United States: technology regulation at a glance

Framework: Patchwork of federal laws and regulators: GENIUS Act (P.L. 119-27, July 18, 2025) for payment stablecoins; SEC/CFTC under existing securities & commodities laws (with joint March 17, 2026 interpretation); FinCEN under the Bank Secrecy Act (MSB regime); IRS for tax; state money-transmitter regimes (e.g., NY BitLicense). The comprehensive Digital Asset Market Clarity (CLARITY) Act passed the House in July 2025 and cleared Senate Banking Committee on May 14, 2026 but is awaiting a Senate floor vote.

Crypto is legal in the United States and is actively used, but federal regulation is in transition. The GENIUS Act created the first comprehensive federal regime for payment stablecoins in July 2025; broader market-structure legislation (CLARITY Act) has cleared the House and Senate Banking Committee but is not yet enacted. In the interim, exchanges and intermediaries operate under a patchwork of SEC/CFTC, FinCEN BSA, IRS, and state licensing rules, with the Atkins-led SEC having pulled back significantly from 'regulation by enforcement.'

Framework: No comprehensive federal AI law; sector-specific rules enforced by existing agencies (FTC, FCC, sector regulators), supplemented by Executive Orders and a March 2026 White House National Policy Framework with legislative recommendations to Congress

The United States has no enacted comprehensive federal AI law as of May 2026. Governance relies on sector-specific statutes, existing agency authority (FTC, FCC, sector regulators), and two major Trump Administration Executive Orders (January and December 2025) that seek to centralise AI policy and pre-empt conflicting state laws. In March 2026 the White House released formal legislative recommendations to Congress for a uniform national AI framework, but no such bill has been enacted.

Framework: Patchwork of federal sector-specific laws (HIPAA, GLBA, COPPA, FERPA, FCRA) enforced by the FTC and sector regulators, plus 20+ state comprehensive privacy laws led by California's CCPA/CPRA. No omnibus federal law is in force as of May 2026.

The United States has no single comprehensive federal data-protection statute equivalent to the EU GDPR. At the federal level, protection derives from sector-specific statutes and FTC Section 5 unfair-practices authority. In the absence of federal action, at least 20 states have enacted comprehensive consumer privacy laws, with new ones (Indiana, Kentucky, Rhode Island) taking effect January 1, 2026. A new federal bill, the SECURE Data Act, was introduced in the House in April 2026 but remains in early legislative stages.

Framework: State-level Money Transmitter Licenses (MTLs) + Federal FinCEN MSB Registration; OCC national/special-purpose bank charters; Bank Secrecy Act (BSA); Dodd-Frank Act §1033 (open banking, under revision)

The United States operates a mature but highly fragmented payments licensing regime: digital payment firms must obtain state-level Money Transmitter Licenses in up to 49 jurisdictions and register federally with FinCEN as Money Services Businesses. There is no single federal payment institution or e-money license analogous to the EU's EMI framework; however, OCC special-purpose national trust bank charters are increasingly available to fintechs. As of mid-2026, a May 2026 Executive Order is accelerating federal regulatory reform to further integrate fintechs into banking and payment infrastructure.

Framework: Immigration and Nationality Act (INA), administered by USCIS and the Department of State; no remote-work/digital-nomad visa category exists

The United States does not offer a dedicated digital-nomad or remote-work visa, and no general route lets a foreign national reside in the U.S. while working remotely. Visitor status (B-1/B-2) does not authorize work performed on U.S. soil, even remote work for a foreign employer is treated as unauthorized employment. Long-term residence requires qualifying under employer-sponsored work visas, investment routes (EB-5), family-based categories, or the new fee-based 'Gold Card' green card.

Framework: Patchwork of federal statutes (TAKE IT DOWN Act 2025, COPPA/FTC Rule, CDA Section 230) plus rapidly expanding state-level age-verification and children's design codes; no single comprehensive online safety statute equivalent to the EU DSA or UK OSA

The United States relies on a fragmented set of targeted federal laws and state legislation rather than a unified online safety regime. The TAKE IT DOWN Act (signed May 19, 2025) is the most significant recent federal enactment, criminalising non-consensual intimate imagery and mandating 48-hour platform takedowns; amended COPPA rules (effective June 2025) tighten children's data protections. Section 230 platform immunity remains largely intact but faces intense legislative pressure, while the Kids Online Safety Act (KOSA) was reintroduced in 2025 and remains pending.

Framework: Sector-specific rules (SEC, FTC, HIPAA) plus CISA as lead civilian cyber agency; CIRCIA (2022) cross-sector incident-reporting rule pending final adoption

The United States does not have a single comprehensive federal cybersecurity law. Obligations are imposed through a patchwork of sector-specific regulations, covering public companies (SEC), non-bank financial institutions (FTC Safeguards Rule), healthcare (HIPAA Security Rule), and critical infrastructure, alongside voluntary NIST standards referenced in federal procurement. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA, 2022) will create the closest analog to a cross-sector mandatory reporting regime once CISA issues its final rule, now anticipated after May 2026 due to appropriations-related delays.

Framework: State-level business formation statutes (e.g., Delaware General Corporation Law, state LLC Acts); federal oversight via IRS (EIN issuance), SBA (loan programs), and CFIUS/FIRRMA (foreign investment review in sensitive sectors)

The United States imposes no general prohibition on foreign nationals forming an LLC or corporation, and most states allow non-citizens as members or shareholders with no minimum capital requirement. However, as of March 2026 the SBA has banned foreign nationals from all SBA-guaranteed loan programs (7(a), 504, Microloans, Surety Bond), significantly limiting government-backed financing access. Formation itself follows a well-documented multi-step federal and state process typically completable in days to weeks.