1.1 The Definition of ‘Security’

Section 2(a)(1) enumerates roughly two dozen instruments — stock, notes, bonds, debentures, certificates of interest in profit-sharing agreements — and closes with the residual category investment contract. Digital assets are not enumerated. Substantially every crypto case proceeds on an investment-contract theory. A minority invoke the “note” prong under Reves v. Ernst & Young, 494 U.S. 56 (1990), where a lending or yield arrangement is documented as debt.

The Supreme Court applies the definition by “economic reality” rather than form or label. In SEC v. Edwards, 540 U.S. 389 (2004), a fixed, contractually guaranteed return did not remove an arrangement from investment-contract treatment — foreclosing an argument several fixed-yield crypto products attempted. That flexibility cuts both ways: it is why the SEC reaches novel structures, and why no drafting formalism reliably escapes the definition.

1.2 Intermediary Registration Provisions

Once a transaction involves a security, obligations attach to anyone standing in the middle of it. Platform cases generally plead four theories together: unregistered exchange under Exchange Act § 5 and the Rule 3b-16 definition; unregistered broker under § 15(a)(1); unregistered clearing agency under § 17A(b); and, for staking or yield programs, unregistered offerings under Securities Act § 5.

Intermediary liability does not require the platform to have issued anything — only that securities transactions crossed its system. A platform’s risk is therefore a function of every asset it lists, not merely assets it created, which is why listing review is a recurring exercise rather than one-time diligence.

2.1 The Four Elements

Investment of money. Rarely contested. Payment in another digital asset satisfies it, as does contribution of services or property having value. Genuine no-consideration airdrops present a harder question no court has squarely resolved.

Common enterprise. The circuits diverge. The Second, Third, and others accept horizontal commonality — pooling of investor assets with pro-rata sharing of profits and risk. The Fifth and Ninth also recognize forms of vertical commonality tying investor fortunes to the promoter’s. The SEC typically pleads horizontal commonality through pooling of sale proceeds into a single treasury used to build the network. Defendants who genuinely segregated proceeds have a real argument that is frequently underdeveloped.

Reasonable expectation of profits. Assessed objectively, from a reasonable purchaser’s perspective, based on what the promoter said and did. Marketing is evidence. Roadmaps, burn mechanics, supply caps framed as scarcity value, and statements about listings or price are routinely quoted back to defendants. Present consumptive use weighs against the element; courts have been skeptical where utility is merely prospective.

Efforts of others. The most contested element and the heart of the “sufficient decentralization” debate. Under SEC v. Glenn W. Turner Enterprises and its progeny, the question is whether the promoter’s efforts are the undeniably significant ones — not whether they are exclusive. A network with meaningful outside contributors can still satisfy the element where the founding team retains controlling development authority, a large treasury allocation, and practical ability to direct the protocol.

2.2 Is the Token Itself the Security?

A persistent defense distinguishes the investment contract from its subject. The orange trees in Howey were not securities; the arrangement bundling trees with a management contract was. On this reasoning a token is a digital object that becomes part of a security only when embedded in a scheme of promises about future efforts.

Judge Failla addressed this in denying Coinbase’s motion to dismiss, reasoning that an investment contract need not be memorialized in a formal contractual obligation and that promotional context can supply the scheme. Judge Torres in Ripple accepted the distinction in substance. Whether a token can be a security standing alone, untethered from the circumstances of its sale, remains open. No court of appeals has resolved it.

3.1 Telegram and Kik: The Structural Lessons

In SEC v. Telegram, the court granted a preliminary injunction halting delivery of Gram tokens to purchasers who bought through Reg D-exempt agreements. The critical holding: the private placement and anticipated public resale could not be viewed in isolation. Examining the scheme as a whole, the court found initial purchasers were statutory underwriters positioned to distribute into a public market, and refused to let the exemption insulate the downstream distribution.

