I. Core Pillars of Compliance

1. Securities Classification - Is your token a security?

• US - Howey Test (SEC v. W.J. Howey Co. 1946): Investment of money + common enterprise + expectation of profit + efforts of others = security. If yes, must register or exempt under Reg D / Reg S.
• EU - MiCA Regulation (EU) 2023/1114 fully applicable from 30 June 2024 / 30 Dec 2024: Creates 3 buckets: Asset-Referenced Tokens (ART), E-Money Tokens (EMT), and Other Crypto-Assets. Requires Whitepaper, CASP authorization.
• Spain: CNMV is competent for MiCA, Bank of Spain for EMT/ART issuance per Additional Provision 23 of Law 10/2014. Crypto trading platform = CASP needing license.

2. AML / KYC - Travel Rule

• FATF Recommendation 16: VASP must collect and transmit originator/beneficiary info for transfers >$1000/€1000.
• EU AMLD + TFR: MiCA CASPs must comply with Funds Transfer Regulation, verify self-hosted wallets for transactions >€1000.
• US FinCEN: VASP = Money Services Business (MSB). Must register, file SARs, implement BSA program.
• Spain: Law 10/2010 AML, RD 7/2021 - VASPs must register with Bank of Spain registry (not a license, but prerequisite).

3. Market Abuse - Insider Trading, Wash Trading
MiCA Title VI prohibits insider dealing, unlawful disclosure, market manipulation for crypto-assets. Similar to MAR.

4. Custody, Capital, Segregation
MiCA requires segregation of client crypto-assets, no reuse without consent, 125k-150k EUR initial capital, own funds = ¼ fixed overheads.

II. Compliance Operating Model for a Trading Venue / Broker

1. Onboarding: KYC, source of funds, PEP/sanctions screening (EU sanctions on Russia include crypto), risk scoring.
2. Listing diligence: Legal opinion on security status, MiCA whitepaper check, conflict of interest.
3. Transaction monitoring: Real-time chain analytics (Elliptic, Chainalysis) for sanctions, darknet, mixers. Flag > thresholds.
4. Trade surveillance: Detect wash trading, spoofing, layering - FINRA 2021 crypto surveillance report noted 90% of unregulated volume is wash.
5. Reporting: SAR/STR to SEPBLAC in Spain, FinCEN in US, daily reporting to regulators if CASP.

III. Landmark Case Laws - Where Compliance Failed

A. US - The Big Three

1. SEC v. Ripple Labs, Inc. (S.D.N.Y. 20-cv-10832) - XRP - 13 July 2023 & 7 Aug 2024

• Facts: SEC alleged XRP was unregistered security, $1.3bn raised.
• Holding (Judge Torres): Programmatic sales on exchanges to retail via blind bid/ask are NOT securities transactions because retail did not expect profits from Ripple's efforts directly. Institutional sales ARE securities.
• Compliance lesson: How you sell matters more than what you sell. Exchange trading ≠ automatic securities exemption. Ripple ordered to pay $125m penalty, injunction to register institutional sales. This is the case that forced all US exchanges to delist/relist analysis.

2. SEC v. Coinbase, Inc. (S.D.N.Y. 23-cv-10299) - Trading Platform as Unregistered Exchange
SEC sued Coinbase for operating unregistered exchange, broker, clearing agency for 13 tokens (SOL, ADA, MATIC, etc.). Coinbase argued tokens are not securities after listing. Judge Failla denied motion to dismiss in March 2024, holding secondary sales can be securities transactions under Howey - transaction itself matters. Case pending but sets compliance standard: If you list tokens that SEC later deems securities, your entire platform is illegal without broker-dealer license.

3. SEC v. Telegram Group Inc. (S.D.N.Y. 19-cv-9439) - GRAMs - March 2020
Telegram raised $1.7bn for TON blockchain via SAFT. Court granted preliminary injunction: entire scheme, including initial private sales + resale, was single integrated unregistered securities offering. Telegram returned $1.2bn + $18.5m penalty. Birth of SAFT doctrine failure.

B. DeFi & Decentralization Defense Fails

4. CFTC v. Ooki DAO (N.D. Cal. 3:22-cv-05416) - Sept 2022/June 2023
CFTC sued decentralized autonomous organization that operated bZx protocol for unregistered leveraged trading. DAO argued no legal person. Court held DAO is an unincorporated association under California law, liable as a person. Default judgment $643,542. First case where DAO members voting are personally liable for compliance failures.

5. SEC v. LBRY, Inc. (D.N.H. 21-cv-260) - Nov 2022
LBRY's LBC token - even though utility token for decentralized video, court held entire offering was security because company promoted price appreciation. No fair notice defense. Company shut down.

C. AML / Mixers / Sanctions

6. US v. Tornado Cash - Roman Storm & Roman Semenov (S.D.N.Y. & E.D. Washington 2023-2024)
OFAC sanctioned Tornado Cash smart contract addresses Aug 2022 - first time code sanctioned. DOJ indicted developers for money laundering and sanctions violations (North Korea Lazarus laundered $455m). District Court in Van Loon v. Treasury (5th Cir Nov 2024) reversed: OFAC cannot sanction immutable smart contracts because they are not property of foreign national. But criminal charges for operating mixer remain. Compliance lesson: Operating non-custodial privacy tool ≠ exempt from BSA if you have control / fee.

7. FinCEN v. Bittrex (April 2023)
Bittrex settled $29m for willful BSA violations - failed to file SARs, allowed transactions from sanctioned jurisdictions (Crimea, Iran, Syria). First major BSA enforcement against exchange.

8. SEC v. Binance Holdings / Zhao (S.D.N.Y. & W.D. Wash. 2023) - $4.3bn Settlement
Binance failed to register, commingled customer funds, wash trading via Sigma Chain. CZ pleaded guilty to BSA violation. Compliance failure textbook: No independent custody, no surveillance, intentionally evaded US.

D. EU / Spain Specific

9. CNMV / Banco de España - Bit2Me, Coinbase Spain Registration Cases (2022-2024)
Under RD 7/2021, Bank of Spain registry is mandatory. Several VASPs operated without registration - SEPBLAC fined €1.5m for AML failures. CNMV issued warnings for offering crypto derivatives without MiFID license. Under MiCA, from Dec 30 2024, registry becomes full CASP authorization - non-compliant platforms must cease.

10. Audiencia Nacional - Arbistar 2.0 Ponzi (2021-2023)
Spanish crypto trading bot promised 8% weekly returns. Prosecutor filed fraud, misappropriation. Court held crypto-assets are seizable assets, investment contract subject to Spanish securities law even without formal token. Directors in pre-trial detention.

11. CJEU C-264/14 - Skatteverket v. Hedqvist (2015)
Bitcoin exchange is VAT-exempt supply of services - foundation for MiCA's financial instrument treatment.

IV. Checklist for Compliance Now (2026)

If you run trading desk, exchange, or OTC in Spain/EU:

1. MiCA Authorization by June 2026 grandfathering ends: Apply to CNMV as CASP - requires 2-5 year business plan, ICS, custody segregation, whitepaper liability
2. Travel Rule: Integrate Sygna / TRP for all transfers >€1000
3. Listing memo: External counsel Howey + MiCA opinion for each token - SEC vs Ripple shows institutional vs retail distinction matters
4. SEPBLAC reporting: Register with Bank of Spain, file monthly UIF, SAR for any transaction >€50k or suspicious chain hop via mixer
5. No wash trading: MiCA Art.91 market manipulation - penalties up to €5m or 3% turnover