The fastest way to improve an outcome with a US regulator is to retain experienced counsel immediately, self-report before the government finds the problem on its own, and back that disclosure with real remediation and restitution. The SEC, CFTC, DOJ/SDNY, and FinCEN all reward early, documented cooperation with reduced penalties, declinations, or more favorable settlement terms built around disgorgement, prejudgment interest, and civil money penalties.
TL;DR:
- Early self-reporting within days of discovering a problem is more valuable than delayed full disclosure, especially when paired with concrete remediation and restitution plans.
- Compliance gaps, particularly late or missing suspicious activity reports or unregistered offerings, significantly increase regulatory scrutiny and penalties in crypto enforcement actions.
- Building ongoing, transparent relationships with regulators through routine engagement and consistent responses can lead to more favorable outcomes and easier resolution.
- A well-prepared, litigation-tested legal strategy that protects privilege and coordinates multi-agency engagement improves negotiation success and potential declinations.
- Prompt, credible restitution and a documented root cause fix are critical to persuading regulators and minimizing non-monetary consequences like bans or reputational harm.
Table of Contents
- What US regulators evaluate: cooperation, remediation, and mitigation credit
- Common enforcement triggers: AML, KYC gaps, and market conduct risk
- Practical 72-hour checklist for teams contacted by a regulator
- Designing remediation and restitution plans that persuade staff
- Regulatory risk differs by the type of crypto asset involved
- Building regulatory trust that goes beyond baseline compliance
- Preparing for regulatory audits and inquiries beyond the first letter
- Staying current as crypto regulatory frameworks keep shifting
- Non-monetary consequences and protecting the firm’s reputation
- What successful negotiations tend to have in common
- Why early, litigation-tested counsel changes negotiation outcomes
- How Murphy’s Law helps with enforcement response and remediation
- FAQ
- Sources
- Official advisories and programs to read next
What US regulators evaluate: cooperation, remediation, and mitigation credit
Enforcement staff do not treat cooperation as a vague gesture of goodwill. The SEC’s Five Principles of Effective Cooperation give staff a concrete rubric: self-policing, self-reporting, remediation, cooperation, and collaboration. Each principle maps to specific behavior the government can observe and reward, and staff use that rubric when recommending charges, penalty amounts, or a declination altogether.
- Self-policing means maintaining board-approved written controls and training before any problem surfaces, not after.
- Self-reporting means telling the regulator before it finds the issue through a complaint, a competitor, or routine surveillance.
- Remediation means fixing the underlying gap, not just the symptom that triggered the inquiry.
- Cooperation includes practical tools like reverse proffers and hot-document previews that help staff move faster and trust the account they are getting.
- Collaboration covers things like facilitating witness interviews and building document maps that staff would otherwise have to construct themselves.
The CFTC’s Enforcement Advisory formalizes a similar framework, explicitly tying timeliness, remediation, and restitution to the availability of declination or reduced penalties. The DOJ’s Southern District of New York runs a parallel program: a company that self-reports, cooperates fully, and provides full restitution can receive a conditional declination rather than a prosecution.
One structural fact changes negotiating posture more than any other: regulators treat early partial disclosure as more valuable than complete disclosure made after they already have the facts. A firm that comes forward with an incomplete but honest account within days of discovering a problem is generally in a stronger position than one that waits weeks to deliver a polished narrative.
Resolution outcomes vary by conduct and scale. Settlements often bundle disgorgement, prejudgment interest, and civil penalties into a single bifurcated figure, and amounts can range widely depending on investor harm and the duration of the violation. Readers evaluating what cooperation credit means in practice can find a fuller walkthrough in our explainer on SEC cooperation credit.
Common enforcement triggers: AML, KYC gaps, and market conduct risk
Most crypto enforcement actions trace back to a handful of recurring failures, and they are largely preventable. FinCEN’s guidance on convertible virtual currency sets a baseline AML program that money services businesses and money transmitters handling virtual currency are expected to maintain:
- Written internal controls tailored to the firm’s actual risk profile, not a template pulled from another industry.
- A designated compliance officer with real authority to flag and escalate issues.
- Ongoing employee training that covers how the firm’s specific products can be misused.
- Independent review of the program’s effectiveness, conducted by someone outside the compliance function.
- Timely filing of Suspicious Activity Reports when the facts warrant it.
Gaps in any of these areas, particularly late or missing SARs, are among the most frequently cited violations in FinCEN consent orders. On the securities and derivatives side, unregistered token offerings, yield or lending products marketed without clear risk disclosure, and recordkeeping shortfalls routinely map to SEC and CFTC enforcement theories. A token marketed as a guaranteed-return product, for instance, invites both a securities registration question and a truth-in-advertising problem at the same time.
