Digital Asset Compliance in 2027: What US Rules Require Firms to Record and Report

Which US rules set record-keeping and reporting duties for digital assets?

Each regime has its own records and retention clock, so keeping audit-ready records for digital assets starts with knowing which rule each record answers to.

For tokenized assets, the token sits onchain while valuations, documents and ownership data sit offchain. Keeping that offchain side checkable is the problem behind verifiable asset data for tokenized assets, and the reason data integrity in tokenization cannot be read off the ledger alone.

So the first question is who the rule addresses. A platform group can act as an IRS broker, a FinCEN-registered money transmitter and an SEC-registered broker-dealer, usually through separate legal entities. Each role has its own records and retention clock.

US record-keeping and reporting duties for digital assets, as of September 30, 2026

Retention periods are simplified. Each rule defines which records it covers and where exceptions apply, so the applicable period depends on the type of record and the rule behind it.

What changes for digital asset tax reporting in 2027?

The first Forms 1099-DA with cost basis reach customers and the IRS in early 2027. Under the IRS broker reporting rules, brokers report gross proceeds for digital-asset sales made since January 1, 2025. For sales after 2025 of covered digital assets, broadly those acquired in a customer's account on or after January 1, 2026, they must also report basis.

Basis reporting turns a sales record into an acquisition record. A broker that cannot show when and at what cost a unit entered an account cannot report its basis, and that record is easiest to evidence when captured on arrival, not rebuilt in January.

The IRS rule covers custodial participants such as trading platforms, hosted wallet providers and kiosk operators. A second rule for non-custodial participants was nullified by Congress in April 2025. Relief is narrowing too: under IRS Notice 2025-33, brokers need not backup-withhold on sales in 2025 or 2026, while relief for 2027 sales is narrower and mostly tied to accounts opened before 2026.

On retention, the IRS asks filers to keep copies of information returns, or the ability to reconstruct them, for at least three years, or four where backup withholding was imposed. The IRS records regulation adds that supporting records are kept as long as they may become material to the administration of tax law. Separately, under Announcement 2024-4, businesses need not count digital assets toward the $10,000 cash-reporting threshold until final regulations are issued.

What do securities rules require when a digital asset is a security?

When a token is a security, the usual recordkeeping rules apply to the firms that handle it. Broker-dealers make and keep current records under SEC Rule 17a-3. Rule 17a-4 sets how long they keep them: six or three years, depending on the record, the first two in an easily accessible place. FINRA Rule 4511 requires member firms to keep the records FINRA rules call for in a format that meets Rule 17a-4.

Rule 17a-4 allows electronic records in a non-rewriteable, non-erasable format or, since 2023, in a system with a complete time-stamped audit trail of every change. For ledger-based records, the audit-trail route matters most: a blockchain entry may be hard to alter, but the offchain data linked to it usually sits in ordinary, editable systems.

Custody adds its own documents. In December 2025, SEC staff said they would not object if a broker-dealer treats itself as having physical possession of crypto asset securities under certain conditions. These include written policies that assess the ledger technology and procedures for events such as forks.

Advisers work to a different clock. Rule 204-2 generally requires advisers registered, or required to be registered, with the SEC to keep required records for five years from the end of the fiscal year of the last entry. A September 2025 staff no-action letter on state trust companies as crypto custodians adds conditions that also leave a paper trail, including annual due diligence on the custodian's audited financial statements and internal control report.

Two steps in September 2026 keep the focus on records a firm can produce. The SEC proposed transfer agent rules with a single retention period for most records and updated provisions for blockchain-based recordkeeping; the proposal is not final. Its temporary, conditional "innovation exemption" for venues trading tokenized NMS stock requires those venues to keep books and records in the United States until three years after the exemption ends, and to produce them to SEC staff on request in human-readable and usable electronic form.

What does anti-money-laundering (AML) law require for digital-asset transfers?

FinCEN applies its existing Bank Secrecy Act rules to convertible virtual currency instead of a separate crypto rule. Its 2019 guidance says such transactions qualify as transmittals of funds and may therefore fall within the travel rule.

For transmittals of $3,000 or more, FinCEN's recordkeeping rule requires financial institutions other than banks to keep details such as the transmittor's name and address, the amount and the date. The travel rule requires the transmittor's institution to pass certain information to the next institution. Bank Secrecy Act records are kept for five years.

