The bill is, in the aggregate, the most substantial digital-asset legislation in U.S. history. It is also conspicuously silent on a long list of questions practitioners will continue to encounter. This capstone post walks through the principal gaps. The structural shape is what the bill leaves unresolved (tax, ERISA, state law, cross-border, residual CFTC jurisdiction) and what watching the post-enactment rulemaking and legislative cycles is going to require.

The architectural point is that CLARITY is a securities-and-CFTC-jurisdiction bill with banking and bankruptcy adjuncts. It is not a tax bill. It is not an ERISA reform. It is not a uniform-commercial-code amendment. It is not a comprehensive cross-border regulatory framework. Each of those is a separate downstream fight. Some are sequenced for legislative action (the Lummis-Gillibrand RFIA framework remains the natural companion legislation for the tax provisions). Others are sequenced for agency rulemaking (Treasury and IRS will continue to develop interpretive positions on §6045 reporting, the §1058 securities-lending parallel for LSTs, and the §475 mark-to-market election). Others are sequenced for state-law adoption (UCC Article 12 status varies by state, and the §505(b) sense-of-Congress endorsement does not move the needle on actual state-by-state adoption).

Tax: the Central Gap

The most consequential silence in CLARITY is on federal tax treatment. Three principal questions remain unresolved.

§1001 realization treatment of token transactions. The IRS position under Notice 2014-21 is that virtual currency is property and that exchanges of one virtual currency for another are taxable events. Rev. Rul. 2023-14, 2023-33 I.R.B. 484, applied dominion-and-control analysis to staking rewards, treating them as taxable income upon receipt at fair market value. Notice 2023-34 followed, addressing certain related questions. The remaining open issues are substantial: token wrapping (wrapping ETH into wETH), bridging across chains (bridging USDC from Ethereum to Solana), rebasing (positive and negative rebases on rebase tokens like AMPL), and chain reorganizations (when a transaction is reorganized off the canonical chain). The §1001 analysis on each of these mechanisms turns on whether the transaction constitutes an exchange of one property for materially different property under Cottage Savings Ass’n v. Commissioner, 499 U.S. 554 (1991). The IRS has not addressed most of these issues with formal guidance, and CLARITY does not direct it to. The joint SEC-CFTC interpretation effective March 23, 2026, Release Nos. 33-11412 and 34-105020, addresses wrapping at the securities-law level (a Redeemable Wrapped Token that is a receipt for a non-security crypto asset not subject to an investment contract is itself not a security and not an investment-contract subject) but expressly disclaims any effect on the federal tax laws, stating that the interpretation “concerns the Federal securities laws... [n]o interference is intended with respect to any other legal regime, including the Federal tax laws under the Internal Revenue Code.” The release’s characterization of wrapped tokens as receipts rather than separate property may, however, provide interpretive support for an IRS position that wrapping is not a §1001 realization event. That argument is for taxpayers to make and the IRS to address; the structural gap remains. Token transactions that look operationally identical from the user’s perspective (a wrap, a bridge, a rebase) may have radically different tax consequences depending on the IRS’s eventual interpretive position.

§1058 securities-lending parallel for liquid staking. Section 1058 of the Internal Revenue Code permits non-recognition treatment for securities lending arrangements that satisfy specified conditions (cash collateral, lender retains rights to substantially identical securities, no reduction in lender’s risk of loss or opportunity for gain, voting rights treatment, and similar). The structural analog for liquid staking is whether the deposit of ETH with Lido or Rocket Pool, and the receipt of stETH or rETH in return, is a §1001 exchange (taxable) or a non-recognition event (deferred). The §1058 framework was drafted for securities lending and does not extend to digital commodities. The IRS has not addressed the question directly, and CLARITY does not address it. The result is that liquid-staking transactions sit in tax uncertainty, with the most defensible position being that the LST deposit is a §1001 exchange but the resulting tax liability is small because the LST and the underlying ETH have approximately the same fair market value. The harder question is what happens on redemption (when the holder exchanges the LST for the underlying ETH and accrued rewards). The Lummis-Gillibrand RFIA contains §1058 parallel provisions for digital commodities; CLARITY does not.

§475 mark-to-market election for digital commodities. Section 475 of the Internal Revenue Code permits dealers in securities and dealers in commodities to elect mark-to-market treatment, with ordinary income or loss recognition on year-end fair market value changes. The dealer-versus-trader distinction governs eligibility. Whether a digital-asset trading firm can elect §475 treatment for its digital-commodity inventory turns on whether digital commodities are “commodities” within the meaning of §475(e). The structural answer is probably yes, given that CLARITY classifies digital commodities under CFTC jurisdiction and that the §475 commodity dealer election has historically applied to commodities under §1256 (with some statutory qualification). But the IRS has not addressed the question, and CLARITY does not direct it to. The defensible posture for digital-asset trading firms is to make the §475 election where possible and defend it on the basis that digital commodities are commodities for §475 purposes.

The tax silence is deliberate, not accidental. The drafters of CLARITY made a structural choice to leave tax treatment to the Senate Finance Committee and the House Ways and Means Committee, with the expectation that tax legislation would follow on a separate timeline. The Lummis-Gillibrand RFIA framework is the natural companion. Whether that framework moves forward in the next legislative cycle is a contested question. The structural reality is that tax treatment of digital-asset transactions remains substantially unresolved through 2026 and beyond.

ERISA Fiduciary Status

Department of Labor Compliance Assistance Release 2022-01, issued in March 2022, warned 401(k) plan fiduciaries to exercise “extreme care” before adding cryptocurrency to plan investment menus. The Release was withdrawn under the Trump administration in 2025 and is no longer operative guidance, but the substantive ERISA fiduciary question remains. A plan fiduciary who includes Bitcoin or Ethereum as a participant-directed investment option must satisfy the §404(a) duties of loyalty and prudence, which include the duty to monitor investment options and remove imprudent ones. The application of those duties to digital-asset investments is the substantive question.

CLARITY does not address ERISA fiduciary duties directly. The §401 bank-permitted-activity framework includes custodial-and-fiduciary services for digital assets (§401(g)(1)), which authorizes banks to act as fiduciaries with respect to digital assets. The structural effect is that a bank can serve as an ERISA fiduciary for a digital-asset investment option without facing a categorical ERISA-statutory bar. But the substantive fiduciary analysis (whether the investment option is prudent for the plan, whether participant-direction satisfies the §404(c) safe harbor for participant-directed plans, whether the plan’s investment-policy statement appropriately addresses digital-asset risks) is unaffected by CLARITY.

The DOL is likely to revisit its 2022 guidance in light of CLARITY’s structural commitments. The substantive direction is uncertain. The pre-2022 DOL position on alternative investments in defined-contribution plans (Information Letter 06-03-2020 on private-equity investments) was relatively permissive, with the fiduciary duty applying to the inclusion decision but not categorically barring the investment class. The post-2022 position has been more cautious. CLARITY, if enacted, will trigger the next round.

The substantive fiduciary risk for plan fiduciaries who include digital-asset investment options is the principal practical concern. A plan fiduciary who includes a Bitcoin index fund in a 401(k) menu and sees substantial participant losses faces potential §502 fiduciary-breach litigation. The defenses available to the fiduciary (procedural prudence, qualifications of the third-party investment manager, alignment with plan investment policy) are the conventional ERISA defenses. CLARITY does not change the substantive standard or the available defenses. It simply removes the categorical structural concern that digital-asset investments are impermissible per se.

State Law: UCC Article 12 and State Money-Ttransmitter Llicensing

State-law adoption of UCC Article 12 on controllable electronic records is the principal property-law question. As of mid-2026, approximately thirty states have adopted Article 12 in full or in substantial part. The §505(b) sense-of-Congress endorsement does not accelerate adoption. The remaining states (including substantial economic centers) operate under the pre-Article 12 property-law framework, which produces uncertainty about how digital assets are owned, transferred, and pledged as collateral.

The structural consequence is that the choice of state law for digital-asset transactions matters. A transaction governed by Delaware law (which has adopted Article 12) sits in a clearer property-law framework than one governed by New York law (which has not, as of mid-2026, adopted Article 12 in full). Cross-border transactions involving multiple state-law venues face additional complexity. Venue selection should follow the Article 12 adoption map, and transaction documentation should address the property-law questions explicitly.

State money-transmitter licensing for DeFi front-ends is the second principal state-law question. The FinCEN 2019 guidance and the §604 BRCA framework address federal money-transmitter status for non-controlling developers and providers. State money-transmitter laws are not preempted by §604. A state could, in theory, take a more aggressive position on state-money-transmitter status for DeFi front-end operators than FinCEN takes on federal money-transmitter status. The structural reality is that the major state money-transmitter regulators (the New York DFS, the California DFPI, the Texas Department of Banking) have generally tracked the federal position, but divergence is possible.

The §15H(g)(1) federal preemption provision in the Exchange Act amendment under §601 preempts state securities, commodities, and digital-asset laws as applied to the §15H(b) software-developer activities. The preemption does not extend to state money-transmitter laws (which are not securities, commodities, or digital-asset laws in the federal sense). The structural effect is that state money-transmitter regulation of DeFi remains a state-law question, with the FinCEN federal framework providing interpretive support but not preemptive authority.

Cross-Border Tax Treatment of Foreign-Issued Network Tokens

The cross-border tax treatment of foreign-issued network tokens is the principal cross-border tax question. A token issued by a foreign foundation (a Cayman Islands foundation, a Marshall Islands DAO LLC, a Swiss foundation), held by a U.S. person, and producing yield through fee distributions or staking rewards, raises a series of questions. Is the U.S. person’s holding a PFIC under §§ 1291-1298? Is the foundation a CFC under §§ 951-965? Is the holder’s income subpart F income or GILTI? Is the holding subject to §1297 PFIC look-through rules?

The IRS has not addressed these questions for digital-asset structures with formal guidance, and CLARITY does not address them. The structural reality is that U.S. persons holding foreign-issued network tokens face substantial tax-compliance uncertainty. The practical posture for most retail holders is that the holdings are too small to trigger PFIC or CFC analysis, but for institutional holders and high-net-worth individuals, the structural analysis is meaningful and unresolved.

The §1297 PFIC look-through rules deserve specific attention. A foreign entity is a PFIC if 75% or more of its gross income for the taxable year is passive income, or if 50% or more of its assets produce passive income. A foreign foundation issuing a token whose value is largely derived from holding the token’s underlying protocol infrastructure may not be a PFIC under a substance-based reading. But the IRS has not provided guidance on how to apply the PFIC tests to digital-asset structures, and the structural analysis is uncertain.

§864(b)(2) Safe Harbor for Foreign Ttraders in Digital Commodities

The trading-safe-harbor provisions of §864(b)(2)(A) (stocks and securities) and §864(b)(2)(B) (commodities) permit foreign persons to trade through U.S. brokers without being treated as engaged in a U.S. trade or business. The structural reality is that U.S. trading infrastructure (brokers, exchanges, custodians) is the natural counterparty for foreign trading activity, and the §864(b)(2) safe harbors permit foreign traders to use that infrastructure without triggering ECI exposure.

Whether digital commodities fit within the §864(b)(2) safe harbors is a substantive question. The §864(b)(2)(A) stocks-and-securities safe harbor applies to “stocks or securities” as defined in the section. Digital commodities are not stocks; whether they are “securities” for §864(b)(2)(A) purposes is the question. The §864(b)(2)(B) commodities safe harbor applies to “commodities of a kind customarily dealt in on an organized commodity exchange” if the transactions “are of a kind customarily consummated at such place.” Digital commodities trade on cryptocurrency exchanges that are not, in the conventional sense, “organized commodity exchange[s],” and the structural fit with §864(b)(2)(B) is uncertain.

The Treasury Regulation under §864(b)(2), Treas. Reg. § 1.864-7(d), addresses agent imputation: trading through a U.S. agent does not create a U.S. trade or business if the agent is an independent agent acting in the ordinary course of its business. The structural analysis for digital-asset trading is whether the U.S. crypto-exchange operating as the trading venue is an independent agent for §1.864-7(d) purposes.

CLARITY does not address §864(b)(2) treatment of digital commodities. The Lummis-Gillibrand RFIA framework contains specific safe-harbor extensions; CLARITY does not. Foreign traders in digital commodities have to evaluate the §864(b)(2) treatment on a fact-specific basis, with the conservative position being that the safe harbors apply by analogy and the aggressive position being that the absence of statutory clarification means the safe harbors apply by their terms.

Residual CFTC Jurisdiction

The CFTC’s authority over digital commodity intermediaries under the new Commodity Exchange Act §1a is operationally significant but structurally complex. CLARITY establishes the CFTC as the primary regulator for digital commodity activity that is not within the SEC’s §4B-and-§301 framework. The CFTC’s authority extends to digital commodity brokers, digital commodity dealers, digital commodity exchanges, and related intermediaries. The structural framework is parallel to the CFTC’s authority over commodity futures intermediaries under the existing CEA.

The substantive scope of the CFTC’s authority is, however, contested. The residual question is which digital commodity activities are within CFTC jurisdiction and which are not. Network tokens are digital commodities for CLARITY purposes, but the §4B framework applies to ancillary assets (a subset of network tokens) and operates as a SEC-regulated disclosure regime. The CFTC’s authority over network tokens that are not ancillary assets is direct. The CFTC’s authority over network tokens that are ancillary assets sits alongside the SEC’s §4B authority, with the boundary requiring inter-agency coordination.

§902 directs the SEC and CFTC to enter into a memorandum of understanding addressing the boundary issues. The MOU is the principal mechanism for resolving residual jurisdictional questions. The structural effect is that the boundary between SEC and CFTC authority over digital-asset activity is not finally resolved by CLARITY; it is delegated to inter-agency coordination through the MOU process.

§906 Effective Dates and Rulemaking Calendar

§906 establishes the effective-date framework. Most CLARITY provisions are effective on enactment, but the substantive operational requirements depend on the rulemaking timeline. §905 directs rulemaking on a broad range of topics, with deadlines varying by topic. The principal rulemakings to watch over the 12-24 months following enactment are:

The SEC rulemaking under §105(a) on the value-from-network rule for network tokens. One year deadline. The rulemaking will define when a network token is not considered to provide a disqualifying right under §4B(a)(7)(B). The stakes: the rule sets the operational scope of network-token status.

The SEC rulemaking under §4B(a)(5)(B)(iv)(II) on custodial and ancillary staking services. The rulemaking will define when custodial staking services are “exclusively administrative or ministerial in nature.” That line decides whether bank-and-exchange custodial staking products fit within the gratuitous-distribution framework.

The joint SEC-CFTC-Treasury rulemaking under §404(c)(3) on stablecoin yield. One year deadline. The rulemaking will draw the line between deposit-equivalent yield (prohibited) and activity-based rewards (permitted). Stablecoin product design lives or dies on where that line lands.

The SEC rulemaking under §301(b) on non-decentralized finance trading protocols. The rulemaking will determine which DeFi protocols are subject to Exchange Act registration and BSA obligations. The operational status of the major DeFi protocols turns on this one.

The Treasury rulemaking under §307(c) on the self-hosted wallet risk assessment. The assessment will inform any subsequent Treasury guidance and is the operational ground for future framework decisions.

The joint SEC-CFTC rulemaking under §402 on portfolio margining. The rule will address cross-margining of securities, swaps, futures, and digital commodities, with bankruptcy and SIPA treatment implications.

The Federal Reserve-OCC-FDIC rulemaking under §403 on capital requirements for netting agreements. One year deadline. The rule will address capital recognition for close-out netting of digital-commodity transactions.

The SEC rulemaking under §15H(d) on the four additional categories of DeFi-related activities (user interfaces, DGS administration, DEX participation, wallet-software distribution). The rulemaking will define the operational safe harbors for software developers and publishers.

The structural reality is that the operational landscape after enactment will be shaped by these rulemakings as much as by the statutory text. The comment-letter process is where those lines get drawn, and it will reward aggressive engagement, individually and through trade associations.

The Unanswered Architectural Question: Agency Capacity

The principal unanswered question that runs across all of the above is whether the SEC, CFTC, Treasury, and the federal banking agencies have the capacity to execute the rulemaking calendar in the deadlines CLARITY establishes. The SEC has substantial digital-asset expertise developed during the enforcement era; the question is whether that expertise can be redeployed effectively to rulemaking. The CFTC has historically been understaffed for its mandate; the substantial expansion of jurisdiction under CLARITY does not come with proportionate budget increases.

The structural risk is that the post-enactment operational framework develops more slowly than the statutory deadlines envision, with the industry operating in interpretive uncertainty until the rulemakings are finalized. The §4B(d)(3) deemed-approval mechanisms and the §305 good-faith-reliance safe harbors provide some structural protection during the interpretive interim. The §906 effective-date framework provides additional structural protection by deferring substantive operational requirements until rulemakings are complete.

The Watchlist

The watchlist is the rulemaking calendar, the cross-reference legislation (Lummis-Gillibrand RFIA for tax, state UCC Article 12 adoption for property law, EU AMLR coordination for cross-border AML), and the inter-agency coordination mechanisms (SEC-CFTC MOU, Treasury-federal-banking-agency coordination, federal-state coordination on money-transmitter and securities-blue-sky issues).

The architectural commitments are now in bill text awaiting a signature. The operational details are in flux. The next twelve to twenty-four months will determine the practical scope of those commitments. Lawyers who engage in the rulemaking process, monitor the companion calendars, and track state-law adoption will advise with more certainty than those who treat CLARITY as a finished framework. The bill is a foundation, not a building. The building is still under construction.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

§305 of CLARITY would extend this framework to digital-asset transactions. A covered person (a permitted payment stablecoin issuer, a registered foreign issuer, or a digital-asset service provider) may implement a “temporary hold” delaying execution of a transaction, conversion, or withdrawal for up to 30 calendar days, extendable to 180 days by qualified written request from a covered agency. The trigger is either (i) a reasonable belief the transaction relates to an action or attempted violation of state or federal law, or (ii) a qualified written request from a covered law-enforcement agency. §305(b) provides immunity from private rights of action for good-faith compliance. The structural similarity to the §5318(g)(3) bank-fraud-hold framework is intentional.

The §305(a) Definitions and the §305(b) Immunity

§305(a) provides the operative definitions. A “covered agency” is any state or federal law-enforcement agency, including the Department of the Treasury. A “covered person” is a permitted payment stablecoin issuer, a registered foreign payment stablecoin issuer, or a digital-asset service provider as defined in §2 of the GENIUS Act. A “qualified written request” is a written communication from an authorized official of a covered agency that (A) identifies a specific wallet, address, account, or transaction reasonably suspected of being linked to illicit activity; (B) requests the covered person initiate an action with respect to the specified wallet, address, account, or transaction, including delaying the execution of a transaction, conversion, or withdrawal; and (C) includes a designated agency contact. A “temporary hold” is a restriction applied by a covered person that delays execution of a transaction, conversion, or withdrawal involving digital assets for a reasonable period of time, not to exceed 30 calendar days, extendable to an additional 150 calendar days (for a total of 180 days) pursuant to a qualified written request.

§305(b)(1) is the immunity provision. A covered person that implements a temporary hold in good faith and in compliance with §305 is not liable under any federal or state private right of action for implementing the hold, provided three conditions. (A) The covered person implements the hold based on reasonable belief the transaction relates to an action or attempted violation of state or federal law, or after receiving a qualified written request from a covered agency. (B) The covered person makes reasonable efforts to notify the affected customer of the hold, or reasonably determines that notification would impede actual or potential law-enforcement efforts, or receives a qualified written request that requests notification not be attempted. (C) The covered person notifies as soon as reasonably practicable an appropriate state or federal law-enforcement agency or the Federal Trade Commission, unless the covered person has received a qualified written request from a covered agency (which functions as the equivalent of advance notification).

The three conditions are structured as alternatives within each subparagraph. Reasonable-belief implementation or qualified-written-request implementation under (A); notification or non-impediment determination or qualified-written-request-with-non-notification under (B); law-enforcement notification or qualified-written-request-substitute under (C). The structural intent is to permit either private-actor-initiated holds (with notification to law enforcement) or law-enforcement-initiated holds (with no separate law-enforcement notification required because the request itself constitutes coordination).

§305(b)(2) requires the covered person to maintain documentation for three years following the implementation of a hold, and to make the documentation available to a covered agency, the FTC, or the Secretary of the Treasury upon request. The documentation requirement operates as the audit trail for the hold mechanism and as the basis for any subsequent regulatory review.

The Qualified-Written-Request Structure

The qualified-written-request mechanism is the structural innovation of §305. It permits law-enforcement agencies to obtain pre-seizure freezes on specific digital-asset wallets, addresses, accounts, or transactions through a written request rather than through judicial process. The Right to Financial Privacy Act, 12 U.S.C. §§ 3401-3423, regulates law-enforcement access to financial records and ordinarily requires customer notice and either consent or judicial process. The §305 framework operates as a parallel pre-seizure freeze authority that does not require judicial process but is subject to specific procedural requirements.

The structural elements of the qualified written request matter. (A) requires identification of a specific wallet, address, account, or transaction. Generic or category-based requests do not qualify. The request must be targeted to specific assets or specific transactions reasonably suspected of being linked to illicit activity. (B) requires the request to specify the action sought (delay, hold, or similar restriction). The request cannot be a generic monitoring or surveillance request; it must specify the freeze action. (C) requires a designated agency contact, which provides accountability for the request and a point of contact for further coordination.

The reasonable-suspicion standard is operationally important. The qualified written request must identify the targeted assets as “reasonably suspected of being linked to illicit activity.” The reasonable-suspicion standard is below probable cause (which would be the standard for judicial process) but above arbitrary or pretextual suspicion. The structural choice is to permit law-enforcement intervention at a lower evidentiary threshold than judicial process while requiring specific targeting and articulable basis.

The 30-day initial freeze and 180-day maximum freeze are calibrated against the structural realities of digital-asset investigation. A 30-day initial freeze gives law enforcement time to develop additional investigative facts. A 180-day maximum total freeze (with one extension) is the practical upper bound for pre-seizure investigation before judicial process is required for continued asset control. The framework operates as a bridge between the immediate suspicion-of-illicit-activity moment and the formal judicial-process moment that follows.

The Reasonable-Belief Alternative

§305(b)(1)(A)(i) permits a covered person to implement a hold based on the covered person’s own reasonable belief that the transaction relates to an action or attempted violation of state or federal law. The covered-person-initiated hold operates without law-enforcement involvement at the front end. The covered person makes its own reasonable-belief assessment, implements the hold, notifies law enforcement, and maintains documentation.

The reasonable-belief standard is the covered person’s belief, supported by articulable facts available to it. The standard maps onto the bank-fraud-hold framework under §5318(g)(3) and the SAR-filing reasonable-suspicion standard. Compliance staff at digital-asset service providers, like compliance staff at banks, develop transaction-monitoring programs that flag suspicious transactions based on pattern recognition, blockchain analytics, sanctions screening, and similar tools. A flagged transaction that supports a reasonable belief of legal violation can be subject to a §305 hold.

The structural protection under §305(b)(1) is that the covered person’s reasonable-belief determination receives qualified immunity from private rights of action. A customer whose transaction is held under §305(b)(1)(A)(i) cannot, by virtue of the §305 immunity, recover damages from the covered person for the hold, even if the suspicion turns out to be incorrect, provided the covered person complied with the §305 procedural requirements. The structural choice is to encourage covered persons to exercise reasonable-belief hold authority by providing immunity for good-faith implementation.

§305(c) Rules of Construction

§305(c) provides four rules of construction limiting the §305 framework. Each is structurally important.

• §305(c)(1) clarifies that nothing in §305 compels or requires any covered person to take action to freeze, seize, or block digital assets that is not otherwise required under existing federal or state law. The §305 framework is permissive, not compulsory. A covered person may implement a §305 hold; it is not required to. The structural choice is to provide a safe harbor for proactive compliance without imposing affirmative obligations.

• §305(c)(2) preserves federal-agency enforcement authority. The §305 framework does not limit or alter the authority of any government agency, including with respect to authority to pursue enforcement actions. The structural commitment is that §305 is a private-actor tool, not a regulatory framework that displaces conventional enforcement authority.

• §305(c)(3) preserves §5318(g)(3) and SAR-filing requirements. The §305 framework does not limit or affect the §5318(g)(3) safe harbor or any regulation requiring financial institutions to report suspicious activity, and it does not limit or affect any lawful authority to seize or freeze assets pursuant to a lawful order or sanctions designation. The structural commitment is that §305 operates alongside the existing AML/CFT framework rather than displacing it.

• §305(c)(4) addresses extraterritorial application. The §305 framework does not limit the ability of a covered person to apply a temporary hold to any wallet, address, account, or transaction located outside the United States. The structural choice is to permit covered persons to implement holds on extraterritorial assets within their control, consistent with the structural reality that digital-asset transactions are inherently cross-border.

§305(e) Court-Order Compliance for PPSIs

§305(e) imposes a separate compliance obligation on permitted payment stablecoin issuers. A PPSI shall comply with any valid writ, process, order, rule, decree, command, or other requirement issued or promulgated under federal law by a court of competent jurisdiction that (1) requires a person to freeze or prevent the transfer of payment stablecoins; (2) specifies the payment stablecoins or accounts subject to blocking with reasonable particularity; and (3) is subject to judicial or administrative review or appeal, as provided by law.

The §305(e) court-order-compliance framework is structurally distinct from the §305(a)-(d) qualified-written-request framework. The court-order framework involves judicial process (a writ or order issued by a court), specific particularity (the stablecoins or accounts subject to blocking must be identified with reasonable particularity), and judicial review (the order must be subject to review or appeal). The framework operates as the formal-process counterpart to the §305(a)-(d) qualified-written-request-and-reasonable-belief framework.

The PPSI-specific scope of §305(e) reflects the structural importance of stablecoin compliance for the broader payments system. PPSIs are the regulated issuers of dollar-denominated stablecoins under the GENIUS Act framework. Their compliance with court-ordered freezes is operationally significant because PPSIs have the technical authority to freeze stablecoins (typically through the smart-contract permissions in the stablecoin contracts). The §305(e) framework commits PPSIs to using that authority in compliance with judicial process.

The structural significance of §305(e) is that PPSIs operate under judicial-process-compliance obligations parallel to those of traditional financial intermediaries. A court-ordered freeze of a bank account is followed; a court-ordered freeze of a stablecoin balance held in a PPSI-issued stablecoin must also be followed. The framework treats PPSIs as functional equivalents of banks for court-process purposes.

Civil-liberties concerns and the structural guardrails

The §305 framework will draw civil-liberties concerns. Pre-seizure freezes by private actors, with qualified immunity and reduced procedural protections compared to judicial process, are inherently in tension with the Right to Financial Privacy Act framework and with Fourth Amendment principles. Carpenter v. United States, 585 U.S. 296 (2018), tightened the Fourth Amendment analysis for digital data held by third parties. The third-party doctrine that historically supported broad government access to bank records is more constrained post-Carpenter. Civil-forfeiture jurisprudence, including Timbs v. Indiana, 586 U.S. 146 (2019), has tightened the constitutional limits on pre-conviction asset seizure.

The §305 framework’s structural guardrails are responsive to these concerns. The qualified-written-request requirement provides specificity (specific wallet, address, account, or transaction must be identified). The reasonable-suspicion standard provides articulability (the request must identify the targeted assets as reasonably suspected of being linked to illicit activity). The 30-day initial limit and 180-day maximum provide duration constraints. The notification requirements (unless impediment is reasonably determined or the qualified written request requests non-notification) preserve customer notice. The documentation requirements (three-year retention, agency access) provide audit-trail accountability.

The structural balance is the policy choice: pre-seizure intervention at a lower evidentiary threshold than judicial process, with procedural protections calibrated to the digital-asset transaction-velocity context. Whether the balance is correct is a contestable policy judgment. The §305 framework’s structural commitments are at least more articulate than the alternative posture of either (i) no pre-seizure freeze authority for digital-asset transactions, leaving illicit-finance flows unrestrained until judicial process is obtained, or (ii) broad pre-seizure freeze authority without specific procedural protections.

The most direct civil-liberties analog to §305 is the OFAC Tornado Cash designation arc. The August 8, 2022 OFAC SDN listing of Tornado Cash smart-contract addresses functioned as a pre-seizure asset block, with the OFAC designation operating as the trigger and the IEEPA enforcement framework operating as the legal basis. Coin Center v. Yellen, 5:22-cv-00149 (E.D. Ky.), and Van Loon v. Department of the Treasury, 122 F.4th 549 (5th Cir. 2024), litigated the constitutional limits of that mechanism, with the Fifth Circuit holding in Van Loon that immutable smart contracts were not “property” capable of being blocked under IEEPA. The §305 framework is structurally distinct from the OFAC framework: §305 operates against transactions held by covered persons within their control, not against immutable smart contracts. But the policy concerns about pre-seizure asset restraint apply across both frameworks.

§306 Voluntary Cybersecurity Program

§306 sits structurally adjacent to §305. It directs NIST to establish a voluntary cybersecurity program for persons developing decentralized finance trading protocols or engaging in §15H(b) covered activities (as defined in §601, covered in Post #7 of this series). The program criteria address cybersecurity threats, vulnerabilities, auditing and code-security standards, consumer protection, and transparency. The program is voluntary, but adoption can be displayed publicly and federal agencies must consider adoption as evidence of good-faith compliance with the law.

The §306 program operates as a soft-law complement to the §305 hard-law freeze mechanism. The structural choice is to provide both enforcement-side tools (§305 holds) and compliance-side tools (§306 cybersecurity program) to address the digital-asset illicit-finance ecosystem. Protocols that adopt NIST cybersecurity standards under §306 receive recognition that operates as a defensive shield in subsequent regulatory analysis.

Building the Hold Protocol

Four program-design consequences follow for covered persons.

• First, the §305 framework is permissive and operationally significant. Covered persons can implement temporary holds based on reasonable belief of legal violation or qualified written requests from law-enforcement agencies. The immunity from private rights of action is the structural protection that makes the framework usable in practice. Compliance teams should develop transaction-monitoring programs, escalation protocols, and documentation procedures consistent with the §305 framework.

• Second, the documentation requirement does real work. The three-year retention period applies to every temporary hold implemented under §305. Compliance programs should ensure that the basis for each hold (whether reasonable-belief or qualified-written-request) is captured in writing, with supporting evidence and the procedural steps taken. The documentation will be the audit trail for any subsequent regulatory review and the basis for the §305(b) immunity protection.

• Third, the qualified-written-request framework requires coordination with law-enforcement agencies. Covered persons should establish points of contact with the relevant law-enforcement agencies (state and federal), develop response protocols for incoming qualified written requests, and ensure that procedural compliance is consistent. The structural framework operates only if both sides (covered person and covered agency) execute the procedural requirements correctly.

• Fourth, the §305(e) court-order-compliance framework for PPSIs is structurally important for stablecoin issuers. PPSIs should establish compliance programs for court-ordered freezes, including technical capability to implement freezes on specific stablecoin balances, procedures for verifying court-order validity and specificity, and coordination with the Office of the Comptroller of the Currency on supervisory matters relating to court-order compliance.

The §305 framework, like much of CLARITY’s anti-illicit-finance architecture, balances enforcement effectiveness with civil-liberties protection. The balance is contestable on policy grounds. But the structural commitments are at least articulated: targeted requests, specific procedural requirements, duration limits, notification obligations, and documentation requirements. The framework provides covered persons with usable compliance tools and law-enforcement agencies with usable investigative tools, while preserving customer protections that exceed what is available today through the OFAC designation framework or the §5318(g)(3) bank-fraud-hold analog.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

§307 of CLARITY answers the self-hosted wallet question structurally. §307(b) amends 31 U.S.C. § 5312(a)(3)(D) to expressly include digital assets within “monetary instruments,” which has cascading BSA implications. §307(c) requires Treasury to conduct a national-strategy risk assessment that explicitly weighs both illicit-finance risks and civil-liberties benefits of self-hosted wallets. §307(d) is the operational constraint: any Treasury guidance “shall not require a regulated entity to collect... personally identifiable information about the controller of a self-hosted wallet when the controller is not both the customer of the regulated entity and a party to such transaction, except as required by Federal law, including United States sanctions laws and regulations or lawful process.” The 2020 FinCEN NPRM in the form it took would be foreclosed.

§307(b) and the Monetary-Instrument Amendment

§307(b) is short but has cascading consequences. The amendment to 31 U.S.C. § 5312(a)(3)(D) inserts “including digital assets (as defined in section 2 of the GENIUS Act (12 U.S.C. 5901)), as may be applicable,” after “value” in the existing statutory text. The pre-amendment text included “any other instrument or evidence of value, including stored value.” The post-amendment text includes digital assets within that residual category, with an “as may be applicable” qualifier that preserves Treasury’s interpretive flexibility on which digital-asset transactions fall within the BSA monetary-instrument framework.

The structural significance of the §5312(a)(3)(D) amendment runs through the BSA. The monetary-instrument definition is the threshold definition that triggers the BSA’s reporting and recordkeeping framework. Form 8300 reporting (cash transactions over $10,000), suspicious activity reporting (SAR), currency transaction reporting (CTR), and the various record-retention requirements operate against a monetary-instrument predicate. Inclusion of digital assets within the monetary-instrument definition extends the BSA framework to digital-asset transactions, at least in principle.

The “as may be applicable” qualifier is the operational constraint. Not every digital-asset transaction is subject to BSA reporting. Treasury retains authority to specify which digital-asset transactions fall within the BSA framework through rulemaking, guidance, and interpretive positions. The qualifier preserves Treasury’s flexibility to draw lines that reflect the operational realities of digital-asset transactions: peer-to-peer transactions on permissionless networks, smart-contract interactions, decentralized-exchange transactions, and self-hosted-wallet transactions raise different policy considerations than custodial-intermediary transactions.

The §307(b) amendment also has cross-references throughout the BSA framework. The §5318 customer due diligence and SAR-filing requirements operate against monetary-instrument transactions. The §5331 reporting of nonfinancial trades or businesses operates against monetary-instrument transactions. The §5332 bulk-cash-smuggling provisions operate against monetary instruments. Each of these provisions would reach digital-asset transactions to the extent Treasury implements them. The §307(d) operational constraint then layers on top, limiting how Treasury may implement these provisions with respect to self-hosted wallets specifically.

§307(c) the Treasury Risk Assessment

§307(c) directs Treasury, as part of the national strategy for combating terrorist and other illicit financing required under §§ 261 and 262 of the Countering America’s Adversaries Through Sanctions Act, to consider eight enumerated factors. The list is structurally important because it builds civil-liberties analysis into the regulatory baseline.

• (1) illicit activity, such as money laundering and sanctions evasion, involving self-hosted wallets. This is the conventional illicit-finance framing. Treasury is required to assess and quantify the illicit-finance flows through self-hosted wallets, which is what FinCEN had attempted to do as the justification for the 2020 NPRM.

• (2) the effectiveness of, and gaps in, existing methods, techniques, and strategies used by regulated financial institutions in detecting illicit activity involving self-hosted wallets. This is a regulatory-effectiveness assessment that asks whether existing tools (blockchain analytics, transaction monitoring at on-ramps and off-ramps, sanctions screening at custodial intermediaries) are adequate or whether additional tools are needed. The structural choice is to require Treasury to demonstrate the inadequacy of existing tools before proposing new ones.

