SEC Regulation Crypto Assets: New Framework for Tokens

The SEC's proposed rulemaking on crypto asset securities — formally introduced under the Commission's broader digital asset initiative and building on the staff guidance released in early 2025 — sets a hard deadline for platforms and issuers to reassess every token they touch. The Commission's April 2025 Staff Bulletin on crypto asset investment contracts clarified that the Howey analysis applies token-by-token, not category-by-category. If your legal team hasn't mapped your token portfolio against the new analytical framework, the clock is already running.

TL;DR

• The SEC's proposed framework applies a fact-specific, asset-by-asset Howey analysis to crypto tokens — no blanket exemptions for "utility" or "governance" labels.
• Platforms facilitating trading of tokens that qualify as securities must register as national securities exchanges, broker-dealers, or alternative trading systems (ATS).
• Issuers conducting token sales that meet investment contract criteria face full Securities Act registration requirements or must fit a recognized exemption (Reg D, Reg A+, Reg S).
• The framework introduces a new "crypto asset security" defined term, distinct from commodity-based digital assets, creating a cleaner but narrower safe harbor.
• Enforcement isn't waiting for final rules — the SEC has brought over 100 crypto enforcement actions since 2023, and the proposed framework codifies the analytical approach already used in those cases.

What This Regulation Actually Requires

The Core Definitional Shift: "Crypto Asset Security"

The proposed rules introduce a defined term — "crypto asset security" — to distinguish tokens that function as investment contracts from those that don't. This matters because the existing statutory definition of "security" under Section 2(a)(1) of the Securities Act of 1933 and Section 3(a)(10) of the Exchange Act of 1934 has been applied to crypto through case law and staff guidance, not through a purpose-built regulatory definition.

Under the proposed framework, a crypto asset security is any crypto asset that satisfies the Howey test: (1) an investment of money, (2) in a common enterprise, (3) with an expectation of profits, (4) derived from the efforts of others. The Commission's proposed rules add interpretive gloss on each prong specifically for token structures — addressing staking rewards, governance token distributions, and protocol fee arrangements that didn't exist when Howey was decided in 1946.

Critically, the label attached to a token by its issuer carries no legal weight. A token called a "utility token," "governance token," or "protocol token" is still a crypto asset security if the economic reality satisfies Howey. The SEC's enforcement record makes this plain: in SEC v. Ripple Labs (S.D.N.Y.), the court found that institutional XRP sales constituted investment contracts while programmatic exchange sales did not — a distinction the proposed rules now attempt to codify into a workable analytical framework.

Issuer Obligations Under the Proposed Framework

Issuers of crypto asset securities face three primary paths:

Full Securities Act Registration. A token offering that qualifies as a securities offering must be registered under the Securities Act unless an exemption applies. The proposed rules clarify that Form S-1 and Form 1-A (for Reg A+) can accommodate crypto asset disclosures, and the SEC has proposed a new supplemental disclosure form — tentatively called Form CA — specifically for crypto asset securities offerings. Form CA would require disclosure of tokenomics, smart contract audit results, validator/miner concentration data, and protocol governance structures.

Exempt Offerings. Reg D Rule 506(b) and 506(c) remain available for private placements to accredited investors. Reg A+ allows up to $75 million in a 12-month period with lighter disclosure requirements. Reg S covers offshore transactions. The proposed rules don't create new exemptions but clarify how existing exemptions apply to token mechanics — including how "general solicitation" rules interact with public blockchain activity.

Resale Restrictions. Tokens sold in exempt offerings carry the same resale restrictions as traditional securities. The proposed rules address the practical problem that tokens are technically transferable on-chain the moment they're minted. Issuers will be required to implement technical controls — smart contract transfer restrictions, allowlists, or similar mechanisms — to enforce resale lockups during restricted periods.

