Weekly Review: August 6 – August 12, 2026This Week's Updates
United States | Does Writing DeFi Code Count as a Crime? A Retrial Will Decide
The most important yet often overlooked crypto case is United States v. Roman Storm—he is the developer of a privacy tool Tornado Cashthe developers.In 2025, a jury found him guilty of operating an unlicensed money-transmitting business, but failed to reach a verdict on the more serious charges of money laundering and sanctions violations. The Department of Justice is now pushing for a retrial on those two charges, with trial expected around October 2026, and the two charges combined could add up to a maximum of 40 more years of imprisonment. The core question—whether developers should bear criminal liability for others' misuse of their code—will determine "what can be done" in the DeFi and privacy fields. See "Focus Case" below for details.
United States | Stablecoin "Rewards" Model Faces Being Cut—Circle and Coinbase Hit First
The detailed rules implementing the GENIUS Act (the U.S. stablecoin law) are taking shape, and they are stricter than the industry expected. The banking regulator (OCC) has proposed a complete framework requiring weekly and quarterly reports; the Treasury Department's financial crimes unit (FinCEN/OFAC) has also proposed rules on anti-money laundering. The point that hits business hardest is: restrictions on stablecoin "rewards/interest rebates"—this is precisely the revenue-sharing that underpins the Circle–Coinbase partnership and a major source of Coinbase's revenue. If you make money by "paying users to hold stablecoins," this model is now at risk.
United States | SEC Decides to Write Crypto Rules Itself (August 14)
With Congress in deadlock, the SEC is scheduled to vote on August 14 on its own rulebook, "Regulation Crypto." The proposal offers three paths to "raise funds without full registration": a startup path of about $5 million; a path of up to $75 million requiring audits and periodic reporting; and a "safe harbor" for genuinely decentralized tokens. This is a shift from "making rules through litigation" to "writing the rules down"—but nothing is settled until the vote and public comment period are completed.
United States | CLARITY Act Delayed to September
This bill, which would divide regulatory authority between the SEC and the CFTC, missed the vote before recess; the Senate's first substantive vote is now scheduled for September 15. Points of contention include: an ethics provision barring senior officials (including the President) from engaging in crypto business, and whether stablecoin rewards can be retained. Betting markets put the probability of passage in 2026 at about one-third. A notable new development: on August 5, the SEC also established a new enforcement team focused on accounting and financial reporting fraud—though not crypto-specific, it signals that financial reports of listed crypto companies will face stricter scrutiny.
China / Hong Kong / Europe | A brief overview of the rest of the landscape
China maintains a hard line — private crypto is banned, and the prohibition now extends to RMB-pegged stablecoins and tokenized assets, both onshore and offshore. Hong Kong has taken the opposite route: establishing a licensed market, with the first bank-backed stablecoin issuers (HSBC, and a joint venture led by Standard Chartered) expected to launch in the second half of 2026. In Europe, MiCA's transitional period has ended — a licence is mandatory to serve EU clients, failing which operations must cease (fines of up to 12.5% of annual turnover).
Focus case: United States v. Roman Storm (Tornado Cash)
One case worth reading closely this week — it will test whether writing and publishing crypto code can itself constitute a crime.
The short version.
Roman Storm, the developer of the Tornado Cash privacy tool, is about to stand trial again. The case may determine whether writing and publishing open-source code can land you in prison because of how strangers later use it.
What happened.
In 2025, a New York jury found Storm guilty of operating an unlicensed money-transmitting business, but failed to reach a verdict on the two most serious charges — money laundering conspiracy and violation of US sanctions. In March 2026, the Department of Justice sought a retrial on those two counts; the retrial is expected around October 2026 and could add up to 40 years in prison.
Why it matters.
Tornado Cash is "autonomous" software — once deployed, the developers cannot control who uses it. Prosecutors allege that Storm knowingly helped launder criminal funds (including for a state-backed hacking group). The defence argues the case is "a terrifying criminalisation of privacy, and of writing code." The verdict will draw the boundaries for DeFi and privacy developers worldwide.
What it means for developers.
If "publishing immutable code that others then misuse" can constitute a crime, then every DeFi, mixer and privacy team faces personal criminal risk — and may be forced to adopt controls (sanctions screening, front-end restrictions) they once regarded as "contrary to decentralisation."