• (3) any illicit actors, including nation-state actors, that pose a high risk of facilitating illicit activity through the use of self-hosted wallets. This is the threat-actor assessment. North Korean state-sponsored cyber actors (the Lazarus Group and similar operations) have used self-hosted wallets to launder proceeds from cryptocurrency exchange hacks. Russian sanctioned entities have used self-hosted wallets to attempt sanctions evasion. The threat assessment is required, but it is structured to focus on specific actors rather than on self-hosted wallets generally.

• (4) is the civil-liberties counter-balance. Treasury is required to consider “the benefits of the use of self-hosted wallets to (A) enhance user privacy and civil liberties through direct asset custody; and (B) expand financial inclusion and access for communities underserved by traditional financial institutions.” This is the structurally important provision. The 2020 FinCEN NPRM did not engage seriously with the civil-liberties and financial-inclusion benefits of self-hosted wallets. The §307(c)(4) directive requires Treasury to do so in the current risk-assessment cycle.

• (5) end-user and counterparty risks associated with self-hosted wallets, including consumer fraud, cybersecurity, and identity verification. This is the consumer-protection assessment. Self-hosted wallets impose user-protection costs (lost keys, phishing, fraud) that custodial intermediaries internalize. The assessment is required to quantify these costs.

• (6) the use of hardware self-hosted wallets to smuggle digital assets for financing cross-border illicit activity. This is the bulk-cash-smuggling analog. The pre-CLARITY policy debate on this issue centered on whether physical hardware wallets carrying private keys to substantial digital-asset balances are functionally equivalent to bulk-cash transportation across borders. The assessment is required to address the question empirically.

• (7) the use of hardware self-hosted wallets for tax evasion and asset concealment. The IRS and Treasury’s tax-enforcement assessment of self-hosted wallet usage. The cross-reference to the §6045 broker-reporting framework and the Coin Center v. Treasury litigation is implicit.

• (8) other considerations the Secretary may determine appropriate. The residual clause allowing Treasury flexibility on the assessment scope.

The cumulative structure of §307(c) is to require a balanced risk assessment that internalizes civil-liberties and financial-inclusion analysis alongside the conventional illicit-finance analysis. The pre-CLARITY assessment posture, which produced the 2020 FinCEN NPRM, focused predominantly on illicit-finance concerns without serious engagement with the civil-liberties counter-weights. §307(c)(4) and the requirement for assessment under the national-strategy framework would structurally constrain Treasury to do better in the next cycle.

§307(d) the Operational Constraint

§307(d) is where the rubber meets the road. The Secretary of the Treasury “may issue guidance for financial institutions that transact with self-hosted wallets based on the results of the research on benefits and risks required under subsection (c), which shall not (1) require a regulated entity to collect, with respect to any transaction, personally identifiable information about the controller of a self-hosted wallet when the controller is not both the customer of the regulated entity and a party to such transaction, except as required by Federal law, including United States sanctions laws and regulations or lawful process; or (2) be construed to hinder, restrict, or otherwise impair the authority of any Federal agency to investigate, detect, counteract, or prevent illegal activity.”

The §307(d)(1) constraint would foreclose the central element of the 2020 FinCEN NPRM. Treasury could not require a regulated financial institution to collect PII about the controller of a self-hosted wallet who is not both a customer of the institution and a party to the specific transaction. The structural carve-outs are (i) other federal law that requires the collection (including U.S. sanctions law), and (ii) lawful process (subpoenas, court orders, search warrants).

The 2020 FinCEN NPRM would have required institutions to collect PII about counterparties to self-hosted wallet transactions even when those counterparties were not the institution’s customers. §307(d)(1) prohibits exactly that requirement, with the exceptions narrowly drawn. A regulated institution can collect PII about its own customer (because the customer is both the controller of the self-hosted wallet and a party to the transaction; the parenthetical conjunction matters). A regulated institution cannot be required by Treasury to collect PII about the other end of a self-hosted-wallet transaction when that party is not its customer.

The sanctions-law carve-out is important. Treasury can require institutions to screen self-hosted wallet counterparties against the OFAC SDN list, and to refuse transactions with sanctioned addresses. The §307(d)(1) framework does not affect sanctions compliance. What it affects is the affirmative collection of PII about non-customer counterparties for AML/CFT purposes outside the sanctions framework.

The lawful-process carve-out preserves law-enforcement access. A subpoena, court order, or search warrant can compel an institution to disclose information about a self-hosted wallet counterparty regardless of the §307(d)(1) limit on routine collection. The §307(d)(1) framework constrains regulatory authority over data collection; it does not constrain criminal-procedure authority over evidence gathering.

§307(d)(2) preserves federal-agency authority over illegal activity investigation, detection, counteraction, and prevention. The §307(d)(1) constraint does not impair these authorities. The structural choice is to preserve enforcement authority while constraining regulatory authority over routine data collection.

Why the 2020 NPRM Could Not Come Back

The principal substantive consequence of §307(d) is that the 2020 FinCEN NPRM, in the form it took, could not be reissued. The proposed rule would have required money services businesses to collect, record, and report PII about counterparties to self-hosted wallet transactions above $3,000 (for recordkeeping) and $10,000 (for reporting), even when those counterparties were not customers of the reporting institution. The collection requirement is exactly the activity §307(d)(1) prohibits.

Treasury would retain authority to require other aspects of the 2020 NPRM. The recordkeeping requirements for the institution’s own customers (where the customer is the controller of a self-hosted wallet and a party to the transaction) are not foreclosed. The reporting of suspicious activity involving self-hosted wallets remains within Treasury’s existing SAR-filing framework. The sanctions-compliance screening of self-hosted wallet counterparties is not foreclosed. What §307(d)(1) eliminates is the centerpiece of the 2020 proposal: the affirmative-collection requirement for non-customer counterparty PII.

The structural effect is that self-hosted wallets would remain a viable financial-privacy infrastructure under U.S. law. Users who hold their own keys can transact with regulated institutions without those institutions being compelled to collect PII about the user’s counterparties. The institution can still satisfy its own customer-identification, customer-due-diligence, and beneficial-owner-identification obligations with respect to its customers. It just cannot be required to extend those obligations to non-customer self-hosted-wallet counterparties.

§307(a)(1) and the Self-Hosted Wallet Definition

§307(a)(1) defines self-hosted wallet as “a digital interface (A) that is used to secure and transfer digital assets; and (B) under which the owner of digital assets secured and transferred under subparagraph (A) retains independent control over those digital assets.” The definition is parallel to §605(b)(2) (the Keep Your Coins Act). The two definitions track each other.

The structural element is the “independent control” requirement. A wallet under which the user can independently move funds without the consent or participation of any third party is self-hosted. A wallet under which the user must obtain the consent or participation of a custodian to move funds is not. The MetaMask, Phantom, Rabby, and similar non-custodial wallets are self-hosted. Coinbase Wallet (in its non-custodial mode) is self-hosted. The custodial Coinbase exchange account is not. Hardware wallets (Ledger, Trezor) are self-hosted. Multisig wallets where the user holds enough keys to move funds independently are self-hosted; multisig wallets where the user does not hold enough keys are not.

The “independent control” formulation is the same one used in FinCEN’s 2019 guidance (FIN-2019-G001) to distinguish money-transmitter wallet providers from non-money-transmitter software providers. The structural consistency between FinCEN’s interpretive framework and the §307 statutory framework simplifies the operational analysis: a wallet that satisfies the §307(a)(1) self-hosted definition is also not within FinCEN’s money-transmitter framework under the 2019 guidance, and a wallet provider that creates the wallet without controlling user funds is a non-controlling developer or provider under §604.

Cross-References to §305 and §303

§307 cross-references §305 (temporary hold) and §303 (special measures expansion). The §305 framework, covered in Post #15 of this series, creates a hybrid private-actor freeze mechanism that permits covered persons to delay execution of transactions on reasonable belief of law violation or qualified written request from a covered agency. The §305 framework operates against transactions involving covered persons (permitted payment stablecoin issuers, registered foreign issuers, digital-asset service providers), which means the §305 freeze authority is broader than self-hosted-wallet transactions. But §305(c) preserves §307(d)(1) by stating that the section does not require compelled freezes beyond existing law.

§303 expands FinCEN’s special-measures authority under 31 U.S.C. § 5318A. The special-measures framework permits Treasury to impose targeted reporting, prohibition, or other requirements on specific jurisdictions, institutions, or transactions identified as primary money-laundering concerns. The §303 expansion incorporates digital-asset transactions within the special-measures authority. §303 is structurally distinct from §307: the special-measures authority is targeted (specific entities or transactions identified as primary concerns), while §307(d)(1) addresses routine institution-wide data collection. The two operate at different levels of the regulatory framework.

Comparison to EU AMLR

The EU’s Anti-Money Laundering Regulation, AMLR, adopted in 2024 and entering into force in mid-2027, takes a structurally different approach to self-hosted wallets. The AMLR imposes verification requirements on crypto-asset service providers when transacting with self-hosted wallets above €1,000, with specific identification and counterparty-verification obligations. The EU framework is closer to the 2020 FinCEN NPRM than to the §307 framework.

The divergence between the EU and U.S. frameworks has cross-border implications. A U.S.-domiciled exchange transacting with a self-hosted wallet from an EU user faces the §307(d)(1) constraint on data collection in the United States and the AMLR requirements in the EU. The structural conflict requires either dual compliance (collecting data for EU purposes that the §307(d)(1) constraint does not require for U.S. purposes) or jurisdictional limitations (the exchange does not transact with EU-based self-hosted wallets above the AMLR threshold). The cross-border policy reconciliation is ongoing and is the subject of §507 of CLARITY (international coordination on digital-asset illicit-finance combatting).

§6045 and Tax-Reporting Cross-Issues

The Treasury 2024 Final Regulations on Broker Reporting under §6045, T.D. 10000, extended broker-reporting requirements to certain digital-asset intermediaries. The regulations were challenged in Coin Center v. Treasury and related litigation, with the principal legal claim that the §6045 broker definition could not constitutionally reach non-controlling parties to digital-asset transactions. The §307 framework does not directly address §6045 broker reporting (which is a tax-reporting framework rather than a BSA framework), but the structural commitments in §307(d)(1) and §605 are relevant to the §6045 analysis.

A regulated entity that is a §6045 broker continues to face its broker-reporting obligations. The §307(d)(1) constraint applies to BSA collection, not to tax-reporting collection. But the structural commitment to limiting routine collection of self-hosted wallet counterparty PII implicit in §307(d)(1) provides interpretive support for narrowing constructions of the §6045 broker definition. The Coin Center litigation and its progeny will play out on tax-law grounds, but the §307 framework, if enacted, would stand as an authoritative congressional signal that self-hosted wallets occupy a privileged position in the U.S. financial-regulatory architecture.

The Compliance Consequences

Four compliance consequences follow.

• First, enactment kills the 2020 FinCEN NPRM in the form it took. Treasury could not reissue the proposal as written. The §307(d)(1) constraint forecloses the affirmative-collection requirement for non-customer self-hosted wallet counterparty PII.

• Second, customer-side compliance is unchanged. An institution’s obligations with respect to its own customers (KYC, CDD, beneficial-owner identification, SAR-filing) are not affected by §307. The §307(d)(1) constraint runs against affirmative-collection requirements for non-customer counterparties, not against customer-side compliance.

• Third, sanctions compliance is preserved. The §307(d)(1) sanctions-law carve-out preserves OFAC compliance. Institutions can be required to screen self-hosted wallet counterparties against the SDN list and to refuse transactions with sanctioned addresses. The Tornado Cash designation arc (and the subsequent withdrawal) is an artifact of the IEEPA framework, not of §307. Sanctions compliance continues to operate on its own terms.

• Fourth, cross-border friction is real. The EU AMLR framework imposes obligations that the U.S. §307 framework does not. Institutions operating across both jurisdictions face structural compliance tensions. The §507 international-coordination framework provides a path to resolution, but the timing is uncertain and continued divergence is the near-term planning assumption.

The §307 framework is, in the aggregate, a substantial accommodation of the self-hosted-wallet privacy and financial-inclusion case. It forecloses the 2020 FinCEN proposal, builds the civil-liberties analysis into the regulatory baseline, and makes the constraint on routine collection of non-customer PII statutory. The remaining questions are how Treasury implements the §307(c) risk assessment, how the resulting guidance is drafted, and how cross-border friction with the EU AMLR is managed. The architectural commitment to self-hosted wallets as legitimate financial infrastructure is now in the bill text, one signature away from statutory law, and enactment would end the policy debate over the 2020 NPRM.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

§505 of CLARITY would put the wrapper-escape argument to rest. The section provides that tokenization does not change the substantive securities-law character of the underlying asset. Equity tokens remain equity. Debt tokens remain debt. Fund-interest tokens remain fund interests. The Commission may adapt the manner in which regulatory requirements are satisfied to accommodate the technological characteristics of digital assets, but it may not adapt the substantive applicability of the federal securities laws. The §505(b) sense-of-Congress endorses state adoption of UCC Article 12. The §505(h)(1) savings clause is explicit: an asset that is a security under federal law does not cease to be one solely because it is issued, recorded, represented, or transferred using DLT.

The Parity Rule

§505(d) is the operative provision. §505(d)(1) provides that, subject to §505(d)(2), a tokenized security shall be treated, for all regulatory purposes, as the security that the tokenized security represents, except as otherwise provided by §106(a) or by a rule, regulation, or order issued by the Commission. The structural commitment is direct: the tokenization process does not change the substantive securities-law analysis.

§505(d)(2) is the limit on Commission rulemaking authority. A rule, regulation, or order described in §505(d)(1)(B) may only be issued by the Commission to adapt the manner in which the applicable regulatory requirements are satisfied, to the extent necessary or appropriate (A) in light of the unique technological or other characteristics of digital assets or substantially similar technology, or (B) consistent with what is necessary or appropriate in the public interest and protecting investors, maintaining fair, orderly, and efficient markets, and facilitating capital formation. The Commission’s adapting authority extends to the manner in which the regulatory requirements are satisfied. It does not extend to the substantive applicability of the requirements themselves.

The distinction matters operationally. A tokenized equity security is subject to §11 disclosure liability, §12(a)(2) prospectus liability, §10(b) and Rule 10b-5 anti-fraud liability, §13 reporting obligations, §16 insider-trading obligations, and §14 proxy obligations, on the same terms as a non-tokenized equity security. The Commission may issue rules adapting how the §13 reports are filed (e.g., permitting on-chain disclosure as an alternative to EDGAR filing for tokenized issuers, or requiring specific reconciliation between on-chain transfer-agent records and traditional transfer-agent records). The Commission may not issue rules exempting tokenized equity securities from §13 reporting altogether. The substantive obligation is fixed by statute; the operational form of compliance is within Commission rulemaking authority.

The §106 cross-reference is to the general exemptive authority CLARITY grants the Commission. §106(a) provides additional exemption authority in specified circumstances. §505(d)(1)(A) preserves Commission ability to apply §106 to tokenized securities, but the operative scope of §106 is established elsewhere in the bill. The bulk of the substantive parity rule operates through §505(d)(2), which constrains the Commission’s adapting authority to operational rather than substantive modifications.

§505(f) Commission Rulemaking Authority

§505(f) authorizes the Commission to issue rules governing tokenized securities consistent with §§ 106 and 107. §505(f)(2) lists the specific topics the rules may address: how requirements applicable to the underlying security apply to custody, books and records, reconciliation with transfer agents or other recordkeepers, auditability, settlement finality, treatment of chain reorganizations, and other operational risks arising from the use of DLT or comparable technology.

The enumerated topics are operational rather than substantive. Custody rules address how a tokenized security is custodied (smart-contract-based custody, custodial intermediary holding the keys, hybrid arrangements). Books-and-records rules address how on-chain records integrate with traditional broker-dealer books-and-records requirements under Rule 17a-3 and 17a-4. Reconciliation rules address how transfer-agent records (typically maintained off-chain) reconcile with on-chain transfer records (which may not match where the on-chain transfer is restricted or the off-chain transfer is unrestricted). Auditability rules address how auditors validate on-chain records. Settlement finality rules address when a transaction is final for purposes of payment-versus-delivery and clearing obligations. Chain-reorganization treatment addresses what happens when an on-chain transfer is reorganized away (a rare but non-trivial issue on some chains).

If the bill is enacted, the Commission’s rulemaking under §505(f) is going to be substantial. The structural choice is to permit operational flexibility within the existing substantive framework. The BlackRock USD Institutional Digital Liquidity Fund (BUIDL), the Franklin Templeton OnChain U.S. Government Money Fund (BENJI), and the various JPMorgan Onyx/Kinexys tokenization platforms are all operating under pre-CLARITY interpretive postures that the §505(f) rulemaking will codify. The rulemaking will have to take up the operational rough edges that have emerged in practice: chain-reorganization handling, transfer-agent reconciliation, custody arrangements for institutional investors, and integration with traditional clearing-and-settlement infrastructure.

§505(b) and UCC Article 12

§505(b) is a sense-of-Congress endorsing state adoption of UCC frameworks providing clear and uniform rules for the ownership, control, and enforceability of rights relating to digital assets. The reference is implicit but unmistakable: UCC Article 12 on Controllable Electronic Records.

UCC Article 12 was adopted in final form by the Uniform Law Commission and the American Law Institute in 2022. The article defines “controllable electronic record” as a record stored in an electronic medium that can be subjected to control, and provides take-free rules, attachment and perfection rules, and priority rules for security interests in CERs. As of mid-2026, more than thirty states had adopted Article 12 or were considering adoption.

The §505(b) sense-of-Congress is not preemptive. State law continues to govern the property-law side of tokenized securities transactions. But the federal-policy signal is supportive of UCC Article 12 adoption, and the §505(h)(2) savings clause preserves state property-transfer rules from §505 preemption. The structural choice is to leave the property-law framework to state law (consistent with the post-Erie architecture of commercial law in the United States) while federalizing the securities-law treatment.

A tokenized security issued in a state that has adopted UCC Article 12 sits in a clearer property-law framework than one issued in a non-Article-12 state. Holders of tokenized securities can rely on Article 12’s take-free rules for good-faith purchase, the attachment-and-perfection rules for security interests in CERs, and the priority rules for competing claims. The §505 federal-securities-law parity rules layer on top of the Article 12 framework. The state-law venue and its Article 12 adoption status belong on the structuring checklist.

The Savings Clauses

§505(h) provides four savings clauses. §505(h)(1) is the principal one: any asset that is a security under the federal securities laws does not cease to be a security solely because the asset is issued, recorded, represented, or transferred using DLT or comparable technology. This is the structural commitment to substance-over-form analysis. The wrapper-escape argument would be foreclosed by statute.

§505(h)(2) preserves state property-transfer rules. The §505 federal-law parity framework does not preempt, supersede, invalidate, or otherwise affect state property-transfer rules, laws, regulations, or common-law principles relating to the transfer or recording of real, tangible, or intangible assets or interests in them. The structural choice is consistent with the §505(b) endorsement of state-law UCC Article 12 adoption: federal securities-law treatment is harmonized, but state property-law treatment remains state law.

§505(h)(3) preserves §106 rulemaking authority. The Commission’s exemptive authority under §106 applies to any rulemaking, order, or other action under §505. The §106 exemptive authority operates as a general flexibility tool that can address tokenization-specific issues that arise outside the §505(f) operational rulemaking framework.

§505(h)(4) preserves the ability of persons to offer or sell tokenized securities consistent with the federal securities laws. The §505 framework is not a registration regime or a permissioning regime. It is a clarification that tokenized securities operate under existing federal securities law with operational adaptations. Persons can offer and sell tokenized securities under §3, §4(a)(2), §4(a)(6), Reg D, Reg A, Reg CF, or under registered offerings on the same terms as non-tokenized securities, subject to the §505(f) operational rules.

§505(e) and §505(g) Anti-Fraud Preservation

§505(e) prohibits misrepresentation. Any statement or omission with respect to any material fact made by a person in connection with the offer, sale, or other representation regarding a tokenized security is subject to the federal securities laws, including the applicable anti-fraud and anti-manipulation provisions. The structural choice is to preserve anti-fraud authority as fully applicable to tokenized securities transactions.

§505(g) is the parallel rule of construction. Nothing in §505 prevents the Commission from enforcing the anti-fraud and anti-manipulation provisions of the federal securities laws, and the rules issued under them, with respect to tokenized securities, provided that the elements of those provisions are satisfied. The §10(b) and Rule 10b-5 framework, the §17(a) framework, and the §13(b)(5) books-and-records anti-fraud framework all apply to tokenized securities on the same terms as non-tokenized securities.

The structural commitment to anti-fraud preservation is consistent with the broader CLARITY architecture. Throughout the bill, the registration-and-disclosure framework is being modified to accommodate digital-asset characteristics, but the anti-fraud overlay is preserved. The §505(e) and §505(g) provisions extend this commitment to tokenized securities.

§506 Post-Quantum Ccryptography

§506 is a sense-of-Congress and technical-assistance provision on post-quantum cryptography. It directs the Under Secretary of Commerce for Standards and Technology to promote voluntary adoption of NIST post-quantum cryptography standards, through dissemination of guidance, technical assistance to high-risk entities, and other activities. The provision is structurally separate from §505 but operationally important: tokenized-securities infrastructure relies on cryptographic primitives that are vulnerable to quantum-computing attacks, and the long-term security of tokenized financial markets depends on cryptographic upgrades.

The §506 framework is voluntary rather than mandatory. The Director’s role is to promote, not to require, post-quantum cryptography adoption. The structural choice reflects both the immaturity of post-quantum cryptography standards (as of 2026, the NIST standards are recent and operational deployment is in early stages) and the cost-and-complexity considerations of migration. For long-duration tokenized-securities transactions, the §506 framework is a leading indicator of future infrastructure requirements.

Comparing to MiCA

The EU’s Markets in Crypto-Assets Regulation provides a useful comparison. MiCA takes a similar substance-over-form posture: financial instruments wrapped in token form remain financial instruments under the EU’s existing financial-instruments framework (MiFID II), and the crypto-asset categories in MiCA (asset-referenced tokens, e-money tokens, other crypto-assets) cover non-security tokens. The MiCA framework, like CLARITY, separates the securities/financial-instruments treatment from the crypto-asset treatment, with the substantive analysis running on the underlying economic character of the instrument.

The principal differences are operational rather than substantive. MiCA includes detailed disclosure-and-conduct rules for crypto-asset service providers (CASPs) that are not directly paralleled in CLARITY’s framework. CLARITY’s §505 framework is narrower in scope: it addresses tokenized securities specifically, with the §4B, §301, and §401 frameworks addressing the non-security side. The U.S. framework is generally more permissive than MiCA on the non-security side (CLARITY’s network-token framework is broader than MiCA’s “other crypto-assets” category) and approximately parallel on the security side (both regimes preserve substantive securities/financial-instruments law).

The cross-border implications matter for transactions that touch both regimes. A tokenized equity security issued under §505 in the United States and offered to EU investors will be subject to MiFID II in the EU and to the federal securities laws in the United States, with the §505 framework providing parity-of-substantive-treatment in the United States and MiFID II providing parity in the EU. The operational integration of the two frameworks is where the work sits.

Building on the Parity Rule

Four consequences follow for deal design.

• First, the wrapper-escape argument is doctrinally dead today and statutorily dead the day CLARITY is signed. Tokenization does not change the substantive securities-law analysis. Equity remains equity, debt remains debt, fund interests remain fund interests. Issuance structures and offering documents should be designed on the assumption that the underlying-security analysis controls.

• Second, the operational rulemaking under §505(f) will determine the practical scope of tokenization. Custody, books-and-records, reconciliation, auditability, settlement finality, and chain-reorganization treatment are the operational dimensions on which the Commission will draw lines. The comment-letter process is the chance to shape those lines, and it will reward early, use-case-specific engagement.

• Third, state-law adoption of UCC Article 12 is the property-law foundation. The federal §505 framework operates against state-law property rules, and the state-law framework is most coherent where Article 12 has been adopted. Venue selection should track Article 12 adoption.

• Fourth, anti-fraud preservation is full and substantive. The §505 framework does not reduce anti-fraud exposure for tokenized-security issuers, intermediaries, or representatives. Disclosure quality, accuracy of representations, and absence of material omissions are as important under §505 as they are for traditional securities. The tokenization wrapper does not provide a shield against §10(b), Rule 10b-5, §17(a), or §13(b)(5) liability.

The §505 framework, in the aggregate, would accomplish a clean codification of what most practitioners already believed but could not point to a statute for: tokenization is a technical-form decision, not a substantive-treatment decision. The federal securities laws apply to tokenized securities on the same terms as non-tokenized securities, with operational adaptations to accommodate distributed-ledger characteristics. The remaining work is at the operational level, where the §505(f) rulemaking, state-law UCC Article 12 adoption, and integration with the broader CLARITY framework will play out over the next several years.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

§602 of CLARITY would end the enforcement-discretion era. It defines an NFT through four traits, creates a strong safe harbor with three narrow exceptions, and provides a good-faith-reliance protection that immunizes parties who reasonably rely on the safe harbor. The structural choice is to draw a categorical line, leaving discretionary case-by-case enforcement only for transactions that genuinely involve all the elements of an investment contract. The §602(b)(4) reliance and prospective-effect provisions go further than most CLARITY provisions in giving issuers and platforms confidence about ongoing operations.

The joint SEC-CFTC interpretation effective March 23, 2026, Release Nos. 33-11412 and 34-105020, complements §602 with an interpretive framework that operates at the Howey analytical level. The release classifies crypto assets into five categories, including “digital collectibles,” which the Commission concludes do not themselves constitute securities because they lack the economic characteristics of a security. The illustrative examples in the release include CryptoPunks, Chromie Squiggles, Fan Tokens, WIF, and VCOIN. The release reaches the same bottom-line conclusion as §602 (an NFT itself is not a security) but through a different mechanism: §602 operates as a statutory safe harbor with enumerated exceptions, while the release operates as a Commission interpretation of Howey applied to the digital-collectible category. The two frameworks complement each other. The §602 safe harbor is the primary protection; the joint release supplies the doctrinal foundation and applies even to NFTs that, for whatever reason, fall outside §602’s literal scope.

The Four-Prong NFT Definition

§602(a)(1) defines an NFT through four conjunctive elements. The asset must be recorded on a distributed ledger; (A) individually identifiable and distinguishable from any other digital asset; (B) represent ownership of, or rights in, a work of authorship, art, a collectible, a membership, an access credential, a certificate of authenticity, an in-game or in-application item, or another similar specific item or discrete digital or physical good, service, or benefit; (C) not interchangeable on a 1-to-1 basis with any other token or digital asset; and (D) capable of being bought, sold, or transferred for consideration.

• (A) excludes mass-issued fungible tokens that share identical traits and serial numbers; the asset must be distinguishable from every other asset in the collection. The standard ERC-721 implementation satisfies (A) because each token has a unique tokenId and corresponding metadata. ERC-1155 semi-fungible implementations may or may not satisfy (A) depending on whether the contract issues distinguishable token IDs for each unit or issues fungible balances within a token class.

• (B) is the use-case enumeration. The list is broad and intentionally so. Art, collectibles, memberships, access credentials, certificates of authenticity, in-game items, and the “similar specific item” residual cover almost every meaningful NFT use case in current practice. The PFP collections (Bored Apes, CryptoPunks, Pudgy Penguins) qualify under “art” or “collectible.” Ticketing NFTs qualify under “access credential.” Membership NFTs (the various creator-economy memberships and on-chain subscriptions) qualify under “membership.” In-game items qualify under “in-game or in-application item.” Identity credentials, qualifications, and certifications qualify under “certificate of authenticity.” The use-case enumeration is permissive: an asset that fits within one of these categories is an NFT for §602 purposes.

• (C) is the non-fungibility test. The asset must not be interchangeable on a 1-to-1 basis with any other token or digital asset. This is the structural antifeature: NFTs cannot be perfect substitutes for other tokens. A token that trades 1-for-1 with any other token in the collection (semi-fungible tokens with no meaningful distinguishing traits) does not satisfy (C). The non-fungibility test screens out attempts to call mass-fungible token collections “NFTs” simply by adding nominal serial numbers.

• (D) requires that the asset be capable of being bought, sold, or transferred for consideration. Soulbound tokens, which by design cannot be transferred, do not satisfy (D) and are not NFTs for §602 purposes. The exclusion is not a substantive problem because soulbound tokens are not the subject of the safe harbor (they are not “offered, sold, resold, transferred, or conveyed” in any commercial sense).

§602(a)(2) defines “promoter” as a person or group that manages, controls, or operates an enterprise in which capital is invested, or any person acting on behalf of such a person, including affiliates, agents, and coordinated actors that contribute to capital-raising efforts. The promoter concept is doing important work in the rules-of-construction section, where the resale carve-out is conditioned on payment not flowing to a promoter.

The §602(b)(1) Safe Harbor and the §602(b)(2) Rules of Construction

§602(b)(1) is the operative safe-harbor provision. The offer, sale, resale, transfer, or conveyance of an NFT shall not be deemed to constitute an offer, sale, or distribution of a security or investment contract under the Securities Act, the Exchange Act, or any equivalent state law, unless the transaction, in substance, involves all of the elements of an investment contract. The exception clause is the key. The safe harbor falls only when the transaction involves all of the Howey elements: investment of money, common enterprise, expectation of profits, derived from the efforts of others. A transaction that lacks any one element is within the safe harbor.

§602(b)(2) provides two rules of construction. Subsection (A) excludes from securities treatment “the resale or secondary market transfer of a nonfungible token, where the payment for that resale or transfer does not flow to a promoter or is not used to raise new capital for an enterprise.” The resale carve-out is structurally important. It preserves secondary-market activity even where the primary issuance might have involved investment-contract elements. As long as the payment is between private parties and does not flow back to the promoter or fund new enterprise capital, the secondary transaction is outside the securities perimeter.

Subsection (B) addresses the collectible-appreciation question. An NFT that serves as a collectible, membership right, event ticket, access credential, or other non-investment-based use case is not a security solely because the NFT may appreciate in value or depend in part on continued efforts or the reputation of the creator or issuer. The clause is the legislative answer to the Friel v. Dapper Labs line of reasoning. Under Friel, the fact that Top Shot Moments could appreciate in value, combined with Dapper Labs’ continued maintenance of the platform and curation of the marketplace, was enough to plausibly allege investment-contract elements. §602(b)(2)(B) would override that holding by statute: appreciation and creator-effort-dependence are not, by themselves, sufficient to convert a use-case NFT into a security.

The Three Exceptions

§602(b)(3) carves out three categories where the safe harbor does not apply. The exceptions are narrow and structurally important.

The first exception, §602(b)(3)(A), covers “a mass-minted series of items with substantially similar or nearly identical traits that are marketed or sold interchangeably.” This is the structurally important carve-out. The exception captures the variant of NFT issuance that most resembles a securities offering: a mass issuance of fungible-in-substance tokens with nominal trait differences, marketed as a pooled investment opportunity. The Founder’s Keys and Stoner Cats fact patterns fall within this exception, because the NFTs in those collections shared substantially similar traits and were marketed to purchasers as a coordinated investment in the project’s development.

The “substantially similar or nearly identical traits” phrasing is the operative limit. PFP collections with meaningful trait diversity (Bored Apes, CryptoPunks, the generative-art collections produced by Art Blocks artists) do not fit the exception, because the individual items have distinguishing traits that distinguish them in commercial trade. The collection is non-fungible at the item level. Generative-art drops in which each item has a unique seed but the trait distribution is engineered to produce many “similar” items might be on the edge; the marketing-and-sale-interchangeably qualifier helps draw the line.

The “marketed or sold interchangeably” qualifier is the second operative limit. An NFT collection with distinct traits sold under a single price (a flat mint price for the entire collection) is, on one reading, marketed interchangeably. A collection sold under a price-discrimination scheme based on trait rarity is not. The SEC’s pre-CLARITY enforcement actions tended to involve collections sold at a flat mint price, with the value distinction emerging post-mint based on trait rarity and project development. Those fact patterns map closer to the §602(b)(3)(A) exception than do collections sold under sophisticated trait-based pricing.

The second exception, §602(b)(3)(B), covers “a fractionalized interest in a nonfungible token.” Fractional NFTs (e.g., the historical fractional.art platform model and similar successor models) are not within the safe harbor. The reason is structural: a fractional interest in an underlying asset is an investment in the underlying asset, not a holding of the asset itself. The fractional interest carries economic exposure to the asset’s value without the asset’s specific use rights. The fractional-NFT model resembles a pooled investment vehicle, and the §602(b)(3)(B) exception treats it as such.

The third exception, §602(b)(3)(C), covers “an interest representing a beneficial or economic claim on a nonfungible token or an asset that a nonfungible token represents.” This is broader than (B) and catches derivative instruments on NFTs as well as fractional interests. A token that conveys an economic right to the appreciation of an NFT, or to the appreciation of the underlying asset the NFT represents, is excluded from the safe harbor. The drafting choice prevents the NFT safe harbor from being used to immunize what are, in economic substance, securities derivatives on NFTs.

§602(b)(4) Reliance and Prospective Effect

§602(b)(4) is the unusually generous reliance provision. §602(b)(4)(A) provides that “a person, other than an originator or related person, that reasonably and in good faith relies on the safe harbor under this subsection shall not be subject to any civil or administrative penalties.” The reliance protection is broader than the typical good-faith-reliance safe harbor in CLARITY. The structural choice is to immunize platforms, marketplaces, and other downstream participants who reasonably rely on the safe harbor as to a particular NFT.

The exclusion of originators and related persons is important. An NFT issuer cannot rely on §602(b)(4)(A) to immunize itself from penalties for its own issuance. But a platform that lists the NFT, a marketplace that facilitates resale, an exchange that holds the NFT for customers, or a custodian that provides storage services can rely on the safe harbor. The structural effect is to make platform-level compliance defensible: a platform that maintains a reasonable belief that an NFT qualifies for the safe harbor is not subject to penalty even if the SEC later determines that the safe harbor does not apply.

§602(b)(4)(B) provides the prospective-effect rule. Any determination by the Commission that the safe harbor does not apply to a particular circumstance must be prospective only and must take effect not earlier than 60 days after the Commission publicly posts the determination. The provision prevents the Commission from making post-hoc determinations that the safe harbor did not apply, with retroactive enforcement consequences. The 60-day notice period gives parties time to adjust their conduct or wind down non-compliant offerings.

The combined effect of §602(b)(4)(A) and (B) is to provide a strong front-end protection for NFT marketplaces, platforms, and downstream participants. Reasonable good-faith reliance is protected, and any change in the Commission’s interpretation runs prospectively with at least 60 days’ notice. The structural commitment to operational stability for the NFT secondary market is meaningful.

The Mass-Minted Series Problem

The §602(b)(3)(A) mass-minted-series exception is the operationally significant edge. It is also the most fact-intensive of the three exceptions. Three structural questions follow.

