IOSCO (International Organization of Securities Commissions)

The International Organization of Securities Commissions (IOSCO) is the international standard-setting body for securities regulation, comprising more than 130 securities regulatory members from over 130 jurisdictions worldwide. Founded in 1983 as an evolution of the Inter-American Conference of Securities Commissions, IOSCO serves as the primary forum through which securities regulators coordinate internationally, develop shared standards, and promote consistent regulatory practices across member jurisdictions.

Institutional Structure

IOSCO operates through a tiered membership structure. Ordinary Members are primarily responsible regulators for securities markets in their jurisdictions and include the SEC, FCA, ESMA (representing EU collectively for certain purposes alongside individual member state NCAs), ASIC, MAS, SFC, and JFSA. Associate Members are typically junior or specialist regulators. Affiliate Members are SROs and other organizations with securities market roles.

IOSCO’s governance centers on the Board (formerly the Presidents’ Committee), which sets strategic direction and approves final publications. Technical work is conducted through the Growth and Emerging Markets Committee (GEMC), the Committee on Emerging Risks, and specialized technical committees covering areas including investment management, secondary markets, enforcement, and market intermediaries. IOSCO’s Secretariat is based in Madrid.

IOSCO standards, like FSB standards, are non-binding international principles and recommendations. Their authority derives from the commitment of member regulators to implement them domestically and from the reputational and political consequences of deviating significantly from standards developed through multilateral consensus.

The 2023 Crypto Policy Recommendations

IOSCO published its final policy recommendations for crypto and digital asset markets in November 2023, following an extended consultation process. The recommendations addressed crypto-asset service providers performing functions similar to traditional financial intermediaries — exchanges, broker-dealers, custodians, and lending platforms — and recommended that members apply regulatory outcomes consistent with those applied to equivalent traditional financial services.

The recommendations are organized around eighteen specific policy areas, grouped into six clusters: regulatory access to information, governance and organizational requirements, conflict of interest management, client asset protection, market manipulation and insider trading controls, and cross-border regulatory cooperation. For each area, IOSCO articulated the outcome regulators should achieve and the tools available to achieve it, without prescribing specific regulatory mechanisms in recognition of the diversity of legal frameworks across member jurisdictions.

A central theme is the “same activity, same risk, same regulation” principle: where a crypto asset service is economically equivalent to a traditional financial service, the regulatory protections and requirements applicable to the traditional service should apply to the crypto service regardless of the technology used. This principle is deliberately technology-neutral and does not create crypto-specific exemptions or lighter-touch frameworks solely on grounds of novelty.

The 2023 DeFi Policy Report

In parallel with the crypto policy recommendations, IOSCO published a detailed policy report on decentralized finance in November 2023. The DeFi report analyzed the functional characteristics of DeFi protocols — automated market makers, lending protocols, derivatives platforms — and examined whether these functions were economically equivalent to regulated financial services.

IOSCO’s analysis concluded that while DeFi protocols exhibit genuine differences from centralized intermediaries, many protocols effectively perform regulated functions and that the existence of identifiable developers, governance token holders, liquidity providers, and foundation entities means that many ostensibly decentralized protocols have persons who exercise meaningful control and who could in principle be subject to regulatory obligations. The report recommended that members apply their existing regulatory frameworks to these persons where feasible and begin developing specific guidance for DeFi, emphasizing that technological innovation does not justify regulatory arbitrage.

Translation into National Regulator Action

IOSCO recommendations translate into national regulatory action through several mechanisms. Member regulators that participated in developing the recommendations are politically committed to their implementation. IOSCO’s self-assessment and peer review mechanisms monitor implementation progress. When IOSCO recommendations align with existing regulatory authority, implementation can be rapid — the SEC, FCA, ESMA, ASIC, MAS, and SFC each incorporated elements of the 2023 recommendations into their domestic crypto regulatory programs within 18 months of publication.

For regulators requiring new legislative authority — such as jurisdictions where the existing securities law framework does not clearly extend to crypto assets — IOSCO recommendations serve as a reference framework for legislative drafting. The consistent articulation of regulatory outcomes across the IOSCO membership reduces the risk that any single jurisdiction’s reform effort creates competitive disadvantage, since member regulators are implementing broadly comparable standards simultaneously.