By Mehdi HassanWhat does crypto website compliance cover?
Crypto website compliance covers what you say, who you say it to and how prominently you warn people about risk. It's mostly a content and design problem, which is why it often falls between the legal team and the web team and gets done badly.
This checklist is written from the design side. It tells you which components to build, where they go and what your counsel needs to approve. It isn't legal advice: rules differ by jurisdiction, change often, and depend on what your product actually does. Use it to brief your lawyers and your designers at the same time. For the bigger picture on trust and structure, start with our guide to web3 website design.
Which regulations shape a crypto website?
The rules that most often shape a crypto website are the UK FCA's financial promotions regime, the EU's MiCA regulation and US securities law. Each touches the site differently, and your counsel will tell you which apply to your product and audience.
Jurisdiction | Main rules | What it changes on the site |
|---|---|---|
UK | FCA financial promotions regime for cryptoassets | Prescribed risk warnings, restrictions on who promotions reach, limits on incentives |
EU | MiCA (Markets in Crypto-Assets Regulation) | White paper rules; marketing must be fair, clear, not misleading and consistent with the white paper |
US | SEC, CFTC and state rules | Care with anything that looks like an investment offer, return claims and token sale language |
Elsewhere | Local licensing and advertising rules | Often a reason to geo-block until you have advice for that market |
If your company also touches traditional finance, many of the same patterns apply. Our guide to fintech website compliance covers disclosures and footer language for regulated money products.
Where should crypto risk warnings appear on a website?
Crypto risk warnings should appear wherever you promote the product, and they should be prominent, not hidden in a footer. The UK FCA in particular expects risk warnings to be clearly visible on promotions, and similar expectations apply in other markets. Design the warning once as a component, then decide where it's required.
Build a risk-warning component
A banner or block with fixed styling: readable size, sufficient contrast, not dismissible where rules require it to persist. It should never look like a cookie notice people learn to ignore.
Map every promotional surface
Home page, product pages, landing pages, emails, social cards and app store listings. Each one that promotes the product may need the warning.
Place it above the fold on promotions
For UK-facing promotions, the risk warning generally needs to be prominent on first view. Confirm the exact requirement with counsel.
Add the risk summary link
Some regimes require a link to a fuller risk summary. Build that page in the CMS so legal owns its content.
Repeat at the point of action
Show relevant risk language again near deposits, staking or trading, where the decision actually happens.
Designing a warning people actually read
Warnings fail when they look like boilerplate. Give the warning the same typographic care as your headline: a clear first sentence, short lines and plain words. Keep it visually distinct from marketing copy but part of the same design system, so it feels like the company speaking rather than a legal sticker.
Avoid tricks that undercut it, such as tiny grey text, a dismiss button that hides it for good, or placing it under an animated hero that pushes it below the fold on mobile. Regulators look at whether a warning is prominent in practice, not just present in the code.
How do you geo-block a crypto website properly?
Geo-blocking a crypto website properly means separating two questions: who may see your promotions, and who may use the product. Many teams block the app but leave promotional pages open to markets where those promotions aren't allowed, which defeats the point.
- Get a list from counsel of restricted jurisdictions for promotion and for product access. They are often different lists.
- Decide the behaviour for each: show a neutral information page, show the site without promotional content, or block entirely.
- Implement detection at the edge, using your host's geolocation headers, so it applies before the page renders.
- Add a self-declaration step where required, such as confirming residence or investor status, and log it.
- Keep the restricted page plain and honest: say the service isn't available in their region and avoid any marketing.
- Review the list on a schedule, because jurisdictions change their rules.
What should crypto disclaimers on a website say?
Crypto disclaimers on a website should say plainly what the product is, what it isn't, and what the user could lose. Generic text like "not financial advice" isn't enough on its own, and it can't fix a misleading headline above it. Counsel will draft the wording; your job is to make sure the site's claims don't contradict it.
- Product status. Whether the company is registered or licensed where it operates, and with whom. If it isn't, don't imply otherwise.
- No guarantee of returns. Any yield or reward figure is variable and may fall to zero. Say so next to the figure.
- Key risks. Smart contract risk, price volatility, liquidity risk and the lack of deposit protection schemes, in plain words.
- Token status. If there's a token, what it does and doesn't entitle holders to, reviewed carefully.
- Jurisdiction notice. Which regions the service isn't available in.
The biggest risk is the copy, not the footer. A hero that promises "earn high yield safely" creates exposure no disclaimer can undo. We write the claims and the disclaimers together so they don't fight each other.
What are the MiCA website requirements for marketing?
MiCA's website requirements for marketing focus on honesty and consistency. Marketing communications for crypto-assets in scope should be clearly identifiable as marketing, fair, clear and not misleading, and consistent with the published white paper. Where a white paper is required, the site will typically need to make it available.
For design, that means three things. Label marketing content as marketing where it's required. Give the white paper a stable, easy-to-find home on the site. And keep landing pages, ads and the white paper aligned, so a campaign page never says something the white paper doesn't. The official text is published on EUR-Lex, and your counsel should confirm how it applies to your token or service.
How should the CMS handle compliance content?
The CMS should let your legal team edit risk warnings, disclaimers and jurisdiction lists without touching the design or waiting for a deploy. Compliance text changes more often than most copy on a crypto site, and hard-coding it creates delays exactly when you need speed.
- Store each warning and disclosure as a single reusable entry, referenced everywhere it appears, so one edit updates every page.
- Give legal its own editing role with access to compliance entries only.
- Keep a version history so you can show what was live on a given date.
- Store region rules in configuration your team can review, not buried in code.
Our guide to CMS setup for marketing websites covers editing roles and structure. If your marketing site is a React app with poor SEO, see React SPA to SEO-friendly website, since compliance pages also need to be indexable and fast.
What does a crypto website compliance checklist look like before launch?
Before launch, run through every promotional surface with counsel and check that warnings, claims and access rules match. A single pass with a shared checklist catches most problems.
- Risk warning component built, prominent and present on every promotional page.
- Risk summary page live and owned by legal in the CMS.
- All return, yield and reward claims reviewed, with variability stated next to the figure.
- Restricted jurisdictions gated for both promotions and product access.
- White paper published and linked where required.
- Licensing or registration status stated accurately, or not implied.
- Accessibility checked, since warnings must be readable for everyone; see website accessibility for startups.
- Version history and sign-off recorded for the launch copy.
Once compliance is in place, the brand still has to carry trust. Our guides to web3 branding and DeFi UX design cover the identity and the in-app transaction states.