• First, what counts as “substantially similar or nearly identical traits”? A collection of 10,000 PFPs generated from 200 traits across 8 trait categories, with rarity distributions producing meaningful variation in the resulting items, is not “substantially similar.” A collection of 10,000 nominally distinct items where the variation is limited to a serial number or a single trait category (color variations on the same base image) might be. The Commission’s eventual rulemaking or interpretive guidance will need to draw the line, and the line will turn on whether the traits produce commercially meaningful distinctions between items.

• Second, what counts as “marketed or sold interchangeably”? A mint at a flat price where all items are offered without trait disclosure (”blind mint”) and the items are randomly assigned post-mint may be marketed interchangeably even if the resulting items have meaningfully distinct traits. The marketing assesses interchangeability ex ante; the resulting trait diversity may or may not redeem the marketing. A reveal-on-mint structure where buyers can see traits before purchasing, with trait-based pricing, is not marketed interchangeably.

• Third, how does the exception interact with project-development marketing? A project that markets a mass-minted collection as a vehicle for funding ongoing development, with the buyers receiving a “stake” in the project’s success, is closer to the SEC’s pre-CLARITY enforcement targets. A project that markets a collection as a collectible or membership without development-funding implications is further from those targets. The marketing analysis is similar to the §4B(a)(7)(B) disqualifying-rights analysis: what is being sold, and what economic rights does the purchaser actually receive?

An issuer that wants to stay inside the safe harbor should design collections with meaningful trait diversity, price items based on trait rarity where the trait structure permits, and market the collection as a collectible or use-case product rather than as a development-funding mechanism. Projects that follow this design pattern sit comfortably within the safe harbor. Projects that follow the pre-CLARITY mass-mint-with-development-promise model are at risk under the §602(b)(3)(A) exception.

The Resale Carve-Out and OpenSea/Blur

§602(b)(2)(A) preserves resale and secondary-market transfers where payment does not flow to a promoter and is not used to raise new capital for an enterprise. The carve-out is structurally important for the secondary-market platforms (OpenSea, Blur, Magic Eden, and their successors). A secondary transaction between two retail collectors, with payment flowing between them and not to the original promoter, is outside the securities perimeter regardless of how the primary issuance is characterized.

The exception has implications for royalty enforcement, an issue that consumed substantial industry attention in 2022-2024 as OpenSea moved away from creator royalty enforcement and Blur built its market position partly on its zero-royalty model. The §602(b)(2)(A) carve-out treats “payment for that resale or transfer” as not flowing to a promoter, even if a portion of the payment is allocated to a royalty to the original creator. The royalty is paid by the seller, not by the platform, and the §602 analysis treats the royalty as a private contractual arrangement between buyer and seller rather than as a continuation of the primary offering.

The §602(b)(2)(A) carve-out also has implications for revenue-sharing structures embedded in NFT smart contracts. A collection that includes a smart-contract-enforced royalty paid to a multisig controlled by the creator team is operating under a structure where the payment, in part, flows to a promoter. The §602(b)(2)(A) carve-out language (”does not flow to a promoter or is not used to raise new capital for an enterprise”) is disjunctive: a resale where the payment does not flow to a promoter (in any part) is within the carve-out, and a resale where the payment is not used to raise new capital (even if some flows to a promoter as a royalty for past creative work, not new capital-raising) is also within the carve-out. The structural reading is that creator royalties on resales remain compatible with the safe harbor as long as the royalties compensate past creative effort rather than fund ongoing capital-raising for the enterprise.

Fractional NFTs and Beneficial-Claim Derivatives

§602(b)(3)(B) and (C) cover the fractional and beneficial-claim categories. The structural intent is to prevent the NFT safe harbor from being used to immunize what are, in economic substance, securities offerings of fractional interests in collectibles. Fractional.art-style platforms that fractionalized high-value NFTs (CryptoPunks, Bored Apes) into ERC-20-equivalent tokens were operating under pre-CLARITY uncertainty about whether the fractional tokens were securities. §602(b)(3)(B) would resolve the question: fractional interests are not within the NFT safe harbor.

The exception does not categorically prohibit fractional NFTs or beneficial-claim derivatives. It simply removes them from the NFT safe harbor. A fractional NFT may be a security; it may be structured as a permitted offering under Reg D, Reg A, or another exemption; it may be a network token if the underlying NFT collection is held by a properly-constituted DGS and the fractional token has the right economic characteristics. The §602(b)(3)(B) exception means that the fractional token’s securities analysis runs on the §4B network-token framework or on the general securities-law analysis, not on the §602 NFT safe harbor.

The beneficial-claim exception under §602(b)(3)(C) is broader and catches NFT derivatives, NFT-collateralized lending tokens, and NFT-yield products. The exception is structurally important because these products are economic exposures to NFTs rather than ownership of NFTs themselves. The securities analysis runs on the structure of the derivative, not on the safe harbor.

§603 GAO Study

§603 directs the GAO to conduct a study of NFTs covering the nature, size, role, purpose, and use of NFTs; the similarities and differences between NFTs and other digital assets; minting and administration mechanics; storage; interoperability; marketplace scalability; benefits including verifiable digital ownership; risks including intellectual property, cybersecurity, and market risks; integration with traditional markets (music, real estate, gaming, events, travel); use for documents, identification, contracts, licenses, and other records; risks to traditional markets from integration; and levels and types of illicit activity in NFT markets. The GAO is required to publicly release the study within one year of enactment.

The §603 study is the bill’s signal that NFT policy is not settled. The §602 safe harbor is the doctrinal answer for the current market structure. The §603 study is the framework for evaluating whether the safe harbor is appropriately calibrated as the market matures. The §603 study will feed any future revisions of the §602 framework, and the comment-letter cycle around the GAO study itself will be substantive.

Where this Leaves Issuers and Platforms

The practical structure reduces to four points.

• First, the safe harbor is broad and the exceptions are narrow. Most NFT activity in the current market structure is within the safe harbor. Mass-minted collections with substantial trait diversity, marketed and sold under trait-aware pricing, are within the safe harbor. Resale activity is within the safe harbor regardless of the primary issuance’s status, provided the payment doesn’t flow to a promoter or fund new capital-raising.

• Second, the §602(b)(3)(A) mass-minted-series exception is the principal compliance concern for new issuance. Design choices that produce meaningful trait diversity and that price items based on rarity push offerings further from the exception. Marketing focused on the collection’s use case (art, collectible, membership, access credential) rather than on project-development funding pushes offerings further from the exception. The pre-CLARITY enforcement targets (Founder’s Keys, Stoner Cats) fit the exception; well-designed art-and-collectible drops do not.

• Third, fractional-interest and derivative products are outside the safe harbor. Issuers contemplating these products should plan to comply with the general securities-law framework, including possible registration, exemption-based offerings under Reg D or Reg A, or §4B network-token treatment if the structural conditions are met. The §602 safe harbor does not cover them.

• Fourth, the §602(b)(4) reliance protection is operationally significant. Platforms and marketplaces that maintain reasonable good-faith reliance on the safe harbor for the NFTs they list, custody, or facilitate are protected from penalty exposure even if the Commission later determines that the safe harbor does not apply to a particular collection. Platforms should maintain documentation of the reasonable-belief analysis for each listed collection and monitor SEC pronouncements for prospective changes.

The §602 framework would substantially resolve the NFT regulatory uncertainty that consumed industry attention from 2021 to 2025. The safe harbor is broad, the exceptions are narrow and fact-specific, and the reliance protection is generous. The remaining work is at the margin: drawing the mass-minted-series line, addressing fractional NFTs and derivatives, and integrating NFT activity with the broader CLARITY framework. If the bill is signed, the Commission’s enforcement-discretion era for NFTs is over, and the statutory framework that replaces it is materially more accommodating of legitimate NFT activity than the pre-CLARITY enforcement posture suggested.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

§404 of CLARITY resolves the fight with a categorical prohibition that has a broad activity-based exception. The categorical prohibition under §404(c)(1) bars a “covered party” (a digital asset service provider and its affiliates, excluding permitted payment stablecoin issuers and foreign issuers registered with the Comptroller) from paying interest or yield “economically or functionally equivalent” to deposit interest on stablecoin balances held by U.S. persons. The activity-based exception under §404(c)(2) preserves a non-exhaustive list of permissible rewards and incentives that are not deposit-equivalent. The joint SEC-CFTC-Treasury rulemaking under §404(c)(3) would be the comment-letter fight of the post-enactment rulemaking cycle, because the line between “economically equivalent to deposit interest” and “activity-based reward not equivalent” is where the practitioner work lives.

The Structural Choice and the GENIUS Act Companion

§404 sits alongside §4(a)(11) of the GENIUS Act, 12 U.S.C. 5903(a)(11), which prohibits permitted payment stablecoin issuers and registered foreign issuers from paying interest or yield on the stablecoins they issue. The GENIUS Act prohibition runs against the issuer. The §404 prohibition runs against everyone downstream of the issuer in the distribution chain, with the limited exception of foreign-issued stablecoins from non-U.S. issuers operating outside the registered-foreign-issuer framework. The two together cover the spectrum: an issuer cannot pay interest on the stablecoin it issues, and a downstream service provider cannot pay interest on the stablecoin balance the customer holds.

The drafting move is functionally similar to the historical Regulation Q prohibition on interest on demand deposits, 12 C.F.R. pt. 217, which prevented commercial banks from competing for transaction-account deposits on interest-rate terms. Reg Q was eliminated by the Dodd-Frank Act of 2010, but the underlying policy concern (interest-rate competition for transactional liquidity drives bank funding costs up and reduces credit availability) carries through to the §404 stablecoin context. The §404(b) sense-of-Congress provision is explicit about the banking-primacy framing: depository institutions provide financial services integral to the U.S. economy, and the payment of consideration by digital-asset service providers based on payment-stablecoin balances “in a manner that is economically or functionally equivalent to the payment of interest or yield on an interest-bearing bank deposit may inhibit depository institutions’ key functions in the economy of the United States.”

The sense-of-Congress provision also makes the contrary point. Payment stablecoins represent a significant innovation in financial infrastructure that can strengthen the U.S. payments system and the primacy of the U.S. dollar, and activity-based rewards and incentives tied to the use of payment stablecoins and participation in distributed ledger systems are critical to enabling innovation, competition, and consumer adoption. The §404 architecture is structured to permit the latter while prohibiting the former, with the joint rulemaking under §404(c)(3) tasked with drawing the line.

The “Economically or Functionally Equivalent” Standard

§404(c)(1) is the operative prohibition. A covered party shall not, directly or indirectly, pay any form of interest or yield (whether in cash, tokens, or other consideration) to a restricted recipient (a U.S. person who is a customer or user of the covered party) (A) solely in connection with the holding of the recipient’s payment stablecoins, or (B) on a payment-stablecoin balance in a manner that is economically or functionally equivalent to the payment of interest or yield on an interest-bearing bank deposit.

Two formulations, with different substantive content. (A) is the cleanest case: a covered party that pays consideration solely in connection with the holder’s holding of stablecoins, with no other activity required, is paying deposit-equivalent yield. That is the In re BlockFi Lending LLC fact pattern (SEC consent order, $100M, February 2022), the Coinbase Earn fact pattern as alleged in SEC v. Coinbase, Inc., and the Celsius Earn fact pattern. A customer deposits stablecoins; the platform pays the customer a fixed rate based on the balance and duration. (A) prohibits exactly that, and the prohibition is categorical: no rulemaking required, no activity-based exception applies.

(B) is the more interesting formulation. It prohibits payments on a stablecoin balance “in a manner that is economically or functionally equivalent” to deposit interest. The qualifier “economically or functionally equivalent” is the legal standard. The qualifier “in a manner” provides the doctrinal hook. Two structural elements drive the analysis. The economic-equivalence test asks whether the payment produces, in substance, the same economic result as deposit interest: a predictable return on a balance over time, without meaningful additional activity by the holder, with downside protection on principal. The functional-equivalence test asks whether the payment serves the same functional role in the customer’s financial life as deposit interest: a yield on cash held in a transaction account.

The categorical (A) prohibition catches the simple cases. The “economically or functionally equivalent” (B) standard catches the structured cases: products designed to deliver yield-equivalent outcomes through formal compliance with activity-based requirements while economically functioning as deposit substitutes. The joint rulemaking will need to identify the specific operational features that distinguish the two.

The Activity-Based Exception

§404(c)(2)(A) exempts “rewards or incentives based on bona fide activities or bona fide transactions that are not economically or functionally equivalent to the payment of interest or yield on an interest-bearing bank deposit pursuant to the regulations promulgated under paragraph (3).” The exception is conditional on the joint rulemaking, but the exception’s structural breadth is established by the statute.

§404(c)(3)(A) directs the SEC, CFTC, and Treasury, no later than one year after enactment, to jointly promulgate regulations to clarify the circumstances under which the §404(c)(1) prohibition and the §404(c)(2) permissible-rewards exception apply. The rulemaking is required to include a non-exhaustive list of permissible activity-based or transaction-based rewards or incentives, including payments to restricted recipients in connection with or in compensation for any of three categories:

(i) Transaction, payment, transfer, conversion, remittance, or settlement activity, including rebates or incentives provided in connection with the acceptance or use of a payment stablecoin. This is the merchant-acceptance and payment-rewards category. A stablecoin issuer or service provider that pays a rebate on stablecoin payments to merchants, or that pays a cashback equivalent on consumer payments made with stablecoins, is within this category. The structural analogy is credit-card cashback programs and merchant interchange rebates.

(ii) Providing liquidity for market-making activity, posting of collateral in connection with trading, or otherwise putting assets at credit or investment risk. This is the DeFi-and-trading category. A market-making protocol that pays rewards to liquidity providers, a perpetuals exchange that pays rewards to collateral posters, or a lending protocol that pays rewards to depositors who accept credit risk on borrower defaults is within this category. The structural test is whether the holder is putting assets at credit or investment risk. Static cash-equivalent holding is not in. Active liquidity provision with skin in the game is.

(iii) The use of any product or service, including participation in governance, validation, staking, or a loyalty, promotional, subscription, or incentive program. This is the broadest of the three categories and is the one that will determine whether the §404 yield ban has substantive bite. Loyalty programs, subscription-based rewards, governance-participation rewards, and validation-based rewards all sit within this category. The question is what counts as “use of a product or service” and what counts as mere holding.

§404(c)(3)(B) is the structural payoff. It clarifies that payments to restricted recipients of consideration, rewards, or benefits that are permissible under §404(c)(2) and §404(c)(3)(A) “may be calculated by reference to a balance, duration, tenure, or any combination of the foregoing.” This is the critical drafting choice. Activity-based rewards may be measured by balance, duration, or tenure metrics, provided the rewards are tied to qualifying activity. A loyalty program that pays cashback on stablecoin transactions, with the cashback rate increasing based on the customer’s balance, duration of platform tenure, or transaction tenure, is permissible if the underlying activity is qualifying.

The breadth of §404(c)(3)(B) is the structural concession to the crypto-industry position. Activity-based rewards do not have to be flat-rate or transaction-by-transaction. They can be balance-weighted, duration-weighted, or tenure-weighted, provided they are activity-based at the foundation. The economic substance of a balance-weighted activity reward is approximately the same as deposit interest for a customer who engages in any meaningful activity. A 4% annualized cashback rate on stablecoin payments, with the rate paid on the customer’s total balance rather than on transaction volume, looks substantially like 4% deposit interest with a use-it-or-lose-it cliff. The joint rulemaking will need to draw the line, but §404(c)(3)(B) substantially constrains how restrictively that line can be drawn.

§404(c)(4) Anti-Evasion

§404(c)(4) provides the anti-evasion authority. A covered party may not circumvent or evade the §404(c)(1) prohibition or the §404(c)(3) rules. The SEC, CFTC, and Treasury may jointly issue such rules as may be necessary or appropriate to prevent circumvention or evasion.

The anti-evasion language operates as a backstop to the activity-based exception. A program that complies with the literal terms of the §404(c)(2) exception but that, in economic substance, is designed to deliver deposit-equivalent yield to a holder who engages in nominal qualifying activity, is subject to the anti-evasion authority. The joint rulemaking will have to translate evasion into operational terms: what activity threshold is required, what proportionality is required between the activity and the reward, what minimum holding periods or active-use requirements apply.

The principal anti-evasion concern is “rake-back” or “phantom activity” structures: a service provider that pays rewards calculated as percentage of balance to a customer who engages in a single low-friction qualifying transaction per period (a single token swap, a single governance vote) is functionally paying yield on the balance while complying with the literal terms of activity-based reward. The rulemaking will have to confront this structure directly. The likely approach is a proportionality test: the reward must be proportionate to the qualifying activity, not a thin layer of activity supporting a balance-weighted reward.

§404(c)(5) Good-Faith Reliance

§404(c)(5) provides a good-faith reliance safe harbor. A covered party that structures a program in good-faith reliance on §404(c)(2) and §404(c)(3) is not subject to penalties if a subsequent rulemaking or adjudication determines the program falls outside the exception, provided the covered party comes into compliance within 90 days and the violation is not substantially similar to a past violation by the covered party.

The 90-day cure window is operationally meaningful. It permits aggressive program design at the front edge of the §404(c)(2) line, with the protection that the worst-case downside is a 90-day cure rather than penalty exposure. The anti-recidivism limitation prevents repeat offenders from claiming the safe harbor for each new variant of an essentially similar program.

§404(d) Marketing-Representation Prohibition

§404(d) addresses the marketing side of stablecoin yield programs. §404(d)(1)(A) prohibits a covered party from representing that payment stablecoins are investment products, deposits, backed by the full faith and credit of the United States, guaranteed by the U.S. government, subject to FDIC deposit insurance, or subject to NCUA share insurance. §404(d)(1)(B) prohibits representing that compensation paid to a restricted recipient in connection with stablecoin holding, use, or retention is paid or generated by the payment stablecoin itself or the issuer, is risk-free or comparable to deposit interest, or is offered, administered, or paid by a person other than the covered party.

§404(d)(2) prohibits misleading omission of material information necessary to prevent the marketing, promotion, or description from being misleading. The §404(d) prohibitions are structured as marketing-conduct rules rather than as substantive prohibitions on the underlying programs. A program can be lawful under §404(c)(2) and yet be marketed unlawfully under §404(d). The marketing rules are independently enforceable.

§404(e) imposes joint disclosure-rulemaking authority on the agencies, with required disclosures presented in plain English, identifying the circumstances under which compensation is paid, identifying the responsible persons and any affiliations with the issuer, outlining all material terms, and including a statement that payment stablecoins are not investment products, deposits, or government-backed obligations. §404(e)(4) provides that a covered party that provides the required disclosures is deemed not to have made a prohibited representation under §404(d), provided the marketing does not contradict the disclosures and the disclosures are presented in plain English and in a clear and conspicuous manner.

§404(f) Penalties and §404(g) Referral

§404(f) provides civil monetary penalties up to $5,000,000 per violation for knowing and willful participation in a §404(c)(1), (d)(1), (d)(2), or (e)(3) violation. §404(f)(2) provides that separate acts of noncompliance with a common originating cause or arising from the same statement or publication count as a single violation, which limits the multiplication of penalties for systematic compliance failures.

§404(g) directs the SEC and CFTC to refer suspected violations to Treasury, which is the primary enforcement authority under the GENIUS Act framework. The structural choice is to consolidate stablecoin yield enforcement in Treasury rather than to spread it across the three agencies. The SEC and CFTC retain their conduct-rule authority over digital asset service providers, but the §404 enforcement runs through Treasury.

§404(i) Third-Party Payments

§404(i) addresses third-party payment structures. A covered party is not deemed to violate the §404(c)(1) prohibition solely because an unaffiliated third party independently makes a payment with respect to a payment stablecoin, unless the covered party directs or maintains significant influence over the offering of the consideration and the offering would otherwise violate §404(c).

The clarification is operationally important. A merchant that independently pays a customer a discount for paying with stablecoins is not subject to the §404 prohibition, and the stablecoin service provider that facilitates the payment is not deemed to have made the payment. The structural choice is to permit unaffiliated-third-party payments to flow through the stablecoin without the service provider’s involvement being deemed a payment by the service provider. The §404(i) “directs or maintains significant influence” qualifier means that a covered party cannot orchestrate a third-party-payment structure to evade the prohibition.

The Political Economy and the Comment-Letter Fight

If CLARITY is enacted, the joint SEC-CFTC-Treasury rulemaking under §404(c)(3) is going to be the most contested administrative proceeding of the cycle. The banking-lobby comment will press for narrow construction of the activity-based exception, with particular attention to two issues. First, the proportionality between activity and reward: how much qualifying activity is required to support how much reward? A high proportionality requirement (substantial activity required for substantial reward) prevents activity-based programs from functioning as yield substitutes. A low proportionality requirement (nominal activity sufficient for substantial reward) permits activity-based programs to operate as economic equivalents of deposit interest. Second, the calculation-by-reference issue: under what circumstances can rewards be balance-weighted versus transaction-volume-weighted? The banking position will be that balance-weighted rewards are the principal vector for evasion and should be limited.

The crypto-industry comment will press for broad construction of the exception, with corresponding attention to the same two issues from the opposite direction. The proportionality test should be permissive: activity should qualify if it is bona fide, with the agencies declining to inquire into the proportionality of the resulting reward. The calculation-by-reference allowance under §404(c)(3)(B) should be implemented fully: rewards should be calculable on balance, duration, or tenure metrics provided the underlying activity qualifies.

The Treasury position is the swing vote. Treasury’s policy posture on stablecoins, articulated through the GENIUS Act framework and the §404 sense-of-Congress provisions, is supportive of dollar-denominated stablecoin growth as a vehicle for U.S. dollar primacy in global trade and payments. A restrictive §404 rulemaking that suppresses activity-based reward programs would be in tension with that policy. A permissive §404 rulemaking that allows activity-based programs to function as yield substitutes would be in tension with the banking-primacy framing in §404(b)(1). The likely Treasury position is somewhere in the middle: substantive activity required, but not at a level that prevents activity-based programs from operating commercially.

Program Design Under §404

Four structuring consequences follow.

• First, the §404 prohibition is real but narrow. Pure deposit-equivalent yield is out. Activity-based rewards with bona fide qualifying activity are in. The structuring work is in designing programs that satisfy the activity-based exception while delivering the reward economics customers want.

• Second, the proportionality of activity to reward is the principal regulatory risk. Programs that pay substantial balance-weighted rewards on nominal activity will face anti-evasion scrutiny. Programs that scale rewards with activity are structurally safer. The joint rulemaking will draw the line, but the conservative design approach pre-rulemaking is to keep activity-to-reward proportionality reasonable.

• Third, marketing and disclosure are independently enforceable. A program can be substantively lawful under §404(c) and yet generate liability under §404(d) and (e). Plain-English disclosure of the program’s mechanics, identification of the responsible parties, and the boilerplate non-deposit non-investment disclosures are required. The disclosure safe harbor under §404(e)(4) is the operational protection.

• Fourth, the 90-day cure under §404(c)(5) is the front-edge protection. Aggressive program design in the period before the joint rulemaking is final, in good-faith reliance on §404(c)(2) and the published interim positions, is protected if compliance is achieved within 90 days of a later determination. The defensible posture is aggressive design backed by documented good-faith reliance, with cure protocols ready.

The §404 framework is, in the aggregate, more permissive than the banking lobby wanted and less permissive than the crypto industry wanted. The exception swallows much of the rule, but the rule retains meaningful bite for the simple deposit-equivalent programs that drew the most regulatory attention pre-CLARITY. The joint rulemaking will define the operational scope. If the bill is signed, the political economy of stablecoin rewards becomes a regulatory question rather than a legislative one.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

§701 of CLARITY would change that. It amends 11 U.S.C. § 741 to define “ancillary asset” and “digital commodity” by reference to the CLARITY Act §2 definitions, expands the “customer” and “customer property” definitions in §741 to include positions in those assets, and updates §746(b) on the extent of customer claims to cover ancillary assets and digital commodities alongside cash and securities. §701(d) makes the architectural point explicit. In any Subchapter III or IV proceeding, the §701 provisions are to be construed to treat ancillary assets and digital commodities held for customers as customer property required to be distributed according to title 11. §702 supplements §701 by treating digital-commodity transactions as commodity contracts for purposes of the safe-harbor netting and setoff provisions. The combined effect is to extend the customer-property doctrine that has structured securities and commodity broker-dealer bankruptcies for forty years to digital-asset intermediaries, prospectively.

The §741 Amendments

§701(a)(1) is the principal operative provision. It amends 11 U.S.C. § 741 in seven structurally distinct ways.

• First, the existing paragraph numbering in § 741 is reorganized to make room for two new definitions. Existing paragraphs (5) through (9) become (7) through (11); existing paragraphs (1) through (4) become (2) through (5). The reorganization creates space for “ancillary asset” at the new (1) and “digital commodity” at the new (6). Both definitions are pulled by cross-reference from §2 of CLARITY.

• Second, the §701(a)(1)(D) amendments to redesignated § 741(3), which defines “customer,” add a new subparagraph (B) to capture entities that hold a claim against the broker-dealer on account of a digital commodity or ancillary asset received, acquired, or held by the broker-dealer for the customer’s securities account. The existing subparagraph (A) lists six purpose categories under which a holding produces customer status. The new subparagraph (B) extends customer status to ancillary-asset and digital-commodity holdings for any of those six purposes. The structural effect is that an ancillary-asset or digital-commodity holding for one of the six purposes (purchase, sale, loan, pledge, custody, or related transaction) produces customer status with respect to that holding, on the same terms as a securities holding.

• Third, the §701(a)(1)(D)(iv) amendments to the catch-all in redesignated § 741(3)(C) sweep ancillary assets and digital commodities into the residual category of holdings that produce customer status. The amendments insert “ancillary asset, or digital commodity” after “security” in clause (i) and “an ancillary asset, a digital commodity,” after “a security,” in clause (ii). The residual covers holdings not enumerated in subparagraph (A) but that nonetheless qualify, on the broker-dealer’s books or otherwise, as broker-dealer customer holdings.

• Fourth, the §701(a)(1)(E) amendments to redesignated § 741(5), defining “customer property,” add ancillary assets and digital commodities to the list of property types that constitute customer property. The amendments insert “ancillary asset, digital commodity,” after “cash, security,” in the preamble. The structural effect is that customer property includes not only cash and securities held for customers (as under existing law) but also ancillary assets and digital commodities so held.

• Fifth, §701(a)(1)(F) adds the §741(6) digital-commodity definition by cross-reference.

• Sixth, §701(a)(1)(G) amends redesignated § 741(8), defining “net equity,” to include ancillary-asset positions and digital-commodity positions alongside securities positions in the net-equity calculation. Net equity is the calculation that determines a customer’s share of the customer-property pool, and the §741(8) amendment ensures that ancillary-asset and digital-commodity holdings are valued and aggregated with securities holdings for distribution purposes.

• Seventh, §701(b) amends 11 U.S.C. § 746(b), which addresses the extent of customer claims, to cover ancillary assets and digital commodities alongside cash and securities. The §746(b) provision is the operative one for determining the amount a customer can claim in a Subchapter III proceeding.

The cumulative effect of these amendments is to treat ancillary-asset and digital-commodity holdings, for Subchapter III stockbroker-liquidation purposes, the same way securities holdings have been treated since the Subchapter III framework was enacted. The customer-property pool includes ancillary assets and digital commodities. The customer-property distribution under § 766 runs pro-rata across the entire pool, with each customer receiving a pro-rata share based on net equity. The estate-property residue (assets not part of the customer-property pool) is available to general unsecured creditors after customer-property claims are satisfied.

The §746(b) Extent of Claims

§701(b) is short but doctrinally important. § 746(b) governs the extent of a customer’s claim in a Subchapter III liquidation. The existing language limits customer claims to “cash or a security.” The amendment expands the formulation to “cash, a security, an ancillary asset, or a digital commodity.” The result is that customer claims would extend to the digital-asset positions held by the broker-dealer for the customer, on the same terms as cash and securities.

The structural significance is that customer claims are valued by reference to the asset class. A customer who held 10 ETH at the broker-dealer has a claim for 10 ETH (or its cash equivalent, depending on the trustee’s election under § 766). The pre-CLARITY position, exemplified by the FTX claim-valuation methodology, was to value claims in dollars at the petition date, with the customer bearing the upside and downside risk of the underlying asset’s price movement during the case. The post-§701 position is closer to the SIPC net-equity methodology established in SIPC v. Bernard L. Madoff Inv. Sec. LLC, 522 B.R. 41 (Bankr. S.D.N.Y. 2014), which valued customer claims by reference to actual securities holdings rather than fictitious account balances. The asset-denominated claim formulation is more protective of customers in a recovering market and less protective in a declining one.

The §766 distribution mechanic continues to operate. The trustee distributes customer property to customers in proportion to net equity, with any shortfall in customer property satisfied by general estate property up to the extent of net equity, and any surplus in customer property returned to the estate for general distribution. The asset-denominated claim valuation creates the possibility of asset-denominated distributions, which is structurally consistent with the customer’s underlying expectation of receiving the asset rather than its dollar equivalent.

§701(c) Technical Amendments to the Safe-Harbor Provisions

§701(c) makes technical amendments to §§ 546(e), 561, and 752(c) of title 11 to update cross-references following the §741 paragraph renumbering. The substantive change is in §701(c)(1), which amends § 546(e) to reference § 741 generally rather than § 741(7) specifically. § 546(e) is the safe-harbor provision that protects settlement payments from avoidance as preferential or fraudulent transfers. The existing language cross-references § 741(7), which defines “settlement payment.” The post-§701 language references § 741 generally, picking up the updated definitions of customer property, ancillary asset, digital commodity, and net equity.

§701(c)(2) makes parallel amendments to § 561 (which addresses netting under master netting agreements) and §701(c)(3) updates § 752(c)’s cross-reference. The structural effect is to ensure that the safe-harbor framework operates consistently across the updated §741 definitions and the new ancillary-asset and digital-commodity classifications.

§701(d) Clarifications

§701(d) is the architectural clarifier. Three points are made explicit.

• §701(d)(1) preserves the existing SIPA framework. Securities and cash held by a broker-dealer continue to be governed by SIPA, 15 U.S.C. §§ 78aaa et seq. The §701 amendments do not displace SIPA coverage for securities and cash. A broker-dealer that holds both securities and digital commodities for customers will see SIPA coverage continue to apply to the securities-and-cash component and the §701 customer-property framework apply to the digital-commodity-and-ancillary-asset component.

• §701(d)(2) preserves the existing bank-deposit and commodity-contract frameworks. Deposits held by a bank are not affected. Commodity contracts (covered by Subchapter IV of Chapter 7) continue to be governed by the existing commodity-broker framework. The cross-reference to §702, which adds digital-commodity transactions to the commodity-contract safe-harbor framework, is the bridge.

• §701(d)(3) is the operative architectural commitment. In any Subchapter III or IV proceeding, the §701 provisions are to be construed to treat ancillary assets and digital commodities held for customers as customer property required to be distributed according to title 11. This is the no-take-back provision. The customer-property treatment cannot be defeated by clever drafting of customer agreements, terms of service, or omnibus account arrangements that purport to convert customer-asset holdings into estate property. The §701(d)(3) construction directive ensures that, regardless of how the broker-dealer characterized the customer relationship pre-bankruptcy, the customer-property treatment applies in the Subchapter III or IV proceeding.

The Earn-versus-Custody distinction from Celsius survives in modified form. A customer agreement that grants the broker-dealer title to the assets is still a customer agreement that does that. But the consequence is different. Under §701(d)(3), even an Earn-style title-transfer arrangement does not defeat customer-property treatment, because the §701 amendments are construed to require customer-property treatment in any Subchapter III or IV proceeding. The structural choice is to override clever customer-agreement drafting in favor of customer-property protection. This is the post-FTX policy commitment, written into the bill.

§702: Commodity-Contract Treatment

§702 addresses the digital-asset side of the safe-harbor architecture. Subsection (b) provides that a purchase, sale, loan, margin loan, extension of credit, repurchase, reverse repurchase, or other transaction involving a unit of a digital commodity, occurring with a commodity broker, stockbroker, financial institution, financial participant, or securities clearing agency, is deemed to be a commodity contract for purposes of:

• (A) the bankruptcy safe-harbor provisions in §§ 362(b)(6), 362(o), 546(e), 553, 556, 561, and 562 of title 11. These provisions cover the automatic-stay exception for commodity-contract terminations and offsets, the safe-harbor protections from preference and fraudulent-transfer avoidance, and the contractual setoff and netting rights that commodity-contract counterparties have historically enjoyed.

• (B) § 11 of the Federal Deposit Insurance Act (12 U.S.C. 1821), which addresses FDIC receivership treatment of qualified financial contracts. The §702 amendment extends qualified-financial-contract status to digital-commodity transactions, with the consequence that close-out netting and offset rights are preserved in bank FDIC receiverships involving digital-commodity counterparties.

• (C) § 210 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (12 U.S.C. 5390), which addresses orderly-liquidation-authority treatment of qualified financial contracts. The §702 amendment provides parallel treatment under the FDIC’s orderly-liquidation-authority framework for systemically important institutions.

• (D) § 5(b)(2)(C) of SIPA (15 U.S.C. 78eee(b)(2)(C)), which addresses SIPC liquidation treatment of qualified financial contracts. The §702 amendment extends qualified-financial-contract status under SIPA for digital-commodity transactions, which is operationally significant for SIPC-protected broker-dealers that also handle digital commodities.

§702(b)(2) provides that digital-commodity transactions are deemed margin payments for purposes of § 548(d)(2)(B) of title 11. The margin-payment safe harbor under § 548(d)(2)(B) protects transferees of margin payments from fraudulent-transfer avoidance, with the consequence that legitimate margin-call payments in digital-commodity transactions cannot be clawed back as constructive fraudulent transfers.

The structural significance of §702 is that digital-commodity derivatives, repurchase agreements, and securities-lending arrangements receive the same bankruptcy and FDIC-receivership treatment as commodity contracts under the existing framework. The position under current law is uncertain, with the FTX bankruptcy litigation generating substantial commentary on whether digital-commodity derivatives qualified for safe-harbor treatment under § 546(e) and related provisions. §702 would resolve the question by statute.

The Earn-versus-Custody Distinction Revisited

The single most important pre-CLARITY bankruptcy ruling in the digital-asset space was the Celsius Earn-versus-Custody decision. The court held that customer assets held in Celsius’s Earn program were property of the estate because the Earn terms of service granted Celsius title, while customer assets held in the Celsius Custody program retained customer-property status because the Custody terms preserved customer ownership.

The §701 framework treats this distinction in a structurally different way. Under §701(d)(3)’s construction directive, ancillary assets and digital commodities held for customers in a Subchapter III or IV proceeding are customer property regardless of how the customer agreement characterizes the relationship. The implication is that an Earn-style title-transfer arrangement does not defeat customer-property treatment for ancillary-asset or digital-commodity holdings if the broker-dealer is liquidated under Subchapter III or IV. The customer-property pool includes the Earn-program assets, and the pro-rata distribution under § 766 covers Earn customers on the same terms as Custody customers.

The practical consequence is that the Celsius Earn customers, in a hypothetical post-§701 reorganization, would have received pro-rata distributions from a customer-property pool that included the assets they deposited in Earn. The dollar value of that recovery would have been substantially higher than the 30-cents-on-the-dollar general-unsecured-creditor recovery they actually received. The asymmetry between Earn and Custody customers, which produced substantial litigation and customer dissatisfaction in the Celsius case, would be eliminated prospectively.