The ledger carries the value, not the identity data. FinCEN's guidance says the information must be provided before or at the time of the transmittal, whatever system settles it. A firm therefore needs a record that links the onchain transfer to the offchain data sent with it.

Investment advisers have more time. FinCEN's AML rule for SEC-registered and exempt reporting advisers now applies from January 1, 2028, not January 1, 2026. A final rule published in January 2026 made that change, and FinCEN said in 2025 that it would also revisit the rule's scope.

What does the GENIUS Act add for stablecoin issuers from January 2027?

The GENIUS Act, signed on July 18, 2025, sets federal rules for permitted payment stablecoin issuers. Each month, an issuer publishes its reserve composition, has that report examined (not audited) by a registered public accounting firm, and has its CEO and CFO certify it. The Act also treats these issuers as financial institutions under the Bank Secrecy Act, including the retention of appropriate records.

The Act takes effect on the earlier of January 18, 2027, or 120 days after the primary federal payment stablecoin regulators issue final regulations. Those regulators are the OCC, the FDIC, the Federal Reserve and the NCUA. As of September 30, 2026, all four had published only proposed rules. Any final rule issued from late September onward starts a 120-day clock that ends after January 18, 2027, so that is the date the statute points to.

The Act does not set its own retention period. A joint FinCEN and OFAC proposal of April 2026 would create AML and recordkeeping rules specific to stablecoin issuers. Until it is final, the retention details remain open.

How do MiCA, CARF and the DLT Pilot Regime compare with the US rules?

A US group whose EU affiliate is authorized as a crypto-asset service provider meets a different structure: one crypto rulebook, MiCA, and a separate EU tax-reporting track that implements the OECD's Crypto-Asset Reporting Framework (CARF). The table sets the two systems side by side.

What are the common mistakes with digital asset records?

Most gaps follow the same pattern as other data integrity failures in regulated finance: the record exists, but nobody can show where it came from or whether it changed.

Treating digital assets as one regime. Retention clocks differ by rule and by firm. Copies of IRS information returns run at least three years, Bank Secrecy Act records five, adviser records generally five, broker-dealer records six or three, OFAC transaction records ten. A single "crypto retention policy" is likely to miss at least one of them.

Treating the ledger as the record. A public ledger shows that value moved. It does not hold the customer's name, the cost basis or the travel-rule information. The SEC staff's January 2026 statement describes a securityholder file on a crypto network linked to offchain data. The required records sit partly off the ledger, and a reviewer needs the link between the two.

Reading staff statements as rules. The January 2026 tokenized-securities statement, the December 2025 custody statement and the September 2025 no-action letter set out staff positions, not Commission rules. They can change without rulemaking, so it helps to keep the rule and the staff position apart in internal policies.

Waiting for final rules. The GENIUS Act date is set by statute, and basis records for assets acquired in 2026 are needed for forms filed in 2027. Proposals change details, not the need for the underlying record.

A record kept under any of these rules is only useful in an exam if it also passes the four checks behind audit-ready records: it can be found, read, attributed and shown to be unchanged.

Where does Filedgr fit?

Most of these rules end in a similar request: produce the record, show where it came from, and show what changed and when. Today that record is usually assembled from exports of the ledger, the custody system, the tax engine and email approvals. The weakness sits between those systems. An export can be complete and still impossible to tie back to the moment the underlying record was created.

One way to close that gap is to fix each supporting record when it is created: hash it, have the responsible party sign it, and timestamp the result, so any later copy can be checked against the original. Filedgr provides verification infrastructure built on that approach. Records are captured with their context, held in a Filedgr Vault with permissions set per recipient, and kept with their hash, signature and timestamp in an append-only history. For tokenized assets, Filedgr AssetID applies the same approach to NAV data, documents and corporate actions.

Since June 2026, the public Filedgr Explorer lets a third party check a record's signature and blockchain transaction without a Filedgr account and without seeing the content behind it.

Filedgr does not prepare or file Forms 1099-DA or CARF returns, does not monitor transactions for AML purposes, does not calculate tax, and does not decide whether a record meets a rule. It supports the compliance evidence, review and reporting workflows that those decisions rely on.

This article is for general information only and reflects the rules, guidance and proposals published as of September 30, 2026. It is not legal, tax or compliance advice and does not create an advisory relationship. Requirements depend on a firm's registrations, activities and jurisdiction, and some of the measures described are proposals or staff positions that may change. Consult qualified counsel before acting on any of it.