanges.

Commissioner Hester Peirce said in March that SEC staff was developing an exemption to facilitate “limited trading of certain tokenized securities.” Peirce described the possible measure as narrower than the blanket exemption discussed by the SEC’s Investor Advisory Committee.

No final framework, eligibility criteria, or implementation date has been announced. Investors therefore cannot assume that tokenized versions of every U.S. stock will soon become available for continuous trading.

SEC exemption could open 24/7 tokenized stock trading

Regular U.S. stock market hours run from 9:30 a.m. to 4 p.m. Eastern time on business days, although registered venues and brokers can provide extended sessions. A blockchain-based venue can process transfers continuously, allowing eligible securities to change hands during nights, weekends, and public holidays.

According to reporting on the SEC’s preparations, the exemption could give regulated platforms a defined route to test round-the-clock markets for tokenized shares. Such relief would still require the commission to decide which firms qualify, what activities they may conduct, and which existing rules remain mandatory.

For American investors, continuous trading could provide access outside the normal market day. The SEC would still need to determine how brokers handle best execution, disclosures, and order routing when the underlying stock market is closed, and price discovery is spread across blockchain and conventional venues.

Investor protections also depend on the type of token offered. An issuer-backed token can represent the same security recorded through a new ownership system, while a product created by an unrelated third party may only track the price of a stock or provide a contractual claim against the platform.

In July, two transfer-agent groups asked the SEC to separate issuer-backed shares from unaffiliated tokens. As crypto.news previously reported, the groups warned that some third-party structures may not give buyers direct ownership, voting rights, or the same legal claim to dividends as registered shareholders.

The SEC’s Investor Advisory Committee raised similar concerns in a March recommendation. Committee members opposed a blanket exemption and called for clear ownership disclosures, regulatory oversight of intermediaries, and protections designed to give investors fair execution terms.

Tokenized stocks would remain U.S. securities

Putting a stock on a blockchain does not change its status under U.S. law. Atkins said in a November 2025 speech that economic reality, rather than the token label, determines how federal securities rules apply to an asset.

A token representing a share of a public company would therefore remain a security. Depending on the structure, platforms involved in issuing, trading, custody, or settlement could face requirements covering broker-dealer registration, exchange or alternative trading system rules, transfer-agent records, and clearing.

Custody presents another issue because a blockchain token and the underlying share must remain properly linked. If a third party holds conventional stock and issues a separate token against it, regulators must determine how buyers can verify the backing and recover assets if the issuer or custodian fails.

Market surveillance will require its own controls. The SEC must decide how participating venues detect manipulation, share trading information, and manage transactions that occur when the main U.S. exchanges are closed. Regulators may also need to address whether blockchain settlement can operate alongside the Depository Trust Company’s existing custody and post-trade systems.

The proposed exemption has not changed current requirements. On Aug. 14, the SEC canceled an open meeting that was scheduled to consider a tailored offering regime for certain investment contracts involving crypto assets, citing an unforeseen scheduling issue.

The canceled meeting did not amount to a vote on blanket approval for 24/7 tokenized stock trading. The SEC’s public notice said the meeting concerned registration and offering rules for certain crypto-related investment contracts, while the tokenized-securities exemption remains a separate policy project under development.

DTCC and Nasdaq have started regulated tokenization tests

Parts of the U.S. market have already received limited permission to test tokenized securities. In December 2025, SEC staff issued a no-action letter allowing the Depository Trust Company to operate a defined tokenization service for three years under specified conditions.

The eligible asset universe includes Russell 1000 stocks, major index exchange-traded funds, and U.S. Treasury securities. A no-action letter indicates that SEC staff would not recommend enforcement based on the facts presented, but it does not create a permanent industry rule or authorize every company to offer similar services.

DTCC has assembled more than 100 members and partners for its tokenization work, according to an August project update. Participating firms include traditional financial institutions and blockchain companies testing tokenized equities, Treasuries, collateral, securities lending, and margin processes.

Earlier production tests examined whether regulated assets could move between blockchain networks while remaining connected to established custody and ownership records. DTC, DTCC’s depository subsidiary, provides custody and asset servicing for more than $114 trillion in securities, although that figure represents its total business and not the value scheduled for tokenization.