The §701 framework does not, however, override pre-CLARITY customer agreements or pre-CLARITY bankruptcy proceedings. The Celsius confirmed plan, the Voyager confirmed plan, and the Genesis confirmed plan are not affected. The §701 framework applies prospectively to digital-asset intermediary bankruptcies that begin after the effective date. The §906 effective-date provision is therefore important: §701 applies to cases commenced on or after enactment, and §701’s customer-property treatment is operative for those cases.

Operational Consequences for Intermediaries

If §701 becomes law, the operational consequences for digital-asset intermediaries run in five directions.

• First, customer-agreement drafting changes. Pre-CLARITY, the dominant drafting approach was to either preserve customer title (the Custody model) or transfer title with a yield-promise (the Earn model). The §701(d)(3) construction directive means that the latter would no longer produce estate-property treatment in a Subchapter III or IV liquidation. The customer-agreement choice would matter less for bankruptcy-distribution purposes, though it still matters for the §404 yield prohibition covered in Post #11 and for the SEC’s analysis of the underlying product structure under §4B and §301.

• Second, account-segregation requirements take on new importance. The §701 framework presumes that the broker-dealer maintains records and physical or logical segregation sufficient to identify customer assets. A broker-dealer that comingles customer assets with proprietary assets, or that fails to maintain adequate records of customer holdings, will face the same allocation problems in a Subchapter III liquidation that securities broker-dealers face under SIPA. The Madoff-style fictitious-account-balance problem is avoidable only through rigorous segregation and recordkeeping.

• Third, the §401(g)(1) and §401(g)(2) bank-permitted custody activities discussed in Post #9 take on additional significance. A bank-conducted digital-asset custody operation that satisfies the bank’s existing fiduciary and segregation standards is structurally well-positioned for §701 customer-property treatment in the event of bank failure. The interaction with the FDIC receivership framework, governed by § 11 of the FDI Act as amended by §702, is favorable to customers.

• Fourth, the §702 safe-harbor treatment for digital-commodity transactions is operationally significant for derivatives counterparties. Bilateral digital-commodity derivatives, repurchase transactions, and securities-lending arrangements receive close-out netting and offset protection in the counterparty’s bankruptcy. The structural change reduces counterparty credit risk for digital-commodity derivatives and supports the development of bilateral derivatives markets in digital assets.

• Fifth, the §402 portfolio-margining framework (covered in Post #9) interacts with §701 and §702 in important ways. A customer account that holds both securities positions and digital-commodity positions, with cross-margining authorized by the §402 rulemaking, will face Subchapter III treatment for the entire account in the event of broker-dealer failure. The customer-property framework will need to accommodate the cross-margined positions, and the §402 rulemaking will need to specify how customer-property allocation works across asset classes.

The structural lesson is that, under §701, the U.S. bankruptcy framework for digital-asset intermediaries would line up with the framework for securities broker-dealers and commodity brokers. Customer-property protection becomes the default. The Subchapter III and Subchapter IV procedural mechanics become operative. The pre-CLARITY uncertainty that produced Celsius Earn outcomes and Voyager creditor disputes would be resolved. The remaining policy fight is around the SIPC analog for digital assets: §110 of the bill and the §804 SIPC-consultation framework. But the architectural commitment to customer-property treatment is in the bill text, and the next round of digital-asset intermediary failures under this framework would produce customer recoveries materially more aligned with customer expectations than the post-2022 cycle produced.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

§401 of the engrossed Senate substitute is the legislative end of the arc. The section enumerates fourteen specific bank activities involving digital assets, declares them permissible by statute, authorizes national banks, financial holding companies, federal credit unions, and (by parity) insured state banks and state credit unions to engage in them, eliminates prior-notice and prior-approval requirements outside the existing organic banking statutes, and explicitly excludes the activities from being treated as anything other than the business of banking under 12 U.S.C. § 24 Seventh. Whatever residual question the OCC’s interpretive-letter framework left open about whether banks could do these activities at all is now answered by Congress.

The Fourteen Activities

§401(g) is the operative list. It is best read in full because the breadth of the authority granted only becomes apparent when the activities are read consecutively. The list runs to:

1. providing custodial, fiduciary, or safekeeping services for digital assets;

2. providing related custodial services for digital assets and distributed ledgers, including staking, facilitating digital asset lending, distributed ledger governance services, and advancing funds for the purchase of digital assets or in respect of distributions on digital assets, whether as principal or agent;

3. facilitating customer purchases and sales of digital assets;

4. making loans collateralized by digital assets;

5. engaging in payment activities involving digital assets;

6. purchasing or selling digital assets as principal for any investment or trading purpose;

7. operating a node on a distributed ledger;

8. providing self-custodial wallet software;

9. engaging in derivatives transactions, including related hedging activities, in a manner consistent with 12 C.F.R. § 7.1030 as in effect on the date of enactment;

10. providing brokerage services, including clearing and execution services, whether alone or in combination with other incidental activities;

11. facilitating transactions in the secondary market for all types of digital assets on a riskless principal basis;

12. holding as principal digital assets to the extent incidental to an otherwise permissible activity, including holding digital assets to pay fees arising from distributed ledger system interactions;

13. underwriting, dealing in, or making a market in digital assets; and

14. exercising all such incidental powers as are necessary to carry out any of the activities described in paragraphs (1) through (13).

Read activity by activity, the structural changes are substantial. Custody (g)(1) was confirmed by IL 1170 in 2020 and contested under IL 1179 thereafter. §401 puts it beyond dispute. Related custodial services (g)(2) including staking, lending, governance, and advancing funds were never cleanly addressed in the IL series and were treated as supervisory negotiations under the IL 1179 regime. §401 enumerates them as permitted. The staking authorization in particular intersects with the §4B(a)(5)(B)(iv) custodial staking framework covered in Post #8 of this series: the SEC’s rule defining “exclusively administrative or ministerial” custodial staking will define the operational scope of bank staking services, but the activity itself is statutorily authorized.

(g)(3) facilitating customer purchases and sales is a brokered-execution authority that maps onto bank trading desks operating as agents for customers. (g)(4) lending collateralized by digital assets covers Bitcoin-backed loans, ETH-backed loans, and the broader category of digital-asset-secured lending that pre-CLARITY regulatory uncertainty had pushed into specialty lenders. (g)(5) payment activities involving digital assets is the stablecoin-payment-rails authority and dovetails with the GENIUS Act framework for permitted payment stablecoin issuers.

(g)(6) and (g)(13) are the two most expansive grants and deserve separate attention. (g)(6) authorizes purchasing or selling digital assets as principal for any investment or trading purpose. The pre-CLARITY position on bank principal trading in non-stablecoin digital assets was that such activity was not permissible under 12 U.S.C. § 24 Seventh because digital assets were not securities or otherwise within an enumerated category. (g)(6) overrides that position by statute. National banks can now hold Bitcoin, Ethereum, or any other digital asset on their balance sheets as principal investments, subject to safety-and-soundness oversight. (g)(13) authorizes underwriting, dealing in, or making a market in digital assets. The Glass-Steagall residue that nominally separates underwriting and dealing in securities from commercial banking has no analog in the digital-asset context; (g)(13) authorizes the full investment-bank suite of underwriting, dealing, and market-making for digital assets.

(g)(7) operating a node on a distributed ledger and (g)(8) providing self-custodial wallet software are the infrastructure authorities. Banks can run Ethereum validators, Bitcoin nodes, Solana validators, and similar infrastructure. They can also build and distribute wallet software, including non-custodial wallets where the bank does not hold the underlying keys. The latter is a substantial change from the pre-CLARITY interpretive framework, which would have struggled to fit non-custodial wallet software into 12 U.S.C. § 24 Seventh on a conventional reading.

(g)(9) derivatives transactions are authorized in a manner consistent with 12 C.F.R. § 7.1030 as in effect on the date of enactment. The reference to § 7.1030 incorporates the OCC’s existing derivatives regulatory framework. The structural choice is to extend the existing regulatory architecture for bank derivatives activities to digital-asset derivatives, without rewriting the framework.

(g)(10) brokerage services including clearing and execution and (g)(11) riskless-principal facilitation of secondary-market transactions are the broker-dealer-equivalent authorities. Banks can operate digital-asset brokerage platforms, clear digital-asset trades, and execute customer orders. (g)(11)’s riskless-principal authority specifically addresses the structural issue that bank trading of digital assets for customers requires the bank, in practice, to use its own account to offset the customer trade. The pre-CLARITY position was that riskless-principal digital-asset trading was not within § 24 Seventh; (g)(11) overrides.

(g)(12) holding as principal digital assets to the extent incidental to an otherwise permissible activity includes the de minimis category of bank operations: holding tokens to pay protocol fees, holding stablecoins for payment-rail operations, holding governance tokens to participate in protocol decisions affecting bank-held assets. The “incidental to” qualifier means the bank’s holding must be tied to another permitted activity, but the catchall is broad enough to accommodate the full range of operational holdings.

(g)(14) the incidental-powers clause is the residual. It authorizes “all such incidental powers as are necessary to carry out any of the activities described in paragraphs (1) through (13).” The clause functions like the parallel residual in 12 U.S.C. § 24 Seventh (”such incidental powers as shall be necessary to carry on the business of banking”), and operates as the catchall under which the OCC has historically expanded national-bank authority case-by-case. After §401, the OCC can rely on (g)(14) to authorize incidental activities that have not yet been invented.

The Structural Choice: Business-of-Banking by Statute

§401(c)(2) is the doctrinally important provision. It declares that the activities described in paragraphs (1) through (5) and (7) through (14) of §401(g) “are authorized as part of, or incidental to, the business of banking under the paragraph designated as the ‘Seventh’ of section 5136 of the Revised Statutes (12 U.S.C. 24).” The activity numbered (6), principal trading for investment or trading purpose, is conspicuously absent from §401(c)(2)’s business-of-banking declaration. The omission appears intentional. (g)(6) authorizes the activity as a statutory matter, but the business-of-banking classification under § 24 Seventh, which has historically constrained bank principal-trading activity in securities, is not extended.

§401(c)(2)’s structural move matters because it bootstraps the §401 activities into the existing 12 U.S.C. § 24 Seventh framework rather than creating a parallel regulatory architecture. The activities are not granted under a new digital-asset banking statute. They are added to the conventional business-of-banking framework. That has two consequences. First, the existing supervisory and safety-and-soundness framework applies. The OCC’s examiners can examine bank digital-asset activities the way they examine bank securities, deposit-taking, and lending activities. Second, the existing legal infrastructure (sound banking principles, customer-protection rules, transaction-with-affiliates restrictions, lending limits) applies. The §401(c)(3) rule of construction reinforces this: the digital-asset character of an activity does not exempt it from any prohibition, restriction, registration, limitation, or other requirement that would apply if the activity were conducted without digital-asset involvement. A bank conducting an underwriting under (g)(13) with respect to a digital asset that is a security must still comply with the securities laws applicable to that underwriting; a bank conducting derivatives transactions under (g)(9) must still comply with the derivatives regulatory framework. The (c)(3) clause is the equivalent of the §505 tokenization-parity rule covered in Post #13: form does not change substance.

§401(b) extends the same architecture to financial holding companies under § 4(k) of the Bank Holding Company Act of 1956. The §401(g) activities are declared “financial in nature” for § 4(k) purposes, which authorizes FHCs (and their subsidiaries) to engage in the activities under the existing § 4(k) regulatory framework. The structural effect is that the major bank holding companies (JPMorgan Chase, Bank of America, Wells Fargo, Citigroup, Goldman Sachs, Morgan Stanley) and their non-bank subsidiaries (JPMorgan Onyx/Kinexys, the BNY Mellon digital-asset custody platform, the State Street digital-asset division) can conduct §401(g) activities at the holding-company level without separate banking-statute authorization.

State-Bank Parity and Credit Unions

§401(d) provides state-bank parity. For purposes of FDI Act § 24(a) and (d), the activities authorized for national banks under §401(c) are permissible for insured state banks and their subsidiaries to engage in as principal. The parity provision means that a state-chartered bank can do anything a national bank can do under §401, subject to state-law authorization and FDIC supervisory oversight. The Custodia Bank precedent on master-account access (the Custodia Bank litigation in the D. Wyo.) is not directly addressed by §401, but the parity provision means that a state-chartered specialty bank holding a state crypto-banking charter (Wyoming SPDIs, the Nebraska digital-asset depository institution charter, the Texas industrial banking framework) can engage in §401 activities to the extent the FDIC’s supervisory regime permits.

§401(e) extends authority to federal credit unions, with the §401(g) activities classified as authorized under § 107(17) of the Federal Credit Union Act. §401(f) provides credit-union parity for state-chartered credit unions, subject to state law and any NCUA limitations applicable to insured credit unions. The credit-union authorization is meaningful because the pre-CLARITY interpretive framework on credit-union digital-asset activities was even more restrictive than the national-bank framework. The 2021 NCUA Letter to Credit Unions 21-CU-16 permitted limited custody-and-execution partnerships with third-party providers but did not authorize principal-trading or full-service digital-asset banking. §401 changes that.

§401(h) and the End of Prior Approval

§401(h) is short and consequential. It eliminates prior-notice and prior-approval requirements for the §401 activities, except for those required under the National Bank Act, the Federal Reserve Act, the Bank Holding Company Act, and the Federal Credit Union Act. The OCC’s IL 1179 prior-supervisory-non-objection regime is foreclosed. The FDIC’s pause-letter framework, to the extent it operated as a prior-approval requirement outside the existing banking statutes, is foreclosed. The Federal Reserve’s pre-CLARITY positions on Federal Reserve-supervised institutions engaging in digital-asset activities, to the extent they imposed prior-approval requirements outside the existing statutes, are foreclosed.

The §401(h) carve-out for the organic banking statutes means that the routine supervisory tools the agencies use under those statutes (examination, capital and liquidity requirements, supervisory expectations communicated through guidance, enforcement actions for unsafe-and-unsound practices) remain available. What is foreclosed is the imposition of new prior-approval regimes that are not grounded in the existing organic statutes. The structural choice is to require the agencies to use the tools they have rather than to invent new tools for the digital-asset space.

§401(i) preserves the existing safety-and-soundness authorities of the federal banking agencies and the NCUA. The activities authorized under §401 are subject to ordinary supervisory oversight, and the agencies retain authority to determine that any §401 activity, as conducted by a particular institution, is unsafe or unsound and to take enforcement action accordingly. The structural choice is permissive-by-default with safety-and-soundness backstop, not permissive-with-prior-approval.

§401(j) and the NFT Exclusion

§401(j) excludes nonfungible assets from the authorities granted under §401. The exclusion runs through the entire section. Banks cannot custody NFTs, lend against NFTs, deal in NFTs, or make markets in NFTs under §401. The cross-reference to §602’s NFT framework covered in Post #12 of this series is implicit but important. NFTs sit in their own regulatory bucket under CLARITY. The bank-permissibility framework does not extend to that bucket.

The structural choice reflects the residual policy concerns about NFT market structure, valuation, and customer-protection issues. The May 2025 SEC staff statement on NFTs noted ongoing concerns about pump-and-dump schemes, market manipulation, and investor protection in NFT markets. Congress responded by excluding NFTs from the bank-permissibility regime, on the theory that banks should not be brokers, dealers, or custodians for an asset class with the volatility and information-asymmetry characteristics of NFTs. The exclusion is open to revisiting as the NFT market matures, but for now banks are not permitted to deal in or hold NFTs as principal.

§402 Portfolio Margining and §403 Netting

The cross-references to §402 and §403 deserve brief attention. §402 directs the CFTC and SEC to jointly issue rules to facilitate portfolio margining across securities, security-based swaps, futures, options on futures, swaps, and digital commodities. The rule must address the bankruptcy and SIPA treatment of accounts holding mixed assets, and must be developed with the participation of the Federal Reserve, FDIC, OCC, state bank supervisors, and SIPC. The portfolio-margining framework is structurally important because the §401 activities position banks to operate brokerage and clearing services for digital-asset and securities products simultaneously. The cross-margining of those positions is operationally significant for capital efficiency, and the §402 rulemaking will determine how aggressively the agencies can authorize netting across asset classes.

§403 directs the Fed, OCC, and FDIC to develop risk-based and leverage capital requirements that address netting agreements providing for termination and close-out netting across multiple types of financial transactions, in the event of counterparty default. The netting-recognition framework is structurally important for derivatives and other transactions involving digital assets. The pre-CLARITY position on whether close-out netting of digital-asset derivatives transactions qualified for capital netting recognition under the existing risk-based capital rules was uncertain, and §403 directs the agencies to clarify.

The Regulatory-competition Dynamic

The §401 framework reshapes the competitive landscape for digital-asset financial services. Three structural shifts are worth flagging.

First, national banks now have substantially equivalent authority to state-chartered specialty banks. The Wyoming SPDIs (Custodia, Kraken Bank as it eventually exists, Avanti as it existed), the Nebraska digital-asset depository institutions, and the federally chartered specialty banks that have been chartered or are pending now compete on a level playing field with national banks for digital-asset banking business. The §401(d) parity provision means that state-chartered banks are not disadvantaged relative to national banks on the federal-law authority front, but the federal supervisory regime (OCC for national banks, FDIC for state-chartered banks) and the master-account-access framework (covered partially by the Custodia Bank litigation) remain separate questions.

Second, financial holding companies can now offer the full digital-asset suite. JPMorgan’s Onyx/Kinexys platform, BNY Mellon’s digital-asset custody platform, State Street’s tokenization platform, and similar offerings at other major institutions can be expanded to include underwriting, market-making, principal trading, and brokerage activities. The competitive pressure on the standalone crypto exchanges (Coinbase, Kraken, Gemini, the Crypto.com US operation) will increase as the major FHCs enter the market with the structural advantages of established banking franchises (customer base, capital, regulatory relationships).

Third, federal credit unions enter the market with §401(e) authority. The historically conservative posture of the credit-union industry on digital-asset activities is now a strategic choice rather than a regulatory mandate. The largest credit unions (Navy Federal, State Employees’, PenFed) can engage in custody, brokerage, lending, and other §401 activities. The competitive effect on smaller community banks, which have historically competed with credit unions in retail and small-business banking, is direct.

The §404 Yield Carve-Out is the Limit

§404, covered in Post #11 of this series, is the residual prohibition on a “covered party” (a digital asset service provider and its affiliates, excluding permitted payment stablecoin issuers and registered foreign stablecoin issuers) paying interest or yield “economically or functionally equivalent” to deposit interest on payment stablecoin balances held by U.S. persons. The §404 prohibition does not apply to banks engaged in §401 activities other than payment-stablecoin yield, but it shapes the bank-stablecoin-product design space. A bank operating a payment-stablecoin product cannot pay interest on stablecoin balances in a manner equivalent to deposit interest; the bank’s stablecoin offering and its deposit offering must be substantively differentiated. The §404(c)(2) activity-based exception preserves activity-based rewards for liquidity provision, market-making, staking, governance participation, validation, and loyalty programs, which leaves substantial room for bank-stablecoin product design even within the §404 prohibition.

Takeaways

§401 may be the most consequential statutory change in U.S. banking law since the Gramm-Leach-Bliley Act of 1999. Once passed, the pre-CLARITY interpretive uncertainty will be over over. The prior-approval framework outside the existing organic banking statutes is foreclosed. The state-bank parity, FHC authority, and credit-union authority provisions complete the framework.

The structural questions that remain are about execution rather than authority. How will the OCC, FDIC, Federal Reserve, and NCUA exercise their ongoing supervisory oversight of §401 activities? How will the SEC and CFTC develop the §402 portfolio-margining framework? How will the §403 netting rulemaking shape capital efficiency for bank digital-asset derivatives activity? How will the §404 yield prohibition interact with bank stablecoin product design? These are the next round of practitioner questions, but they are questions about how banks engage in digital-asset activities, not whether they can.

The dynamic to watch is the rapidity of bank entry into the digital-asset business. The structural advantages of the major bank holding companies (regulatory relationships, capital, established customer bases, deposit franchises) are real. The structural disadvantages (legacy technology, conservative compliance culture, slow product cycles) are also real. The competitive pressure on the standalone crypto-native firms will be substantial. The market structure of U.S. digital-asset financial services in 2030 is going to look very different from the market structure of U.S. digital-asset financial services in 2025, and §401 is the reason.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

Two things changed in early 2026. The first is the joint SEC-CFTC interpretation effective March 23, 2026, Release Nos. 33-11412 and 34-105020, which the Commission issued (with CFTC concurring guidance) and which expressly supersedes the 2019 Framework and all prior staff statements on these topics. The release sets out a detailed framework for protocol mining, protocol staking (in four flavors), staking receipt tokens, wrapping, and airdrops. The second is CLARITY’s §4B(a)(5), which codifies a six-clause statutory taxonomy of “gratuitous distribution” and applies the §4B(b)(4) non-security presumption to each clause. Read together, the interpretation and the statute substantially eliminate the staking-and-airdrop enforcement risk that consumed industry attention from 2021 through 2025. The interpretation defines the analytical method; the statute codifies the bottom-line treatment. This post reads them together.

§4B(a)(5) of the Securities Act, added by §102 of CLARITY, replaces the enforcement-risk soup with a defined term and a six-clause taxonomy. The defined term is “gratuitous distribution,” and it sweeps far more broadly than the word “gratuitous” suggests. The taxonomy enumerates self-staking, self-custodial third-party staking, liquid staking, custodial and ancillary staking services, programmatic and automated distributions, and a technology-neutral residual. Each receives a non-security presumption under §4B(b)(4)(A). The cumulative effect is the most consequential statutory accommodation of staking and airdrop economics anywhere in U.S. law.

The Definition Does the Work

§4B(a)(5)(A) defines a gratuitous distribution as “a distribution of a network token, including a distribution effected by an agent or other service provider engaged solely in an administrative or ministerial capacity, in exchange for not more than a nominal value of cash, property, services, or other assets in a broad, equitable, and non-discretionary manner.” The substantive elements are four: distribution of a network token, optional agent involvement in a strictly administrative capacity, exchange for not more than nominal value, and broad-equitable-non-discretionary character.

The “not more than a nominal value” formulation is the principal limit on the otherwise expansive definition. A distribution made in exchange for substantial consideration is not gratuitous. An airdrop sized to a holder’s prior on-chain activity but with no payment required is. A staking reward delivered in exchange for staked capital and validator effort is, on a literal reading of “exchange for,” not in exchange for nothing, but the bill’s enumerated clauses confirm that staking falls within the term. The drafting is best read as: gratuitous means without significant out-of-pocket cash payment to the distributor. Staking is gratuitous because the staker provides validator effort to the protocol and receives rewards from the protocol, not from a counterparty who is selling them. The broad-equitable-non-discretionary requirement screens out targeted private placements dressed up as airdrops. A distribution made only to accredited investors who pay a tokenization fee is not gratuitous. A distribution made to everyone who held a particular NFT before a snapshot date is.

§4B(a)(5)(B) then enumerates six specific mechanisms that are gratuitous distributions, “without limitation.” The enumeration is not exhaustive; the technology-neutral residual in clause (vi) makes that explicit. But each enumerated mechanism receives statutory recognition, and reading the six side by side is the cleanest way to understand the doctrine.

The Six Clauses

Clause (i), self-staking, covers the distribution of a network token as a programmatic result of validating or staking activity for a consensus mechanism, where the owner of the staked token and the operator of the node, validator, or similar software are the same person. The paradigmatic example is the solo Ethereum validator running her own node on her own staked ETH. The reward she receives is statutorily a gratuitous distribution. So is the reward a solo Solana, Cosmos, or Polkadot validator receives. The clause is technology-agnostic on consensus mechanism; proof-of-stake, delegated proof-of-stake, proof-of-history, and any future consensus mechanism producing token rewards for validating activity are within its scope, provided the validator is the token owner.

Clause (ii), self-custodial staking with a third party, extends the same treatment to the case where the staked token owner and the node operator are different persons, but the operator does not maintain custody or control of the staked token. The paradigmatic example is the Lido validator running infrastructure on behalf of stakers who hold the staked tokens themselves through a smart-contract escrow. Rocket Pool’s minipool architecture is similar in structure: the node operator stakes its own ETH plus rETH-routed customer ETH, and operates the validator software without holding direct custody of the customer’s principal. The clause confirms that non-custodial delegated staking is gratuitous. The structural test is custody. If the operator does not control the staked token, the distribution remains gratuitous.

Clause (iii), liquid staking, addresses the LST architecture that has become the dominant form of staking in the Ethereum ecosystem. The clause covers “the distribution of network tokens, as the issuance, transfer, or redemption of liquid staking tokens representing a pro rata interest in staked network tokens, and their associated rewards, provided that such tokens are issued as administrative or ministerial receipts and not providing discretionary management authority.” The administrative-or-ministerial language is the operative limit. An LST that conveys a pro rata interest in the underlying staked tokens and accruing rewards, without conferring discretionary management authority on the issuer, is a gratuitous distribution. An LST that conveys a discretionary right (a yield-optimizing manager’s authority to redirect capital among validator sets in exchange for performance fees) is not, or at least not within clause (iii). Lido’s stETH, Rocket Pool’s rETH, ether.fi’s eETH, and Coinbase’s cbETH all sit within the safe side of the line as currently designed, with cbETH the closest to the edge because the validator selection is centralized but the holder rights are still pro rata receipt rights.

Clause (iv), custodial and ancillary staking services, is the SEC-rulemaking clause. It covers custodial or ancillary staking services enabling the owner of a network token to participate in validating or staking activity, where the services are “exclusively administrative or ministerial in nature.” §4B(a)(5)(B)(iv)(I). §4B(a)(5)(B)(iv)(II) directs the Commission to issue rules defining what custodial and ancillary staking services qualify as exclusively administrative or ministerial. This is the post-Kraken, post-Coinbase Earn clause. Custodial staking-as-a-service is gratuitous if it is administrative or ministerial, and the operational content of that test has substantially been resolved at the federal-securities-law level by the joint SEC-CFTC interpretation. Under Release No. 33-11412, a “custodial arrangement” in which a custodian stakes deposited digital commodities on behalf of a depositor does not involve essential managerial efforts under Howey if the custodian does not decide whether, when, or how much of the depositor’s digital commodity to stake; does not guarantee or otherwise set the amount of rewards; selects a third-party node operator (where applicable) as its only staking-process decision; and holds the deposited digital commodities in a manner that (1) does not use them for operational or general business purposes, (2) does not lend, pledge, or rehypothecate them for any reason, and (3) is designed not to subject them to claims by third parties. The depositor retains ownership of the deposited digital commodity throughout. The release also expressly identifies four ancillary services that do not constitute essential managerial efforts: slashing coverage, early unbonding, alternate rewards payment schedules and amounts (provided rewards are not fixed, guaranteed, or greater than protocol-set amounts), and aggregation of digital commodities to meet protocol minimums. The Commission’s eventual §4B(a)(5)(B)(iv)(II) rulemaking will have to honor the structure the joint release establishes; the remaining contested area is custodial arrangements that involve discretionary validator selection, pooled-customer-asset management, or other features beyond the release’s conditions.

Clause (v), programmatic and automated distributions, is the airdrop catch-all. The mechanism must be automated, programmatic, protocol-defined, or rules-based; achieved through the transparent functioning of the DLS; subject to five conditions. The conditions track the language elsewhere in the bill on decentralization and transparency. (I) Distributions must occur pursuant to public, transparent, rules-based parameters publicly available and accessible on a permissionless basis, without individualized or real-time negotiation with recipients. (II) Recipients receive tokens as a direct programmatic result of objective, verifiable network participation, consumption, or contribution, including consensus participation, data availability, bandwidth, governance, or use and interaction with the protocol or application. (III) The number of tokens received is proportionate to the verifiable service, usage, or contribution. (IV) Any expected utility or value of the tokens arises primarily from decentralized network participation and market forces, rather than the discretionary actions of any single person or affiliated group. (V) No person or group has unilateral authority to alter, restrict, or direct the issuance parameters or distribution mechanisms, and any modification occurs only through a DGS.

The five conditions read together describe the difference between a properly-structured retroactive airdrop and a sweetened insider distribution dressed up as a community reward. The Optimism retroactive airdrops to Ethereum bridge users, the Arbitrum airdrop to active arbitrum.io users, and the Uniswap airdrop to historical LPs all sit comfortably within clause (v) if the eligibility rules are objective and rules-based. A discretionary “community contributor” airdrop curated by the founding team’s judgment of who counts as a contributor is harder to fit. The (II) requirement of objective, verifiable network participation does not, on its face, permit the team to award tokens based on subjective merit. Point programs that resolve into token distributions face a similar analysis: if the point allocation is rules-based and the conversion to tokens is mechanical, clause (v) covers it. If the point allocation is discretionary, it is not.

Clause (vi), the technology-neutral catch-all, covers any distribution employing a mechanism, protocol, or technology not specifically described in clauses (i) through (v), without regard to whether the mechanism is in existence at the time of enactment, provided the distribution meets the §4B(a)(5)(A) general requirements. This is the future-proofing clause. Whatever the next generation of staking and reward mechanisms turn out to be, if they distribute network tokens in exchange for nominal or no value in a broad-equitable-non-discretionary manner, they get gratuitous-distribution treatment. The clause is structurally similar to other technology-neutral residual clauses in the bill and protects against the recurring problem of statutory definitions overtaken by technical innovation.

The §4B(b)(4) Non-security Presumption

§4B(b)(4)(A) provides that, notwithstanding §4B(b)(1), a gratuitous distribution by itself does not constitute an offer, sale, or distribution of a security under §2(a)(1) of the Securities Act, §3(a) of the Exchange Act, §2(a) of the Investment Company Act, §202(a) of the Advisers Act, §16 of SIPA, or any state-law equivalent that is not commodity-consistent. The presumption is rebuttable, but the burden of proof shifts. A plaintiff or enforcement agency contending that a gratuitous distribution is in fact a securities transaction must affirmatively prove it.

§4B(b)(4)(B) is the anti-fraud savings clause. The non-security presumption does not displace the anti-fraud, anti-manipulation, or false-reporting authorities of the SEC, the CFTC, or state regulators. A gratuitous distribution that is structured to defraud or manipulate is still actionable on those grounds. The non-security status applies to the registration-and-disclosure architecture of the federal securities laws, not to the anti-fraud overlay.

The doctrinal effect of §4B(b)(4)(A) on the existing case law is direct. LBRY‘s holding that LBC distributions to early users were unregistered securities offers does not survive §4B(b)(4)(A) as applied to the LBRY fact pattern, at least prospectively. The SEC’s theory in Coinbase Earn that pooled-customer staking constituted a securities transaction is preserved only to the extent the staking service does not qualify as exclusively administrative or ministerial under the §4B(a)(5)(B)(iv)(II) rulemaking, which is to say only to the extent the Commission’s rule says so. The Kraken consent order is preserved as a historical compliance matter, but the substantive theory underlying it is foreclosed prospectively. Jarrett v. United States, 1:21-cv-00419 (M.D. Tenn.), and the tax-side staking-rewards realization analysis remain live questions on a different track; §4B(b)(4) deals only with the securities-law treatment of staking.

Cross-Reference to Bank-Permitted Activities

§401(g)(2), covered in Post #9 of this series, authorizes national banks and federally insured depository institutions to provide staking and “related services” to customers. The provision works alongside §4B(a)(5)(B)(iv). Banks may offer custodial staking under the §401(g)(2) authority; the staking rewards delivered to customers in connection with that activity are gratuitous distributions under §4B(a)(5)(B)(iv) to the extent the bank’s service satisfies the exclusively administrative or ministerial standard the SEC will define. The combined effect is that banks can offer custodial staking products in the same way they offer custodial securities-lending and cash-sweep products, without the principal product (the reward) being a separate security.

The state-bank parity provisions in §401(d) extend the same authority to state-chartered banks meeting the FDIC’s parallel determinations. The credit-union provisions in §401(e) and (f) extend it to federally insured credit unions. The customer experience under CLARITY is that staking will become a routine banking product, indistinguishable in user interface from a savings account except in the substantive economics of the underlying mechanism. The SEC rulemaking under §4B(a)(5)(B)(iv)(II) will set the operational rules.

Liquid-Staking Carve-Out and the Administrative-or-Ministerial Framing

Clause (iii)’s “administrative or ministerial receipts and not providing discretionary management authority” qualifier is the load-bearing element of the LST treatment. The SEC’s pre-CLARITY interpretive posture, as developed in the joint interpretive release of March 2026, treated LSTs as receipts for non-security digital commodities, subject to specified conditions including no rehypothecation, no lending without consent, and custody designed to prevent third-party claims. CLARITY codifies a compatible position and, importantly, does not require the joint-release conditions to be satisfied as a matter of definition. The statutory test is administrative-or-ministerial-receipt character and non-discretionary management.

A well-structured LST satisfies the test. The token represents a pro rata claim on a pool of staked tokens and accruing rewards. The issuer’s role is limited to running validator infrastructure, accepting deposits, issuing receipt tokens, and processing redemptions according to a predetermined formula. No discretionary management is involved. The rewards flow mechanically from the protocol to the staking contract to the token holders, with the issuer taking a fixed fee from the gross reward stream.

A poorly-structured LST does not. An LST that confers on the issuer discretionary authority to redirect capital among different chains, to engage in leveraged staking strategies, or to execute MEV-extraction-and-share programs on staked capital is, structurally, an actively-managed pooled investment vehicle. Clause (iii) does not protect it. The administrative-or-ministerial language is the gating test.

Two structuring implications follow. First, LST issuers who want clause (iii) treatment should design the issuance-and-redemption mechanism to be fully programmatic. The smart contracts should accept ETH, deposit it with predetermined validator operators, and mint stETH or rETH or equivalent in proportion. Discretionary validator selection by the issuer is permissible, but discretionary capital reallocation outside the staking activity is not.

Second, restaking protocols (EigenLayer and its analogs) sit at the edge of clause (iii). A restaking position involves the staking of an already-staked LST or LRT to secure additional services. The restaker accepts additional slashing risk in exchange for additional reward streams. The restaking layer’s treatment depends on whether the issuance, transfer, and redemption of the restaking receipt token operates as administrative-or-ministerial receipts of the additional reward stream, or as a more discretionary management of additional risk-reward exposure. The joint SEC-CFTC interpretation expressly declines to address restaking (Release No. 33-11412, footnote 107), which means the SEC’s eventual rulemaking under §4B(a)(5)(B)(iv)(II) (and any subsequent interpretive release) will carry the analytical weight. The structural answer for a properly-built restaking protocol is that the receipt token tracks a programmatic position with no discretionary management, in which case clause (iii) covers it. But restaking-specific guidance is not yet available, and practitioners structuring restaking offerings should plan for an extended period of interpretive uncertainty.