Platform and Intermediary Requirements

Any platform that facilitates trading of crypto asset securities must register with the SEC. The proposed rules clarify three registration pathways:

1. National Securities Exchange under Section 6 of the Exchange Act — the highest regulatory burden, requiring fair access rules, surveillance systems, and listing standards.
2. Alternative Trading System (ATS) under Regulation ATS — available to broker-dealers operating trading systems that don't set rules governing subscriber conduct outside the system.
3. Broker-Dealer Registration — required for any entity that effects transactions in crypto asset securities for the accounts of others, regardless of whether it operates a trading platform.

The proposed rules also address decentralized exchanges (DEXs). Where a DEX has an identifiable operator, developer team, or governance structure that exercises meaningful control over the protocol, that entity may be deemed to be operating an unregistered exchange. This is the most contested aspect of the proposal and has drawn significant comment from the DeFi industry.

Custody and Safeguarding Rules

The proposed framework incorporates the SEC's 2023 Staff Accounting Bulletin 121 (SAB 121) approach — requiring entities that custody crypto asset securities on behalf of clients to reflect those assets as liabilities on their balance sheets. The proposed rules go further, requiring qualified custodians of crypto asset securities to maintain segregated cold storage, implement multi-signature controls, and carry insurance or maintain capital reserves against loss.

What This Means for Your Company

Token issuers need a legal opinion — not a memo, an opinion — on whether each token in their ecosystem qualifies as a crypto asset security under the proposed framework's Howey analysis. That opinion should be refreshed whenever the token's economic structure changes: new staking rewards, protocol fee distributions, or governance changes can shift the analysis.

Exchanges and trading platforms face the starkest choice. Platforms currently operating without SEC registration that list tokens qualifying as crypto asset securities are operating as unregistered exchanges or broker-dealers. The proposed rules don't grandfather existing operations. Platforms have a defined compliance window after final rules take effect — likely 12 to 18 months based on the proposal's transition provisions — to register or delist affected tokens.

DeFi protocols with identifiable governance structures or development teams should treat the proposed DEX provisions as a serious litigation risk even before final rules. The SEC has already brought enforcement actions against DeFi operators — including the 2024 action against Uniswap Labs — arguing that existing law already covers their activities.

Investors and funds holding crypto asset securities in client accounts need to assess custody arrangements against the proposed qualified custodian requirements. Holding tokens in self-custodied wallets on behalf of clients almost certainly won't satisfy the proposed standard.

How to Operationalize

Step 1: Token Classification Audit. Map every token your company issues, lists, or holds. For each token, document the Howey analysis: who invested, what's the common enterprise, what's the profit expectation, and whose efforts drive that expectation. Flag tokens where the analysis is close.

Step 2: Engage Outside Counsel Early. The proposed rules are complex and the comment period generated thousands of responses. Counsel familiar with both securities law and token mechanics is not optional at this stage.

Step 3: Assess Registration Pathways. For tokens that qualify as crypto asset securities, determine whether you need to register the offering, rely on an exemption, or restructure the token's economics to move it outside the definition. Each path has different cost and timeline implications.

Step 4: Implement Technical Controls. If you're relying on exempt offering status, build transfer restriction mechanisms into your smart contracts now. Retrofitting these controls after deployment is technically difficult and legally risky.

Step 5: Platform Registration Decision. If you operate a trading platform, make a board-level decision on registration pathway before the compliance window closes. ATS registration is faster than exchange registration but carries its own requirements. Broker-dealer registration requires FINRA membership.

Step 6: Custody Review. Audit your custody arrangements against the proposed qualified custodian standard. If you're holding client assets in arrangements that won't qualify, begin transitioning to compliant custodians now.

Step 7: Monitor Final Rules. The proposed rules are not yet final. Track the SEC's rulemaking calendar and engage in the comment process if your business model is materially affected by specific provisions — particularly the DEX operator provisions.

Common Mistakes and How to Avoid Them

Relying on token labels. "Utility token" is not a legal category. The SEC has said this repeatedly. Don't structure your compliance program around a label — structure it around the economic reality of how the token functions.