Conclusion.
Do not assume that “I merely wrote code” constitutes a complete defense. Keep records of your compliance intent, conduct screening to the extent feasible, and consult a lawyer before launching tools that enable anonymous transfer of value.
Regulatory Radar — Web3
Shadow conduct added this week; no shadow conduct in ongoing tracking items.
Date: approximately October (retrial) | Region: United States
Event: United States v. Roman Storm (Tornado Cash) — Department of Justice seeks retrial
Status: New — ongoing
What this means for companies: Tests whether “writing DeFi/privacy code is a crime”; criminal risk for developers
Date: ongoing | Region: United States
Event: GENIUS detailed rules threaten stablecoin "rewards" (OCC framework; FinCEN/OFAC anti-money laundering)
Status: New — in progress
What it means for companies: Revenue-sharing (Circle–Coinbase) is under threat; weekly/monthly and quarterly reporting required
Date: August 5 | Region: United States
Event: SEC establishes new accounting/financial reporting fraud enforcement team
Status: New
What it means for companies: Financial reporting by listed crypto companies will face stricter scrutiny
Date: August 14 | Region: United States
Event: SEC votes on its own rulebook ("Regulation Crypto")
Status: Pending vote
What it means for companies: Near-term rules may come from regulators rather than Congress
Date: September 15 | Region: United States
Event: CLARITY Act — first Senate vote
Status: Bill — Postponed
What it means for companies: No new market-structure law before autumn
Date: July 18 | Region: United States
Event: The final GENIUS stablecoin implementing rules remain incomplete
Status: Overdue
What it means for companies: Prepare according to the draft standards: full reserves, monthly audits, and no interest payments
Date: Already in effect | Region: China
Event: Prohibition expanded to RMB stablecoins + tokenized assets
Status: In effect
What it means for companies: Do not issue RMB-pegged stablecoins, including offshore
Date: Second half of 2026 | Region: Hong Kong
Event: First batch of bank-backed stablecoins (HSBC and Standard Chartered joint venture)
Status: Under monitoring
What it means for companies: Licensed pathway — contrary to the mainland prohibition
Date: July 1 | Region: European Union
Event: End of the MiCA transition period
Status: In force
What this means for companies: A license is mandatory to serve EU clients; otherwise operations must cease
Attorney Joanna's Observations
For years, the core question in the U.S. crypto space has been "does this token count as a security?" This week, however, the contest shifted in a direction that is more "person-focused" and more dangerous for developers.The Tornado Cash retrial asks: can people who write crypto code be imprisoned for how others use it? The GENIUS stablecoin rules ask: can the business models that actually make crypto profitable (such as paying yield to users) survive? Add to that the SEC writing rules on its own due to congressional deadlock—and the main thread is clear: the focus is shifting from "what can be sold" to "who is responsible for building it, and which business models are permitted to exist."
Two practical lessons follow. First, personal and criminal risk now falls on developers and executives, not just companies. Second, do not build a business on a feature that regulators are trying to "shut down"—whether anonymity or yield.
— Joanna's Observations
A Brief Guide to Compliance Action for Web3 / Crypto Companies
If you work on DeFi, privacy or mixing tools, take the Tornado Cash case as a warning: "I just wrote code" may not protect you.Keep records of compliance intent, add sanctions screening where you can (at least at the front end), and consult a lawyer before launching tools that enable anonymous transfer of value. If your business relies on stablecoin yields or rewards, be prepared for that model to be restricted—both the GENIUS detailed rules and the CLARITY dispute are watching it. In the United States, you should generally design tokens and fundraising to fit the SEC's forthcoming "Regulation Crypto," and remember: rules set by regulators may also be overturned. For China, treat RMB-pegged stablecoins and tokenized assets as prohibited zones, both onshore and offshore. For Hong Kong, confirm whether issuing, trading or holding stablecoins requires a license. For Europe, confirm your MiCA license—the transition period has ended.
AI Compliance | Web3 and Digital Assets | Legal support for technology companies going global.
This brief is for general information only and does not constitute legal advice. If you need AI legal governance or Web3 and digital asset compliance support, please contact our lawyers.