The joint release’s Staking Receipt Token analysis is, however, fully applicable to ordinary (non-restaked) liquid staking. The release treats an SRT that is a receipt for a non-security crypto asset not subject to an investment contract as itself a receipt rather than a security, on the theory that the SRT evidences ownership of the deposited digital commodity (and its accruing rewards) without providing any independent essential managerial efforts. The definition of “security” in §2(a)(1) of the Securities Act expressly includes a “receipt for” a security, but a receipt for a non-security is not a security. The release reaches this conclusion for both protocol-based liquid staking providers (Lido, Rocket Pool) and third-party liquid staking providers (custodial models with receipt-token issuance), subject to the same custody-and-non-discretion conditions described above for custodial staking. The SRT secondary-market trading is also covered. This is the substantive interpretive piece that practitioners structuring LST offerings have been pressing for since 2022, and it is now in place.

Airdrops and the LBRY Problem

The LBRY holding deserves attention because it was the high-water mark of the SEC’s pre-CLARITY airdrop theory. The court held that LBC, distributed through a series of programmatic mechanisms including mining rewards, content-creator rewards, and operating-system airdrops, constituted unregistered securities offers because purchasers had a reasonable expectation of profits from LBRY Inc.’s ongoing development efforts.

Under §4B(b)(4)(A), the same fact pattern (programmatic mining rewards, content-creator rewards, operating-system airdrops) is presumptively not a securities offering. Each of the three distribution mechanisms maps onto clause (v) of §4B(a)(5)(B): they are automated, programmatic, protocol-defined, rules-based, and proportionate to verifiable contribution. The non-security presumption applies. To rebut, the SEC would need to establish, against the §4B(b)(4)(B) carve-out, that some anti-fraud or anti-manipulation violation occurred, not merely that the distributions otherwise satisfied Howey.

The structural shift is that Howey compliance with respect to a gratuitous distribution is now decided by the §4B(b)(4) presumption, not by a fresh four-prong analysis. The four prongs continue to operate as the theoretical foundation; an originator-controlled offering of an ancillary asset in exchange for cash is still an investment contract under §4B(b)(1). But a gratuitous distribution, by statutory presumption, does not satisfy the offer-or-sale element of §5. The case is over.

The retroactive cleanup in §4B(k)(3) extends the presumption to pre-effective-date gratuitous distributions, foreclosing future SEC enforcement based on historical airdrop conduct, provided the originator complies with the §4B(c)(3) transition disclosure obligations. The LBRY judgment remains as a final adjudication, but no future LBRY-style case can be brought.

The joint SEC-CFTC release adds a doctrinal layer that runs alongside the statutory presumption. Section VII of Release No. 33-11412 interprets the Howey “investment of money” prong with respect to airdrops, concluding that recipients who do not provide money, goods, services, or other consideration to the issuer in exchange for the airdropped non-security crypto asset have not made an “investment of money,” and that the Howey test therefore fails at the first prong. The release identifies three illustrative scenarios within the interpretation: an airdrop to existing holders of another specified crypto asset where the issuer does not announce the airdrop before dissemination; an airdrop to users of a testing-environment version of a crypto system after deployment; and an airdrop to users of a related software application based on prior use, where the issuer does not announce the airdrop before dissemination. The release excludes airdrops in which the recipient provides consideration in exchange for the asset (such as a service performed in exchange for the airdrop) or where recipients must fulfill conditions subsequent to the airdrop announcement to receive the asset. For airdrops that fit within the release’s interpretation, the conclusion that no investment contract is created is independent of CLARITY’s §4B(b)(4) presumption: the Howey test simply does not apply because one of its required elements is missing. The two frameworks operate in parallel, with the joint release providing the constitutional-and-doctrinal foundation and CLARITY providing the statutory backstop and procedural mechanisms.

Practitioner Structuring Takeaways

For protocols planning post-CLARITY token launches, the gratuitous-distribution architecture is the most generous channel available. A retroactive airdrop sized to historical on-chain activity, distributed proportionately to objective metrics, with no individualized negotiation and no discretionary “contributor” allocations, satisfies clause (v) and receives the §4B(b)(4) non-security presumption. The originator avoids §5 registration, avoids the §4B(d) disclosure menu (which attaches only to ancillary assets, not to gratuitous distributions, and the asset itself can be a network token without ancillary-asset status if its value does not depend on continuing originator efforts), and lands in a posture closer to the pre-2017 ICO-era treatment of community distributions, but with statutory rather than enforcement-discretion support.

For staking-service operators, the path forward is the §4B(a)(5)(B)(iv) rulemaking. The crypto-industry comment-letter effort will be focused on getting “administrative or ministerial” defined broadly enough to cover the operational realities of custodial staking. The traditional-securities-bar position will be that the term should be construed against the issuer in cases of pooled customer assets and aggregated validator selection. Operators should plan for a regulatory line that covers operational custody but does not protect discretionary capital management of staked assets.

For liquid-staking protocol issuers, the design principle is administrative-or-ministerial-receipt character. Issuance, transfer, and redemption should be programmatic. Discretionary management should be excluded from the issuer’s role. Fee structures should be fixed and transparent. The Lido and Rocket Pool architectures are within the safe side of the line; any restaking or active-validator-selection design needs to be evaluated against the (iii) standard with care.

For airdrop designers, the design principle is rules-based proportionate distribution. Snapshot dates, eligibility criteria, and allocation formulas should be objectively measurable and publicly disclosed in advance. Discretionary contributor awards should be moved to a separate program with separate documentation; mixing rules-based and discretionary distributions in a single airdrop transaction is the principal way to lose clause (v) coverage for the entire transaction.

The §4B(a)(5) framework is, in the aggregate, the most consequential statutory accommodation of post-Ethereum token economics yet enacted. Staking is gratuitous. Airdrops are gratuitous. LSTs are gratuitous receipts. Custodial staking can be gratuitous once the SEC defines administrative-or-ministerial. And the technology-neutral clause means the framework keeps working as the underlying mechanics evolve. The tax treatment of these distributions remains a separate question, sequenced with the tax-article queue covered in Post #16 of this series, but the securities-law treatment is now resolved.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

Title VI of CLARITY resolves the split in favor of speech. The resolution runs through three operative provisions and one rulemaking direction. §601 amends both the Securities Act and the Exchange Act to immunize a defined list of activities from securities-law liability. §604, which incorporates the Blockchain Regulatory Certainty Act in substance, defines “non-controlling developer or provider” and exempts that class from money-transmitter status under 31 U.S.C. § 5330 and 18 U.S.C. § 1960. §605, the Keep Your Coins Act, prohibits federal agencies from restricting self-custody. §301(b)(2)(B), covered in Post #6 of this series, directs the SEC’s rulemaking on non-DeFi trading protocols to protect the First Amendment rights of software developers, publishers, and users. Read together, they are the most explicit congressional accommodation of code-as-speech doctrine since the Crypto Wars of the 1990s.

§601 and the new Securities Act / Exchange Act safe harbors

§601(a) inserts a new §27C into the Securities Act of 1933 titled “Application to Software Developers.” §601(b) inserts a parallel §15H into the Securities Exchange Act of 1934. Both sections operate as carve-outs. They provide that a person is not subject to the underlying Act, or to the regulations under that Act, “solely based on” engaging in any of a defined list of activities, whether singly or in combination, in relation to the operation of a distributed ledger system or any component of it. The lists in §27C(b) and §15H(b) are not identical, and the differences matter.

The Securities Act §27C(b) safe harbor lists two activity categories. (1) compiling network transactions, relaying, searching, sequencing, validating, or acting in a similar capacity. (2) providing computational work, operating a node or oracle service, or procuring, offering, or utilizing network bandwidth, or providing other similar incidental services. The Securities Act safe harbor stops there. The list maps onto the §301(a)(2)(C)(i) and (ii) activity carve-outs covered in Post #6 of this series, and the drafting parallel is intentional.

The Exchange Act §15H(b) safe harbor adds a third category: (3) developing, publishing, or constituting a distributed ledger system, or software or systems (including wallets) that facilitate user self-custody. “Constitute” is defined in §15H(a)(1) to mean compiling, assembling, integrating, or otherwise combining software components into a complete software system. So the Exchange Act safe harbor protects, in plain English, building or distributing the protocol itself, plus building or distributing wallet software. The Securities Act safe harbor protects only running infrastructure for it. The asymmetry is reasonable: the Exchange Act has historically been the source of the broker, dealer, and exchange registration claims that have been pressed against software publishers, while the Securities Act has been the source of issuer-side registration claims that would not apply to pure development activity in any event.

Both safe harbors apply “solely based on” the listed activity. That phrase is important. It does not immunize a developer who is doing the protected activity plus other unprotected conduct. A developer who publishes a protocol and also operates a custodial business using that protocol is not within the safe harbor for the custodial business. The carve-out tracks the activity, not the actor. A developer who limits her activity to the listed categories cannot be a respondent in a Securities Act or Exchange Act proceeding founded on those activities. A developer whose activities exceed the listed categories has to defend the excess activity on its own terms.

§15H also incorporates a clarification regime. §15H(d)(1) directs the Commission, through notice-and-comment rulemaking, to clarify the circumstances under which a person engaging solely in one or more of four additional activities, in relation to the operation of a decentralized finance trading protocol or any component, is not subject to the Exchange Act. The four are: (A) providing a user interface that enables a user to read and access data; (B) administering, maintaining, or distributing a decentralized governance system or a decentralized finance trading protocol; (C) administering, maintaining, or distributing a decentralized finance messaging system or operating a smart-contract-based liquidity pool; and (D) administering, maintaining, or distributing software or systems facilitating user self-custody. The clarification rulemaking imports the §15H(d)(2) considerations: consistency with securities-law purposes, applicability of the Lummis-Gillibrand RFIA §108(a), protection of First Amendment rights of developers, publishers, and users, and legal clarity for DLS development.

§15H(d) is the bridge from the categorical safe harbor in §15H(b) to the activities that surround front-end interface operation, governance facilitation, and liquidity-pool participation. The bill does not categorically immunize those activities. It directs the SEC, instead, to draw lines through rulemaking, with First Amendment compliance as a binding statutory directive. The structural choice is sensible: front-end operators and liquidity-pool participants are closer to the edge of the protected zone than core developers or infrastructure operators, and the lines need to be drawn with attention to operational facts. The §15H(d)(3) rule of construction is also important. It confirms that the Commission has no authority over persons, systems, software, or activities that do not otherwise fall within the Commission’s jurisdiction under the Exchange Act, and creates no presumption that any activity is subject to the Act.

§15H(e) preserves the Commission’s anti-fraud, anti-manipulation, and false-reporting authorities. The §15H(b) and (d) determinations of non-subject status do not extend to those authorities. The point is structurally the same one made in §4B(b)(4)(B) and §4B(h): the offering and registration regime is the regime being immunized. Anti-fraud authority continues to run, on its own terms, against anyone who satisfies the elements of an anti-fraud violation.

§15H(f) prevents the Commission from leveraging the section to expand its authority over digital commodities or to regulate the §15H(d)(1) activities beyond what existing law permitted. §15H(g)(1) preempts state securities, commodities, and digital-asset laws as applied to the §15H(b) activities, with §15H(g)(2) preserving state AML, anti-fraud, and anti-manipulation authority. The federal-preemption choice for the §15H(b) activities, but not the §15H(d) clarification activities, is deliberate. The categorical safe harbor activities are protected fully, including from state blue-sky enforcement. The clarification-rulemaking activities are protected only to the extent the SEC’s rule provides protection, and state law may continue to operate in the meantime.

§604: BRCA and the money-transmitter line

§604 incorporates the Blockchain Regulatory Certainty Act as a discrete subtitle. The substantive provision is §604(c), which states that “notwithstanding any other provision of law,” a non-controlling developer or provider shall not be treated as a money transmitting business under 31 U.S.C. § 5330 or as engaged in money transmitting under 18 U.S.C. § 1960, and shall not be subject to any registration requirement substantially similar to those in §§ 5330 or 1960, solely on the basis of creating or publishing software, providing hardware or software facilitating customer self-custody, or providing infrastructure support to maintain a distributed ledger service.

The definitional work in §604(b)(3) is where the law gets decided. A “non-controlling developer or provider” is one that, in the regular course of operations, “does not have the legal right or the unilateral and independent ability to control, initiate upon demand, or effectuate transactions involving digital assets to which users are entitled, without the approval, consent, or direction of any other third party.” The phrase tracks the structural test the Fifth Circuit applied in Van Loon to the Tornado Cash smart contracts. The court held that immutable smart contracts were not “property” capable of being blocked under IEEPA because no one had the ability to control them. §604(b)(3) takes the same control-in-fact concept and applies it as a statutory test for BSA money-transmitter exposure.

Three structural elements deserve attention. First, the test is conjunctive on its enumerated dimensions (”control, initiate upon demand, or effectuate”). A developer who lacks the ability to do any of these things on her own is non-controlling. A developer who has the ability to do any one of them is controlling. Second, the inability must be operational, not contractual. The phrase “in the regular course of operations” means that a developer with a theoretical legal right to control that she does not exercise is still controlling if she could exercise it. The test is functional. Third, the consent of a third party defeats independent control. A developer who can only act with the consent of a multisig she does not control, or only at the direction of a DAO vote she does not control, is non-controlling. This is the structural exit for protocol teams that have migrated upgrade authority to DAOs.

§604(d) clarifies that the safe harbor does not extend to a person who acts “with the specific intent to transfer, on behalf of another person, funds that are known... to be derived from a criminal offense or intended to be used to promote or support unlawful activity.” That language tracks 18 U.S.C. § 1960(b)(1)(C) and the United States v. Velastegui line on knowing and intentional unlicensed money-transmission liability. The point is that the §604(c) safe harbor protects publishing and infrastructure activity; it does not protect knowing facilitation of criminal money movement. A developer who builds a mixer with the specific intent to launder criminal proceeds is still exposed under §1960(b)(1)(C) even if she meets the structural non-controlling test.

§604(e) is the conduct-based residual. It preserves application of money-transmitter classification based on conduct outside the scope of §604(c). A developer who is non-controlling with respect to the protocol but also operates a custodial exchange remains subject to BSA classification as to the exchange activity. The carve-out tracks activity, again, and follows the same architectural pattern as §15H(b) and §301(a)(2)(C).

The interaction with FinCEN’s 2019 guidance is direct. FIN-2019-G001 already drew a similar line, exempting from money-transmitter status persons providing “anonymizing software” but treating as money transmitters persons providing “anonymizing services” with control over user funds. §604(b)(3) codifies the control-in-fact line and overrides any FinCEN interpretive position that would treat a non-controlling developer or provider as a money transmitter. FinCEN’s existing guidance on developers of unhosted-wallet software, mining-pool operators, and protocol publishers is now interpretive support for, rather than independent authority over, the §604 line.

§605: self-custody as a federal right

§605 is the Keep Your Coins Act. The operative provision is §605(c): a federal agency may not prohibit, restrict, or otherwise impair the ability of a covered user to self-custody digital assets using a self-hosted wallet or other means to conduct transactions for any lawful purpose. A “covered user” is defined in §605(b)(1) as a U.S. individual who obtains digital assets to purchase goods or services on behalf of that individual, without regard to the method of acquisition. A “self-hosted wallet” is defined in §605(b)(2) as a digital interface used to secure and transfer digital assets where the owner retains independent control.

The provision operates as a statutory bar on federal-agency action restricting self-custody. The 2020 FinCEN NPRM (Notice 2020-CVC-2), which proposed reporting and recordkeeping requirements for unhosted wallet transactions, is foreclosed in the form it took. The IRS Final Regulations on Broker Reporting, T.D. 10000, which extended Form 1099-DA reporting to certain unhosted-wallet intermediaries, would need to be re-evaluated under §605 to the extent any provision could be characterized as restricting individuals from self-custody for the purchase of goods or services. The provision does not preempt state law (state AML and state consumer-protection authorities remain operative), and it does not bar lawful enforcement under existing federal authority.

§605(d) preserves federal-agency enforcement authority under the Bank Secrecy Act, the Combating Russian Money Laundering Act §9714, the Fentanyl Sanctions Act §7213A, and any other law relating to illicit finance, money laundering, terrorism financing, or U.S. sanctions. The drafting choice is to immunize ordinary self-custody activity by individuals, while preserving the enforcement authorities that target unlawful activity. The line is narrower than some self-custody advocates wanted, but it is broad enough to take the 2020 FinCEN NPRM, and any successor proposal in that form, off the table.

§301(b)(2)(B) and the First Amendment as binding directive

§301(b)(2)(B), covered in Post #6 of this series, directs the Commission to “protect the rights of software developers, publishers, and users to create, publish, and use code and software in a manner consistent with the First Amendment to the Constitution of the United States.” The directive is binding on the §301 rulemaking and, through cross-reference, on the §15H(d) clarification rulemaking. The same First Amendment compliance directive recurs in §15H(d)(2)(C).

The legal substance of the directive is Bernstein and Junger. Both circuits held that source code is expressive speech subject to First Amendment protection, and that prepublication restraints on source-code publication are subject to strict scrutiny. Bernstein, 176 F.3d at 1140-46; Junger, 209 F.3d at 484-85. The doctrinal posture has been stable for twenty-five years, but the Tornado Cash prosecutions tested it under contemporary money-transmitter and OFAC theories. The Fifth Circuit in Van Loon reached the OFAC question and held that immutable smart contracts were not “property” capable of being blocked. The criminal prosecutions of Storm and Pertsev pressed past the First Amendment defense on the theory that the developers were not merely publishing code but operating the resulting protocol. CLARITY codifies a line that tracks the Fifth Circuit’s reasoning and preempts the prosecutorial theory that conduct adjacent to publication can be reached on a code-equals-conduct basis.

Three points about how the directive operates. First, the directive is binding on agency rulemaking, not on the agency in litigation. The SEC and Treasury can still bring enforcement actions that would have been brought under existing law against persons whose conduct exceeds publishing and operating infrastructure. What they cannot do is promulgate rules that themselves restrict the protected activity. The directive is structural, not adjudicative. Second, the directive is enforceable through the Administrative Procedure Act. A rule that fails to comply with the First Amendment directive is “not in accordance with law” under 5 U.S.C. § 706(2)(A) and can be set aside. Third, the directive is paired with the §604 categorical safe harbor and the §605 self-custody right. A First Amendment violation by an agency would, in many cases, also be a §604 or §605 violation. The directive operates as a backstop to the categorical provisions, not as the sole protection for the protected activity.

What the Tornado Cash defendants would have under CLARITY

Roman Storm was charged with conspiracy to commit money laundering under 18 U.S.C. § 1956(h), conspiracy to operate an unlicensed money transmitting business under 18 U.S.C. § 1960, and conspiracy to violate IEEPA under 50 U.S.C. § 1705. The §1960 count is the one most directly affected by §604.

Storm’s defense, in substance, was that he was a software developer who published open-source code and that the code, once published, ran without his ability to control it. The Department of Justice’s theory was that Storm and his co-defendants continued to operate the Tornado Cash front-end, maintained relay infrastructure, and were paid by the protocol’s token economics in ways that constituted operation, not just publication. The factual question of how much operational control Storm retained is for the jury. The legal question of whether non-controlling-developer status is a defense to §1960 is for the court.

Under §604(c), if Storm met the §604(b)(3) non-controlling test for the relevant activity, the §1960 charge based on that activity could not proceed. Whether he met the test is fact-specific. The protocol’s smart contracts are immutable; the relay network was, as a structural matter, an open infrastructure layer that anyone could run; the front-end was open-source and forkable. On those facts, a substantial portion of the §1960 charge would not survive the §604(c) safe harbor. The §604(d) intent carve-out preserves prosecution to the extent the government can prove specific intent to transfer criminally derived funds, but that is a meaningfully higher evidentiary standard than the general money-transmitter theory of liability the government pressed at trial.

The IEEPA charge sits outside §604 and is unaffected directly. The OFAC designations of Tornado Cash smart-contract addresses were withdrawn by Treasury in March 2025 following Van Loon. Whatever criminal exposure remains under the IEEPA theory is a function of whether the defendants knowingly transacted with sanctioned addresses during the period the designations were in effect, which is a question independent of the §604 safe harbor.

The §1956 money-laundering charge requires proof of intent to conceal or to promote unlawful activity. §604(d) confirms that the safe harbor does not reach intentional money laundering. The §1956(h) charge survives on its own elements, but its application to publishing and infrastructure activity is constrained by the §604(c) categorical immunity for the publishing and infrastructure conduct itself.

The structural shift is what matters. Under existing law, a developer of an immutable mixer protocol faced the same nominal exposure as the operator of a custodial mixing service, with the defense to be litigated case-by-case. Under §604 and §605, the developer of an immutable mixer protocol is not a money transmitter under §5330 or §1960 by reason of the publication, and the user of that protocol cannot be restricted by federal-agency rulemaking from self-custodying her own funds and using the protocol for lawful purposes. The unlawful-purpose conduct remains prosecutable on the unlawful-purpose elements. The publishing and self-custody conduct does not.

The takeaway is the one Coin Center has been articulating for years. Code is speech. Publishing is protected. Self-custody is a right. Conduct that exceeds publication, infrastructure operation, and self-custody remains regulable on its own terms. CLARITY does not invent any of this; it codifies what the constitutional doctrine has said since 1999, with the operational definitions that the criminal-law and BSA enforcement regimes have lacked. The cost of getting these provisions through Congress was the §305 temporary-hold regime and the §307 monetary-instrument amendment covered in Posts #14 and #15. Whether the trade was worth it is a separate question. But the protections that did make it into Title VI are, on their face, the most substantial statutory accommodation of code-as-speech doctrine in the history of U.S. financial regulation.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

§301 of the engrossed Senate substitute draws the line. It does so without using the word “DeFi” as a regulatory category and without granting blanket immunity to anything that wears the name. The drafting move is structurally similar to the §4B move covered in Post #2 of this series. Howey survives as a routing test rather than a substantive trigger; the Exchange Act survives as a regime for “non-decentralized finance trading protocols” that meet a three-prong test, with an explicit list of activities that do not, by themselves, push a protocol into that bucket. The third prong of the test, and the activity carve-out list, are where the practitioner work lives. Everything else is plumbing.

The Three-prong Test

§301(a)(1) starts with a definition wide enough to include almost every venue practitioners think of as DeFi. A “decentralized finance trading protocol” is a distributed ledger system through which multiple participants can execute a financial transaction in accordance with an automated rule or algorithm that is predetermined and non-discretionary, and without reliance on a person other than the user to maintain custody or control of any digital assets subject to the financial transaction. Two structural elements. The execution is rule-bound rather than discretionary. The custody runs through user-controlled wallets rather than through an intermediary’s omnibus account. Uniswap’s automated market maker satisfies both. Curve, Balancer, Aerodrome, GMX’s perpetuals engine, dYdX v4, and the Cosmos chain on which dYdX v4 lives all satisfy both. So does a much wider universe of orderbook DEXs, RFQ systems, and intent-based settlement protocols, provided that custody never passes to a third party at any step in the execution path.

That baseline definition is then put into productive tension with §301(a)(2), which defines “non-decentralized finance trading protocol” as a DeFi trading protocol that meets one or more of three conditions. The protocol is non-DeFi if a common-control person or in-concert group has the authority, directly or indirectly, through any contract, arrangement, understanding, relationship, or otherwise, to control or materially alter the functionality, operation, or rules of consensus or agreement of the protocol. §301(a)(2)(A)(i). Or if the protocol does not operate, execute, and enforce its operations and transactions based solely on pre-established, transparent rules encoded directly within the source code of the distributed ledger system. §301(a)(2)(A)(ii). Or if a common-control group has the authority, via operation of the protocol, to restrict, censor, or prohibit use of the protocol, including any applicable system-based user activity. §301(a)(2)(A)(iii).

The disjunctive “or” is doing the work. Any one of the three is enough to flip the protocol out of the safe DeFi bucket and into the bucket that triggers SEC Exchange Act registration plus Bank Secrecy Act obligations, to the extent the Commission’s §301(b) rulemaking determines that applicable requirements are triggered. Practitioners need to walk each prong carefully against the actual operational facts of any protocol they advise.

• Prong (i) is the control-in-fact test. It is intentionally broad. “Any contract, arrangement, understanding, relationship, or otherwise” tracks the §3(a)(9) common-control language in the Exchange Act and the analogous attribution rules under 17 C.F.R. § 240.13d-3. A protocol whose smart contracts can be upgraded by an admin key held by a labs entity is captured. A protocol whose parameters can be changed unilaterally by a multisig outside of any governance vote is captured. The harder cases involve hybrid governance: a DAO that votes, but where the labs entity holds the timelock and has historically pushed through proposals the team favored. The drafting question is whether the team has authority “directly or indirectly” through the chain of custody from proposal to execution. If the answer is yes on any link, the protocol is non-DeFi under (i). The §301(f)(1) special rule on decentralized governance systems, which I will come to, takes the DGS itself out of the common-control calculus, but does not save a protocol whose governance is nominally DAO-run but operationally team-controlled.

• Prong (ii) is the source-code test. The protocol must operate, execute, and enforce solely on pre-established, transparent rules encoded directly in source code. The word “solely” is operative. A protocol with a single off-chain RFQ component that intermediates pricing fails (ii). A protocol with an off-chain solver network where solvers are themselves running open-source clients on user-controlled signing keys probably does not, although the line gets fuzzy when solvers are paid through a permissioned auction system run by the labs entity. The Across, CowSwap, and UniswapX solver designs each raise this question in slightly different forms. Counsel structuring intent-based protocols should be designing the solver auction to live on-chain or to operate under open-access rules; closed solver sets controlled by the protocol team risk failing (ii).

• Prong (iii) is the censorship test. It asks whether a common-control group has authority, via operation of the protocol, to restrict, censor, or prohibit use, including any applicable system-based user activity. The “via operation of the protocol” qualifier is important. Front-end interfaces that filter OFAC-sanctioned addresses do not, on a straight reading, satisfy (iii) because they do not operate via the protocol; they operate via a separate web application that points at the protocol. The protocol itself remains permissionless. Van Buren v. United States, 593 U.S. 374 (2021), is not directly analogous, but the structural distinction between an access control imposed at the application layer and one imposed at the protocol layer maps onto the same fact pattern. The harder version of (iii) is the hard-coded blocklist. A protocol whose smart contracts check a sanctions oracle and revert transactions from sanctioned addresses operates censorship “via operation of the protocol.” If the censorship authority sits with a common-control group, even a group that updates the oracle infrequently and only in response to law-enforcement requests, (iii) is satisfied. The Tornado Cash OFAC designation arc (the August 8, 2022 SDN listing of smart-contract addresses, the Coin Center and Van Loon v. Department of the Treasury litigation culminating in 122 F.4th 549 (5th Cir. 2024), and the March 2025 OFAC withdrawal) is the policy backdrop. CLARITY’s drafters were aware of it. The bill draws the line so that protocols whose contracts are immutable and whose censorship, if any, occurs at the front-end layer remain DeFi.

§301(a)(2)(B) inserts the DGS rule. A decentralized governance system, solely by virtue of its operation, is not a person or group of persons under common control or acting in concert. This carve-out flows from §2(5) and Post #5 of this series. The DGS itself does not satisfy any of the three prongs simply by existing. A protocol controlled by a properly-constituted DGS is, on the face of the statute, a DeFi trading protocol, not a non-DeFi one. The harder question is whether the DGS itself satisfies §2(5), and that is where the centralized-management exclusion does work.

The Activity Carve-Outs

§301(a)(2)(C) is the practitioner-actionable core of the section. It excludes a list of activities from the definition of “non-decentralized finance trading protocol,” whether engaged in singly or in combination, in relation to the operation of a distributed ledger system or any component of one. The list runs to three clauses but covers the bulk of the infrastructure stack on which any modern protocol depends.

Clause (i) covers compiling network transactions, relaying, searching, sequencing, validating, or acting in a similar capacity. That language is comprehensive. It immunizes block builders (Flashbots and its competitors), relays (mev-boost), MEV searchers, validators (Ethereum, Solana, and every L1 validator economy), and sequencers (the centralized sequencer Arbitrum and Optimism currently run, and the decentralized sequencer designs both networks are moving toward). The “similar capacity” residual is meant to catch the next generation of mempool and ordering services that have not been invented yet. A practitioner advising a sequencer-operator client whose sequencer is centralized today but is the only consensus mechanism for an L2 rollup gets the answer from (i): the sequencer activity, in itself, does not push the rollup or its component into non-DeFi status. That is a meaningful change from how some of the more aggressive Exchange Act enforcement theories would have treated the same facts.

Clause (ii) covers providing computational work, operating a node or oracle service, or procuring, offering, or utilizing network bandwidth, or providing other similar incidental services. Oracle providers (Chainlink, Pyth, RedStone, Switchboard) get an explicit safe harbor. Node operators, RPC providers (Alchemy, Infura, QuickNode), and bandwidth providers do too. The “computational work” clause covers proof-of-work miners, ZK provers, and the emerging class of agent-as-a-service operators who run inference compute against on-chain prompts and pay-per-call markets. Anything that looks like infrastructure underneath the protocol is on the safe side of the line.

Clause (iii) is the incident-response and security-council carve-out, cross-referenced to §301(f). Practitioners coming from §104 will recognize the language; the §301 carve-out tracks the §104(b)(3)(C) cybersecurity emergency-measures safe harbor with parallel mechanics. The council must operate pursuant to pre-defined, temporary, rules-based authority, in response to a specific and documented cybersecurity incident or imminent threat, under publicly disclosed, on-chain authorization mechanisms, strictly limited in scope and duration to the incident, and without unilateral control by any single person. The procedural mechanism must be disclosed in publicly available written documentation reasonably available to the applicable Federal regulator sufficiently in advance of any exercise. §301(f)(2)(A). And the emergency authority cannot be used to push through protocol upgrades, governance decisions, or economic changes unrelated to the cybersecurity incident. §301(f)(2)(B).

The relationship between (i), (ii), and (iii) deserves attention. The three clauses are listed disjunctively (“whether singly or in combination”), which means an entity engaged in multiple safe-harbored activities does not lose the carve-out by virtue of doing more than one. A validator that also operates an oracle and serves on a security council remains within the safe harbor for all three activities. The “in relation to the operation of a distributed ledger system” qualifier is, however, important. It means the carve-outs apply only to activity directed at the operation of the DLS or its components, not to ancillary financial services unrelated to DLS operation. A node operator that also runs a custodial exchange does not get the (i) carve-out for its custodial-exchange activity. The carve-outs are activity-based and apply activity by activity.

§301(b)(2)(B) and the First Amendment hook

§301(b)(2) sets out the substantive requirements for the SEC’s rulemaking under §301(b)(1). Three of the four are unsurprising. (A) requires consistency with the public-interest, investor-protection, and orderly-market purposes of the securities laws. (C) requires legal clarity for development, publication, and operation of distributed ledger systems and their components. (D) directs Treasury enforcement of AML/CFT obligations to the extent applicable under existing law, which is to say that the Commission’s §301 rulemaking is the vehicle through which Bank Secrecy Act obligations attach to non-DeFi trading protocols once the SEC identifies them.

(B) is the constitutional hook. The rules must protect the rights of software developers, publishers, and users to create, publish, and use code and software in a manner consistent with the First Amendment to the Constitution of the United States. That language is not a vague injunction. It is a specific directive that the Commission’s rulemaking comply with the constitutional doctrine articulated in Bernstein v. United States Department of Justice, 176 F.3d 1132 (9th Cir. 1999), and Junger v. Daley, 209 F.3d 481 (6th Cir. 2000): source code is expressive speech, and prepublication restraints on its publication are subject to strict scrutiny. Post #7 of this series picks up the §601, §604, and §605 package that operationalizes the same First Amendment commitment for non-controlling developers, the Bank Secrecy Act money-transmitter definition, and self-custody, respectively. For §301 purposes, what matters is that the Commission’s eventual rule cannot directly or indirectly require registration of source code, distributed ledger systems as such, or non-controlling developers and publishers. §301(d)(1) reinforces the prohibition: nothing in the section, or in any rule adopted under it, can be construed to require a distributed ledger system or any software code to register with the Commission in its own capacity, or to prohibit the launch, deployment, or operation of a DLS. §301(d)(2)(B) reinforces it again with a cross-reference to the §604(b)(3) non-controlling-developer definition. The Commission has no authority over non-controlling developers and providers under §301, and any rule that purported to reach them would be vulnerable on both statutory and constitutional grounds.

The intra-bill cross-reference matters. §604(b)(3) defines a “non-controlling developer or provider” as one without “the legal right or the unilateral and independent ability to control, initiate upon demand, or effectuate transactions involving digital assets to which users are entitled.” The phrase tracks the structural functional-control test that the Fifth Circuit applied in Van Loon to conclude that Tornado Cash’s immutable smart contracts were not “property” subject to OFAC blocking authority. CLARITY codifies the Van Loon analytical move and routes it through the §301 rulemaking process, ensuring that the line between protocol operator (controllable, regulable) and protocol publisher (not controllable, not regulable) becomes a structural constraint on agency action rather than a constitutional question litigated post hoc.

§301(c), Activity-based Application, and the Death of Form-Over-Substance

§301(c) is short but doctrinally important. Rules adopted under §301(b)(1) must determine the applicable requirements only with respect to securities-related activities, based on the functions performed by the controlling person or group of persons, including brokerage, dealing, trading, execution, clearing, or custody of securities, without regard to technological form, distributed architecture, or purportedly decentralized characterization.

That second clause is the kicker. The activity-based test runs in both directions. A protocol whose operators perform brokerage, dealing, or custody functions cannot escape registration by labeling itself decentralized. The “purportedly decentralized characterization” phrase is a direct response to the “we are just software” defense that was floated, with mixed results, in cases like SEC v. Coinbase and the Uniswap Wells correspondence. Distributed architecture, on its own, is not a defense to control-in-fact. But the inverse is also true: a protocol whose operations consist solely of the §301(a)(2)(C) carve-out activities is not pulled into the regime simply because some of its participants perform broker-like functions. Activity is the test. The technological wrapper is not.

§301(c) operates as a doctrinal check on both the agency and the regulated parties. The SEC cannot push a “decentralized” label as a sufficient defense. It also cannot use “centralized in some respect” as a sufficient trigger. The functions actually performed by the controlling persons or groups have to be securities-related under the existing statutory tests in §3(a)(4), §3(a)(5), and §3(a)(11) of the Exchange Act. If they are, the activity-based application of existing requirements follows. If they are not, the §301 regime does not reach the conduct.

This produces a workable line for the most common edge cases. A protocol team that runs a centralized RPC service for user convenience but does not direct or settle transactions is engaged in (ii) activity, not securities-related activity. A protocol team that operates a closed solver network with discretionary order routing engages in conduct that looks like brokerage in fact, and the activity-based application brings it under the regime, regardless of how the surrounding protocol is structured. A foundation that runs a treasury and a grants program but does not maintain custody of user assets or execute user-facing trades is not engaged in covered activity, and §301 does not reach it.

Comparing the FinCEN and FATF Lines

The §301 test is not the only line that matters for DeFi practitioners. FinCEN’s 2019 guidance, FIN-2019-G001, Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (May 9, 2019), draws its own line for money-transmitter status, asking whether the operator has independent control over user funds. FATF Recommendation 15 and its 2019 and 2021 guidance on virtual asset service providers (VASPs) draw an internationally harmonized line that captures any “natural or legal person... that conducts one or more of the following activities or operations for or on behalf of another natural or legal person,” including transfer of virtual assets, exchange between virtual assets and fiat, and safekeeping.