These failures do not just invite scrutiny. They expand it. A firm with thin AML documentation faces a harder time proving its remediation was genuine, which pushes negotiated penalties higher and makes an injunction more likely rather than less. Businesses building or rebuilding a compliance program from scratch can review our compliance guide for crypto businesses for the baseline elements regulators expect to see in place before trouble starts.
Practical 72-hour checklist for teams contacted by a regulator
The first three days after a subpoena, inquiry letter, or law enforcement contact set the tone for everything that follows. Moving deliberately, not just quickly, is what protects both privilege and credibility with the regulator.
- Issue a document hold immediately and scope custodial preservation narrowly enough to be workable but broadly enough to cover every system touching the conduct at issue.
- Loop in general counsel and the compliance officer the same day, and bring in outside regulatory counsel before any substantive response goes out the door.
- Have counsel scope the inquiry first, mapping what the regulator likely already knows against what the company knows internally, before deciding what to disclose and when.
- Build a controlled self-reporting strategy rather than reacting to each request in isolation, since a scattered response reads as disorganized even when the underlying facts are fine.
- Designate one point of contact with the regulator, almost always outside counsel, so the agency receives a single, consistent account rather than conflicting signals from different employees.
- Offer document summaries and hot-doc flags early rather than a raw data dump, which helps staff trust the account and often speeds the inquiry toward resolution.
- Propose a realistic production timeline rather than promising speed you cannot deliver, since a missed deadline costs more goodwill than a longer timeline stated honestly up front.
Pro Tip: Never let an employee answer a regulator’s informal question without counsel present, even a seemingly harmless one. An offhand characterization can look like a waiver of privilege or an admission later.
Legal teams facing a civil investigative demand or formal subpoena should treat preservation and scoping as inseparable steps; our guide to responding to a civil investigative demand walks through both in sequence. For a broader view of the first response to any inquiry, see how to respond to a crypto regulatory inquiry.
Designing remediation and restitution plans that persuade staff
A remediation package that actually moves a negotiation has specific components, not just a promise to “do better.” Staff look for evidence that the fix addresses the root cause, not just the symptom that drew attention.
- A documented gap analysis showing exactly where the AML, disclosure, or recordkeeping program failed.
- Concrete policy changes tied directly to the identified gaps, not generic updates.
- Added staffing or training where the analysis shows a resourcing shortfall caused the failure.
- Disciplinary action where individual conduct, not just process, contributed to the violation.
- An independent review or an outside consultant engaged to confirm the fix actually works.
Restitution timing matters as much as the amount. A firm that can make victims whole immediately, even partially, while committing to a clear timeline for full restitution is generally viewed more favorably than one that waits for a final number before paying anything. Under SDNY’s self-reporting program, full restitution is foundational to declination eligibility, so a credible restitution plan is often the single most persuasive document counsel can put in front of the government.
Negotiating the scope of an ongoing monitor versus a lighter consultant arrangement, and how long reporting obligations last, is a real point of leverage. A firm with a strong remediation record and prompt restitution has a legitimate basis to argue for a shorter, narrower oversight period.
Regulatory risk differs by the type of crypto asset involved
Not every digital asset carries the same regulatory exposure, and treating a governance token the same way as a payment-focused coin is a common mistake. A token distributed through a capital-raising event, with marketing that emphasizes price appreciation or investor returns, tends to draw securities-law scrutiny because it looks like an investment contract regardless of what the issuer calls it. A coin designed primarily as a medium of exchange, with no centralized promoter promising returns, tends to sit closer to commodity or currency treatment, though facts still control.
Derivatives and lending products built on top of either category introduce a separate layer of risk, since yield-bearing arrangements can trigger CFTC or SEC interest independent of how the underlying asset is classified. Stablecoins pegged to fiat currency raise their own set of money transmission and reserve-backing questions that sit closer to FinCEN’s and state regulators’ territory than to securities law.
This matters in negotiation because the asset’s classification shapes which regulator has the strongest claim to jurisdiction and what remedies are realistically on the table. A firm that has already mapped its token or product against these categories, before a regulator asks, walks into a negotiation with a defensible position rather than a reactive one. Counsel experienced in novel crypto classification questions can shape that argument early, which is often the difference between a negotiation grounded in the facts and one that gets stuck arguing definitions.
Building regulatory trust that goes beyond baseline compliance
Meeting the minimum requirements keeps a firm out of trouble on paper. Building actual trust with a regulator is a different, longer project, and it pays off disproportionately when something eventually does go wrong.