In SEC v. Kik Interactive, the court granted summary judgment on Section 5 liability, rejecting the argument that pre-sale and public distribution were separable and finding the Kin offering was a single integrated unregistered offering.

The shared lesson is structural and remains good law: a compliant private sale does not launder a non-compliant public distribution. Any launch contemplating both a SAFT-style institutional round and subsequent public availability must analyze integration and underwriter status, not merely the front-end exemption.

3.2 The Ripple/Terraform Split

In July 2023 Judge Analisa Torres divided XRP sales by channel. Institutional sales — direct, negotiated, documented, made to sophisticated buyers who received Ripple’s marketing materials — satisfied Howey. “Programmatic” sales on anonymous order books did not, because a blind bid/ask buyer did not know whether their consideration reached Ripple and could not have formed an expectation of profits based on any promise made to them. Distributions to employees and third parties as compensation failed the investment-of-money element.

Weeks later, in SEC v. Terraform Labs, Judge Jed Rakoff expressly declined to follow that reasoning, stating that Howey draws no distinction between sophisticated and retail purchasers or between direct and secondary-market transactions. Both decisions issued from the same district within a single month.

The Ripple litigation concluded at the district level in August 2024 with an injunction and a civil penalty of roughly $125 million — far below the SEC’s request — followed in 2025 by the parties abandoning their cross-appeals. That abandonment matters: it left the district opinion standing without appellate review, meaning the Ripple framework is persuasive authority only, binding on no one, and directly contradicted by a sister court.

3.3 NFTs, Staking Services, and DeFi

NFTs. The Commission brought settled administrative actions treating certain NFT projects as unregistered offerings where the issuer marketed the assets by reference to the team’s future development and expected appreciation — notably Impact Theory (2023). Two Commissioners dissented, arguing the Commission had articulated no limiting principle. The analysis follows ordinary Howey reasoning: what distinguishes a collectible from a security is the promotional promise of managerial effort, not the token standard.

Staking-as-a-service. The Kraken settlement (2023) charged a pooled, custodial staking-reward program as an unregistered offering, emphasizing that customers surrendered control and relied on the platform to generate returns. Non-custodial staking, where the user retains control and the validator performs a technical function, presents a materially different analysis.

DeFi. The hardest unresolved question is who, if anyone, is the issuer or intermediary when a protocol runs autonomously. The Commission’s theory has generally attached to identifiable persons who deployed, marketed, controlled admin keys, or captured fees. Front-end operators and governance-token treasuries carry the most exposure; the analysis is intensely fact-specific and appellate guidance is absent.

Both Impact Theory and Kraken resolved as settled orders, not litigated decisions. They reflect the staff’s enforcement view and carry no precedential weight.

4.1 The Transferability Problem

The recurring structural defect in token offerings is that securities-law compliance assumes the issuer can control who holds the instrument and when they may resell. A token transferable to any wallet the instant it is delivered defeats that assumption. Rule 144 holding periods, accredited-investor limits, and Regulation S distribution compliance periods all presume a controllable cap table.

Projects that navigate this generally do so through on-chain transfer restrictions, permissioned allowlists, lockups enforced at the contract level rather than by side letter, or by distributing a non-transferable claim that converts to a liquid token only once a compliant path exists. A contractual lockup unenforced in code is worth substantially less in a Section 5 analysis than a restriction the protocol itself enforces.

4.2 Registering as an Intermediary

Platforms facing broker-dealer exposure have a narrow path through the special purpose broker-dealer framework for digital asset securities. Uptake has been minimal, reflecting restrictive operational conditions rather than lack of demand. Alternative Trading System registration paired with broker-dealer status is the other established route for secondary trading. Both require FINRA membership and impose capital, custody, and supervisory obligations that most crypto-native platforms cannot meet without substantial re-architecture.