§301 and FinCEN’s 2019 guidance run on parallel tracks. Both ask whether the protocol operator has functional control over user assets. The §301(a)(1) custody prong (no reliance on a person other than the user to maintain custody or control) is structurally similar to FinCEN’s “independent control” test in FIN-2019-G001. A protocol that satisfies §301(a)(1) baseline ordinarily satisfies the FinCEN safe side as well. The §301(a)(2)(A) non-DeFi triggers, however, are more granular than the FinCEN guidance, and the §301(b)(3)(B) BSA-rulemaking direction explicitly authorizes Treasury to draw additional lines through tailored rules. Practitioners should expect FinCEN guidance to be updated post-enactment to track the §301 framework.

The FATF VASP definition is broader than either §301 or FinCEN, and is the source of much of the international compliance friction. FATF’s 2021 updated guidance suggested that DeFi protocol developers could be VASPs if they exercised “control or sufficient influence.” CLARITY’s drafters were aware of the friction; §507 of the bill, on international coordination, directs Treasury to engage with FATF and other multilateral bodies on harmonization. But the U.S. domestic line is now §301. The activity-based application of the existing FinCEN money-transmitter definition will track §301 outcomes, not FATF’s broader VASP concept. That is a meaningful divergence and will produce some cross-border friction for U.S.-domiciled DeFi developers operating in FATF-compliant jurisdictions abroad.

Structuring Choices that Preserve Decentralized Status

The §301 framework rewards structural commitment over branding. A protocol that satisfies §301(a)(1) at the architectural layer and avoids all three non-DeFi triggers under §301(a)(2)(A) stays in the safe bucket.

• First, ship immutable contracts where possible, and where upgradeability is required, route upgrade authority through a properly-constituted DGS with public, on-chain governance, not through an admin key held by a labs entity. The §301(a)(2)(A)(i) common-control prong does not bite if the only authority to alter the protocol runs through a DGS that satisfies §2(5).

• Second, do not embed censorship logic in the protocol layer. Front-end OFAC screening does not implicate §301(a)(2)(A)(iii). Smart-contract sanctions-oracle checks controlled by a common-control group do. The structural choice is to keep censorship at the application layer, where it is run by the operator of the front-end and not by the protocol itself.

• Third, on solver networks, intent-based protocols, and RFQ systems, the §301(a)(2)(A)(ii) source-code test requires that the off-chain components operate under transparent rules. Closed, discretionary solver sets are a problem. Open-access solver networks running standardized client software, with auction mechanics that are themselves transparent, are not.

• Fourth, document the structure. The §301(b)(1) rulemaking will, like the §104(d) and §4B(b)(5) certification regimes elsewhere in the bill, run on disclosure and documentation. A protocol whose governance, upgrade authority, custody architecture, and emergency-response procedures are publicly disclosed in on-chain documentation, governance forum posts, and project README files is in a substantially better position than one whose structure must be reverse-engineered from contract bytecode.

• Fifth, anticipate the activity-based test in §301(c). A controlling person whose activities are limited to publishing software, operating infrastructure within the §301(a)(2)(C) carve-outs, and participating in governance is not engaged in securities-related activity. A controlling person who routes user orders, takes custody, or sets prices in a discretionary capacity is. The structural choice is to keep the labs entity, the foundation, and the development team out of the trade execution path entirely.

The takeaway is that §301 produces a workable, structurally coherent line that was not available under any prior agency interpretation. The line tracks the underlying economic reality of who controls the protocol and what activities they perform, rather than reading from the surface presentation of “decentralized” branding or, conversely, the agency-level intuition that anything involving software must be a sophisticated form of intermediation. SEC v. Coinbase on the exchange-registration theory cannot survive in its prior form after §301. The Uniswap Wells correspondence is moot. The harder question is what happens to the protocols whose actual operational structure puts them on the wrong side of the line, and the answer is straightforward. They register, or they restructure. The bill is candid about which protocols are which.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

The architecture frame established in Post #1 treated CLARITY’s reroute around Howey as a four-cornered structure: the trichotomy of network token, ancillary asset, and digital commodity; the §4B disclosure-only regime; the §104 coordinated-control test; and the decentralized governance system as a separate legal person. This post is on that fourth corner. Section 2(5) does an outsized amount of doctrinal work in roughly twenty-five lines. It overrides Sarcuni. It overrides Ooki DAO. It overrides the Restatement (Second) of Torts § 876 (acting in concert) theory as applied to governance participation. And it does so without inventing a new federal entity form, by accommodating the state-law wrappers that practitioners have spent four years building.

What §2(5) actually says

The definition has four moving parts. Subparagraph (A) defines a decentralized governance system as a “transparent, rules-based system permitting persons to form consensus or reach agreement in the development, provision, publication, maintenance, or administration of the distributed ledger system, in which participation is not limited to, or under the control of, any person or group of persons under common control.” Four elements: transparency, rules-based operation, the formation of consensus or agreement around development or operation of the ledger, and open participation outside the control of a common-control group.

The transparency requirement does light work but matters at the margins. A DGS whose rules cannot be observed or whose voting outcomes cannot be verified will not qualify. The rules-based element is the more substantive constraint: discretionary governance, where a small group can act outside any predefined rule, fails the test. The open-participation requirement is where the bill draws the practical line between something that looks like a DAO and something that looks like a private club whose token holders happen to vote.

Subparagraph (B) is the doctrinal payoff. With respect to a DGS, “the decentralized governance system and any persons participating in the decentralized governance system shall be treated as separate persons unless those persons are under common control or acting pursuant to an agreement to act in concert.” This is direct legislative overruling of the Sarcuni default rule. Mere participation, including voting, no longer triggers the general-partnership inference. Joint and several liability does not attach by default. The DGS has its own legal personality (within the four corners of this Act), and the participants are separate from it.

Subparagraph (D) reinforces this in slightly different language: “a decentralized governance system shall not be deemed to be a person or a group of persons acting under common control.” Where (B) addresses the relationship between the DGS and its participants, (D) addresses the DGS itself, vis-à-vis the rest of the statute. The two provisions are reconcilable. The DGS is a “person” for the purpose of being separate from its participants. It is not a “person or group of persons under common control” for the purpose of any regulatory test that turns on that phrase. Wherever “person” or “common control” is the operative trigger in the rest of the bill, the DGS slides outside the test. This is the mechanism by which DGS treatment flows through to §4B network-token classification, §104 coordinated control, §301 trading-protocol status, and the §2(13) related-person definition. Cross-references in section three.

Two things subparagraph (B) does not do are worth noting. First, it does not override common-control or in-concert findings where they actually exist. If a group of insiders coordinates governance votes via off-chain agreement, the carve-out collapses. Subparagraph (B) protects only the structural inference, not the conspiracy. Second, it does nothing to override liability for one’s own conduct. A core developer who pushes malicious code, or a multisig signer who absconds with treasury funds, remains liable for what she did. What §2(5)(B) eliminates is the imputed liability for what someone else did via the protocol. That is enough to make the difference between a workable governance role and an uninsurable one.

The wrapper accommodation and the centralized-management line

The bill could have stopped at subparagraph (B). The interesting policy choice, and the one most relevant for transactional practice, is subparagraph (C). It states that the term “decentralized governance system” includes “a legal entity, including a decentralized unincorporated nonprofit association or other entity created pursuant to State law, used to implement the rules-based system described in subparagraph (A), provided that the legal entity does not operate pursuant to centralized management.” The reference to the decentralized unincorporated nonprofit association is unambiguous: this is the Wyoming DUNA (Wyo. Stat. §§ 17-32-101 et seq.). The phrase “other entity created pursuant to State law” sweeps in the Wyoming DAO LLC (Wyo. Stat. §§ 17-31-101 et seq.), the Vermont Blockchain-Based LLC, and any subsequent state framework Congress wants to leave room for. The Marshall Islands DAO LLC and the Cayman foundation, although not “created pursuant to State law” in the U.S. sense, satisfy the broader structural test if they otherwise meet (A).

Wrapping the protocol does not, by itself, forfeit DGS status. That is the central drafting choice. The competing model, where any incorporated entity is presumptively centralized, would have pushed structures offshore and incentivized the same legal-form arbitrage that drove the Marshall Islands and Cayman frameworks in the first place. CLARITY says instead: pick the wrapper that fits the operational reality, and let the substantive test (centralized management or not) do the work.

The centralized-management exclusion is the limit. A wrapper that “operates pursuant to centralized management” is not a DGS, regardless of what it calls itself. The bill does not define centralized management directly, but the second sentence of (C) tells us what it is not: “the delegation of ministerial or administrative authority at the direction of the participants in a decentralized governance system shall not be construed to be centralized management.” Read against subparagraph (A)’s open-participation requirement, the picture comes into focus. Centralized management means decision-making authority concentrated in a person or common-control group, exercised outside the rules-based system. Ministerial delegation, by contrast, is the execution of decisions already made by participants pursuant to the transparent rules. A foundation that pays bills on behalf of the DAO does not exercise centralized management. A foundation board that decides which proposals to fund without participant authorization does.

This distinction maps onto current structuring practice with surprising fidelity. The “service-provider” foundation model, in which the entity exists to file taxes, sign contracts, hold IP, and execute participant-approved disbursements, sits comfortably inside the ministerial-delegation safe harbor. The “steward” foundation model, in which the entity retains discretionary authority over treasury, protocol upgrades, or grants, sits outside it. The practitioner question is whether a given wrapper looks like the first or the second, and many existing structures contain both elements. Section four returns to this.

Two interpretive points before moving on. The phrase “at the direction of the participants” implies a chain of authority running from participants down to the wrapper, not the reverse. A multisig that can act on its own initiative is not acting “at the direction of” anyone. A multisig that executes transactions pre-approved by an on-chain vote is. Second, the cybersecurity carve-out at §104(b)(3)(C), which permits pre-defined, rules-based emergency measures by an incident response or security council, suggests that Congress contemplated some narrow discretionary scope being preserved without forfeiting DGS status. But that carve-out is drawn tightly: the response must be limited to a “specific and documented cybersecurity incident or imminent threat,” the rules and procedures must be publicly disclosed in advance, and no single person can hold unilateral control. It is not a license for general discretionary action.

How DGS personhood flows through the rest of the bill

The §2(5) definition is the trunk. The carve-outs scattered through the rest of the bill are the branches, and they work consistently. The first occurs in the related-person definition at §2(13)(B), which expressly excludes a DGS from related-person status. This matters for the §104 disposition restrictions, which apply only to sales by related persons. A DGS-controlled treasury that sells units back into the market is not making a sale by a related person, and the holding-period and volume caps in §104(c) do not apply.

The next is in the network token definition itself. Section 4B(a)(7)(B) excludes from network-token status any investment contract conferring certain disqualifying financial rights, including “an entitlement to, or a reasonable expectation of, an interest, dividend, or other payment, or direct or indirect transfer of value, from a person (other than a decentralized governance system)” (§4B(a)(7)(B)(ii)(III)), and an express or implied financial interest provided by a person other than a DGS (§4B(a)(7)(B)(ii)(IV)). The parenthetical carve-out is doing serious work. Without it, any token holder who could expect payments from the DGS, whether through fee-switch distributions, staking rewards funded out of protocol revenue, or treasury grants, would be holding something with the cash-flow profile of an investment contract under standard Howey analysis. The “(other than a decentralized governance system)” parenthetical converts those flows into non-disqualifying features. The rule of construction at §4B(a)(7)(C)(ii) adds that the “granting of economic interests or voting capabilities with respect to a distributed ledger system or its decentralized governance system” does not disqualify either. Read together, these provisions mean that the DGS can pay, distribute, and confer governance rights without dragging the token into the securities perimeter.

The §104 coordinated-control architecture has two DGS carve-outs. The “distributed ledger control person” defined in §104(a)(3) is “any person or group of persons under common control, other than a decentralized governance system,” that has the unilateral authority to control or materially alter the ledger system. Then §104(b)(3)(B) supplies the safe harbor: a DGS is not a person or common-control group for purposes of the coordinated-control test, and a ledger system is not precluded from being found not-under-coordinated-control “solely based on a functional, administrative, clerical, or ministerial action of a decentralized governance system, including any such action taken by a person acting on behalf of and at the direction of that decentralized governance system.” The ministerial-delegation language from §2(5)(C) reappears here, anchored this time to a specific operational test. The structural choice is consistent: rule-based DGS conduct, including downstream ministerial execution by service providers, does not break decentralization.

Finally, §301(a)(2)(B) supplies the analogous rule for “non-decentralized finance trading protocols.” For purposes of determining whether a protocol is non-DeFi (and therefore subject to traditional intermediary regulation), “a decentralized governance system, solely by virtue of the operation of the decentralized governance system, shall not be considered to be a person or a group of persons under common control or acting pursuant to an agreement to act in concert.” The DeFi-trading test asks whether some common-control person has the authority to alter the protocol, censor users, or operate it outside of pre-encoded rules. DGS operation alone does not satisfy any of those.

The cumulative effect is that DGS treatment is not a one-off accommodation. It is a coordinated decision running through five distinct regulatory choke points: related-person status (§2(13)(B)), network-token classification (§4B(a)(7)), distributed-ledger-control-person status (§104(a)(3)), coordinated control (§104(b)(3)(B)), and DeFi-trading-protocol status (§301(a)(2)(B)). Wherever the bill could have caught a DGS in a person-and-common-control test, it doesn’t. That consistency is what makes §2(5) a structural pillar rather than a definitional curiosity.

Structuring guidance

For anyone structuring (or restructuring?) a DAO under CLARITY, the operative questions reduce to three.

First, does the protocol’s governance qualify as a DGS in the first place? That requires transparency, rules-based operation, formation of consensus around development or operation of the ledger, and participation not limited to or controlled by a common-control group. A multisig of seven anonymous signers with no public charter does not qualify. A token-weighted voting system with on-chain rules, public discussion, and dispersed token ownership ordinarily does. The harder cases sit in between: small councils with formal procedures, hybrid governance models with off-chain ratification, and rolling delegated voting structures all require closer reading against the (A) elements.

Second, does any wrapper preserve DGS status? Wyoming DUNAs and DAO LLCs, Vermont BBLLCs, and offshore analogs all qualify provided they do not operate by centralized management. The drafting question for counsel is whether the operating agreement, association charter, or articles vest discretionary authority in a manager class or council, or whether they confine the entity’s role to executing participant-approved actions. The bill rewards the latter. Existing structures that contain both elements (DAO-controlled treasury plus a discretionary foundation council, for example) should be reviewed against the centralized-management exclusion before any post-enactment certification under §104(d). The wrapper accommodation is generous, but it is conditional, and the condition is structural rather than nominal.

Third, how do off-chain operational arrangements interact with the centralized-management line? A service provider executing payments at participant direction is fine. A service provider with discretionary spending authority is not. A multisig acting on pre-approved on-chain outcomes is fine. A multisig with independent veto authority is not. The cybersecurity-council carve-out at §104(b)(3)(C) creates a narrow exception for predefined emergency response, but it should not be relied on outside its terms.

Section 2(5) is the most consequential twenty-five lines of CLARITY for any practitioner who has worked on DAO structuring under existing law. The Sarcuni general-partnership default is gone. The Ooki unincorporated-association default is gone. The doctrinal cost of governance participation has been reduced from “potential joint and several liability” to “ordinary individual liability for one’s own conduct.” That is a meaningful shift, and the rest of the bill’s DGS carve-outs are not gestures. They are the structural mechanism by which Congress carries DGS personhood through every place in the statute where the form would otherwise have collapsed back into the general-partnership default that Sarcuni and Ooki had built.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

For seven years, “sufficient decentralization” sat at the center of every token launch and every secondary-market listing analysis. The SEC’s April 2019 Framework for “Investment Contract” Analysis of Digital Assets attempted to formalize the inquiry, but ran to dozens of considerations across multiple *Howey* prongs and was published as Staff guidance with no formal regulatory effect. *SEC v. Ripple Labs, Inc.*, 682 F. Supp. 3d 308 (S.D.N.Y. 2023), illustrated the cost of operating in this vacuum. Judge Torres distinguished institutional sales from programmatic exchange sales by reference to the economic reality of each transaction, but neither party could point to a statutory test that would have produced the same result with more certainty.

§104 of the engrossed Senate substitute is the legislative answer. It does not overrule Hinman. Hinman was not law. But §104 effectively buries the speech, replacing the SEC’s “sufficient decentralization” intuition with a five-factor statutory test, anchored by a single quantitative threshold, and operationalized through a certification procedure that produces final agency action reviewable under applicable law. This is the coordinated-control framework that Post #1 identifies as one of the four structural pillars of the bill’s architecture. CLARITY routes around *Howey* rather than overruling it. Decentralization stops being a vibe. It becomes a definition. Once a system is certified as not subject to coordinated control, the resale restrictions in §104(c) lift on a defined schedule that functions as a Rule 144 analog for tokens.

A word on procedural posture before the substance. §104(b)(1) directs the Commission to adopt rules, based on the §104(b)(2) criteria, to define when a distributed ledger system and its related ancillary asset are under coordinated control. The five criteria are not, themselves, the definition. They are the indicia Congress instructs the SEC to consider in rulemaking. The list is exhaustive, however (§104(b)(2) uses “the following criteria,” not “including”), and the §104(b)(3) safe harbors operate independently as bright-line outs. The SEC will fight on weighting and on attribution rules, but it cannot import factors outside the (A) through (E) list.

The Five Indicia

The §104(b)(2) criteria divide cleanly into two structural questions. Three of the five ask whether the protocol is technically open and functional. Two ask whether there is a control group still pulling levers. The five are not weighted on the face of the statute, but the architecture suggests, and the SEC’s rulemaking will likely confirm, that the technical-openness indicia are necessary but not sufficient. A system that ships open-source code under a permissive license and runs on a permissionless validator set can still be under coordinated control if a founding team controls 60% of the float.

§104(b)(2)(A) asks the extent to which the distributed ledger system is not (i) a publicly available protocol, (ii) a distributed ledger application whose source code is freely available via open-source code and recorded on a distributed ledger, or (iii) a Commission-determined analogue. The negative phrasing is awkward but the substance is familiar. A system fails this indicium to the extent the protocol or application source is closed, proprietary, or under license terms that meaningfully constrain forking. This is a low bar. Nearly every credible Layer 1 and Layer 2 in production today clears it. The edge questions are protocols with closed sequencers, MEV-extraction code that is not public, or proprietary fraud-proof systems. The Commission will need to address the extent to which non-public auxiliary infrastructure (block builders, relays, oracles) counts as part of the “distributed ledger system” for §104(b)(2)(A) purposes.

§104(b)(2)(B) is the permissionlessness indicium. It asks whether any person or group under common control has either (i) unilateral authority via operation of the distributed ledger system to restrict, censor, or prohibit use, including any applicable system-based user activity, or (ii) private permissions, hard-coded privileges, or similar capabilities granted by source code that provide preferential treatment compared to similarly situated persons. (i) covers admin keys with censorship power. (ii) covers protocol-level preferential treatment, which is the more interesting prong. A founding-team allocation that vests on a smart-contract schedule, with no special governance rights and no early redemption privilege, should not implicate (ii). A founder-only fee-distribution mechanism that takes a fixed percentage of protocol revenue indefinitely probably does, even if the rest of the protocol is otherwise permissionless. The Tornado Cash sanctions litigation surfaces a harder question on (B)(i): a protocol whose front-end voluntarily blocks sanctioned addresses but whose contracts do not presumably clears it, while a protocol whose contracts hard-code address blocklists arguably does not.

§104(b)(2)(D) is the autonomous-state indicium. The statute asks whether the system has not yet reached “an autonomous state” and whether a person or group under common control has unilateral authority to alter or change the functionality, operation, or rules of consensus or agreement. The term “autonomous state” is undefined and will be a major focus of SEC rulemaking. Compare the SEC and CFTC’s 2026 joint interpretive release (Release Nos. 33-11412, 34-105020), which characterized “functional” digital commodities by reference to whether the network’s native asset can be used “on the system in accordance with its programmatic utility.” §104(b)(2)(D) sits between functionality and immutability. A network can be functional but not autonomous, in the sense that core developers still hold upgrade keys allowing protocol-level changes. The SEC’s natural interpretive move will be to characterize autonomy as a function of governance distribution and upgrade-key custody, which folds (D) into the same inquiry as (B) and (C).

§104(b)(2)(E) is economic independence. The indicium asks whether the primary programmatic mechanisms that are intended to facilitate substantial value accrual to the ancillary asset are functional. This is a value-accrual readiness test. A token whose buy-and-burn or fee-distribution mechanism has not yet shipped fails it. A token whose value-accrual mechanisms are technically live but rely on continued promotional activity by the founding team probably also fails, though the line is fuzzier. (E) is the indicium most directly tied to the *Howey* “efforts of others” prong, and it will drive much of the SEC’s substantive analysis. A network can be open-source, permissionless, and well-distributed, but if its value accrues primarily because a centralized team is still building demand, it is not economically independent within the meaning of §104.

The Only Hard Number

§104(b)(2)(C) is the single quantitative threshold in the entire decentralization framework. It asks the extent to which a person or group under common control has beneficial ownership “of, in the aggregate, more than 49 percent of the total amount of outstanding units of the ancillary asset or voting power with respect to any governance system that relates to the distributed ledger system.” That “or” is doing significant work. A control group that holds 30% of token supply but controls 55% of governance voting power triggers the indicium. So does a group that holds 60% of supply but only 20% of voting power. The disjunctive structure forces issuers to manage decentralization on two axes simultaneously, which the Hinman framework never did with any precision.

Three structural questions follow from the 49% language. First, what does “person or group of persons under common control” mean as an attribution rule. Second, how does the indicium handle lockups, vesting, and time-restricted tokens. Third, how does “voting power” measure against the wide variety of governance structures in the wild.

The common-control attribution rule is the most consequential ambiguity. The statute does not define common control for §104 purposes, and the SEC’s rulemaking will need to import an attribution standard from somewhere. The Investment Company Act’s “control” definition (15 U.S.C. § 80a-2(a)(9), beneficial ownership of more than 25% of voting securities, with a rebuttable presumption) is the most natural analog. The Securities Exchange Act’s beneficial ownership rules (17 C.F.R. § 240.13d-3) are the next candidate. Section 318 of the Internal Revenue Code, with its constructive ownership and family attribution rules, is the most aggressive option. Practitioners should not assume that a majority-owned subsidiary of a foundation is treated as a separate person for §104(b)(2)(C) purposes, or that the SEC will reject family attribution out of hand for founder-controlled vehicles. *Sarcuni v. bZx DAO*, 664 F. Supp. 3d 1100 (S.D. Cal. 2023), analyzed DAO governance through a general-partnership lens, which suggests that joint enterprise principles may sweep token holders together as a single common-control group even without a contractual coordination mechanism. Where the SEC draws the line will determine whether well-distributed foundation-led launches can certify out of coordinated control within a reasonable post-launch window.

Lockup and vesting interplay is the second moving piece. The §104(b)(2)(C) test asks about “beneficial ownership... of total outstanding units.” Standard practice is to exclude unvested team and investor tokens from circulating supply but include them in total supply (the familiar fully-diluted-valuation versus market-cap distinction). “Outstanding units” is ambiguous between these two. The conservative reading is that fully diluted supply controls, in which case a team allocation of 30% counts toward the threshold from day one even if subject to a four-year vest with a one-year cliff. The aggressive reading is that only minted and unrestricted tokens count, in which case the threshold can be managed during the lockup period by burning, locking, or simply not minting reserved supply. The conservative reading is more consistent with the antifraud purposes of the statute and with §104(c), which itself treats unvested holdings as part of related-person exposure. The aggressive reading is more consistent with how the industry has measured decentralization for the last five years.

Governance-power measurement is the third moving piece, and the messiest. The statute says “voting power with respect to any governance system.” That language reaches DAO voting (one-token-one-vote and its quadratic and conviction variants), delegate-based governance (Optimism’s Citizens’ House and Token House, Arbitrum’s delegate system), validator-set voting, and multisig-as-governance (where a multisig executes off-chain governance decisions). It is not obvious that all four are measured the same way. A founding team that holds 40% of governance tokens but has delegated 35% to non-affiliated delegates might fall above or below 49% depending on whether delegation counts as a release of voting power. The Wyoming DUNA framework (Wyo. Stat. §§ 17-32-101 et seq.) and the Marshall Islands DAO LLC structure both address related questions of voting attribution among DAO members, but the §104 test will require its own answer.

The interaction with the §104(b)(3)(B) decentralized governance system safe harbor is also important. A DGS is, by definition, not a person or group under common control. §104(b)(3)(B)(i). The Commission cannot count DGS voting power toward §104(b)(2)(C) because the DGS is a separate legal person. But the participants in the DGS may themselves be under common control with each other or with the founding team. A foundation that funnels its governance influence through a nominally decentralized DAO does not automatically clear (C); the SEC will need to evaluate whether the DGS is operating with independence or as a pass-through for foundation control.

Multisig Councils Survive

The §104(b)(3) safe harbors are the operational counterpart to the indicia. Where the (b)(2) factors describe what coordinated control looks like, the (b)(3) safe harbors describe arrangements that are not, on their own, evidence of coordinated control. There are three. The general safe harbor in §104(b)(3)(A) directs the Commission to establish safe harbors more broadly, and §104(b)(3)(D) confirms that the enumerated safe harbors are not exclusive. The two enumerated safe harbors are the DGS carve-out in §104(b)(3)(B) and the emergency-measures carve-out in §104(b)(3)(C).

The emergency-measures safe harbor is the most thoughtful provision in the entire decentralization framework. Virtually every production DeFi protocol of significance has some form of multisig-based emergency response capability, and subjecting those councils to coordinated-control analysis under a strict reading of (B) would force them to be dismantled in ways that would harm users.

The safe harbor requires that the emergency measure be “pre-defined, temporary, [and] rules-based,” exercised by an “incident response or security council” exclusively in response to a “specific and documented cybersecurity incident or imminent threat,” pursuant to “publicly disclosed, on-chain authorization mechanisms,” “strictly limited in scope and duration solely to address that cybersecurity incident or imminent threat,” and exercised “without unilateral control by any single person.” §104(b)(3)(C). The procedural mechanism for invocation must be disclosed in publicly available written documentation reasonably available to the applicable Federal agency by a decentralized autonomous organization or similar legal entity sufficiently in advance of any exercise.

That language maps cleanly onto Compound’s Pause Guardian (a multisig that can pause specific contract functions in response to a threat, codified in the protocol and disclosed in governance documentation), Aave’s Guardian (similar structure, with explicit on-chain limits on what the Guardian can pause and for how long), and MakerDAO’s Emergency Shutdown mechanism (governance-triggered, with public documentation of the procedure). It is harder to fit the kind of governance-proposal-and-patch response Compound used in the 2021 reserve-distribution incident, which involved community proposals rather than a true incident-response council action. The safe harbor seems to require a council with pre-defined authority, not ad hoc community remediation.

The “publicly disclosed, on-chain authorization mechanisms” requirement deserves attention. It is not enough that a multisig exists with documented members. The authorization mechanism itself (which addresses are in the multisig, what they can do, what triggers their authority, and what limits apply) must be on-chain and publicly disclosed. This is a higher bar than the customary practice of disclosing multisig membership in governance forum posts while leaving the actual multisig contract opaque.

The DGS safe harbor in §104(b)(3)(B) sits alongside the emergency-measures carve-out and does separate work. It establishes that a DGS is not a person or group of persons under common control, and that a system is not precluded from being free of coordinated control “solely based on a functional, administrative, clerical, or ministerial action” of the DGS, including actions taken by a person acting on behalf of and at the direction of the DGS. The clerical-action language preserves operational flexibility for DGS implementations that delegate routine matters to identified service providers. A DUNA that retains a service provider to file annual reports does not become a person under common control with its members because the service provider acts at the DUNA’s direction.

Rule 144 for Tokens

§104(c) is the operational consequence of the coordinated-control framework. If a distributed ledger system is under coordinated control, related persons (broadly defined to include the ancillary asset originator, its subsidiaries, and entities under common control) face restrictions on resale of covered tokens. The restrictions function as a token-equivalent of Rule 144 of the Securities Act (17 C.F.R. § 230.144), and the parallels are deliberate.

Before certification of non-control, a related person may sell covered tokens acquired post-enactment only if (i) §4B(d) disclosures have been furnished, (ii) the holder has held the units for not less than twelve months, and (iii) the amount sold in any twelve-month period does not exceed a cap to be set by SEC rulemaking. §104(c)(1). After certification, the holding period drops to six months, and the volume cap is statutorily floored at no less than ten percent of total outstanding units per twelve-month period. §104(c)(2). For pre-enactment tokens, the holding periods are the same (twelve and six), but the §4B(d) disclosure requirement is waived for post-certification sales. §104(c)(3). Distributed ledger control persons (a narrower category of persons with unilateral authority over protocol functionality) face additional notice and disclosure requirements under §104(c)(4) even after certification.

The Rule 144 analogy is structural rather than mechanical. Rule 144 conditions secondary-market resales of restricted securities on current public information, a holding period (six months for reporting issuers, one year otherwise), volume limitations (the greater of 1% of outstanding or average weekly trading volume), and manner-of-sale restrictions for affiliates. §104(c) adopts the holding-period and volume-limitation concepts directly, conditions on §4B(d) disclosure rather than Exchange Act periodic reporting, and grants the SEC rulemaking authority to fill in the manner-of-sale and notice details. The most consequential difference is the volume cap. §104(c)(2)(C) sets a statutory floor of 10% of outstanding units per twelve months for post-certification sales, which is far more permissive by reference to absolute float than Rule 144(e). For most token launches with standard team allocations, the 10% floor will exceed the related person’s holdings, which means the statutory floor will not bind. The SEC will likely set the actual cap substantially lower in the rulemaking. Where it lands is one of the most consequential open questions in the entire rulemaking process.

Disgorgement is the enforcement mechanism. Under §104(e), profits realized by a related person from sales in violation of §104(c) inure to the holders of the ancillary asset, recoverable in a derivative action by the asset originator or by token holders themselves (with a 5%-of-supply standing threshold for derivative claims and a two-year statute of limitations). The structure mirrors §16(b) short-swing profit recovery under the Exchange Act (15 U.S.C. § 78p(b)) and will be familiar territory for plaintiff-side counsel.

§104(f) mandates a set of exemptions that reveal where the bill expects friction. Material hardship exemptions (death, bankruptcy, dissolution, tax liability arising from token receipt) under §104(f)(1). Liquidity provision exemptions for two-sided market making under §104(f)(2). Agency exemptions for custodians, brokers, dealers, and trading platforms under §104(f)(3). ETP and passive pooled investment vehicle exemptions, with explicit accommodation for authorized-participant create-and-redeem mechanics, under §104(f)(4). The §104(f)(4) exemption is particularly important for the spot Bitcoin and Ether ETPs that came online in 2024 and 2025; without it, related-person tokenholders of an ETP-eligible asset would face disposition restrictions on routine fund operations.

Hinman gave the industry a vibe. §104 gives it a test. The test has five indicia, one hard number, three safe harbors, and a certification procedure that produces final agency action. None of those pieces are self-executing. The SEC’s coordinated-control rulemaking will take eighteen to twenty-four months at best, and the resale restrictions will not lift on any current insider’s preferred timeline. But the architecture is different in a way that matters. Decentralization is no longer a litigation defense to be raised after an enforcement action. It is a statutory standard with a rulemaking path, a certification window, and a Rule 144 analog at the end of it. The “sufficient decentralization” theory survives in §104(b)(2), but only as one of five factors, and only one of those factors has a number attached to it. That number is 49. Hinman would not recognize the section that buried him.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

This carve-out is conditional. It is gated by an enumerated list of disqualifying financial rights in §4B(a)(7)(B). A “network token” includes only digital commodities that do *not* carry (i) any security, (ii) an investment contract or profit-sharing interest equivalent to specified debt, equity, or value-transfer rights, (iii) an interest in a §3(c)-excluded investment company, or (iv) an interest in a non-investment-company asset-holding entity. [1] CLARITY answers that question definitionally. If the rights traveling with the token are within an enumerated disqualifying category, the token is not a network token. If they are not, the token is.

This is a different move from the one FIT21 made. FIT21 introduced “investment contract asset,” a defined term for the underlying digital commodity sold pursuant to an investment contract, with the IC being the security and the asset being something else. That separated the wrapper from the thing being wrapped. CLARITY does something more aggressive. It says the *thing itself* is not a security if it lacks the enumerated rights. The §4B disclosure regime, which I will cover in Post #2 of this series, then attaches to the “ancillary asset” subset of network tokens (network tokens whose value depends on the entrepreneurial or managerial efforts of an “ancillary asset originator” or related person). Network tokens that lack ongoing founder-dependent value (a fully autonomous protocol) are not even ancillary assets and pick up no §4B disclosure burden.

Note that the non-security treatment of §4B(a)(7)(A) is “solely for purposes of the Federal securities laws.” The bill reinforces this in §4B(b)(2), which extends the non-security treatment to §2(a)(1) of the ‘33 Act, §3(a) of the ‘34 Act, §2(a) of the Investment Company Act, §202(a) of the Advisers Act, §16 of SIPA, and functionally-equivalent state law. It does not touch §7701 of the Internal Revenue Code, the §1234 character question for options on tokens, the §475 mark-to-market rules, or state common-law fraud. Tax counsel should not read this as a tax characterization. Litigation counsel should not read it as preemption of common-law fraud, breach of contract, or RICO. It is what it says: a federal securities law carve-out, plus a parallel state securities-law backstop.

The four disqualifying rights

Clause (i) is tautological. “Any security” is a disqualifying right. The work is in (ii) through (iv).

Clause (ii) is the doctrinal core. The term “network token” excludes any “investment contract or a certificate of interest or participation in any profit-sharing agreement” that represents, gives, or is “substantially economically or functionally equivalent to” four enumerated rights, as the SEC shall establish by rule. The four sub-rights are: (I) a debt or equity interest, or an option on either, in a person; (II) liquidation rights with respect to a person; (III) an entitlement to, or reasonable expectation of, an interest, dividend, other payment, or direct or indirect transfer of value from a person (other than a decentralized governance system); and (IV) an express or implied financial interest in (including a limited partnership interest or interest in intellectual property of), or provided by, a person (other than a decentralized governance system).

Critically, clause (ii) does not say “any token whose value depends on the efforts of others is disqualified,” which would have been the Howey import. Howey’s “efforts of others” prong, as elaborated in SEC v. Glenn W. Turner Enters., Inc., 474 F.2d 476 (9th Cir. 1973), reaches any scheme in which “the efforts made by those other than the investor are the undeniably significant ones, those essential managerial efforts which affect the failure or success of the enterprise.” CLARITY does not adopt that test. It asks something narrower and structural: does the token carry an enumerated financial right? Tokenizing an LLC interest, a debt instrument, an option on stock, or a profit-share in a centralized operating company fails. Tokenizing a right to participate in the operation, governance, or fee-revenue of a distributed ledger system does not.

The sub-rights are themselves doctrinally precise.

• (I) (debt, equity, options on same) maps to the conventional security categories. A token that represents a share of an operating company, a note, or a call option on equity is out.