Firms that engage with regulators before there is a problem, through routine exam participation, voluntary briefings on new products, or transparent responses to informal inquiries, build a track record that staff remember. That history matters later, because an agency that has seen a firm handle smaller issues honestly is more inclined to extend the benefit of the doubt on a bigger one.
Consistency matters as much as any single gesture. A firm that answers every regulator request the same way, promptly and completely, builds a reputation that outlasts any one examiner or case team. A firm that stonewalls on small requests and only engages fully once litigation looms builds the opposite reputation, and that reputation travels across agencies faster than most companies expect.
Transparency about limitations also builds credibility. Telling a regulator directly that a system cannot produce a report in the requested format, while proposing a workable alternative, reads as honest. Promising something the firm cannot deliver, then missing the deadline, reads as either incompetent or evasive, neither of which helps in a later negotiation.
Preparing for regulatory audits and inquiries beyond the first letter
An initial inquiry letter or exam notice is rarely the end of the process. Regulators frequently follow up with supplemental requests once they have reviewed the first production, and how a firm handles that second and third round often matters more than the first.
Treat every regulatory relationship as ongoing rather than transactional. Keep the same point of contact in place for the life of the inquiry, maintain a running log of everything produced and every representation made, and update that log every time new information surfaces that might affect an earlier answer. Inconsistency between an early answer and a later one, even an innocent one, is one of the fastest ways to lose credibility with examiners.
Build internal readiness before the next request arrives rather than after. That means keeping transaction records, compliance training logs, and board minutes organized and retrievable on short notice, since a firm that takes weeks to produce routine records looks disorganized even when nothing is actually wrong. Routine FinCEN examinations, SEC sweeps, and CFTC inquiries often arrive with tight production windows, and counsel who has already mapped where records live can meet those windows without scrambling.
Where an inquiry expands into new territory, such as a routine exam uncovering a potential AML gap, treat that expansion as its own decision point: does it change the self-reporting calculus, and does it require pulling in a different set of specialists. Firms that reassess at each stage, rather than running on the assumptions from day one, negotiate from a stronger position throughout.
Staying current as crypto regulatory frameworks keep shifting
Crypto regulation in the United States is not static, and a compliance program built two years ago may already have gaps relative to current agency expectations. Firms that treat compliance as a one-time build, rather than an ongoing practice, are the ones that get caught flat when a rule or enforcement priority shifts.
Ongoing monitoring means more than running the same AML checks on a schedule. It means assigning someone, internally or through outside counsel, to track SEC, CFTC, and FinCEN guidance updates and translate them into concrete changes to policy and training. It also means revisiting the independent program review on a regular cadence rather than treating the first review as a one-time checkbox.
Firms that build this habit early tend to negotiate from a position of credibility when an issue does arise, because they can show a documented history of adapting, not just a single static policy binder. That history is exactly the kind of self-policing evidence the SEC’s Five Principles reward. Businesses rebuilding or formalizing this function should see our guide on compliance officer responsibilities for what an effective ongoing monitoring role looks like in practice.
Non-monetary consequences and protecting the firm’s reputation
Penalties and disgorgement get the headlines, but non-monetary consequences often do more lasting damage. An injunction barring certain business activities, a bar on individuals serving as officers or directors, or a required public admission of wrongdoing can reshape a company’s operations long after a check clears.
Reputational harm compounds these effects. Exchange partners, banking relationships, and institutional customers often react to a regulatory action faster than the legal process itself resolves, and a firm that has not prepared a factual, measured public response is left reacting in real time while the narrative is set by others.
Mitigating this starts with the same remediation work that helps the legal negotiation: a credible, documented fix communicated clearly, rather than a defensive statement that reads as minimizing the problem. Firms that get ahead of the story with a factual account of what went wrong and what changed tend to retain more of their banking and partner relationships than those that go silent and let speculation fill the gap. This is also where restitution matters twice: it helps the legal outcome and it gives the firm something concrete and true to say publicly.
What successful negotiations tend to have in common
The pattern across resolved crypto enforcement matters is consistent even when the facts differ. Firms that come out with declinations or reduced penalties generally did three things early: they retained counsel before the first substantive response went out, they disclosed a known problem before the regulator found it independently, and they paired that disclosure with a remediation and restitution plan that was ready to execute, not just promised.