Treating the proposal as hypothetical. The SEC's enforcement posture already reflects the analytical framework in the proposed rules. Waiting for final rules before conducting a Howey analysis is waiting too long.

Ignoring secondary market activity. An issuer who conducts a compliant exempt offering can still face liability if it facilitates or encourages secondary trading on unregistered platforms. The proposed rules address issuer conduct in secondary markets explicitly.

Assuming DeFi is outside SEC jurisdiction. The Uniswap Labs enforcement action and the proposed DEX provisions signal that the SEC views meaningful protocol control as sufficient to establish jurisdiction. "Decentralized" is a spectrum, not a binary.

Underestimating the custody requirements. SAB 121's balance sheet treatment created significant capital implications for banks and custodians. The proposed rules' custody provisions will have similar effects. Model the capital impact before assuming your current custody arrangement is compliant.

Missing the comment window. If the proposed rules would materially harm your business model, the comment period is your best opportunity to shape the final rules. Substantive, data-driven comments from affected industry participants have historically influenced SEC rulemaking.

FAQ

Q: Does the proposed framework create a safe harbor for tokens that are "sufficiently decentralized"?

A: Not explicitly. The proposed rules acknowledge the concept — the SEC's former Director of Corporation Finance, William Hinman, introduced it in a 2018 speech regarding Ether — but the proposed framework doesn't codify a bright-line decentralization safe harbor. Instead, it applies a facts-and-circumstances analysis. Tokens that were initially sold as investment contracts may lose that status over time if the network becomes genuinely decentralized, but the burden of demonstrating that shift falls on the issuer.

Q: How does the proposed framework interact with the CFTC's jurisdiction over crypto commodities?

A: The proposed rules don't resolve the SEC-CFTC jurisdictional boundary — that requires Congressional action. The framework focuses on tokens that qualify as securities and explicitly carves out tokens that are commodities (like Bitcoin) or currencies. Tokens that don't satisfy Howey remain outside SEC jurisdiction under this framework, though they may fall under CFTC jurisdiction for derivatives trading purposes.

Q: Can a token be a security at issuance and a non-security later?

A: Yes, under the proposed framework's analysis. If a token is sold in circumstances that satisfy Howey but the network subsequently becomes sufficiently decentralized that purchasers no longer rely on the efforts of an identifiable promoter, the token may no longer qualify as a crypto asset security. The proposed rules don't specify what "sufficiently decentralized" means quantitatively, which is a significant gap that industry commenters have flagged.

Q: What's the timeline for final rules?

A: The SEC has not published a final rule date. Based on the proposal's comment period and the Commission's current rulemaking calendar, final rules are unlikely before mid-2027. However, enforcement under existing law continues regardless of the rulemaking timeline.

Q: Do non-US issuers need to comply?

A: If a token offering is made to US persons or on US trading platforms, US securities law applies regardless of where the issuer is incorporated. Reg S provides an exemption for offshore transactions, but it has strict conditions — including no directed selling efforts into the US — that many token projects fail to satisfy.

---

Sources

• U.S. Securities and Exchange Commission, Staff Bulletin: Crypto Asset Securities (April 2025), SEC.gov
• U.S. Securities and Exchange Commission, Staff Accounting Bulletin No. 121 (March 2022), SEC.gov
• Securities Act of 1933, Section 2(a)(1); Securities Exchange Act of 1934, Section 3(a)(10)
• SEC v. W.J. Howey Co., 328 U.S. 293 (1946)

---

Disclaimer

This article is provided for general informational and educational purposes only. It does not constitute legal advice and does not create an attorney-client relationship. The regulatory landscape described reflects publicly available information as of the publication date and may not reflect subsequent developments, final rulemaking, or enforcement actions. Readers should consult qualified legal counsel before making compliance decisions. BizLegal-AI Intelligence Desk is not a law firm and does not provide legal representation.