Nasdaq has also moved into regulated blockchain-based trading. The SEC approved its pilot in March 2026, allowing selected participants to trade certain tokenized equities alongside conventional shares.

Under Nasdaq’s structure, tokenized and traditional versions carry the same rights and pricing. The pilot covers eligible Russell 1000 securities and major index-linked ETFs, keeping the products inside the existing national market system rather than creating unrelated stock-tracking tokens.

NYSE has filed rule changes for tokenized securities as well. SEC records show that the exchange submitted amendments in April to enable securities to trade in tokenized form, adding another regulated-market model for the commission to assess.

Regulation NMS changes could affect on-chain venues

At the same time, the SEC is considering amendments to Regulation NMS, the collection of rules that controls how U.S. equity orders move between trading venues. Proposed changes include rescinding Rule 611 and Rule 610(e), which govern order protection and access fees in the national market system.

Ondo Finance supported the proposed rescission in an Aug. 11 letter to SEC Secretary Vanessa Countryman. The company argued that the existing rules favor continuous order books and can restrict alternative execution systems that use different trading models.

Rule 611 generally requires trading centers to prevent executions at prices inferior to protected quotations displayed elsewhere. Ondo told the commission that removing the provision could give auction-based, blockchain-based, and other execution systems more room to operate alongside conventional order books.

The company also asked the SEC to correct parts of its economic analysis before adopting the amendments. Ondo’s submission was filed under Release No. 34-105655 and File No. S7-2026-20 as part of the commission’s public comment process.

Binance has reportedly shared Russian law enforcement with detailed transaction records and personal identity information tied to a man accused of funding terrorism through cryptocurrency donations linked to Ukrainian fundraising efforts. The disclosure, according to law enforcement documents reviewed by Reuters, became part of the evidence used in Russia’s case against an IT specialist awaiting trial.

Reuters reports that investigators requested the data from Binance and received information connecting the suspect to crypto transfers, along with sensitive personal details such as date of birth, address, phone number, and passport number—along with copies of his documents. Binance, in response to coverage, said it cooperates with lawful information requests subject to applicable legal, privacy, and regulatory requirements, while declining to comment on the specific matter.

Key takeaways

• Reuters reviewed documents indicating Russian authorities asked Binance for a customer’s transaction history and received personal identity details.
• The Russian Investigative Committee alleges the suspect sent more than $700 in crypto between January 2023 and March 2024 to Ukrainian military-related efforts and a banned group.
• Binance’s reported response included links to specific transfers as well as copies of a Russian passport and a Bulgarian residency permit.
• Binance says it generally cooperates with lawful information requests, but it declined to comment on the particular case.

What Russian investigators say the data was used for

Russia’s Investigative Committee alleges that IT specialist Yuri Belenkiy made cryptocurrency transfers totaling more than $700 between January 2023 and March 2024. The allegation is that the funds were directed to the Ukrainian military and to an organization identified by Reuters as the group known at different times as the Azov Brigade and the Azov Regiment.

According to Reuters’ review of law enforcement documents, investigators relied on information attributed to Binance in building the case. Belenkiy was detained in September 2025 and is currently awaiting trial in Russia.

Binance reportedly provided transaction trails and identity documents

The evidentiary link described by Reuters centers on a formal request from Russian authorities to Binance for Belenkiy’s transaction history. Reuters says the company’s response connected him to the alleged transfers.

Beyond blockchain-related activity, the response reportedly included personal identifying information commonly required for law enforcement verification: Belenkiy’s date of birth, address, phone number, and passport number. Reuters also reports that the material provided included copies of a Russian passport and a Bulgarian residency permit, suggesting the request extended beyond tracing crypto flows into confirming the suspect’s identity.

For investors and users, the case underlines a recurring reality of crypto compliance: even when transactions are pseudonymous on-chain, centralized exchange records and customer due diligence can materially shape investigations.

Why Binance’s Russia exit does not remove the data link

Binance announced a full exit from Russia in September 2023, selling its local business to CommEX, according to a Cointelegraph report. That corporate shift did not erase the underlying compliance trail described in the Reuters account—namely, that transaction history and customer information tied to a specific user can remain relevant to later investigations.