5.1 Elements of a Rule 10b-5 Claim

The SEC must establish a material misrepresentation or omission (or a deceptive scheme), scienter, and a connection to the purchase or sale of a security. Unlike private plaintiffs, the Commission need not prove reliance, loss causation, or damages — an asymmetry that makes SEC fraud actions easier to sustain than parallel class actions on identical facts.

Materiality follows the TSC Industries / Basic v. Levinson standard: whether a reasonable investor would consider the fact important to the investment decision. Scienter means intent to deceive or, in most circuits, recklessness. Sections 17(a)(2) and (3) require only negligence, which is why the Commission frequently pleads them alongside 10b-5.

Scienter is where a contemporaneous written classification analysis earns its cost. It does not defeat strict-liability Section 5 exposure, but it is directly probative on whether the defendant knew or recklessly disregarded that statements were misleading.

5.2 Recurring Fact Patterns

The digital asset fraud docket clusters around a few repeating patterns. Test each directly in any risk review:

• Misstated reserves or backing — representing a token as fully backed or reserves as audited when they are not, or when the attestation is materially narrower than described.
• Undisclosed insider selling — founders liquidating into retail demand while publicly signaling lockup or long-term commitment.
• Fabricated partnerships, credentials, or adoption metrics — including fictitious advisors and inflated user or transaction counts.
• Wash trading and manipulated volume — reachable under both securities and commodities antifraud authority.
• Undisclosed paid promotion — touting without disclosing consideration, independently actionable under Securities Act § 17(b), which reaches influencers and celebrity promoters regardless of their role in the issuance.
• Misuse of offering proceeds — diverting funds to personal use or to purposes materially different from those disclosed.

Note the remedial asymmetry: fraud findings trigger scienter-based charges, the ten-year disgorgement period, officer-and-director bars, potential criminal referral, and a jury trial under Jarkesy. A registration-only case carries none of that weight.

6.1 Staff Statements Are Not Law

This is the most important practical point in the guide, and the one founders reading headlines most often get wrong.

A Division statement carries an express disclaimer that it reflects staff views, has not been approved by the Commission, and creates no enforceable rights. It can be withdrawn without notice or rulemaking. It does not bind a federal judge applying Howey. And it has no effect whatsoever on three independent sources of exposure:

• Private plaintiffs, who may sue for rescission under Securities Act § 12(a)(1) for unregistered sales — no scienter required — and under Rule 10b-5 for fraud.
• State securities regulators, who enforce independent blue sky statutes and are not bound by federal enforcement priorities.
• Future Commissions, since a five-year limitations period means conduct undertaken in reliance on today’s posture remains actionable under tomorrow’s.

A deregulatory posture reduces the probability of an SEC action. It does not change the legal character of the transaction. Advise clients on that distinction and document having done so.

7.1 The Wells Process

Before recommending an action the staff ordinarily issues a Wells notice identifying intended charges. The recipient may make a Wells submission arguing law and facts against the recommendation.

The calculus is genuinely two-sided. A submission is the last chance to persuade before a complaint is filed and reputational harm incurred, and it can narrow charges or defeat a recommendation outright. But it is a written statement by a represented party that is generally discoverable, may be used as an admission, and telegraphs the defense theory. Submissions are most valuable where the argument is legal — that the transaction fails a Howey element as a matter of law — and least valuable where it depends on contested factual assertions that discovery will test.

Settlement discussions typically run in parallel. Most matters resolve on a “neither admit nor deny” basis. Cooperation credit follows the Seaboard framework: self-reporting, remediation, and genuine assistance measurably affect outcomes.

7.2 Whistleblowers and Parallel Proceedings

Exchange Act § 21F awards 10–30% of sanctions above $1 million to individuals providing original information leading to successful enforcement. Digital asset matters generate disproportionate whistleblower activity because disgruntled early employees have direct access to treasury movements and internal communications.

Critically, Rule 21F-17 prohibits any action impeding communication with the Commission. The SEC has repeatedly charged companies over severance and confidentiality agreements lacking a regulatory carve-out. Review your employment, severance, and NDA templates for this provision — it is a standalone violation independent of any underlying misconduct.