• (II) (liquidation rights) tracks corporate liquidation preferences and partnership distribution rights. If the token entitles the holder to a share of the proceeds of winding up a person, it is out. (III) and (IV) are the catch-alls, and they are where the structuring happens. (

• III) sweeps in any dividend, interest, payment, or transfer of value from a person, with the controlling parenthetical “other than a decentralized governance system.”

• (IV) sweeps in any financial interest in (or provided by) a person, again with the DGS parenthetical.

A “person” is undefined in CLARITY for these purposes, which means it carries its ‘33 Act default meaning under §2(a)(2): an individual, corporation, partnership, association, joint-stock company, trust, unincorporated organization, or government. The DGS parenthetical removes one specific kind of entity from that definition for purposes of clauses (II)(III) and (II)(IV). Everything else remains a “person.” This matters for token cap-table design. A token paying revenue out of a labs entity is disqualified. A token paying revenue out of a properly-structured DGS is not.

Clauses (iii) and (iv) are backstops against laundering economic exposure to a pool of assets through a token. Clause (iii) catches functional interests in entities excluded from investment company treatment by §3(c) of the Investment Company Act. Anyone who has structured a §3(c)(1) or §3(c)(7) private fund will recognize the move. Tokenizing a fractional interest in what would be a §3(c)-excluded private fund and calling the resulting token a “network token” does not work. Clause (iv) extends that backstop one step further to non-investment-company asset-holding vehicles. A token that represents an economic interest in an LLC holding real estate, gold, or any non-securities asset is out. The combined effect of (iii) and (iv) is that wrapper architectures used to securitize off-chain assets do not collapse into network-token status.

Clause (ii) ends with the language “as the Commission shall establish by rule.” That is a rulemaking directive. The substantive content of “substantially economically or functionally equivalent” sits with the Commission. §105(a) gives the SEC one year from enactment to put that flesh on the bone, and I will return to that timing point at the end.

The parenthetical does the work

Four words sitting in parentheses in clauses (ii)(III) and (ii)(IV) do most of the practical structuring work in §4B(a)(7). “Other than a decentralized governance system” is the carve-out that preserves protocol-revenue tokens, fee-switch tokens, vote-escrow tokens, liquid-staking receipt tokens, and the other actually-existing economic primitives on which DeFi has been built. Read without that parenthetical, clause (ii)(III) would disqualify any token providing a “reasonable expectation of” any “payment” or “transfer of value” from any “person.” Every fee-accruing token would fail. With the parenthetical, the question becomes: from whom does the value flow?

§2(5) of CLARITY defines a “decentralized governance system” with care. It is “any transparent, rules-based system permitting persons to form consensus or reach agreement in the development, provision, publication, maintenance, or administration of the distributed ledger system, in which participation is not limited to, or under the control of, any person or group of persons under common control.” §2(5)(B) treats the DGS and the persons participating in it as separate legal persons unless they are under common control or acting under an agreement to act in concert. §2(5)(C) confirms that a DGS includes legal-entity wrappers (decentralized unincorporated nonprofit associations and “other entity created pursuant to State law” such as Wyoming DAO LLCs and Marshall Islands DAO foundations), provided the legal entity does not operate pursuant to centralized management. §2(5)(D), the rule of construction, states that a DGS shall not be deemed a person or a group of persons acting under common control for purposes of the Act.

This is a statutory separate-legal-personhood doctrine for properly-constituted on-chain governance systems. Payments flowing from a DGS to network token holders are not “transfers of value from a person” within clause (ii)(III). Equity-like interests “provided by” a DGS are not financial interests in a person within clause (ii)(IV). The DGS is a person, in some sense, but not the kind of person the disqualifying rights are targeting.

The rule of construction in §4B(a)(7)(C)(ii) reinforces the carve-out from a different angle. It says a digital commodity “shall not be disqualified from being deemed a network token due to the granting of economic interests or voting capabilities with respect to a distributed ledger system or its decentralized governance system.” Economic interests in a DLS or DGS, and voting capabilities over either, are not disqualifying. Read together with the parenthetical, the doctrinal posture is clear: a token can carry meaningful economic rights and meaningful governance rights, provided both run through (or are with respect to) the DLS or the DGS, and not through a related labs entity, foundation operating with centralized management, or other “person.”

The §2(5) DGS definition becomes the load-bearing wall. Anyone structuring a token cap table is now structuring a DGS. The substantive content of “transparent, rules-based,” “consensus or reach agreement,” “participation is not limited to, or under the control of” common-control persons, and “does not operate pursuant to centralized management” is what the bill leaves on the table for SEC and CFTC interpretive elaboration and, eventually, judicial gloss. The Wyoming DUNA framework and the Marshall Islands non-profit DAO foundation provide one set of structuring templates. Whether either, as deployed in any given protocol, satisfies §2(5) is a matter to be analyzed on the facts.

§105(a) and what to do now

§105(a) is the rulemaking direction. The SEC must, within one year of enactment, adopt rules providing that a network token is not considered to provide a disqualifying right under §4B(a)(7)(B) if its market value is “primarily derived, or is reasonably expected to be primarily derived,” from a distributed ledger system or from the broader adoption and use of such a system. The rule must cover four explicit fact patterns: (A) DLS-internal mechanisms collecting, receiving, accruing, or distributing consideration from the functioning of the DLS; (B) governance capabilities with respect to a DLS or DGS; (C) value appreciation or depreciation in response to the use of, or efforts, operations, or financial performance of, the DLS or its DGS; and (D) for network tokens that also meet the ancillary-asset definition, value appreciation or depreciation due to the efforts of the ancillary asset originator or related person.

(D) is the bridge clause and worth dwelling on. It confirms that a single token can be both a network token and an ancillary asset. The “efforts of the ancillary asset originator” pathway preserves the network-token classification for tokens in protocols that still have meaningful contribution from a labs entity, foundation, or core dev team. The price of preservation is the §4B disclosure regime, which attaches to ancillary assets. But the token itself does not flip into security status because a labs entity is still doing work. That is the principal architectural improvement on FIT21’s “mature blockchain system” formulation.

For anyone structuring token cap tables in the year before §105(a) rules are final, the takeaways follow from the architecture.

• First, build the DGS. §2(5) is the load-bearing wall, and tokens whose economics depend on a DGS that does not satisfy §2(5) on close inspection will not survive the disqualifying-rights test.

• Second, route economics through the DLS or the DGS, not through the labs entity. Where the labs entity must receive value (treasury inflows, IP licensing fees, contribution payments), those flows should sit outside the token economics.

• Third, do not write LP-interest-equivalent terms into token whitepapers. Clause (ii)(IV) explicitly names limited partnership interests and IP-licensing economic interests.

• Fourth, separate the network token analysis from the ancillary-asset analysis. A network token that depends on ongoing founder efforts is a network token plus an ancillary asset, with §4B disclosures attaching to the latter. A network token whose value derives only from DLS adoption is a network token and nothing more, with no §4B disclosure burden.

• Fifth, watch the §105(a) rulemaking. The proposed rule will tell us how aggressively the SEC reads “substantially economically or functionally equivalent” in clause (ii), and how it intends to police the line between a DGS that satisfies §2(5) and a foundation operating with centralized management.

A final observation. The structural choice §4B(a)(7) embodies, a rights-based rather than activity-based or maturity-based test, is the right call. It puts the analysis where the analysis belongs, on what the token actually does for its holder, and it spares everyone the indeterminate fact-finding of “sufficiently decentralized” inquiries. It also concentrates enormous interpretive weight on the four enumerated disqualifying rights and on the DGS definition. Those will be the litigated provisions for the next decade.

[1] The list reads like a structured catalog of what the SEC has spent the last decade arguing tokens really are. SEC v. Telegram Grp. Inc., 448 F. Supp. 3d 352 (S.D.N.Y. 2020), SEC v. LBRY, Inc., 639 F. Supp. 3d 211 (D.N.H. 2022), SEC v. Kik Interactive Inc., 492 F. Supp. 3d 169 (S.D.N.Y. 2020), and the now-dismissed SEC v. Coinbase, Inc. litigation, No. 23-cv-04738 (S.D.N.Y. June 6, 2023), all turned on whether the rights traveling with a token amounted to an investment contract enforced through software and protocol economics rather than through paper.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

The post-2017 enforcement era ran on the assumption that Howey was the substantive trigger and registration was the consequence. SEC v. Telegram Group Inc., 448 F. Supp. 3d 352 (S.D.N.Y. 2020), and SEC v. LBRY, Inc., 639 F. Supp. 3d 211 (D.N.H. 2022), are the canonical cases on the originator-controlled side. The SEC’s 2019 Framework for “Investment Contract” Analysis of Digital Assets (April 3, 2019) and the Hinman speech (June 14, 2018) tried to draw a line that token-issuance is an investment contract today but the token, post-decentralization, is not. SEC v. Ripple Labs, Inc., 682 F. Supp. 3d 308 (S.D.N.Y. 2023), got there by judicial route, distinguishing institutional sales (investment contracts) from programmatic secondary-market sales (not investment contracts). CLARITY codifies the Ripple distinction and then goes further. The investment-contract finding is preserved at the transaction level for ancillary-asset distributions. The asset, the secondary market, and gratuitous distributions are all reset to non-security.

The four-step rerouting

Read §4B(b) end to end and the architectural move is obvious.

• Paragraph (1) provides that the offer, sale, or distribution of an ancillary asset by, or caused by, an ancillary asset originator (including through an underwriter) is treated as an offer, sale, or distribution of an investment contract involving an ancillary asset, except with respect to a gratuitous distribution. So the originator’s primary distribution is statutorily deemed an investment contract. Howey’s four prongs are imported wholesale, but as a label rather than as a test. The label triggers no Section 5 obligation. It triggers the §4B(d) disclosure menu and, if the issuer wants, the §103 Regulation Crypto exemption.

• Paragraph (2) of §4B(b) does the real work. A network token is treated as a non-security for purposes of §2(a)(1) of the Securities Act, §3(a) of the Securities Exchange Act of 1934, §2(a) of the Investment Company Act of 1940, §202(a) of the Investment Advisers Act of 1940, §16 of the Securities Investor Protection Act of 1970, and any state-law equivalent that is not also commodity-consistent. This is, functionally, a federal preemption of blue sky law as to network tokens, written into the asset definition. The investment-contract status of the offering does not infect the asset. Howey is a transaction test under §2(a)(1), and §4B(b)(2) simply reads §2(a)(1) (and its sister provisions) out of the network-token analysis. The disqualifying-financial-rights carve-outs in §4B(a)(7)(B), expanded by the §105 rulemaking directive, route any token that looks too much like debt, equity, a liquidation claim, an interest-bearing instrument, or an investment-company interest back into ordinary securities treatment. Reves v. Ernst & Young, 494 U.S. 56 (1990), and the family-resemblance test for notes thus retain bite, but only for the disqualifying-rights inquiry, not for network tokens that pass that gating screen.

• Paragraph (3) is the Ripple codification. Secondary-market offers, sales, or distributions of a network token by any person are treated as not involving the offer, sale, or distribution of a security under the same suite of statutes. The limitation in §4B(b)(3)(B) is structurally interesting and worth flagging. The secondary-market relief is unavailable if the network token was offered, sold, or distributed pursuant to the offer, sale, or distribution of a security by the originator or underwriter. Plain reading: if the originator chose to register the investment contract pursuant to which the token was issued, the secondary-market non-security treatment falls away. The bill thus penalizes the issuer who voluntarily registers. That is a clear structural choice in favor of the disclosure-only path. It is also a trap for foundations and other originators who, on advice of counsel, want belt-and-suspenders Section 5 registration. The price of belt-and-suspenders is losing secondary-market coverage for downstream holders.

• Paragraph (4) creates a presumption that a gratuitous distribution, by itself, does not constitute an offer, sale, or distribution of a security under the same suite of statutes. The anti-fraud and anti-manipulation authorities of the SEC, the CFTC, and state regulators are preserved by §4B(b)(4)(B). What §4B(b)(4) actually accomplishes is far broader than the word “airdrop” suggests. The defined term “gratuitous distribution” in §4B(a)(5) sweeps in self-staking, self-custodial staking with a third party, liquid staking (subject to administrative-or-ministerial-receipt constraints), custodial and ancillary staking services (subject to SEC rulemaking), programmatic and automated rules-based distributions, and a technology-neutral catch-all. That list, taken seriously, captures essentially every protocol-native issuance mechanism that has appeared in the last decade. LBRY’s holding that programmatic rewards constituted unregistered securities offers does not survive this paragraph in any practical sense, at least prospectively.

• §4B(b)(5) closes the loop with a procedural mechanism that runs against the issuer. The paragraph creates a rebuttable presumption that any network token is an ancillary asset (and therefore disclosure-triggering under §4B(d)) unless the originator or a digital asset intermediary submits a written certification, supported by reasonable evidence, that the token is not an ancillary asset. The Commission has 60 days from submission to issue an objection, with deemed effectiveness thereafter. The structural choice is to put the burden on the issuer to demonstrate non-ancillary-asset status. The default is disclosure; the exit is a Commission vote that cannot be delegated to staff or to an individual Commissioner under §4B(b)(5)(C)(iii)(II). That non-delegation requirement is deliberate. It forces the Commission to take public positions on close cases rather than retreating into staff no-action correspondence.

Stack the five paragraphs and the Section 5 registration question for an originator-controlled network-token distribution dissolves into a §4B(d) disclosure question. Howey survives in §4B(b)(1) as the label for what the transaction is called. It is not asked whether Howey is satisfied (it is statutorily deemed satisfied for ancillary-asset distributions other than gratuitous ones). And nothing turns on the answer at the asset level.

Disclosure where registration used to be

The substantive obligation under CLARITY runs through §4B(d), not Section 5. §4B(c) triggers initial and periodic disclosure on the earlier of a public-offering distribution by the originator (whether under Regulation Crypto, an effective Section 5 registration statement, a §3(b)(2) offering statement, or a §4(a)(6) crowdfunding offering) or the first secondary-market distribution that constitutes a public offering in the §4(a)(2) sense. Smaller offerings escape entirely. §4B(c)(1)(B) excludes any offering where aggregate gross proceeds were $5 million or less during the 12 months following the first offer, or where the 12-month average daily aggregate trading value across U.S. spot markets is $5 million or less (both adjusted for inflation).

The disclosure menu itself is more capacious than the comparable Form 10 or Form S-1 line items, and more flexible. §4B(d)(2)(A) requires basic corporate information: the experience of the originator, distribution history including price history, planned activities and anticipated costs to promote use and value of the asset, a going-concern statement from the CFO, ownership disclosures by ≥10 percent equity holders and senior management holding ≥5 percent of the asset, related-person transactions, and the current state and timeline for moving the distributed ledger system out from under coordinated control as defined by §104. §4B(d)(2)(B) layers on economic and technical information: a plain-English description of how the distributed ledger system functions, intended functionality and uses, total supply and emission schedule, governance and consensus mechanism, gratuitous-distribution recipients receiving more than 5 percent of total supply, external code audit information, custodial services available, and a technology description sufficient to permit independent verification of transaction history.

Financial statements are scaled. Under §4B(d)(2)(A)(vii), originators who have distributed less than $25 million in gross proceeds need only reviewed financials; above that threshold, audited. There is no equivalent of the §11 strict liability that attaches to registration statements, because §103(d)(2)(A) explicitly provides that disclosures furnished under §4B are not registration statements for purposes of §11 of the Securities Act, nor are they deemed filed under the Exchange Act. The §10b-5 and §12(a)(2) channels are preserved by §4B(h), and the §103(d)(1)(A) recharacterization of disclosures as “prospectuses” for §12(a)(2) purposes ensures rescission remedies for purchasers in Regulation Crypto offerings. Underwriter §11 exposure, which has shaped the economics of public-offering practice since 1933, is simply not present in the §4B regime. Whatever else CLARITY does, it removes the gatekeeper liability function the underwriter has played for ninety years.

§4B(c)(4) is the offshore-originator solution. A digital asset intermediary may satisfy the §4B(d) disclosure obligation in lieu of the originator, subject to allocation rules. The intermediary path is unavailable when the originator is U.S.-organized and the asset is offered domestically pursuant to Regulation Crypto, an effective Section 5 registration, a §3(b)(2) offering statement, or a §4(a)(6) crowdfunding offering. Translation: U.S. originators must own their own disclosure; offshore originators (or originators of tokens that arrived in U.S. markets by secondary-market migration rather than by primary offering) can outsource disclosure to the listing venue. The standard of liability under §4B(c)(4)(C) is something less than strict: the intermediary cannot file disclosures containing material misstatements or omissions unless it did not know and could not have known of the defect in the exercise of reasonable care. Exchanges become disclosure conduits with diligence-based liability. The structural choice here is to let foreign-organized issuers exist in U.S. markets without forcing a U.S. domestication, but to push the costs of compliance onto the venue that wants to list the asset. Coinbase, Kraken, and Gemini become §4B(d) filers for the long tail of foreign-originated tokens that trade on their platforms.

The §4B(d)(2)(A)(xv) decentralization-roadmap requirement deserves attention as well. The originator must disclose the current state and timeline for development of the distributed ledger system, detailing if, how, and when the system and the related ancillary asset are intended to no longer be subject to coordinated control. That is an affirmative obligation to plan for the §104 coordinated-control exit and to commit to reportable milestones. Practitioners drafting these disclosures should expect to be held to them. A roadmap filed in year one that bears no relation to the system’s posture in year three will look, at best, like a §4B(h) misstatement candidate, and, depending on whether circular value flows or timing manipulation under §4B(m)(2)(C) are also present, like a §4B(m) evasion candidate.

§4B(d)(3) provides the exit. A certification covered party (the originator, a subsidiary, a related person, or any entity in common control) may file a written certification, supported by reasonable evidence, that during the preceding 180 days no covered party has engaged in more than a nominal level of entrepreneurial or managerial efforts and that any such prior efforts were not a primary factor in determining the value of the ancillary asset. A §104(d) certification (the coordinated-control exit) must also be effective. The Commission has 90 days from submission to issue a written notice of objection or non-objection. Silence means deemed approval under §4B(d)(3)(B)(iv). Disclosure obligations terminate. This is the Hinman speech, codified, with a procedural backstop and a 90-day deemed-approval clock. It is also the practical end-state of the disclosure regime for any token that reaches a decentralized steady state: the originator files, periodically updates, and eventually certifies out.

§103 and the capped exemption

Section 103 of CLARITY directs the SEC to adopt Regulation Crypto, a new exemption from Section 5 registration for offers, sales, and distributions of investment contracts involving ancillary assets. The exemption is capped at the greater of $50 million per calendar year (for up to four years) or 10 percent of the dollar value of outstanding ancillary assets. §103(b)(1)(A). Total proceeds under Regulation Crypto across the life of the originator are capped at $200 million in the aggregate. §103(b)(2). Both caps adjust for inflation under §103(b)(3) and may be raised by the Commission on a two-year review cycle.

This is the back door, and it is narrow. A $1.7 billion Telegram-style raise (institutional pre-sales of SAFTs followed by a public launch of the network token) cannot fit through Regulation Crypto. It would have to take one of three other routes: registration of the investment contracts under Section 5 with a token-specific form, reliance on §4(a)(2) (and the new digital-asset modernization rules under §108 of CLARITY), or a §4(a)(6) regulation crowdfunding offering as recharacterized by the bill. The point worth underlining for clients is that the §103 cap is sized against the type of fundraising that produced the post-2017 enforcement cycle. Large pre-launch raises remain a registration question. Smaller raises, retroactive disclosure programs, and post-launch ongoing distributions are the constituency Regulation Crypto is sized for.

The §103 conditions matter. §103(c)(1) requires disclosures under §4B(d) at least 30 days before the first Regulation Crypto offer, sale, or distribution. §103(c)(2) imports the §104 coordinated-control restrictions on related-person dispositions. §103(c)(3)(A) excludes non-U.S.-organized originators, a meaningful change from current practice where offshore foundations regularly stand behind U.S. token distributions, and worth thinking through against the Wyoming DUNA and Marshall Islands DAO LLC frameworks. Bad-actor disqualifications under §103(c)(3)(E) through (H) track Rule 506(d) and Rule 262 with a 10-year felony lookback for insider trading, embezzlement, cybercrime, money laundering, terrorism financing, and financial fraud. The §103(d) status provision recharacterizes the disclosures: prospectus for §12(a)(2), statement for §17(a), §10(b), and Rule 10b-5, not a registration statement for §11 purposes, and not deemed filed under the Exchange Act.

The combined effect of §4B and §103 is to convert the registration question into a disclosure-and-cap question. Above $200 million in lifetime reliance, the issuer either registers under Section 5 (losing §4B(b)(3) secondary-market coverage in the process per the §4B(b)(3)(B) limitation) or uses another exemption, typically §4(a)(2) for institutional pre-sales. Below $200 million, Regulation Crypto with §4B(d) disclosure is the path. Both paths converge on the same §4B(d) menu and the same §4B(d)(3) exit.

What’s left of Howey

Howey now does three things in the network-token context.

• First, it sorts. The §4B(a)(1) definition of “ancillary asset” requires that the value of a network token be dependent upon the entrepreneurial or managerial efforts of an ancillary asset originator or a related person, as those concepts are further specified by the Commission by regulation. That phrase is Howey’s fourth prong, lifted and repurposed as a classification criterion. Network tokens whose value does not depend on the entrepreneurial or managerial efforts of an originator are not ancillary assets. They live outside §4B(d). Network tokens whose value does so depend are ancillary assets and trigger disclosure. Howey tells you which bucket the token sits in.

• Second, Howey polices the disqualifying-financial-rights exclusions in §4B(a)(7)(B). Any token that represents, gives the holder, or is substantially economically or functionally equivalent to a debt or equity interest, a liquidation right, an entitlement to a dividend or transfer of value from a person other than a decentralized governance system, or an investment-company interest, is excluded from network-token treatment and falls back into ordinary securities analysis. Howey, Reves, and the lineage of cases that runs through them remain dispositive for that gating screen. The drafting choice to vest the exclusion in “substantially economically or functionally equivalent” language ensures that this is where the major future contests will sit. Anti-evasion is reinforced in §4B(m), which expressly contemplates the removal of a disqualifying financial right paired with reintroduction through a related-person vehicle (a foundation, a DAO, a laboratory) as evidence of willful evasion. The §4B(m)(2)(C) factor list reads as if it were drafted with the post-2020 wave of foundation-and-protocol structures in mind.

• Third, Howey lingers in §4B(b)(1) as a label. An originator-controlled distribution of an ancillary asset is an offer, sale, or distribution of an investment contract involving an ancillary asset. That is a useful nominal fiction for §12(a)(2) and Rule 10b-5 purposes. It is also useful for anti-fraud authority that travels with the investment-contract designation. But it has no Section 5 consequence, and the §4B(b)(2) non-security treatment of the asset itself prevents the investment-contract label from infecting the token in secondary markets or on the books of any holder.

The retroactive piece deserves a moment. §4B(k)(1) bars the SEC and any private plaintiff from initiating, pursuing, or maintaining a §5 or §12(a)(1) action arising from pre-effective-date offers, sales, or distributions of ancillary assets, provided the originator (or certification covered party) complies with the §4B(c)(3) transition disclosure obligations. Anti-fraud actions survive under §4B(k)(2). Secondary-market pre-effective-date sales of network tokens are similarly retroactively cleansed under §4B(k)(3). The Telegram, LBRY, Kik, and Coinbase backlog of Section 5 enforcement risk substantially dissolves on the effective date. The Ripple institutional-sale holding remains as to the historical liability the SEC obtained, but no future SEC enforcement of analogous conduct can build on it. The 2019 Framework is, in any event, formally superseded by the joint SEC-CFTC interpretation effective March 23, 2026 (Release Nos. 33-11412 and 34-105020), which expressly displaces the prior Framework and the Commission’s staff statements on related topics. The Hinman speech, never Commission policy in the first place, retains only historical interest. What “ancillary asset” and “entrepreneurial or managerial efforts” mean going forward will be developed through the §4B(b)(5) prior-certification process, the §4B(d)(3) ongoing-certification process, and the Commission’s eventual §105 rulemaking, with the joint release’s analytical structure (essential managerial efforts as the operative concept, separation doctrine for when a non-security crypto asset ceases to be subject to an investment contract) as the relevant interpretive background.

Token offerings have moved from a registration question to a disclosure question. Howey still routes assets between the network-token bucket (disclosure regime) and the ordinary-securities bucket (registration regime), and still polices the disqualifying-financial-rights screen. But its central role in the digital-asset space since 2017, as the substantive trigger for Section 5 enforcement, is over. The structural questions that remain are no longer about whether Howey is satisfied. They are about whether the §4B(b)(5) prior certification will issue, whether the §4B(d)(3) exit certification will be granted, whether §104 coordinated control has dissolved, whether §4B(m) anti-evasion regulations will catch a particular structure, and whether the originator has correctly screened its instrument under §4B(a)(7)(B). Those are good questions, and they will keep this practice busy for the next decade (but they are not Howey questions).

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

This post is the doctrinal scaffold for the series that follows. The thesis is straightforward and worth stating up front: CLARITY’s central innovation is the construction of a three-tier statutory regime — network token, ancillary asset, digital commodity — sitting atop the existing securities laws, paired with a fourth construct, the decentralized governance system, that operates as a separate legal person and refuses to be deemed an unincorporated association of its participants. The §4B disclosure regime grafted onto the Securities Act of 1933 is what makes that three-tier scheme operational. Every other title in the bill — Title III’s DeFi line, Title IV’s bank-permissibility expansion, Title VII’s bankruptcy reform, Title VI’s developer protections — is downstream of this architecture. Reading CLARITY as a series of standalone subject-matter reforms will leave you confused about why pieces fit together the way they do. Reading it as a single doctrinal engine that classifies first and then routes consequences accordingly will not.

The Trichotomy

Start with the categories. CLARITY’s §2 defines “digital commodity” by reference to the new §1a of the Commodity Exchange Act added elsewhere in the bill; the Commission’s universe is everything that is digital, recorded on a distributed ledger system, and not a security. So far this is unremarkable — the categorical move is borrowed wholesale from the 2024 FIT21 framework. The novelty is in the further subdivision. A “network token,” defined in §4B(a)(7) of the Securities Act as added by §102, is a digital commodity “intrinsically linked to a distributed ledger system and that derives, or is reasonably expected to derive, its value from the use of such distributed ledger system.” A network token is, by statutory operation, “treated as a non-security solely for purposes of the Federal securities laws,” subject to a narrow set of disqualifying conditions discussed below. The *ancillary asset*, also defined in §4B(a)(1), is the network token that has not yet reached maturity: a network token “the value of which is dependent upon the entrepreneurial or managerial efforts of an ancillary asset originator or a related person, as those concepts are further specified by the Commission by regulation.” The bill borrows the Howey vocabulary (entrepreneurial or managerial efforts) and uses it to mark the ancillary asset’s developmental phase rather than to determine whether the asset is a security at all.

In other words: every network token is potentially an ancillary asset in its infancy, and every ancillary asset is expected to mature into a fully decentralized network token whose value is no longer dependent on identifiable promoter effort. The bill builds in a rebuttable presumption to that effect in §4B(b)(5): a network token is presumed to be an ancillary asset until the originator or a digital asset intermediary submits a certification, supported by reasonable evidence, “sufficient to demonstrate that the network token is not an ancillary asset.” The Commission has sixty days to object; absent an objection, the certification takes effect automatically. The presumption runs *toward* regulation, but the mechanics make graduation cheap and quick.

So, the CLARITY framework is doing exactly what the SEC’s 2019 Framework for “Investment Contract” Analysis of Digital Assets purported to do, and what former Director Hinman gestured at in his June 2018 speech at the Yahoo Finance All Markets Summit — except that the bill replaces a multi-factor evaluative framework with a statutory category whose entry and exit conditions are spelled out and whose default direction is non-security. Howey survives by name; its operational consequences for token markets do not. The maturity question — Hinman’s “sufficiently decentralized” intuition — becomes a structured certification with a sixty-day clock rather than a years-long enforcement-driven discovery of the answer.

§4B as Bolt-On

The mechanism for routing consequences is Securities Act §4B, inserted by §102 of CLARITY immediately after §4A (the JOBS Act’s crowdfunding section). §4B(b) is where the doctrinal magic happens. Subsection (b)(1) provides that “the offer, sale, or distribution of an ancillary asset by, or caused by, an ancillary asset originator, including through an underwriter, shall be considered to be an offer, sale, or distribution of an investment contract involving an ancillary asset.” Read that carefully. The transaction is an investment contract. The transaction therefore implicates the Securities Act. But subsection (b)(2) immediately provides that the network token itself is “treated as a non-security” for purposes of §2(a)(1) of the 1933 Act, §3(a) of the 1934 Act, §2(a) of the Investment Company Act, §202(a) of the Advisers Act, and §16 of SIPA. The bill carefully distinguishes between the transaction — which can be an investment contract — and the asset — which, even when it is the subject of an investment contract, retains its non-security status everywhere else in the federal securities laws.

The doctrinal upshot is that Section 5’s registration requirement applies to the transaction, but the analytic surface area shrinks dramatically because Section 5 compliance for ancillary asset transactions is achieved through the §4B(d) disclosure menu rather than through the standard S-1/S-3/Reg A/Reg D pathway. §103 lays out the exemption-and-rulemaking framework that makes this concrete: an ancillary asset offering meeting the disclosure conditions of §4B(d) is exempt from registration, the Commission is directed to adopt implementing rules within 360 days, and the rulemaking must “tailor” the disclosure burdens to the technical and economic realities of distributed ledger systems. Practitioners who lived through the SEC’s no-action experience with the Munchee (DAO Order Sec. Act Release No. 81207 (July 25, 2017)), Telegram (SEC v. Telegram Grp. Inc., 448 F. Supp. 3d 352 (S.D.N.Y. 2020)), and LBRY (SEC v. LBRY, Inc., 639 F. Supp. 3d 211 (D.N.H. 2022)) line of cases will recognize what is happening: the registration question that those cases agonized over is rerouted into a disclosure question, and the disclosure question is given a finite scope.

Two further provisions complete the bolt-on. Subsection (b)(3) addresses the secondary market: the offer, sale, or distribution of a network token by *any person other than the originator or underwriter* is not the offer of a security under any of the federal acts or any “functionally equivalent” state law. This is the provision that, more than any other, kills the Reves v. Ernst & Young, 494 U.S. 56 (1990), family-resemblance overhang for secondary trading. Subsection (b)(4) addresses gratuitous distributions: airdrops, staking rewards, validator rewards, liquid-staking issuance, and protocol-rules-based programmatic distributions are presumed not to be offers, sales, or distributions of a security. The taxonomy of “gratuitous distribution” in §4B(a)(5) is broad enough to capture nearly every non-purchase token-acquisition mechanism — a taxonomy worth a standalone post (and getting one).

Anti-fraud authority is preserved expressly. §4B(b)(4)(B) clarifies that nothing in the gratuitous-distribution presumption “may be construed to limit, impair, or otherwise affect the anti-fraud or anti-manipulation authorities of the Commission, the Commodity Futures Trading Commission, or a State regulator.” The same savings language reappears throughout the bill. Practitioners should not mistake CLARITY for a deregulation bill. It is a re-routing bill. The Commission’s §10(b)/Rule 10b-5 jurisdiction over token markets is unaffected; the §17(a) anti-fraud authority over offers and sales is unaffected; the New York Martin Act survives where consistent with the federal scheme. What changes is the registration overhang, not the anti-fraud floor.

The Disqualifying-Financial-Rights Test

The next layer of the architecture sits inside §4B(a)(7)(B). To qualify as a network token — and therefore as a presumptive non-security at the asset level — a digital commodity must not bear any of four “disqualifying financial rights.” First, a security as that term is otherwise defined, or anything functionally equivalent to one. Second, an interest representing or substantially equivalent to a debt or equity interest, an option on such an interest, liquidation rights, or “an entitlement to, or a reasonable expectation of, an interest, dividend, or other payment, or direct or indirect transfer of value, from a person other than a decentralized governance system.” Third, an interest in a §3(c)-excluded investment company. Fourth, an interest in a non-investment-company entity holding assets other than securities.

The third and fourth disqualifiers are largely housekeeping — they prevent the use of network-token wrappers to evade the Investment Company Act and its §3(c)(1) and §3(c)(7) carve-outs. The first is tautological. The doctrinal work is being done by the second, and specifically by the parenthetical “other than a decentralized governance system.” Read carefully: a token can confer “an entitlement to, or a reasonable expectation of, an interest, dividend, or other payment, or direct or indirect transfer of value” from a decentralized governance system without losing its network-token status. This means protocol-revenue-sharing tokens, fee-switch tokens, vote-escrow tokens, and similar mechanisms survive the test so long as the value flow runs *from* the DGS rather than from a centralized issuer or a related person. The doctrinal lever is the legal personhood of the DGS, which we get to in a moment.

A separate provision, §105(a), instructs the Commission to adopt rules within one year confirming that a network token “shall not be considered as providing a disqualifying financial right” if its market value is “primarily derived, or is reasonably expected to be primarily derived, from a distributed ledger system or from the broader adoption and use of such a system” — including where the ledger collects, receives, accrues, or distributes consideration from network functioning; where the token provides governance capabilities; or where its value appreciates or depreciates due to network use or ancillary-asset-originator efforts. This rulemaking instruction collapses the most-litigated Howey prong — “efforts of others” — by deeming network-derived value to be non-disqualifying as a matter of statutory direction. The Commission has discretion in the rule’s particulars but not in the basic principle.

§105(b)(2) adds what is probably the most consequential and least-discussed grandfather in the bill: a digital asset that was, on January 1, 2026, the principal asset of an exchange-traded product not registered under the Investment Company Act and listed on a national securities exchange is, by statutory operation, neither an ancillary asset nor a security. BTC and ETH receive this status automatically; any other token whose spot ETP was listed before the cutoff joins them. The asymmetry created is significant — a token *with* a spot ETP gets a regulatory free pass; a token *without* one has to clear the §4B/§105 maturity tests — and it creates an obvious incentive structure for issuers to push ETP listings onto national exchanges before the cutoff freezes the universe. That dynamic deserves its own post (and gets one in the queue).

The Decentralized Governance System as a Separate Person

The fourth structural element — and the one that does the most quiet doctrinal work — is the DGS construct. §2(5) defines a “decentralized governance system” as, with respect to a distributed ledger system, any “transparent, rules-based system permitting persons to form consensus or reach agreement in the development, provision, publication, maintenance, or administration of the distributed ledger system, in which participation is not limited to, or under the control of, any person or group of persons under common control.” Subparagraph (B) is the key: “the decentralized governance system and any persons participating in the decentralized governance system shall be treated as separate persons unless those persons are under common control or acting pursuant to an agreement to act in concert.” Subparagraph (C) accommodates wrapper entities — a state-law decentralized unincorporated nonprofit association (Wyoming’s DUNA), a Marshall Islands DAO LLC, or analogous foreign-jurisdiction vehicles — so long as the entity does not operate “pursuant to centralized management” and provided that “the delegation of ministerial or administrative authority at the direction of the participants in a decentralized governance system shall not be construed to be centralized management.” Subparagraph (D) closes with a rule of construction: a DGS “shall not be deemed to be a person or a group of persons acting under common control” for purposes of the Act.

