When Does a Token Stop Being a Security? The Howey Test Evolution in 2026

For nearly a decade, the cryptocurrency industry has grappled with a fundamental question: when does a digital token cross the line from security to commodity, utility, or something else entirely? The answer lies in the Howey test crypto analysis—a 1946 Supreme Court framework now being actively reinterpreted for the blockchain era.

In 2025-2026, following a significant shift in SEC leadership and enforcement philosophy, we’re witnessing the most meaningful evolution in how regulators and courts apply this test to digital assets. This guide explains the current state of the law, what has changed, and what crypto founders, counsel, and investors should do now.

Key Takeaways

• The Howey test remains binding law. Under SEC v. W.J. Howey Co., 328 U.S. 293 (1946), a token is a security if it involves (1) an investment of money, (2) in a common enterprise, (3) with an expectation of profits, (4) derived from the efforts of others.
• “Sufficient decentralization” is an emerging theory—not settled law. No federal court has definitively held that a token can “graduate” from security to non-security status, though the Ripple ruling and SEC staff statements provide analytical support.
• SEC enforcement posture shifted dramatically in 2025. Under Chairman Atkins, the SEC dismissed or favorably settled major cases against Coinbase, Binance, and Gemini, and launched a Crypto Task Force focused on regulatory clarity.
• The CLARITY Act could codify token graduation. This legislation passed the House in 2025 and is pending in the Senate. If enacted, it would establish statutory criteria for when tokens are not securities.
• Documentation is critical. Projects should meticulously document their decentralization journey—governance changes, token distribution, and operational independence—to support potential future reclassification arguments.

What Is the Howey Test?

The Howey test defines when a transaction constitutes an “investment contract”—and therefore a “security”—under Section 2(a)(1) of the Securities Act of 1933 (15 U.S.C. § 77b(a)(1)) and Section 3(a)(10) of the Securities Exchange Act of 1934 (15 U.S.C. § 78c(a)(10)).

In SEC v. W.J. Howey Co., 328 U.S. 293, 301 (1946), the Supreme Court held that an investment contract exists when there is:

Prong	Traditional Formulation	Crypto Application
1. Investment of Money	The investor provides capital or value	Purchasing tokens with fiat, crypto, or other value (including airdrops in exchange for actions) generally satisfies this prong
2. Common Enterprise	Investors’ fortunes are tied together or to the promoter	Token holders share in the success or failure of the protocol/project; courts have found this satisfied in virtually all crypto cases
3. Expectation of Profits	The investor anticipates returns	Marketing emphasizing token appreciation, staking yields, or protocol revenue sharing indicates profit expectations
4. Efforts of Others	Profits depend on a third party’s efforts	This is the critical prong for crypto. If token value depends on a founding team’s ongoing work, this is satisfied. If the network is “sufficiently decentralized,” it may not be.

The test is applied based on the “economic realities” of a transaction, not its form. Howey, 328 U.S. at 298. Courts examine the totality of circumstances, including how the asset was marketed and sold.

What Changed: The 2025 SEC Policy Shift

Before (2017-2024): Enforcement-Driven Regulation

Under former SEC Chair Gary Gensler (2021-2025), the agency pursued an aggressive enforcement posture toward crypto, bringing over 100 enforcement actions and taking the position that most tokens—other than Bitcoin—were likely securities. Key characteristics of this era:

• Enforcement as guidance: The SEC declined to issue formal rules for crypto, instead articulating its views through enforcement actions.
• Broad assertions: SEC staff suggested that nearly all tokens sold to raise capital for a project were securities, with limited exceptions.
• No recognition of “graduation”: The agency’s implicit position was that once a token was sold as a security, it remained a security indefinitely.

Key cases from this era:

• SEC v. Telegram Group Inc., 448 F. Supp. 3d 352 (S.D.N.Y. 2020) — Court enjoined Telegram’s token distribution, finding the entire scheme was an unregistered securities offering.
• SEC v. LBRY, Inc., 639 F. Supp. 3d 211 (D.N.H. 2022) — Court held LBRY Credits (LBC) were offered as securities, though it did not address whether they would remain securities in perpetuity.
• SEC v. Ripple Labs, Inc., No. 1:20-cv-10832 (S.D.N.Y. July 13, 2023) — In a nuanced ruling, Judge Torres found that XRP sales to institutional investors were unregistered securities offerings, but “programmatic” sales on exchanges were not because those purchasers did not have a reasonable expectation of profits from Ripple’s efforts specifically.

After (2025-2026): Regulatory Clarity Emphasis

Chairman Paul Atkins, confirmed in April 2025, has publicly committed to providing “regulatory clarity rather than regulation by enforcement.” Observable changes include:

• Case dismissals and favorable settlements: The SEC voluntarily dismissed its case against Coinbase and reached settlements with Binance and Gemini on terms significantly more favorable than the original complaints sought. (Note: Specific dates and terms should be verified against current case dockets.)
• SEC Crypto Task Force: Launched in January 2025, this task force is charged with developing formal guidance on digital asset classification, custody, and trading. Public statements indicate guidance on token status transitions is a priority.
• Reduced enforcement volume: According to SEC data, crypto-related enforcement actions declined significantly in 2025 compared to prior years, reflecting the policy shift. (Note: Practitioners should verify current statistics against official SEC reports.)
• Staff Accounting Bulletin 121 rescission: In March 2025, the SEC rescinded SAB 121, which had effectively prevented banks from custodying crypto by requiring on-balance-sheet treatment.