The SEC routinely coordinates with DOJ, CFTC, and state authorities. Where criminal exposure exists, individual witnesses need independent counsel before testimony. Fifth Amendment invocation is available to individuals but not entities, and an adverse inference may be drawn in the civil case — a bind with no clean answer, which is why it must be worked through before the testimony date rather than at it.

7.3 Remedies and Limitations Periods

Injunctive relief. Permanent injunctions against future violations, plus conduct-based injunctions restricting participation in digital asset offerings. Violation exposes the defendant to contempt.

Disgorgement. Liu v. SEC, 591 U.S. 71 (2020) limits it to net profits after deducting legitimate business expenses and generally requires return for investors’ benefit. In token cases it is typically measured by proceeds of unregistered sales — which is how registration-only cases produce nine- and ten-figure figures with no fraud finding.

Civil penalties. A three-tier structure escalating with fraud and with substantial losses to others, assessed per violation and adjusted annually for inflation. Courts retain discretion; the Ripple penalty, far below the SEC’s request, illustrates it. This guide omits dollar figures because the tiers re-adjust annually — consult the current release before quoting amounts.

Individual exposure. Entity-level resolution does not necessarily protect founders. Officer-and-director bars are available where conduct demonstrates unfitness. Control person liability attaches under Exchange Act § 20(a); aiding and abetting under § 20(e). Section 5 liability extends to any “necessary participant and substantial factor” in the distribution — readily satisfied by a founder who directed the launch.

Limitations. Civil penalties are subject to the five-year period in 28 U.S.C. § 2462, per Kokesh v. SEC, 581 U.S. 455 (2017). The FY2021 NDAA codified disgorgement authority and extended it to ten years for scienter-based violations. Practically: a 2021 launch remains within the penalty window into 2026 and the disgorgement window into 2031 if fraud is alleged. Conduct undertaken during a permissive enforcement period is not immunized by that period having existed. Tolling agreements should not be signed reflexively — declining may accelerate a charging decision, agreeing may surrender the strongest available defense.

8.1 Jarkesy and Loper Bright

SEC v. Jarkesy, 603 U.S. 109 (2024) held that when the SEC seeks civil penalties for securities fraud, the Seventh Amendment entitles the defendant to a jury trial in an Article III court. The in-house administrative forum — where the Commission historically enjoyed structural advantages — is therefore unavailable for contested fraud penalty actions. Contested matters go to federal court, before a jury, with full discovery. This raises the Commission’s litigation cost and correspondingly improves defense leverage in settlement.

Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024) overruled Chevron, requiring independent judicial judgment on statutory interpretation. This matters for challenges to SEC readings of “exchange,” “broker,” and “dealer” as applied to novel market structures. It is substantially less helpful against Howey itself, which is a judicial construction of a statutory term rather than an agency interpretation ever entitled to deference — a distinction defendants sometimes elide and courts do not.

8.2 Merits and Jurisdictional Defenses

• Failure of a Howey element. Often the strongest defense and the most underdeveloped — particularly absence of common enterprise where proceeds were never pooled, and absence of reliance on others’ efforts for genuinely mature networks. Requires evidence assembled contemporaneously, not litigation-driven reconstruction.
• Major questions doctrine. That regulating a multitrillion-dollar asset class requires clear congressional authorization. Raised in Coinbase and rejected at the pleading stage on the reasoning that the SEC applied a longstanding definition rather than claiming novel power. Preserved but not yet successful.
• Fair notice / due process. Rejected on liability in LBRY and largely in Ripple, though inconsistent agency signals have influenced remedies. Best deployed against penalties rather than liability.
• Extraterritoriality. Under Morrison, 561 U.S. 247 (2010), the Exchange Act reaches domestic transactions. Offshore issuers with geofenced US exclusion have a real argument — but courts examine whether exclusion was effective in practice, not whether a terms-of-service page recited it.

