October 26, 2026

Recap: TRM Labs Quarterly Policy Roundtable, Q3 2026

TRM Team

Which mission will you select?

November 2-3, 2026

Recap: TRM Labs Quarterly Policy Roundtable, Q3 2026

This quarter, TRM's Ari Redbord and Isabella Chase were joined by Ziqing Ang, who took part in her first quarterly roundtable, for a tour of what mattered most in global crypto policy in Q3 2026. They also made time for the launch of Ardence, TRM's AI investigation platform.

Read on for highlights from their discussion or watch the full recording below.

Meet Ardence

Ari kicked things off with the news everyone was already talking about: Ardence. Ardence combines TRM's blockchain data with 60+ partner datasets, including threat intelligence, shipping records, beneficial ownership, corporate registries, and ad tech data. The result is a single graph that looks like the TRM graph investigators already know, but with offchain elements alongside the onchain flows.

Isabella said the launch gave TRM a chance to say plainly what it is here to do: put powerful data and tools in the hands of public and private investigators, so they can achieve their missions. Ziqing added how pressing the need for a tool like Ardence is in the cyber threat intelligence space.

United States: Congress pauses, agencies keep going

From there, the group headed to Washington, D.C. The CLARITY Act did not clear a cloture vote in recent weeks, and Ari said most people in the policy community now expect no further action before the midterm elections. The midterms could change the makeup of Congress, which would send digital asset legislation back to the drawing board.

Regulators, though, kept moving. Within 36 hours of the vote, the Commodity Futures Trading Commission (CFTC) put out new guidance and opened a 60-day comment period on retail crypto trading rules. The US Securities and Exchange Commission (SEC) announced a five-year innovation exemption for onchain trading of tokenized stocks. Ari's takeaway is that regulators are working out the SEC and CFTC questions themselves. That brings clarity to the market, but it can shift with the political winds because none of it is written into law.

Stablecoins are the exception. The GENIUS Act is already law, Treasury and the Office of the Comptroller of the Currency are writing the rules to carry it out. Ari encouraged listeners to read TRM's comment letter on how technology can support stablecoin compliance and investigations.

An audience question gave Ari a chance to talk about definitions. Without legislation, how does anyone know what counts as a security? He pointed to the SEC's token taxonomy from March, which divides digital assets into five categories: digital commodities, digital collectibles such as NFTs, digital tools, stablecoins, and digital securities. It is guidance, not a statute, so courts will likely still look to the Howey test.

Europe and the UK: A long review begins

Isabella picked up on something Ari said and took us to Europe next, when a long summer of consultations will set the foundation for future rule making.

In the EU, the MiCA 2.0 consultation closed on September 30, a month later than planned. Isabella said the extension shows how much people had to say. The consultation is the first step in a formal review of the Markets in Crypto-Assets Regulation (MiCA), and the European Commission will publish a report with proposals for new rules by June 30, 2027.

The 86 questions covered token classification, the stablecoin regime, authorization of crypto asset service providers (CASPs), and everything the original MiCA left out, including DeFi, staking, lending, borrowing, prediction markets, and perpetual futures. These were not part of everyday crypto when MiCA was drafted. Early responses from ESMA and the EBA lean toward keeping most of the existing framework and making it clearer, with tighter rules on influencer marketing and costs. Both also weighed in on stablecoins, including whether issuers should be able to freeze coins found to be used for illicit purposes.

MiCA's grandfathering period also ended. Isabella said about 281 CASPs held authorization at the end of the grandfathering period, compared with roughly 1,300 identified across Europe during the period.

In the UK, the Financial Conduct Authority (FCA) opened its authorization gateway on September 30. It stays open until February 28, 2027, and firms that want to operate from the UK must be authorized before the new regime starts in October 2027. The FCA finalized its rules on June 30, so firms have had little time to prepare, and the final details on the regulatory perimeter are due in early 2027. When an audience member asked how the UK handles definitions, Isabella said the FCA has long followed a "same risk, same regulatory outcome" approach.

Isabella also covered sanctions. The UK and the EU both made major crypto-related designations this quarter, including HTX. She sees both moving beyond sanctioned countries and entities to the enablers of sanctions evasion networks.

Asia-Pacific: From frameworks to function

Ziqing opened with Token2049 in Singapore the week before. Underneath the buzz, she kept hearing the same question: now that frameworks are in place, how does the region scale digital assets? That question shaped everything she covered.

Singapore's stablecoin consultation was the first example. The Monetary Authority of Singapore (MAS) opened it on September 1, and it ran until October 16. It proposes a dedicated issuance license, full reserves, redemption requirements, and quarterly stress tests. The industry has focused on one proposal in particular, which would restrict issuers from using customer funds, and the interest earned on them, to materially finance their own business. MAS drew the idea from e-money rules and has acknowledged the effect on the commercial viability of issuer models, so Ziqing expects more discussion on how to calibrate it.

