The SEC Finally Answered the Question: When Does a Token Stop Being a Security?

The full 402-page proposing release (Rel. Nos. 33-11434; 34-106150; File No. S7-2026-27) is here: Proposed Rule: Regulation Crypto Assets. The SEC's summary page, with the comment form, is here.

Here is what matters.

The scope: “covered investment contracts”

The regulation applies only to a covered investment contract — an investment contract where the only subject asset is a crypto asset that is not itself a security. In other words, this is for the Howey fact pattern the SEC has litigated for ten years: a token that isn't equity or debt, sold with a promise that a team will build the network that gives it value. Tokenized stock, tokenized fund interests, and tokenized notes are outside the regime entirely. The security was always the contract, not the token — and this rulemaking finally builds on that distinction instead of fighting about it.

Path one: the startup exemption ($5M, one time, four years)

An issuer can raise up to $5 million over a four-year period — including the value of airdrops, network incentives, and validator rewards, not just cash sales. Retail investors are permitted. General solicitation is permitted. There are no investor purchase limits, and — notably — the tokens are not restricted securities, so they trade freely in secondary markets from day one.

The catch: it is a one-shot exemption. The issuer and its affiliates can use it once, ever, per asset — and the rule reaches “substantially similar” crypto assets, so relaunching the same token under a new name from a new entity doesn't work. The issuer files a notice (Form NOR), posts principles-based narrative disclosures on a public website, keeps them updated annually, and files a transition report (Form TR) at the end of the four years.

Path two: the fundraising exemption ($20M / $75M tiers)

Modeled on Regulation A, with two tiers: Tier 1 up to $20 million and Tier 2 up to $75 million in any 12-month period. Both require a qualified offering statement on new Form 1-CRYPTO and the same narrative disclosures — management, the network or application itself, and risks — rather than traditional S-K line items. Tier 2 adds financial statements and ongoing reporting (annual, semiannual, and current reports). Non-accredited investors face investment limits under this exemption, unlike the startup path.

The safe harbor: when the security goes away

This is the headline. Proposed Rule 400 provides that a covered investment contract ceases to exist — and the token stops being a security — when the issuer has completed, or permanently ceased, all the essential managerial efforts it promised investors, isn't undertaking new ones, and files a certified transition report. The test keys off the issuer's own stated promises, not an abstract decentralization standard. That's a genuinely workable framework: it tells founders what to promise carefully and what finishing looks like. The safe harbor is non-exclusive, so a token outside it can still argue Howey on the facts.

Preemption — including secondary markets

The proposal defines every purchaser in a compliant Regulation Crypto Assets offering as a “qualified purchaser” under Securities Act Section 18(b)(3), making the securities “covered securities” and preempting state registration and merit review — for the offerings and for secondary market trades. This is the same move the D.C. Circuit upheld for Regulation A+ in Lindeen v. SEC, and it removes the fifty-state qualification problem that has quietly killed a lot of compliant token distribution plans. One condition worth watching: secondary market preemption continues only while the issuer stays current on its disclosure obligations. An issuer that goes dark takes its holders' resale preemption with it.

What doesn't change

Antifraud liability under Section 17 and Rule 10b-5 applies in full to both exemptions. Bad-actor disqualification applies. States keep antifraud enforcement and notice filings. And nothing here touches assets that are themselves securities — tokenization of traditional instruments still runs through the existing framework.

What to do now

The comment period runs 60 days from Federal Register publication. If you are a founder sitting on a token launch, a fund holding tokens acquired in earlier rounds, or a platform building distribution infrastructure, this proposal will shape your next two years — and the definitions of “affiliate,” “substantially similar,” and “essential managerial efforts” are exactly the kind of terms that get fixed (or broken) in the comment file. I expect the final rule to look meaningfully different in those three places.

---

Lara Slachta is a securities and corporate attorney with 25 years of experience in private fund formation, securities tokenization, and digital assets. This post is commentary on a proposed rule and is not legal advice.