This distinction matters. “Exiting” a market typically addresses future operations and licensing, but it does not necessarily eliminate retention or earlier records associated with accounts created and used while a platform operated there. The Reuters reporting implies that the relevant data existed in a form Russian authorities could request, even years after the public announcement of Binance’s exit.

Binance’s response and the broader compliance tension

Reuters says a Binance spokesperson declined to comment on specific confidential law enforcement requests or on the details of individual cases. In a broader explanation given to Cointelegraph, Binance stated that it does not make or enforce laws, determine charges, or decide how any government uses information in legal proceedings. The company added that, like other global financial institutions, it cooperates with lawful information requests from law enforcement worldwide, subject to applicable legal, privacy, and regulatory requirements.

That formulation reflects a familiar compliance tension for crypto exchanges operating at the intersection of financial privacy, customer protection, and state requests. While platforms often frame cooperation as bounded by law and privacy rules, public reporting like this highlights how those safeguards function in practice—particularly when requests target individuals connected to politically sensitive conflicts.

It also raises practical questions for customers and the wider ecosystem: what categories of data exchanges retain; how long they retain it; and how cross-border identity and documentation checks can be combined with transaction history in court filings. The Reuters account does not detail those internal policies, but it shows the end result—law enforcement having both a behavioral trail (transfers) and a personal dossier (identity documents).

What to watch next

As Belenkiy’s case moves forward, attention will likely center on what precisely the court accepts as admissible evidence and whether the exchange-supplied materials are used narrowly for transaction tracing or more broadly for identity verification. More broadly, the episode is a reminder that even after major exchange restructuring or market exits, compliance data can still surface years later when investigators pursue crypto-related allegations.

However, the proposal notes, “Treasury believes that the Act evinces a clear intent for payment stablecoins to serve as an effective means of payment and settlement, including across borders, and application of traditional investment rules to payment stablecoins may frustrate that goal.”

Monday’s action is a follow-up to the Treasury advance notice of the rule, which it issued in September of last year on what was meant to be a tight timeline. The public and the growing industry of stablecoin issuers now have 60 days to weigh in with comments, and the department will be expected to take further months to review them before issuing a final rule.

The proposed rule poses dozens of questions about the best approach to interpreting the law, each of which must be answered before the final sign-off. The industry will pay special attention to how it approaches foreign issuers, such as industry leader Tether. It set a deadline for responses in mid-October.

The law’s one-year target to have its rules implemented passed last month, without the administration meeting the requirement. The next mark is the effective date of the law, which is supposed to come by January 18. It’s unlikely that all the rules will be finalized by then, and new regulations usually come with runways allowing an industry to transition into them.

Austria’s financial regulator has issued its first final penalty under the EU’s Markets in Crypto-Assets Regulation (MiCA), fining crypto platform Bitpanda 70,000 euros (about $82,000) for breaching MiCA’s publication and marketing disclosure rules. The Austrian Financial Market Authority (FMA) said the case was handled under an expedited procedure and that the decision is final.

According to the FMA, the issue centered on Bitpanda’s timing and compliance with mandatory pre-publication and disclosure requirements for a crypto-asset white paper.

Key takeaways

• The FMA fined Bitpanda 70,000 euros for failing to submit the required crypto-asset white paper at least 20 working days before publication.
• Regulators also said Bitpanda issued marketing communications before the white paper was filed.
• Another alleged breach involved marketing material that omitted MiCA-mandated disclaimers, including that it had not been reviewed or approved by a competent authority and that Bitpanda is responsible for the content.
• The penalty was issued as the first published final enforcement under MiCA, signaling the EU framework is moving from licensing and guidance into outcomes.
• Bitpanda stated the problems were limited to formal timing and documentation requirements, and said customer funds and platform security were not affected.

FMA details: white paper submission and marketing timing

In a notice published Friday, the FMA said Bitpanda did not submit a crypto-asset white paper to the regulator at least 20 working days prior to its publication, as MiCA requires. The regulator also reported that Bitpanda distributed a marketing communication before publishing the required white paper.

The regulator’s explanation is significant because MiCA’s approach to investor protection depends heavily on structured disclosures. The white paper is intended to provide standardized information before the public is exposed to an offering or related marketing materials.