She also found the overall design distinctive. A coin that meets the standard earns a MAS-regulated label. A coin without it can still be distributed but is treated as a digital payment token. MAS would recognize foreign stablecoins from substantially equivalent jurisdictions, which Ziqing said opens a door to interoperability, and it could designate any stablecoin as systemic wherever it is issued. Her read is that MAS is balancing market safety with commercial viability.

Banks came next. Ziqing said they are moving faster on tokenized money and stablecoins, but they want the full rulebook before they commit, including capital treatment. In April, MAS consulted on letting banks treat crypto assets on permissionless blockchains as Group 1, with lower capital requirements than a 1,250% risk weight, if they can show they manage the risks of public chains. Settlement is the other piece. Hong Kong's tokenization pilot settles tokenized money market transactions with tokenized deposits, but the cash leg still runs through a system that does not operate around the clock. Regulators are looking at tokenized central bank money on a 24/7 basis, because faster rails do not help if the cash side stays slow.

AI guidance followed naturally. Questions in the region have become practical: what AI does an institution run, what evidence supports its decisions, and can it reconstruct a decision trail? On October 7, MAS published final AI risk management guidelines built on three ideas. Oversight should scale with risk. Every AI use case needs to be documented, with clear roles and responsibilities. And institutions should be able to show that models are monitored on an ongoing basis, not rely on static documentation. Oversight expectations start in October 2027 and lifecycle controls in October 2028, with a consultation on agentic AI planned for next year.

Ziqing ended with licensing. Taiwan passed its Virtual Asset Service Act on June 30, with the earliest reported effective date in the first quarter of 2027. Korea's Digital Asset Basic Act has yet to be introduced, and stablecoins are the sticking point, with the Financial Services Commission and the Bank of Korea debating whether banks must hold a majority stake in issuers. Australia has the clearest dates of the three. The Australian Securities and Investments Commission's no-action window closed on September 30, and the Digital Assets Framework Act, brings digital asset platforms into the financial services licensing regime, takes effect on April 9, 2027. A consultation on asset holdings, settlement, and financial requirements is expected soon.

AI: A threat, and a tool for supervisors

The AI conversation has become shaped by the new paradigm for cyber resilience.

The Hugging Face Incident from this summer will be the defining example of this new period. An AI model tested in an allegedly closed environment worked with about 700 agents, connected itself to the internet, and accessed multiple databases. Hugging Face engineers found the activity and reported it to OpenAI. The second major attack of the quarter was a social engineering attack on Revolut, where attackers posed as Italian law enforcement and gained access to data on high-net-worth customers before demanding a ransom. Isabella said secure end-to-end messaging between the firm and the agency would have closed that route. She encouraged firms and agencies to ask where else their ways of working leave openings for AI, hackers, or both. Ari added that he has written several pieces for Forbes on rogue AI agents in cyber attacks.

Isabella also pointed to a hopeful side. AI can test financial crime control frameworks and surface failures earlier. Ziqing said regulators in APAC are already using it this way. MAS is running a proof of value with five banks, using AI models on historical transaction records and account numbers in a secure environment so banks can intervene before customers lose money. In India, the Reserve Bank of India's innovation hub built MuleHunter.AI, which helps banks identify mule accounts in near real time and stop scam proceeds.

Ziqing's summary of where this leaves things: finance now runs at machine speed, and supervision is catching up. As regulators apply AI themselves, she expects them to look even more closely at the inventories, evidence, and audit trails they ask of firms. AI is enabling crime, and it is also enabling investigations and supervision.

What we're watching in Q4 2026

In the US, the team is watching whether any market structure legislation moves before the midterms, how the CFTC comment period plays out, and what comes next from the GENIUS Act rulemaking.

In Europe and the UK, the MiCA 2 review heads toward the Commission's June 2027 report, and firms work through the FCA gateway before it closes in February. Final perimeter guidance is expected in early 2027.

In APAC, Ziqing is watching the close of the MAS consultation, ASIC's expected consultation on digital asset platforms, Taiwan's implementing rules, and Korea's stablecoin debate.

TRM is putting policy into practice too. Isabella said the team is running its second Beacon Network Sprint in the UK, testing private-to-private intelligence sharing between crypto firms and financial institutions. She is also leading growing work on environmental crime, which she described as a USD 281 billion a year industry. Find the team at Resolve 2026, TRM's user conference, on November 2–3 in Washington, DC, and at Singapore FinTech Festival, where the team will speak on several panels and will hold the annual SFF TRM Run Club - see you there.

Want weekly, bite-sized updates on these developments? Subscribe to TRM's Weekly Roundup on LinkedIn for expert analysis on crypto policy, regulation, and financial crime enforcement — delivered on your feed or in your inbox every Thursday.

‍