Who Actually Writes the Rules of Digital Finance?

When a country adopts new rules for crypto exchanges, stablecoin issuers, or tokenized securities, the legislation or regulation that emerges is often the visible tip of a much larger process. Below it lies a complex, layered architecture of international standard-setting bodies, intergovernmental organizations, national bureaucracies, and industry participants — all of whom have shaped what the final rules say before any parliament or agency has formally acted.

Understanding who actually writes the rules is essential to understanding why regulation looks the way it does and where to focus if you want to influence it.

The International Layer

IOSCO: The Securities Regulators’ Club

The International Organization of Securities Commissions is where the world’s securities regulators — the SEC, FCA, ESMA, MAS, ASIC, and approximately 200 others — share experience and develop common approaches. IOSCO does not have legislative authority. Its standards are not law. But in practice, IOSCO policy reports are adopted by national regulators with remarkable consistency, because IOSCO standards represent the professional consensus of the people who run securities regulation worldwide.

IOSCO’s technical committees produce reports on specific regulatory questions — how to regulate crypto-asset service providers, how to apply market integrity rules to crypto markets, how to regulate DeFi. These reports go through extensive internal review by member regulators, who bring them to their home jurisdictions for comment and refinement. By the time a final IOSCO report is published, it typically reflects what most major regulators are already prepared to implement.

The practical consequence is that when the SEC, FCA, and MAS all adopt similar rules for crypto exchanges within a few years of each other, this is rarely coincidence. They have all been working from the same IOSCO template.

FSB: The G20’s Financial Stability Arm

The Financial Stability Board coordinates financial regulation across the G20. Its membership includes central banks, finance ministries, and supervisory authorities from the major economies. FSB recommendations carry significant political weight because they are formally endorsed by G20 leaders at their annual summits.

The FSB’s process for crypto-asset regulation illustrates how international financial governance works. FSB working groups — staffed by officials from member jurisdictions — develop analytical frameworks, consult with industry and academics, and draft policy recommendations. These go through internal FSB review, then are sent to G20 leaders for endorsement. Once a G20 communiqué has endorsed an FSB recommendation, national finance ministries and regulators face political pressure to implement it.

The FSB’s October 2023 framework for crypto-asset regulation, which articulated the “same activity, same risk, same regulation” principle, followed this trajectory. Within a year of G20 endorsement, that principle was appearing in national regulatory consultations across multiple jurisdictions.

FATF: AML Rules That Become National Law

The Financial Action Task Force is arguably the most powerful standard-setter in financial regulation. FATF’s plenary — which meets three times annually and includes finance ministry and central bank officials from 40 member jurisdictions — adopts guidance and recommendations that become de facto national law through a combination of peer pressure and formal assessment.

The FATF process works through mutual evaluations: teams of officials from member countries assess each other’s compliance with FATF standards and publish reports. A poor FATF evaluation results in placement on the “grey list” or “black list,” which restricts access to the international financial system and imposes significant economic costs. This creates powerful incentives for compliance.

FATF’s Recommendation 15, which extended the Travel Rule to virtual asset service providers (VASPs), illustrates this mechanism. FATF adopted the guidance in 2019. Over the following years, the vast majority of FATF member jurisdictions implemented Travel Rule requirements for crypto firms — not because any international treaty required it, but because the cost of non-compliance in FATF evaluations was too high.

Basel Committee: Capital Rules for Banks in Crypto

The Basel Committee on Banking Supervision sets capital rules for banks. Its standards — Basel III and the forthcoming Basel IV — determine how much capital banks must hold against various asset categories. The Basel Committee’s treatment of banks’ crypto exposures, finalized in late 2022, placed crypto assets in two groups: tokenized traditional assets and stablecoins that meet certain conditions receive treatment analogous to their underlying assets; unbacked crypto assets like Bitcoin receive a punitive 1,250% risk weight, meaning banks must hold capital equal to the full value of their exposure.

This rule — developed in Basel, implemented by bank supervisors in every major jurisdiction — is more consequential for institutional adoption of crypto than almost any national legislation. It determines which crypto activities banks can economically conduct.

The European Layer

DG FISMA: Drafting MiCA

Within the European Commission, the Directorate-General for Financial Stability, Financial Services and Capital Markets Union (DG FISMA) is the bureaucratic engine that produces financial regulation. MiCA was drafted by DG FISMA officials over several years, drawing on consultations with the European Banking Authority and European Securities and Markets Authority, input from industry through formal and informal processes, and political direction from the Commission.

The formal consultation process — in which the Commission publishes draft texts and receives written comments — produced tens of thousands of responses on MiCA from industry, consumer groups, and member state governments. DG FISMA officials reviewed these comments and made drafting decisions. Industry participants who engaged seriously with this process — providing detailed technical analysis rather than general advocacy — had meaningful influence on specific provisions.

ESMA’s role in developing Level 2 measures — the technical standards that fill in the details of MiCA’s Level 1 framework — follows a similar pattern. ESMA consults publicly, receives industry input, and develops technical standards that are then adopted by the Commission.

The National Layer

At the national level, Treasury and Finance Ministry officials advise ministers on legislative proposals, and agency staff develop detailed rulemaking. In the US, Treasury’s Office of International Affairs tracks international standard-setting and ensures that US positions are coordinated across agencies. The SEC’s Division of Corporation Finance and CFTC’s Division of Market Oversight develop rulemaking that implements statutory requirements.

Industry Comment Letters: More Important Than They Appear

The formal comment letter process — available at every stage of rulemaking in most democratic jurisdictions — is more influential than its apparent formality suggests. Regulators are required to respond to substantive comments, which means a well-argued technical objection can force rulemaking staff to reconsider a provision. Industry trade associations and major firms invest significantly in developing detailed comment letters precisely because this process works.

The revolving door ensures that industry experience shapes all of this. Former CFTC and SEC officials who understand the rulemaking process in detail advise clients on how to engage effectively. Former industry lawyers who join agencies bring commercial perspectives to regulatory design. This flow of personnel is not inherently corrupt — it also brings practical knowledge into government — but it means that the line between regulator and regulated is more porous than public accounts of rulemaking typically acknowledge.

The rules of digital finance are written in committee rooms, consultation responses, and bilateral conversations between officials and industry representatives. Understanding this process is the first step to influencing it.