Can a Token “Graduate” from Being a Security?

The theory that a token can transition from security to non-security status is commonly called “sufficient decentralization” or “token graduation.”

Important caveat: This theory has not been definitively adopted by any federal court. It is an analytical framework supported by SEC staff statements and certain court rulings, but it is not settled law.

Origin of the Theory: The Hinman Speech (2018)

The most detailed public articulation of sufficient decentralization came from William Hinman, then-Director of the SEC’s Division of Corporation Finance, in a June 14, 2018 speech. Hinman stated:

“[I]f the network on which the token or coin is to function is sufficiently decentralized—where purchasers would no longer reasonably expect a person or group to carry out essential managerial or entrepreneurial efforts—the assets may not represent an investment contract.”

Critical limitations of the Hinman speech:

• It was explicitly “not a rule, regulation, or statement of the Commission.”
• It did not provide quantitative standards for “sufficient decentralization.”
• Its legal status was heavily litigated in SEC v. Ripple Labs, where the court ultimately did not rely on it as binding authority.

Legal Support for Token Graduation

While no court has held that a specific token graduated from security to non-security, the following authorities provide analytical support:

SEC v. Ripple Labs (S.D.N.Y. 2023): Judge Torres distinguished between different categories of XRP transactions:

• Institutional sales: Securities offerings, because buyers reasonably expected profits from Ripple’s efforts.
• Programmatic exchange sales: Not securities offerings, because secondary market purchasers did not know whether they were buying from Ripple or other sellers, and thus could not have had the requisite expectation tied to Ripple’s efforts.
• Other distributions: Not securities offerings, because no “investment of money” occurred.

The Ripple ruling is significant because it rejected the notion that a token is inherently and permanently a security based solely on how it was initially sold. However, the ruling addressed different transaction types, not a single token’s evolution over time.

SEC Framework for “Investment Contract” Analysis (April 2019): This staff guidance document (not a formal rule) provides factors for analyzing whether a token is a security. Notably, it contemplates that factors may change over time:

“[T]he inquiry into whether a digital asset is a security is not static and does not strictly inhere to the instrument.”

What Factors Indicate “Sufficient Decentralization”?

Based on the Hinman speech, the 2019 Framework, and court rulings, the following factors appear relevant. No single factor is determinative—courts and regulators examine the totality of circumstances.

1. Governance Decentralization

• Is protocol governance controlled by a broad, diverse set of token holders?
• Do governance proposals originate from the community, not just the founding team?
• Has the founding team relinquished administrative control (e.g., admin keys, upgrade authority, multi-sig control)?
• Are governance decisions binding without founding team approval?

2. Token Distribution

• What percentage of tokens are held by founders, the team, or affiliated entities?
• Are tokens widely distributed among many independent holders?
• Were tokens distributed through decentralized mechanisms (mining, staking, airdrops) rather than concentrated sales?
• Are there lockup schedules or vesting periods for insider tokens?

3. Operational Independence

• Can the network function without any involvement from the original development team?
• Are there multiple independent development teams or contributors?
• Would the protocol continue operating if the founding entity ceased to exist?

4. Marketing and Communications

• Does the founding team still actively market the token or make statements about its value?
• Are promotional activities focused on the network’s utility rather than investment returns?
• Has promotion shifted to community-led efforts?

5. Network Functionality and Utility

• Is the network fully operational with real users engaged in non-speculative use?
• Does the token serve genuine utility purposes (gas fees, governance, access)?
• Is there meaningful demand for the token’s utility function independent of speculation?

Special Cases: NFTs, DAOs, and Staking

NFTs (Non-Fungible Tokens)

The SEC has not issued comprehensive guidance on NFTs and the Howey test. However, in August 2023, the SEC brought its first NFT-related enforcement action, In re Impact Theory, LLC (SEC Release No. 34-98136), finding that “Founder’s Keys” NFTs were securities because they were marketed with expectations of profits from the company’s efforts.

Key factors for NFT analysis:

• Were NFTs marketed as investments or as collectibles/art?
• Did the issuer promise future benefits, royalties, or value appreciation?
• Is secondary market value tied to the issuer’s ongoing efforts?

Unique, one-of-one art NFTs with no promised future benefits are less likely to be securities. Fractionalized NFTs, NFT collections with promised utility tied to issuer efforts, or NFTs marketed as investments warrant closer scrutiny.

DAO Governance Tokens

DAO governance tokens present a unique analytical challenge. On one hand, they often represent voting rights rather than profit participation. On the other hand, they frequently appreciate based on protocol success.