The tactics that drive those outcomes are specific. Reverse proffers let counsel preview the strongest facts to staff before a formal interview, shaping the narrative early. Structured restitution proposals, timed to the regulator’s own program requirements under SDNY’s self-reporting framework or the CFTC’s advisory, give staff something concrete to recommend up their own chain. Coordinated engagement across multiple agencies, when more than one has jurisdiction, prevents one agency’s demands from contradicting another’s and keeps the firm from negotiating the same facts twice under different theories.
What separates a declination from a contested enforcement action is rarely the severity of the original conduct. It is whether the firm’s response, in the days and weeks immediately after discovery, gave the government a reason to trust the account it was given.
Why early, litigation-tested counsel changes negotiation outcomes
Counsel’s first job in a regulatory matter is protecting privilege while still enabling the disclosure that earns cooperation credit, and that balance is harder to strike than it sounds. A reverse proffer, a carefully scoped document summary, or a controlled witness interview can move a negotiation forward without handing the government a roadmap built on privileged analysis. Structuring restitution proposals around the actual timelines regulators have published, rather than a generic settlement template, signals seriousness rather than stalling.
Coordinating engagement across the SEC, CFTC, and FinCEN when more than one agency has an interest in the same facts takes litigation judgment, not just familiarity with the regulations. Liam Murphy has litigated against crypto industry players in matters involving Celsius, Terraform Labs, and BitMEX, and that courtroom experience shapes the approach to enforcement negotiations: the same preparation that wins a contested motion is what makes a cooperation pitch credible.
The firms that negotiate well are the ones that walk in with a plan the government can act on, not just an apology.
— Mark
How Murphy’s Law helps with enforcement response and remediation
Murphy’s Law represents crypto businesses and individuals facing SEC, CFTC, DOJ, and FinCEN inquiries, handling regulatory enforcement defense, crypto compliance consulting, white-collar criminal defense, and remediation planning alongside its litigation practice in crypto fraud recovery and digital asset disputes.
An initial engagement typically focuses on three near-term goals: preserving privilege while the facts are still being gathered, building a self-reporting strategy suited to the specific regulator involved, and setting a realistic remediation timetable the firm can actually meet. Those three pieces, done early, are what give a firm something real to bring to the negotiating table instead of a reactive apology. If your business has been contacted by a regulator or is bracing for an inquiry, visit Murphy’s Law to discuss your situation and next steps.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
What is SEC cooperation credit and how is it earned?
Cooperation credit is the reduction in charges or penalties the SEC may recommend when a company or individual self-polices, self-reports, remediates, cooperates, and collaborates with staff. It is earned through documented behavior, not a single statement of good faith, and staff weigh timeliness heavily when deciding how much credit to apply.
When should a crypto business self-report to regulators?
A business should generally self-report as soon as it has a good-faith understanding of the problem, even if the facts are not fully developed, because early partial disclosure is viewed more favorably than complete disclosure made after the regulator already knows. Waiting to deliver a polished, complete account typically costs more credit than it gains.
What does the DOJ’s Corporate Enforcement Policy require for a declination?
The Criminal Division’s Corporate Enforcement and Voluntary Self-Disclosure Policy sets out four core requirements: voluntary self-disclosure, full cooperation, timely and appropriate remediation, and the absence of aggravating factors. Meeting all four can result in a declination or a substantial reduction in penalties.
What AML program failures most often trigger FinCEN enforcement in crypto?
The most common failures involve missing or outdated written controls, no designated compliance officer, insufficient employee training, and late or absent Suspicious Activity Reports. FinCEN’s guidance treats these as baseline program elements, and gaps in any of them are a frequent basis for consent orders.
Does Murphy’s Law handle both regulatory defense and fraud recovery matters?
Yes, Murphy’s Law represents businesses facing regulatory inquiries and enforcement actions through its compliance consulting and regulatory defense services, while also litigating fraud recovery matters on behalf of victims through its crypto fraud recovery litigation practice.
Sources
- The Five Principles of Effective Cooperation in SEC Investigations — Remarks
- Enforcement Advisory: Advisory on Self-Reporting, Cooperation, and Remediation (CFTC)
- Corporate Self-Reporting and Cooperation Program (SDNY)
- FinCEN guidance on convertible virtual currency and AML requirements
Official advisories and programs to read next
Readers who want to go directly to the primary materials behind this guide can start with the SEC’s remarks on the Five Principles of Effective Cooperation and its companion page on the benefits of cooperation with the Division of Enforcement. The CFTC’s Enforcement Advisory on self-reporting and remediation and SDNY’s Corporate Self-Reporting and Cooperation Program lay out the clearest paths to declination currently available. FinCEN’s guidance on convertible virtual currency remains the baseline for AML program design.