Long lagging behind, cryptocurrency regulation is now gathering pace. But on a global scale, approaches remain fragmented, sometimes contradictory, and often ill-suited to the speed of cyber threats. Between attempts at harmonization, regulatory influence wars, and geopolitical pressures, companies are navigating a shifting legislative jungle.

Europe: from permissiveness to structured regulation

With the adoption of the MiCA (Markets in Crypto-Assets) regulation, the European Union has clearly demonstrated its desire to become a regulatory leader in the crypto sector. This text, which will came into full effect at the end of 2024, goes far beyond simply regulating platforms: it lays the foundations for a regulated internal market for crypto-assets, with requirements for transparency, traceability (travel rule), and governance.

But this shift is also a direct response to the rise of crypto-based money laundering and cyberattacks involving anonymous payments. The gradual ban on unverified wallets, the monitoring of stablecoins, and reporting requirements for crypto service providers are all responses to a growing demand for digital security at the European level.

The paradox is that this regulatory tightening could ultimately shift criminal flows to non-cooperative areas where anonymity remains the norm. Hence the challenge for European companies to also monitor entry and exit points outside the EU.

United States: between competing regulators and a federal vacuum

On the US side, the situation is more complex. Players in the crypto sector operate in a fragmented ecosystem, where several agencies are vying for leadership:

• The SEC (Securities and Exchange Commission) considers certain cryptocurrencies to be financial securities.
• The CFTC (Commodity Futures Trading Commission) treats them as commodities.
• The US Treasury, through OFAC and FinCEN, imposes sanctions, monitors flows, and wants to expand the scope of the Bank Secrecy Act.

But no unified regulatory framework has yet emerged. This uncertainty fuels tensions between innovation and protection. 

The CCPA (California Consumer Privacy Act), often compared to the GDPR, is one of the few US laws to set rules for notification in the event of a cyberattack. But it remains confined to a single state. The adoption of a federal law on cybersecurity and crypto assets, promised for years, still seems a long way off.

As a result, for companies operating in the United States, managing a crypto incident requires active legal monitoring and close coordination with authorities, whose jurisdictions overlap.

Canada: transatlantic alignment and legislative caution

In Canada, PIPEDA (Personal Information Protection and Electronic Documents Act) governs the management of personal data, including in the event of a security breach. Although not specifically designed for digital assets, this law requires companies to notify significant privacy breaches, including those related to crypto ransom demands.

But Ottawa is preparing for a paradigm shift. The CPPA (Consumer Privacy Protection Act) bill aims to modernize Canadian law in the era of AI, blockchain, and mass breaches. It would strengthen penalties, the powers of the Office of the Privacy Commissioner, and introduce a new dedicated tribunal.

For Canadian companies, this will mean:

• Greater responsibility for managing crypto-ransom incidents.
• The likely obligation to keep a record of extortion attempts and payments, including in a cross-border context.

Canada, often seen as a bridge between European and American models, could thus play a strategic role in the international standardization of crypto rules.