Factors suggesting a DAO token may not be a security:

• The token’s primary function is governance, not profit distribution
• Token holders must actively participate (not passive investment)
• No central team’s efforts drive token value
• The DAO is genuinely decentralized in practice, not just form

The SEC has not specifically addressed DAO tokens, but the CFTC’s September 2023 enforcement action against Ooki DAO suggests regulators are willing to pursue decentralized organizations.

Staking Rewards

Staking rewards raise distinct Howey questions. In February 2023, the SEC alleged in its action against Kraken that its staking-as-a-service program constituted an unregistered securities offering (In re Payward Ventures, Inc., SEC Release No. 33-11169).

Key distinction:

• Self-custody staking (user runs own validator): Less likely to be a security because rewards derive from user’s own efforts and protocol mechanics.
• Staking-as-a-service (platform stakes on user’s behalf): More likely to be a security because users rely on the platform’s efforts to generate returns.

Pending Legislation: The CLARITY Act

The CLARITY Act (Crypto Legal Ambiguity Resolution and Innovation Through Year-round Guidance Act) passed the House of Representatives in September 2025 and is pending in the Senate. If enacted, it would:

• Establish statutory criteria for determining when a token is “sufficiently decentralized” and therefore not a security
• Provide a clear handoff between SEC and CFTC jurisdiction
• Require the SEC to issue formal guidance on token classification within 180 days
• Create a process for token issuers to seek classification determinations

The legislation’s passage is uncertain. Practitioners should monitor its status but not rely on its provisions until enacted.

Practical Implications: What Projects Should Document

For projects seeking to support a future argument that their token has become sufficiently decentralized, contemporaneous documentation is essential. Consider maintaining records of:

Category	Documentation
Governance	Governance proposals and voting records; timeline of admin key transfers; multi-sig changes; constitutional amendments
Token Distribution	On-chain analytics showing holder distribution over time; vesting schedule compliance; lockup expirations
Development	GitHub contribution logs; grants to independent developers; third-party protocol improvements
Operations	Evidence the network operates independently; uptime records; validator/node distribution
Marketing	Transition from team-led to community-led promotion; cessation of price-related statements

What to Do Now: Actionable Steps for 2026

1. Conduct a Howey analysis with securities counsel. Apply the four-prong test to your current facts, not your aspirational future state. Document the analysis in a privileged memorandum.
2. Map your decentralization roadmap. If you believe your token may eventually qualify as sufficiently decentralized, create a timeline with specific milestones: governance handoff, team token lockup expirations, multi-sig changes, third-party development grants.
3. Audit your marketing and communications. Review all public statements about the token. Cease any statements that could be construed as promising investment returns or tying value to team efforts.
4. Monitor SEC Crypto Task Force developments. The Task Force has indicated it will issue guidance on token classification. Submit comments on proposed rules when the opportunity arises.
5. Track CLARITY Act status. If the legislation advances in the Senate, its specific criteria for decentralization will become the operative standard. Engage with industry associations advocating for workable standards.
6. Preserve compliance optionality. Until the law is settled, consider maintaining compliance with securities exemptions (Reg D, Reg S, or Reg A) even if you believe your token is not a security. The cost of compliance is typically lower than the cost of being wrong.
7. Consider state law implications. Even if a token is not a federal security, state blue sky laws may apply. Several states have their own investment contract definitions. Consult counsel licensed in relevant jurisdictions.

Open Questions and Areas of Uncertainty

Despite the evolving landscape, significant legal questions remain unresolved:

• No court has held that a token can graduate. The Ripple ruling addressed different transaction types, not a single token changing status over time. The graduation theory remains untested in this specific application.
• No quantitative thresholds exist. Neither the SEC nor any court has specified what percentage of tokens must be distributed, or what governance participation rates are required, for “sufficient decentralization.”
• Retroactive effect is unclear. If a token graduates, does that apply retroactively to past secondary market transactions, or only prospectively?
• The Hinman speech’s status remains uncertain. While influential, it is not binding and was criticized by Judge Torres in Ripple for the SEC’s inconsistent positions.
• International divergence creates complexity. The EU’s Markets in Crypto-Assets Regulation (MiCA) does not use the Howey test. A token may be a security in the U.S. but not in the EU, or vice versa. Projects operating globally must navigate multiple classification regimes.

Conclusion

The Howey test remains the binding legal framework for determining whether a crypto token is a security under U.S. law. However, its application is more nuanced in 2026 than at any prior point. The SEC’s pivot toward regulatory clarity under Chairman Atkins, combined with the Ripple ruling’s recognition of transaction-specific analysis, suggests that token classification is not necessarily permanent.

The “sufficient decentralization” theory provides a plausible analytical path for tokens to graduate from securities to non-securities—but it is not yet settled law. Projects that believe their tokens have become or are becoming sufficiently decentralized should document that journey meticulously, engage with pending regulatory guidance, and maintain compliance optionality until clearer rules emerge.

For crypto founders, in-house counsel, and investors, the practical imperative is to understand where your token sits on the Howey spectrum today—and to prepare for whichever direction the law develops.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly—consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.