The End of Crypto and Security Law

The SEC published more than 400 pages this week on how a crypto token can stop being a security. It has yet to spend one on how a security becomes a token.

Tuesday's proposal, Regulation Crypto Assets, allows early-stage projects to raise up to $5 million over four years without registering; allows larger projects to raise up to $75 million a year with audited accounts; creates a formal route for a project to declare that its token has outgrown SEC oversight; and overrides state registration rules. The public comment and feedback period runs for the next sixty days. It’s the first crypto-specific offering regime in the agency's ninety-year history, and it represents a regulatory effort that has finally arrived through proper public rulemaking rather than a staff letter. The federal rulemaking process is the slower route, but one that survives a court challenge.

Within it lies Footnote 11, which explains why crypto received a regime of its own. In the words of the commission, conventional instruments do not change nature over time, so a stock or a bond sits permanently inside the securities laws or outside them, while crypto tokens have the ability to move between the two. Footnote 19 then states there are other securities involving crypto, such as digital securities, which are not expected to evolve that way and may be better served by ordinary registration, thus it is not proposing to amend the rules and points to those forms governing existing securities to accommodate them. So we now find ourselves in a position where crypto-native tokens get tailored disclosure, two exemptions and a safe harbor, while tokenized securities are pointed at forms designed for corporate equity and told the existing framework will do.

The agency built a framework for assets capable of escaping its jurisdiction, acknowledged that tokenized securities never will, and confirmed it is proposing nothing for them, all in a footnote on page eleven. Citi Bank projects the tokenized asset market at $5.5 trillion by 2030. 

The exit you grant yourself

On the SEC's own reading, a crypto token is usually not a security by itself. It gets pulled into securities law by the way it is sold: when a team raises money promising to build a network, that arrangement is an investment contract, and the investment contract is the security. The token rides along, and so does every resale afterward, because the contract transfers to each new buyer until something severs the link.

Critically, the safe harbor severs it. A team that has delivered or permanently abandoned everything it promised simply files a short report with the Commission certifying as much and explaining why, and if the certification holds, the token trades from that point on as an ordinary non-security. Chairman Paul Atkins acknowledged the result which is that the asset would be no longer subject to the authority of the Commission. An escape hatch opens.  

The limits of this proposal got very little attention in the mainstream financial press. As part of the rule, nobody at the SEC signs off, since there is no decentralization test to pass and no staff review, so a project certifies its own exit and the agency simply receives the filing. However, because that filing is not technically an approval, the SEC reserves its right to revisit the short report later, conclude the promises were never actually finished, and treat the token as having been sold as a security the whole time. The relief also only works going forward, so every sale made before the filing stays exposed to the registration claims that most crypto enforcement has been built on. And the proposed rule binds the SEC alone, which leaves a private plaintiff or a state attorney general free to sue on the theory that the token is a security regardless of what the Commission accepted.

The shorthand of it all is that as of this week, tokens are finally graduating out of (only) securities law. 

Three provisions worth reading closely

There are three required provisions which some might consider obvious in order to take advantage of the provisions provided by the new rule. The first being that to use the larger exemption, a project must be organized in the United States and run principally from here, which rules out the offshore foundations that have structured essentially every major token launch for the last six years. 

The second provision require issuers to describe what they promised to build and how far along they are. That description becomes the yardstick for whether the escape hatch ever opens, so an ambitious offering document doubles as a longer sentence while a vague one raises less money. The incentive here becomes for initial investors to push for a limited disclosure. 

The third provision governs who is allowed to buy and is an interesting change from the long-standing rules on “accredited investors” that have been the spite of many a retail investor. Now, an investor who is not accredited may invest up to 10 percent of the greater of their annual income or net worth.

The smaller exemption, meanwhile, is the most permissive the agency has proposed: no wealth test, no cap per investor, no lockup, all with advertising allowed. A survey in the footnotes complicates that. Broadridge polled two thousand crypto investors, found they ranked conventional disclosure highest and token economics last, then concluded the respondents were unaware of what mattered.

Two doors

None of the 400 pages reaches tokenized securities, and the Commission says outright that it has not addressed where they would trade or whether the platforms handling them must register as exchanges or brokers. So, the question of who gets to run those markets is still open, and it is worth seeing how it has been answered so far.

Almost every American share sits at a single institution, The Depository Trust and Clearing Company, which keeps the ownership record, covering more than $114 trillion in securities. Last December, SEC staff sent DTC a no-action letter, saying they will not recommend action against them for their intent to tokenize large-cap stocks, major index funds and Treasuries.

In doing so they provided the DTCC two waivers. The first switches off the rules requiring critical market infrastructure to run tested, resilient systems, which were written after a run of technology failures in the early 2010s. The second switches off the requirement that a clearinghouse file its proposed rule changes publicly, which is how rival firms normally learn what is coming and get to object. DTCC ran live tokenized securities trades on July 15 and opens this functionality commercially in October.

Everyone else has been waiting on a separate initiative, the innovation exemption, which would give firms other than DTCC a route to issue and trade tokenized securities. It was delayed again on August 13 and was absent from Tuesday's release. CoinDesk reported that the White House worried about complicating the legislation moving through Congress, and that SIFMA, the trade association for the large banks and brokers, was among the groups holding it up, having argued in a June letter that changes of this size belong in an open process with public notice and comment. 

September 15

On August 8, Senate Majority Leader John Thune set up a procedural vote on the Digital Asset Market Clarity Act for September 15, the day after the Senate returns. Clearing it takes 60 votes and Republicans hold 53 seats, so at least seven Democrats must cross, with the fights over ethics, illicit finance and stablecoin yield unresolved. Galaxy Research has cut its odds of passage this year from 50 percent to 30, and after September roughly fourteen working days remain before the election recess.

If that vote fails, the agency is left with exemptions and staff letters as its only instruments for everything this week's proposal did not touch, which happens to be the part of the market where the money is.

Sources: SEC Release Nos. 33-11434 and 34-106150 (File No. S7-2026-27), footnotes 11, 19 and 89 and proposed Rules 100, 103, 200, 300 and 400; statement of Chairman Atkins, August 18, 2026; Morrison Foerster client alert, August 19, 2026; Morgan Lewis LawFlash, January 9, 2026; CoinDesk, August 8, 13 and 18, 2026; SIFMA letter of June 30, 2026; Galaxy Research.