English Edition
Web3 & Digital Assets Regulation Weekly
Compliance notes for cross-border fintech companies going global
Week in Review: August 6 – August 12, 2026
This Week's Developments
United States | Is writing DeFi code a crime? A retrial will test it
The most important crypto case you may not be tracking is U.S.v. Roman Storm, a developer of the privacy tool Tornado Cash. A jury convicted him in 2025 of running an unlicensed money-transmitting business, but deadlocked on the more serious money-laundering and sanctions charges. The Justice Department is now pushing to retry those counts, expected to start around October 2026, with up to 40 more years at stake. The core question — can a developer be criminally liable for code others misuse? — will shape what's legal to build in DeFi and privacy. See the Case in Focus below.
United States | Stablecoin “rewards” under threat — Circle and Coinbase in the crosshairs
The rules to implement the GENIUS Act (the U.S. stablecoin law) are taking shape, and they're stricter than issuers hoped. The bank regulator (OCC) proposed a full framework with weekly and quarterly reporting, and Treasury's financial-crime units (FinCEN/OFAC) proposed anti-money-laundering rules. The biggest business threat: limits on stablecoin “rewards” — the yield-sharing that powers the Circle–Coinbase partnership and a major Coinbase revenue source. If you earn by paying users to hold a stablecoin, that model is now at risk.
United States | The SEC decides to write crypto rules itself (Aug 14)
With Congress stalled, the SEC set an August 14 vote to launch its own rulebook, “Regulation Crypto.” It offers three ways to raise money without full registration: a ~$5M startup path, a ~$75M path with audits and regular reporting, and a “safe harbor” for genuinely decentralized tokens. It's a shift from “rules by lawsuit” to “rules written down” — but nothing is final until the vote and the public-comment period.
United States | The CLARITY Act slips to September
The bill that would split oversight between the SEC and CFTC missed its pre-recess vote; the first real Senate vote is now September 15. Sticking points include an ethics rule barring senior officials — including the President — from crypto ties, and whether stablecoin rewards survive. Betting markets put 2026 passage at about one in three. A new detail worth noting: on August 5 the SEC also created a specialized unit targeting accounting and financial-reporting fraud — not crypto-specific, but a sign that public crypto companies' financial statements will get sharper scrutiny.
China / Hong Kong / Europe | The rest of the map, in brief
China holds its hard line — private crypto is banned, and the ban now covers yuan-linked stablecoins and tokenized assets, onshore and offshore. Hong Kong is building the opposite: a licensed market, with the first bank-backed stablecoin issuers (an HSBC and a Standard Chartered–led venture) expected in late 2026. And in Europe, the MiCA grace period is over — serve EU customers only with a licence, or stop (fines reach 12.5% of yearly turnover).
Case in Focus: U.S. v. Roman Storm (Tornado Cash)
This week's case worth reading closely — the test of whether writing and publishing crypto code can itself be a crime.
The short version.
Roman Storm, a developer of the crypto-privacy tool Tornado Cash, is heading back toward trial in a case that could decide whether writing and releasing open-source code can put you in prison for how strangers later use it.
What happened.
In 2025 a New York jury convicted Storm of running an unlicensed money-transmitting business, but couldn't agree on the two most serious charges — money-laundering conspiracy and violating U.S. sanctions. In March 2026 the Justice Department asked to retry those counts; a retrial is expected around October 2026, with up to 40 additional years of exposure.
Why it matters.
Tornado Cash is “autonomous” software — once deployed, its developers can't control who uses it. Prosecutors say Storm knowingly helped launder criminal funds (including for a state-backed hacking group). The defense calls the case a “terrifying criminalization of privacy” and of writing code. The verdict will set the boundary for DeFi and privacy developers everywhere.
The stakes for builders.
If publishing immutable code that others misuse can be a crime, every DeFi, mixer, and privacy team faces personal criminal exposure — and may need to build in controls (sanctions screening, front-end restrictions) they once saw as the opposite of decentralization.
Bottom line.
Assume “I just wrote the code” is not a complete defense. Document your compliance intent, screen where you can, and get legal advice before launching tools that move value anonymously.