9.1 Investment Company and Advisers Act Exposure

Two statutes are routinely overlooked in crypto structuring and carry severe consequences.

The Investment Company Act § 3(a)(1)(C) captures an issuer holding investment securities exceeding 40% of assets (exclusive of government securities and cash items). A DAO treasury or protocol entity holding a portfolio of other projects’ tokens may inadvertently fall within it. Registration is impractical for such entities, and the § 3(c)(1) and § 3(c)(7) exclusions cap beneficial owners or require qualified purchasers — both hard to police for a permissionless governance token. Unregistered investment company status renders contracts voidable under § 47(b), a materially worse outcome than a Section 5 violation.

The Advisers Act § 202(a)(11) reaches anyone compensated for advising others on securities. Managed crypto portfolios, token-selection services, and certain automated allocation products can trigger federal or state investment adviser registration. Fiduciary duty attaches on registration and is not waivable.

10.1 Contemporaneous Analysis and Marketing Discipline

Obtain a written securities analysis from qualified counsel before distribution, applying each Howey element to each distribution channel. Preserve it under privilege. This does not defeat Section 5 liability, but it is directly probative on scienter, bears on penalty tier, and matters to any officer-and-director bar analysis. The absence of any analysis is evidence the staff will highlight; an analysis obtained only after an inquiry began is worse than useless.

The overwhelming majority of “expectation of profits” findings rest on the promoter’s own words. Establish review covering the website, whitepaper, decks, X/Twitter, Discord, Telegram, podcasts, and conference remarks. Eliminate price predictions, listing-as-value-event framing, burn and supply-cap messaging framed as appreciation, comparisons to prior tokens’ returns, and “investor” terminology. Founders’ personal accounts are attributable to the project and routinely collected in discovery — a policy exempting the CEO’s personal feed is not a policy. Where third parties are paid to promote, build § 17(b) disclosure into the promoter agreement rather than trusting the promoter to add it.

10.2 Structural and Records Measures

• Segregate offering proceeds where facts permit, preserving the common-enterprise defense.
• If excluding US persons, implement geofencing that is actually enforced — IP blocking, wallet screening, terms enforcement. Courts examine practice, not policy.
• Impose contract-level transfer restrictions and lockups aligned to any exemption relied upon.
• Adopt and enforce an insider trading policy covering the project’s own token, with blackout windows around protocol and partnership announcements.
• Document decentralization concretely and with dates — governance transitions, admin key renunciation, treasury control changes, client and validator diversity. The “efforts of others” argument requires evidence, not assertion.
• Scrub employment, severance, and NDA templates for Rule 21F-17 compliance (§ 7.2).
• Maintain board minutes reflecting genuine deliberation on regulatory risk; adopt records retention and disable ephemeral messaging for business communications before any dispute.
• Confirm D&O and E&O coverage does not exclude regulatory proceedings, digital asset activity, or prior acts.

10.3 Scope, Currency, and Disclaimer

Jurisdictional scope. This guide addresses United States federal securities law. State blue sky regimes, state money transmitter licensing, and non-US frameworks are identified where they create parallel exposure but not treated comprehensively. Nothing here addresses the law of any non-US jurisdiction.

Currency limitations. Sections 1–5 and 7–10 rest on statutes, Supreme Court precedent, and procedural mechanics that are stable and independently verifiable through the linked sources. Section 6, and any statement about developments after 2024, could not be verified against live sources when drafted. Confirm the current status of every cited staff statement, pending bill, and case posture before relying on this material.

Version 1.0 — August 2026. Check for a later revision before use.

This content is for educational purposes only and does not constitute legal advice. Using this guide does not create an attorney-client relationship. Cryptocurrency regulation changes rapidly — consult a qualified attorney for advice specific to your situation. Seth Goettelman is licensed in Wisconsin and Florida.