Disclosure gaps in marketing materials

The FMA further alleged that another marketing communication failed to include mandatory disclosures. Specifically, the regulator said the content did not state that the material had not been reviewed or approved by a competent authority, and that the crypto-asset provider alone was responsible for the content. The regulator also said the marketing communication lacked required contact details, including a telephone number and email address.

These points matter for compliance teams because they show that regulators are not only checking whether documents exist, but whether the surrounding communications include the specific legal language and contact information required under MiCA.

Expedited proceedings and final decision

The FMA said the case was concluded under an expedited procedure and that the penalty decision is final. While the fine amount is comparatively small relative to some large-scale financial enforcement actions, the regulatory significance is larger: this is presented as the watchdog’s first published final penalty under MiCA.

For market participants, the outcome suggests that formal compliance lapses—such as filing timelines and required statement formatting—are actionable under MiCA, even when the core product or platform functionality is not necessarily implicated.

Bitpanda’s response: timing and formal requirements only

Bitpanda told Cointelegraph that the concerns raised by the FMA related exclusively to the timing and formal requirements surrounding the publication of the white paper and an accompanying information document. The company said customer funds and platform security were not affected and that customers suffered no financial harm.

Bitpanda added that it corrected the issues after receiving notice from the FMA, and it opted for a swift, consensual conclusion of the proceedings.

That framing may influence how investors and users interpret the case. The regulator’s enforcement narrative emphasizes process compliance, while Bitpanda points to the absence of customer impact. Still, the penalty itself indicates that regulators are prepared to treat disclosure mechanics and marketing rules as enforceable obligations under the new regime.

Why this is a broader MiCA signal

MiCA created a harmonized regulatory framework for crypto assets across the European Union, including disclosure standards, marketing requirements, and authorization conditions for crypto companies. The FMA’s action reinforces that MiCA compliance is not limited to licensing status or long-form disclosures alone; marketing materials and document submission timelines are also subject to scrutiny.

Earlier coverage of the implementation of MiCA licensing timelines and transitional measures (including references to the end of certain grace periods) highlighted that firms would eventually face stricter enforcement as operational readiness deadlines were crossed. This penalty fits that pattern: once formal requirements are in effect, regulators can convert guidance into penalties.

For the wider industry, the main uncertainty going forward is how frequently regulators will pursue similar “paperwork” cases and whether enforcement will focus on specific categories of issuers or on any instance of noncompliance with pre-publication timing and mandated marketing language. Market participants should watch for more final decisions across member states as regulators test the boundaries of MiCA’s disclosure and communications requirements.

Readers should pay attention to the next enforcement steps from Austria and other EU jurisdictions—particularly whether additional cases involve similar white-paper submission delays and missing mandatory marketing disclaimers, or whether regulators begin targeting other parts of MiCA compliance such as authorization obligations and ongoing disclosure practices.

The trouble with military hegemony

Nobody can measure how much licensing pressure shaped the scope or speed of that rewrite, and the overhaul also pursued legitimate technical goals. The documented facts are narrower and still damning: a license change made to restrict competitors preceded a rushed replacement of battle-tested cryptographic code, and the replacement contained the flaw now draining wallets. Free and open-source software principles exist precisely to keep security from depending on any one company’s choices. Those principles cannot come with a personality exception.

Zach Herbert is co-founder and CEO of Foundation.

Researchers learned not to look

The deeper failure is what happened to the people who did look. In August 2020, researchers from Shift Crypto and Nunchuk disclosed a multisig verification flaw in Coldcard. Coinkite acknowledged the bug and shipped a fix, and NVK, on the Citadel Dispatch podcast simultaneously branded the disclosure “PR terrorism” and questioned whether a researcher without a CVE counted as a professional. In 2023, when the WalletScrutiny project reported problems reproducing older Coldcard builds, the response labeled the project incompetent or malicious and floated litigation. Independent follow-up later found genuine reproduction problems in older releases and concluded nobody had acted in bad faith.

Every public attack on a researcher changes the math for the next one. Independent review is slow, difficult, and usually unpaid. A researcher weighing months of that work against the prospect of ridicule, blocklists, and legal threats will often spend their time elsewhere. Nobody can prove this culture caused the entropy bug to go unnoticed. What can be said with confidence is that security depends on people being willing to look, and the environment around Coldcard punished looking.