Regulatory Radar — Web3
Shaded rows are new this week; unshaded rows are kept for tracking.
Date: ~Oct (retrial) | Region: U.S.
Development: U.S. v. Roman Storm (Tornado Cash) — DOJ seeks retrial
Status: NEW — active
What it means for companies: Tests whether writing DeFi/privacy code is a crime; developer criminal liability
Date: Ongoing | Region: U.S.
Development: GENIUS rules threaten stablecoin “rewards” (OCC framework; FinCEN/OFAC AML)
Status: NEW — active
What it means for companies: Yield-sharing (Circle–Coinbase) at risk; weekly/quarterly reporting
Date: Aug 5 | Region: U.S.
Development: SEC creates accounting / financial-reporting fraud unit
Status: NEW
What it means for companies: Sharper scrutiny of public crypto companies' financials
Date: Aug 14 | Region: U.S.
Development: SEC votes on its own rulebook (“Regulation Crypto”)
Status: Vote due
What it means for companies: Near-term rules may come from the regulator, not Congress
Date: Sep 15 | Region: U.S.
Development: CLARITY Act — first Senate vote
Status: Bill — delayed
What it means for companies: No new market-structure law before the fall
Date: Jul 18 | Region: U.S.
Development: GENIUS stablecoin final rules still unfinished
Status: Missed
What it means for companies: Plan against the draft: full backing, monthly audits, no interest
Date: In force | Region: China
Development: Ban extended to yuan stablecoins + tokenized assets
Status: In force
What it means for companies: Don't issue yuan-linked stablecoins, even offshore
Date: H2 2026 | Region: Hong Kong
Development: First bank-backed stablecoins (HSBC, StanChart venture)
Status: Ongoing
What it means for companies: A licensed path — the opposite of the mainland ban
Date: Jul 1 | Region: EU
Development: MiCA grace period over for crypto firms
Status: In force
What it means for companies: Serve EU customers only with a licence, or stop
Joanna Lawyer's Observation
For years, the defining U.S.crypto question was “is this token a security?” This week the fight moved somewhere more personal — and more dangerous for builders. The Tornado Cash retrial asks whether the people who write crypto code can go to prison for how others use it. The GENIUS stablecoin rules ask whether the business models that make crypto profitable — like paying users yield — can even survive. Add the SEC writing its own rulebook because Congress stalled, and the through-line is clear: the action has shifted from “what is legal to sell” to “who is liable for building it, and which business models are allowed to exist.”
Two practical lessons follow. First, personal and criminal exposure now sits on developers and executives, not just on companies. Second, don't build a business on a feature — anonymity, or yield — that regulators are actively trying to switch off.
— Joanna's Observation
Compliance Actions for Web3 / Crypto Companies
If you build DeFi, privacy, or mixing tools, treat the Tornado Cash case as a warning: “I only wrote the code” may not shield you.Document your compliance intent, add sanctions screening where you can (at least at the front end), and get legal advice before shipping tools that move value anonymously. If your business relies on stablecoin yield or rewards, plan for that model to be restricted — the GENIUS rules and the CLARITY fight both target it. In the U.S. generally, design your token and fundraising to fit the SEC's coming “Regulation Crypto,” and remember rules made by a regulator can be undone. For China, treat yuan-linked stablecoins and tokenized assets as off-limits, onshore and offshore. For Hong Kong, check whether issuing, trading or holding stablecoins needs a licence. For Europe, confirm your MiCA licence — the grace period is over.
Watch Next Week
The CLARITY Act's September 15 Senate vote and the reaction to the SEC's August 14 “Regulation Crypto” vote; scheduling and pretrial motions in the Tornado Cash retrial; and the comment periods on the GENIUS stablecoin rules — especially the limits on “rewards.”
AI compliance | Web3 & digital assets | Legal support for technology companies going global.
This briefing is for general information only and is not legal advice. If you are seeking AI legal governance or Web3 & digital-assets compliance, please reach out to our lawyers.
/ END.
*This article is an original article of Mankun Law Firm and represents only the personal views of the author. It does not constitute legal consultation or legal advice on any specific matter. For reprinting and legal consultation, please add our customer service: mankunlawyer.
About the Lawyer