The construct is doing four things at once. First, it solves the entity-classification problem that the *Sarcuni v. bZx DAO*, 664 F. Supp. 3d 1100 (S.D. Cal. 2023), and *CFTC v. Ooki DAO*, No. 2:22-cv-05416 (N.D. Cal. 2023), courts grappled with — the question of whether a token-holder-governed protocol is, by virtue of its operation, a general partnership of its token holders with joint and several liability flowing from any actionable conduct. CLARITY says no, by statutory direction, so long as the participants are not under common control or acting in concert. Second, it preserves token-holder governance — voting, treasury management, parameter setting — without converting that participation into the kind of “common enterprise” that *Howey* and its progeny treat as evidence of a securities relationship. Third, it makes the “value flow from a DGS” carve-out in §4B(a)(7)(B)(ii)(III) coherent — value can flow from the DGS to token holders without being treated as a distribution from a person, because the DGS and its participants are separate persons by statute. Fourth, it provides the doctrinal foundation for the §301 DeFi carve-out, which uses the same construct to draw the line between a “decentralized” and a “non-decentralized” trading protocol.

The construct is not unlimited. Subparagraph (B) preserves the common-control and acting-in-concert exceptions; subparagraph (C) excludes wrappers operated pursuant to centralized management. Practitioners structuring DAOs in CLARITY’s wake should expect a body of Commission rulemaking and eventual enforcement on the boundary between ministerial delegation (preserved) and centralized management (disqualifying). The drafting is sound enough that the boundary should be administrable, but it is not self-executing.

Coordinated Control and the 49% Test

§104 puts operational teeth on the DGS construct by defining “coordinated control” as the disqualifying condition for ancillary-asset status. The Commission is directed to adopt rules implementing five indicia: (A) the protocol and any distributed-ledger applications are open-source and publicly available; (B) no person or common-control group has unilateral authority to censor, restrict, or grant preferential treatment via system operation or hard-coded source-code privileges; (C) no person or common-control group has beneficial ownership of more than 49% of outstanding token units or 49% of governance voting power; (D) the system has reached an autonomous state — no person has unilateral authority to alter functionality or consensus rules; (E) economic independence — the value-accrual mechanisms intended to flow consideration to the ancillary asset are functional.

The 49% threshold is the only hard number in the entire decentralization framework, and it is doing a great deal of work. Token-supply concentration and governance-vote concentration are both captured (the test is disjunctive — either trips it), and “beneficial ownership” is the operative metric, which means scoped grants, vesting schedules, lockups, custody arrangements, and trust structures will all need to be analyzed for ownership-attribution purposes. The Commission has discretion in the precise rules of construction (the bill says the Commission “shall consider” the criteria) but not on the 49% number, which is hard-coded.

§104(b)(3) provides safe harbors. Subparagraph (B) reaffirms that a DGS is not a person or common-control group for §104 purposes. Subparagraph (C) is the cybersecurity emergency-measure safe harbor: a pre-defined, temporary, rules-based emergency measure exercised by an incident response or security council exclusively in response to a documented cybersecurity incident or imminent threat, pursuant to publicly disclosed on-chain authorization mechanisms, that is strictly limited in scope and duration and exercised without unilateral control by any single person, does not by itself constitute common control or acting in concert. This is a thoughtful drafting concession to the realities of protocol governance — most major DeFi protocols maintain emergency-pause multisigs, and CLARITY explicitly preserves them as compatible with decentralization status.

The §301 Line and the Rest of the Architecture

The DGS construct and the coordinated-control test repeat themselves in §301, which applies the same logic to DeFi trading protocols. A “decentralized finance trading protocol” is defined as a distributed ledger system through which participants execute transactions via predetermined non-discretionary automated rules without third-party custody. A “non-decentralized” version is one in which (i) a person or common-control group has authority to control or materially alter functionality, (ii) execution is not based solely on source-code-encoded rules, or (iii) someone has censorship authority. §301(a)(2)(C) carves out from the “non-decentralized” classification a long list of activities that should not be deemed control: compiling, relaying, searching, sequencing, validating, oracle services, computational work, bandwidth provision, and participation in security councils. The activity carve-outs are practitioner gold and merit a standalone post, but the architectural point for this post is that §301 reuses the same DGS-separate-person logic and the same control-versus-non-control distinction that §104 establishes. The trading-protocol layer is just the trading-protocol analog of the asset-classification layer.

The same architectural through-line runs through Title IV (banking) and Title VII (bankruptcy). §401 authorizes national banks, FHCs, federal credit unions, and (by parity) state banks to perform the full menu of digital-asset activities — custody, staking, lending, principal market-making, dealing, payment, brokerage, derivatives — and bootstraps those activities into “the business of banking” under 12 U.S.C. § 24 Seventh. The list is fourteen items long and explicitly excludes nonfungible assets. §401(h) eliminates prior-notice and approval requirements outside the existing organic banking statutes. This is the statutory equivalent of, and significantly broader than, the OCC’s 2020–21 Interpretive Letter 1170/1172/1174 sequence (modified by IL 1179 to reinstate prior approval). For a chartered institution, the universe of permissible digital-asset activity goes from contested-and-conditional to expressly enumerated.

§701 then pulls ancillary assets and digital commodities into the Subchapter III stockbroker liquidation regime of Chapter 7 of the Bankruptcy Code. Ancillary assets are added to 11 U.S.C. § 741’s customer-property definitions, and digital commodity transactions are designated commodity contracts for purposes of the safe-harbor provisions (§§ 362, 546(e), 553, 556, 561, 562). The doctrinal point — and the through-line back to §4B — is that CLARITY treats ancillary assets as quasi-securities for customer-property and bankruptcy-safe-harbor purposes while treating them as non-securities for offering, trading, and reporting purposes. That asymmetry is not an oversight. It is the structural choice the bill is making: protect customers as if they hold investment property, but classify the property itself out of the registration regime.

What this Means in Practice

The practical consequences of the architecture, before we get into the standalone deep dives that follow in this series, are five.

First, the classification question becomes a routing decision rather than a legal conclusion. The question every issuer’s counsel will ask is no longer “is this an investment contract” but “is this a network token, an ancillary asset, or something else.” The first two categories are presumed non-securities at the asset level even when the originating transaction is a §4B(b)(1) investment contract; the third — anything that fails the network-token test, including any token with disqualifying financial rights — remains a security subject to the full *Howey* analysis and the standard registration/exemption framework.

Second, the registration question shrinks. Ancillary-asset offerings clear §4B(d) disclosure rather than full §5 registration. Secondary-market trading of network tokens is non-securities trading. Gratuitous distributions are presumed non-securities events. The compliance surface for token issuance is meaningfully smaller and more predictable. The compliance surface for fraud and manipulation is unchanged.

Third, DAO and protocol structuring becomes a structured exercise. The DGS construct, the 49% test, and the §301 carve-outs together provide a checklist for assessing whether a given arrangement clears the decentralization bar. Wyoming DUNA wrappers, Marshall Islands DAO LLCs, and similar vehicles are accommodated. Multisig emergency councils are accommodated. What is not accommodated is centralized management masquerading as decentralized governance.

Fourth, custody and intermediary regulation becomes activity-based. §301(c) requires the SEC to determine intermediary-registration consequences “only with respect to securities-related activities, based on the functions performed by the controlling person or group of persons, … without regard to technological form, distributed architecture, or purportedly decentralized characterization.” The bill is explicit that decentralization rhetoric is not a defense to control-in-fact; conversely, the absence of control is a defense regardless of decentralization rhetoric.

Fifth, every consequence flows from the classification. Banking permissions, bankruptcy treatment, BSA obligations, broker-dealer registration, anti-fraud reach — all turn on whether the asset is a digital commodity, ancillary asset, network token, security, or payment stablecoin. The five-way taxonomy is the bill’s organizing principle. Read every other title with that taxonomy in front of you and the structure resolves.

What this Series Will Cover

The posts that follow this one will work through the architecture in the order it was built. Next up: the §4B disclosure regime in detail — how the bill keeps *Howey* nominally while draining it of consequence — and the §4B(a)(7) disqualifying-financial-rights test that determines who is in the network-token category in the first place. After that: the §104 coordinated-control test and the 49% threshold; the DGS construct and the *Sarcuni*/*Ooki* overrule; the §301 DeFi line; the §401 bank-permissibility expansion; the §701 bankruptcy reform; the §404 stablecoin yield prohibition and its activity-rewards loophole; the §602 NFT safe harbor; the §505 tokenization-parity rule. Toward the end of the series, the contrarian posts: the §105(b)(2) ETF grandfather and the regulatory-arbitrage incentive structure it creates; what CLARITY pointedly does not address (tax, ERISA, residual CFTC jurisdiction); and the §904 Build Now Act housing rider that found its way into a digital-asset market-structure bill.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

My goal here is not to re-tread their ground but to build on it: to explain what the Revised UCC actually fixes, where the sharp edges still are, and what people should do. The short version is this: commercial law has been groaning under the weight of 2020s asset classes shoehorned into 1950s concepts. New York finally fixed the plumbing. Now the rest of us get to work out what flows through it.

To appreciate what the Revised UCC accomplishes, it helps to remember what secured lending against crypto collateral actually looked like under the pre-Amendments regime.

If your borrower pledged a bunch of Ether, your options were ugly. Ether isn’t a “deposit account,” isn’t “investment property” (because it isn’t a security held through a securities intermediary), isn’t “chattel paper,” isn’t “money” in any conventional sense, and isn’t a “negotiable instrument.” Practitioners mostly settled on classifying it as a “general intangible” under Article 9 and perfecting by filing a UCC-1 financing statement against the debtor. That worked, sort of, for some purposes. But it created two problems that never really went away.

First, there was no concept of negotiability for crypto. If someone bought Bitcoin from your borrower on the secondary market, that purchaser took the coins subject to your lien forever. There was no holder-in-due-course doctrine, no take-free rule, nothing to cleanse the asset of prior claims as it changed hands. A motivated secured party could, in theory, chase the collateral through ten wallets and claim it back from an innocent purchaser. That’s not how functioning financial markets work. It’s how a legal opinion ends with “we are unable to opine” and the deal falls apart.

Second, the idea of control, which the UCC already used for deposit accounts, investment property, and electronic chattel paper, had no analog for blockchain-native assets. You couldn’t perfect a security interest in Bitcoin by taking the private key. Or rather, you could, in the sense that operationally you would control the coins, but the UCC didn’t bless that approach with priority rules, and a later-filing party might still leapfrog you.

The upshot is that secured lending against digital assets has, for the last several years, been either overcollateralized, overengineered, or both. Credit facilities against crypto collateral routinely use custodial arrangements with negotiated contractual priorities, belt-and-suspenders UCC filings, and legal opinions that qualify themselves into unreadability. It works, but it’s expensive, it’s inconsistent across transactions, and it presumes a court someday won’t take a dim view of the whole arrangement.

What Article 12 Actually Does

The Revised UCC does four things that matter. It creates a new asset class, defines a perfection method tailored to that asset class, imports negotiability-style take-free rules, and sets a choice-of-law default.

The new asset class: Controllable Electronic Records. Section 12-102(a)(1) defines a “controllable electronic record” (CER) as a record stored in an electronic medium that can be subjected to “control.” The definition is intentionally broad and technology-neutral. It plausibly covers Bitcoin and Ether, GENIUS Act payment stablecoins, DeFi receipt tokens (LP tokens, vault shares, liquid staking tokens), NFTs, tokenized real-world assets, tokenized off-chain loan obligations, and more. Importantly, “investment property” is carved out, so tokenized securities remain in the Article 8 regime, but parties can elect to treat a CER as an Article 8 “financial asset” if it’s held through a securities intermediary. [2]

CERs can also carry “tethered” payment rights as “controllable accounts” and “controllable payment intangibles” (CPIs). Together, the three categories (CERs, controllable accounts, and CPIs) form the “Digital Assets” universe under the Revised UCC.

The perfection method: Article 12 Control. Section 12-105 defines when a person has “control” of a CER. The three elements are (i) the power to avail oneself of substantially all the benefit from the CER, (ii) the exclusive power to prevent others from doing the same and to transfer control to another person, and (iii) the ability to readily identify oneself as having those powers.

That’s statute-speak for something pretty simple: control means you hold the keys, you can spend the coins, you can keep others from spending them, and the system (whether that’s a blockchain, a custodian’s internal ledger, or a vault-and-registry combo) lets you prove it’s you.

Take-free rules for qualifying purchasers. Section 12-104 brings holder-in-due-course doctrine to CERs. A “qualifying purchaser” (i.e., someone who obtains control of the CER “for value, in good faith, and without notice of a claim of a property right” in it) takes the CER free of prior property claims. [3] The rule is exactly what’s been missing from the crypto secondary market: a legal basis on which buyers can acquire digital assets cleansed of prior liens, just like a negotiable instrument transferee.

Choice-of-law default. Section 12-107 sets up a choice-of-law waterfall. Parties can expressly designate a jurisdiction as the CER’s jurisdiction (as long as that jurisdiction has enacted the Amendments); if they don’t, the CER’s own “system” rules apply; and if that fails, the District of Columbia is the residual default.

Together these four moves turn Digital Assets from legal orphans into a proper asset class with a perfection regime, a priority scheme, and a transfer doctrine. That is not nothing.

Control, Properly Understood

The most consequential piece of Article 12 for Web3 practitioners is the control concept, because it finally reconciles commercial law with the actual architecture of digital asset custody.

The statute is drafted to be technology-neutral, which means Article 12 Control can be established through a lot of different arrangements:

• A custodian holding the assets in a pooled omnibus structure, so long as the custodian can identify the position as held for the purchaser.

• An electronic vault or e-registry (think the MERS® eRegistry system for e-Notes) where the system guarantees a unique authoritative copy and exclusive controller rights.

• A self-custodied wallet, where the purchaser holds the private keys directly.

• A multisig arrangement, which is the one I want to spend a minute on.

Multisig does not defeat exclusivity. This was a genuine open question before the Amendments, and the resolution is correct. Under § 12-105(b)(2) and Official Comment 5, the exclusivity requirement is not defeated if power is shared with other persons, even if any party can act unilaterally, so long as the person seeking to establish control is not dependent on another person’s concurrent exercise of power. Translation: a 2-of-3 Safe where you hold one signer and a co-signer can act with either of the other two still lets you satisfy the control test, provided you can act on your own. If the arrangement required your signature plus someone else’s, you’d lose exclusivity on your own but might still have it jointly.

Smart-contract liquidation does not defeat control. This is the one I think DeFi builders should have tattooed on their forearms. Under § 12-105(b)(1), exclusivity is not impaired when control is limited by “a protocol programmed to cause a change, including a transfer or loss of control.” Official Comment 5 uses exactly this rationale: “a transfer of control resulting from a program that is a part of a system’s protocol is inherent in the controllable electronic record and does not impair the exclusivity of the power of the person in control of the record.”

That means if your collateral is sitting in a decentralized lending protocol and the smart contract is programmed to liquidate the position upon a health-factor breach, you can still have Article 12 Control of the collateral for UCC purposes. The protocol’s automated transfer doesn’t kill your control any more than the possibility of a bank’s setoff right kills your control over a deposit account. That clarification matters enormously for lending-against-DeFi-positions structures and for any credit arrangement where collateral lives inside a protocol rather than a custodian’s cold storage.

Indirect control through another person. Section 12-105(e) lets a party have control through another person who acknowledges holding for them. Practically, this enables the collateral agent pattern that structured credit transactions already use for other asset classes: a third-party custodian holds the keys, acknowledges holding for the secured party, and the secured party is perfected by control.

This is the architecture that institutional crypto lending has already been building toward with qualified custodians, tri-party arrangements, and contractual priorities. Article 12 now provides the statutory backbone those arrangements have been missing.

Take-Free

If Article 12 Control is the piece practitioners will talk about, the take-free rules are the piece they should be talking about. Import holder-in-due-course doctrine into the crypto market and the consequences ripple outward in ways that haven’t fully registered yet.

The rule, again, is that a qualifying purchaser of a CER (for value, in good faith, without notice) takes the CER free of competing property claims. [4] Two points on top of that are worth underlining.

First, the Revised UCC expands the “filing is not notice” rule to make clear that a filed UCC-1 financing statement does not, by itself, constitute notice to a qualifying purchaser of a CER. [5] This is a significant shift - previously, a secured party could file a UCC-1 and rely on constructive notice to defeat later purchasers. Under Article 12, that constructive notice doesn’t reach CER purchasers. If you want to bind a later purchaser of Bitcoin to your lien, filing is not enough: you have to prevent them from becoming a qualifying purchaser, which really means you need to take control yourself.

Second, the take-free rule has a carve-out for CERs that represent off-chain interests. If the CER evidences an interest in an underlying asset (e.g., a token that represents a claim to a real-world asset held in a SPV) the qualifying purchaser takes the CER free of claims on the CER itself, but takes the underlying interest subject to existing property claims on that underlying. [6] For CERs with controllable payment rights tethered to them, the take-free protection extends to those payment rights. For CERs without any tethered interests (e.g., Bitcoin) the full take-free applies. See Uniform Commercial Code Amendments (2022), Prefatory Note to Article 12, Comment 3 (applying the qualifying purchaser standard to a hypothetical Bitcoin transaction).

What this means in practice: Bitcoin is now treated, for property-law purposes, closer to the way negotiable bearer paper has historically been treated. A tokenized real-world asset is closer to a bill of lading: the token cleanses, but only as to the token. And a stablecoin representing a dollar claim against an issuer gets take-free protection on the CER and the payment right, which is basically exactly the cash-like treatment the stablecoin industry has been asking for.

Control > Filing

Under the Revised UCC, a security interest in a CER can still be perfected by filing. But Section 9-326A makes clear that a security interest perfected by Article 12 Control takes priority over one perfected by filing even if the filing pre-dated the control. [7] When two secured parties both have control, Section 9-322(a)(1)’s first-to-file-or-perfect rule decides priority. [8]

For leveraged finance, this is a real change. A syndicated credit agreement with an “all assets” security package and a filed UCC-1 no longer automatically has senior position on crypto collateral. A later lender who takes Control (e.g., through a tri-party custodial arrangement) leapfrogs the earlier filer.

If you work on leveraged credit facilities for companies that might hold CERs (and that increasingly means any company, not just the obvious ones, but treasury departments have been quietly accumulating BTC since 2021), you have a documentation problem to solve in the next twelve months:

1. Audit existing facilities to see whether the borrower has CERs that your UCC-1 nominally covers but that a later Control-based lien could jump over.

2. Expand control agreement requirements, or at least blocked-wallet / custodial acknowledgment concepts, to cover CERs the borrower may hold.

3. Consider the Article 8 election. If the CERs are held through a securities intermediary, parties can elect to treat them as “financial assets” and perfect by securities account control agreement, which is a familiar playbook that doesn’t require climbing the Article 12 learning curve. [9]

Electronic Money and the Stablecoin Question

The Amendments create a new collateral category “electronic money” defined as a medium of exchange authorized or adopted by a domestic or foreign government in electronic form. Central bank digital currencies would fit. The digital form of existing sovereign money (think a future Fed-authorized tokenized dollar) would fit. Payment stablecoins issued under the GENIUS Act would not fit this definition, because GENIUS Act stablecoins are issued by licensed private issuers, not governments; they are more naturally CERs with tethered payment rights.

For electronic money, the perfection rules are similar to those for CERs, with one important twist: a security interest in electronic money can only be perfected by control, not by filing. The only exception is when the electronic money constitutes identifiable cash proceeds of other collateral. If a CBDC ever arrives in the U.S. (which, per the current administration’s position, it very much won’t) this is the regime that would govern credit transactions collateralized by it.

For the stablecoin question, the more immediate and practical point is that Article 12 finally gives GENIUS Act payment stablecoins the commercial-law treatment their economics have always demanded. A well-structured payment stablecoin is a CER with a controllable payment intangible tethered to it. The qualifying purchaser takes free of competing claims on both the token and the redemption right. That is, legally, exactly how cash works. It’s the treatment the stablecoin industry has been pushing toward for years without having a statute that unambiguously delivered it.

The Choice-of-Law Trap

The most underappreciated risk in the whole regime is the choice-of-law trap.

As of April 2026, 34 jurisdictions have enacted the 2022 Amendments, and seven more (Alaska, Maryland, Massachusetts, Mississippi, Ohio, South Carolina, and Tennessee) have introduced legislation. That still leaves a meaningful number of states that have not adopted and have not introduced. A court sitting in one of those states, applying its own choice-of-law rules, might conclude that no jurisdiction’s version of Article 12 governs, and treat the CER as a mere “general intangible” under the pre-Amendments framework, without the take-free rules, without Control-based perfection, without the super-priority doctrine.

That’s a bad outcome, especially if you’re a qualifying purchaser who thought you took clean title, or a Control-based secured party who thought you had priority over an earlier filer.

The mitigation strategy is threefold, and it’s what practitioners should be inserting into every CER-touching deal now:

• Designate an enacting state as the CER’s jurisdiction under Section 12-107(c). New York is the obvious candidate for financial deals, since the financial contracts market is already predominantly New York-law governed.

• Choose an enacting state’s law as the governing law of the underlying agreement.

• Consider forum selection clauses that keep disputes in courts that have adopted the Amendments.

None of this perfectly eliminates the risk, because a forum court is not bound to honor choice-of-law elections if it decides the relevant question is one of property rather than contract. But it substantially reduces the surface area, and it’s cheap to do.

The Revised UCC takes effect on June 3, 2026. The grace period runs through June 3, 2027.

[1] See N.Y. U.C.C. Law §§ 12-101 et seq.

[2] N.Y. U.C.C. Law § 8-102(a)(9)(iii).

[3] N.Y. U.C.C. Law § 12-102(a)(2).

[4] N.Y. U.C.C. Law § 12-104(e), (g)-(h).

[5] N.Y. U.C.C. Law § 9-331(c).

[6] N.Y. U.C.C. Law § 12-104(f).

[7] N.Y. U.C.C. Law § 9-326A.

[8] See Uniform Commercial Code Amendments (2022) § 9-326A cmt. 2.

[9] N.Y. U.C.C. Law §§ 8-102(a)(9)(iii), 8-106(d).

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

What Problem Is This Solving?

Under the Exchange Act, a “broker” is “any person engaged in the business of effecting transactions in securities for the account of others.” 15 U.S.C. § 78c(a)(4)(A). Courts have interpreted “effecting transactions” broadly — routing orders, soliciting trades, handling funds, and providing transaction-related advice can all trigger registration obligations. [1]

The problem for crypto is that the line between “software tool” and “broker” has been unclear (to say the least). A non-custodial wallet that integrates a swap aggregator, a DEX front-end that routes trades across multiple liquidity pools, an app that compares execution venues for token trades - each of these could be characterized as “effecting transactions” under a sufficiently aggressive reading of existing caselaw.

The Crypto Task Force roundtables and written submissions throughout late 2025 and early 2026 surfaced this issue repeatedly. The Blockchain Association’s April 6, 2026, comment letter put it bluntly: providers of non-custodial wallet interfaces and DEX front-ends that neither control customer assets nor perform core trading functions are not securities intermediaries. The staff appears to have listened.

The “Covered User Interface Provider” Framework

The statement introduces the concept of a “Covered User Interface Provider” - an entity that operates a website, mobile application, or browser-based tool that helps users prepare and transmit crypto asset securities transactions through self-custodial wallets. The staff’s position is that such a provider need not register as a broker-dealer, provided it satisfies a detailed set of conditions.

I want to emphasize: this is a staff statement, not a Commission-level rule or interpretation. It is not legally binding. It doesn’t create rights or obligations enforceable in court. That said, what it does do is signal that the Division of Trading and Markets won’t recommend enforcement action against providers that color inside these lines. That matters (think of it as the practical equivalent of a conditional no-action position) but it’s a different animal from the Joint Interpretation the SEC and CFTC issued on March 17, which was a formal Commission action binding on both agencies. [2]

The Conditions: Seven Pillars of Neutrality

The conditions break down into roughly seven categories. Each is independently necessary. Miss one, and you’re back in broker-dealer territory.

1. No Recommendations, No Solicitation. The provider cannot recommend specific trades, suggest particular crypto asset securities, or solicit transactions. The interface must function as a passive tool through which users make their own decisions about what to buy, sell, or swap, in what quantity, and at what price.

2. User Retains Full Control. The user must control all trade parameters — price, size, timing, execution preferences. The interface cannot override, modify, or constrain user choices in ways that reflect the provider’s judgment about what’s best for the user. Self-custody is assumed throughout.

3. Objective Presentation of Options. If the interface displays multiple execution routes or venues, it must sort or filter them using objective, pre-disclosed criteria: price, speed, fee amount, liquidity depth. The provider cannot label any route as “best,” “preferred,” or “recommended.” No subjective characterizations, no editorial overlay.

4. Fee Neutrality. Fees must be fixed, transparent, and applied consistently regardless of which asset is traded, which venue is selected, or what execution route is chosen. The provider’s compensation cannot vary based on trade outcomes, counterparty identity, or venue affiliation. If you’re currently earning revenue through route-dependent fee structures (and a lot of aggregators and wallet-integrated swap features are) this condition requires a fundamental business model rethink.

5. Conflict Disclosure and Fair Treatment. If the provider is affiliated with a trading venue, liquidity pool, or other execution system, it must disclose that relationship prominently. Affiliated venues must be treated on the same terms as unaffiliated venues in how they’re presented and accessed through the interface.

6. Comprehensive Disclosure Obligations. Providers must clearly communicate their non-registered status, their fee structures, their conflicts of interest, the mechanics of how the system works, their cybersecurity controls, and the limitations of the interface. The staff wants users to understand what they’re using and what protections they don’t have.

7. Venue Monitoring. Providers must implement and maintain policies for evaluating connected trading venues on factors like liquidity, transparency, security, and reliability. These evaluations must be consistent across all integrated systems and subject to ongoing review. Default parameters must be based on objective criteria.

What (or who) is Still a Broker

The statement explicitly carves out activities that remain squarely within the broker-dealer registration requirement: executing trades, holding or handling customer assets, providing investment advice, negotiating transactions, or exercising discretion over order routing or execution. If your platform does any of these things, you’re a broker. Full stop. The statement doesn’t change that.

This is worth emphasizing because there’s a natural tendency to read these kinds of staff positions as broader than they are. The statement protects a specific, narrow category of activity: providing a neutral software tool through which users independently prepare and submit transactions using their own wallets. The moment the provider’s thumb is on the scale (in any direction, for any reason) the protection evaporates.

How This Fits Into the Broader Picture

This statement doesn’t exist in a vacuum. It sits inside a rapidly evolving regulatory architecture that has taken shape over the past twelve months:

• The SEC/CFTC Joint Interpretation (Release No. 33-11412, March 17, 2026) established a five-part crypto asset taxonomy — digital commodities, digital collectibles, digital tools, stablecoins, and digital securities — and formally superseded the SEC staff’s 2019 Framework for “Investment Contract” Analysis of Digital Assets.

• The GENIUS Act (Pub. L. No. 119-27), enacted in July 2025, created a statutory carve-out for payment stablecoins issued by permitted issuers.

• The Division’s December 2025 statement on broker-dealer custody of crypto asset securities clarified how Rule 15c3-3 applies to private key management.

• The DTC no-action letter (December 11, 2025) authorized a three-year pilot for tokenizing DTC-custodied assets on supported blockchains.

Today’s statement is the next tile in the mosaic by addressing the front-end layer, the interfaces through which retail and institutional users actually interact with onchain markets, and does so in a way that’s consistent with the trajectory of the Crypto Task Force comment letters, which have consistently argued that software providers who don’t control assets, don’t exercise discretion, and don’t intermediate trades shouldn’t be forced into the broker-dealer box.

Five-Year Sunset

The framework has a built-in expiration: five years from issuance, unless superseded by Commission-level rulemaking or legislation. The staff clearly expects that either the forthcoming “Reg Crypto” exemptive framework (currently under OIRA review) or a comprehensive market structure bill from Congress will provide a more durable answer before then. All of that said, read the actual statement. The conditions are detailed and the distinctions matter. Further, it is really important to remember that staff-level guidance is not a safe harbor, it’s a weather forecast, and a forcast won’t keep you dry if it storms.

[1] See, e.g., SEC v. Kramer, 778 F. Supp. 2d 1320 (M.D. Fla. 2011); SEC v. Hansen, No. 83 Civ. 3692, 1984 WL 2413 (S.D.N.Y. Apr. 6, 1984).

[2] See “Application of the Federal Securities Laws to Certain Types of Crypto Assets and Certain Transactions Involving Crypto Assets,” Release No. 33-11412, 91 Fed. Reg. 13,714 (Mar. 23, 2026).

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

The Securities and Exchange Commission (SEC)

The SEC regulates the issuance and transfer of securities in both primary and secondary markets. Its broad statutory mandate puts the Commission at the center of digital asset regulation, particularly for startups that issue tokens, coins, or any other instrument that may qualify as an investment contract.

When Is a Crypto Asset a Security?

The foundational question for every crypto project is whether its tokens or digital assets constitute “investment contracts” under the framework established by SEC v. W.J. Howey Co. An investment contract exists where there is (1) an investment of money, (2) in a common enterprise, (3) with a reasonable expectation of profit, (4) derived from the efforts of others. If a token satisfies these elements, it is a security subject to the full panoply of federal securities laws—including registration requirements, disclosure obligations, and anti-fraud provisions.

The SEC’s 2019 Framework for “Investment Contract” Analysis of Digital Assets provided granular guidance on the third and fourth prongs, emphasizing that the more active a promoter is in the development and operation of the token network and its market, the more likely it is that the token will be treated as a security. The framework remains relevant, but the analytical landscape has continued to evolve through enforcement actions, court decisions, and, increasingly, affirmative guidance from the Commission.

The Shift Under Chairman Atkins

The SEC’s approach to digital assets underwent a fundamental transformation beginning in January 2025, when Acting Chairman Mark Uyeda established the Crypto Task Force under Commissioner Hester Peirce’s leadership. The task force was explicitly designed to move the Commission away from regulation-by-enforcement and toward a comprehensive, transparent regulatory framework.

When Chairman Paul Atkins took office in April 2025, he accelerated this shift. The Commission held a series of public roundtables on topics including the securities status of digital assets, public offerings, exemptions and safe harbors, and trading and custody requirements. In July 2025, Atkins unveiled “Project Crypto”—a Commission-wide initiative to modernize securities regulation for digital assets—and directed staff to develop a comprehensive framework to facilitate crypto asset distributions within the United States. Atkins stated publicly that, in his view, most crypto assets are not securities, and that classification as a security should not be a deterrent to development.

In November 2025, Atkins outlined the next phase: a token taxonomy anchored in the Howey investment contract analysis, designed to provide clearer guidance on which tokens fall within the SEC’s jurisdiction. In January 2026, the Division of Corporation Finance, Division of Investment Management, and Division of Trading and Markets jointly issued a statement elaborating this taxonomy for tokenized securities.

Formal rulemaking is expected in 2026, with proposals anticipated for a comprehensive crypto asset framework and amendments to the Securities Exchange Act of 1934 to accommodate crypto trading on exchanges and alternative trading systems. For founders, the practical takeaway is that the regulatory posture has changed—but the rules have not yet been rewritten. Operating as though compliance is optional because the political winds have shifted is a serious mistake.

Stablecoins

In April 2025, the Division of Corporation Finance issued a staff statement analyzing whether transactions in stablecoins are subject to federal securities laws. The statement concluded that certain “covered stablecoins”—those designed to maintain a 1:1 peg to the U.S. dollar, backed by reserves of cash and short-term U.S. Treasuries, and redeemable on demand—do not involve the offer and sale of securities. This guidance was subsequently reinforced by the GENIUS Act, signed into law in July 2025, which established a federal regulatory framework for payment stablecoins and expressly provides that qualifying payment stablecoins are neither securities nor commodities.

Bitcoin

The SEC has consistently maintained that Bitcoin is not a security, on the basis that its consensus mechanism is too decentralized to constitute an enterprise controlled by a promoter or third party. This position has been reaffirmed across multiple administrations and is unlikely to change.

The Commodity Futures Trading Commission(CFTC)

The CFTC regulates the sale and transfer of commodities, derivatives, and futures contracts. The Commission’s jurisdiction over digital assets arises from the Commodity Exchange Act’s broad definition of “commodity,” which encompasses “all services, rights, and interests…in which contracts for future delivery are presently or in the future dealt in.” The CFTC has interpreted this language to encompass virtual currencies and certain digital assets—most notably, Ethereum has been treated as a commodity under this standard.

When Are Digital Assets Commodities?

The line between a security and a commodity remains one of the most contested questions in digital asset regulation. The CLARITY Act, which passed the House in July 2025, proposes to resolve this by creating a taxonomy that divides crypto assets into digital commodities, investment contract assets, and permitted payment stablecoins—with the CFTC exercising primary jurisdiction over digital commodities and the SEC over investment contract assets. If enacted in its current form, the CLARITY Act would provide the clearest jurisdictional framework the industry has seen. Until then, the analysis remains fact-specific and the outcome can depend on which regulator reaches a given asset first.

SEC-CFTC Coordination

In September 2025, Chairman Atkins and Acting CFTC Chairman Caroline Pham issued a joint statement formalizing their commitment to harmonize digital asset regulation. The statement previewed potential joint actions including expanded trading hours, coordinated margin requirements, and safe harbors for peer-to-peer spot crypto trading. With Michael Selig—former chief counsel of the SEC’s Crypto Task Force—confirmed as CFTC chairman, the two agencies are better positioned for coordination than at any point in the history of digital asset regulation.

Futures and Swaps

If your company allows users to exchange futures contracts or hedge the value of a digital asset, it is likely subject to CFTC registration requirements. The CFTC has brought numerous enforcement actions against crypto platforms operating unregistered futures exchanges, and this area of enforcement has continued regardless of the broader shift in regulatory posture.

The United States Treasury

FinCEN

The Financial Crimes Enforcement Network (FinCEN) is a bureau of the Treasury Department responsible for policing financial crime and regulating money services businesses (MSBs). Companies engaged in the exchange of virtual currency for fiat currency, or that issue or administer virtual currencies, may qualify as MSBs and must comply with the Bank Secrecy Act, including know-your-customer (KYC) requirements, anti-money laundering (AML) obligations, and suspicious activity reporting.

Determining whether your company qualifies as an MSB is one of the most important regulatory questions a crypto startup can ask—particularly if your business processes payments, facilitates exchanges, or provides custodial services involving digital assets. State-level money transmitter licensing adds an additional layer of complexity, as requirements vary significantly across jurisdictions.

The IRS

The IRS treats crypto as property—analogous to stock, bonds, and other capital assets. Accordingly, U.S. taxpayers must report a range of crypto transactions, including sales, exchanges, and conversions. If your startup involves a crypto exchange, staking rewards, mining, yield farming, or other income-producing activities, you must ensure compliance with federal tax obligations. The IRS has also intensified its enforcement focus on crypto tax reporting in recent years, and the information reporting requirements imposed on centralized exchanges and brokers continue to expand.

The Legislative Landscape

The regulatory framework for digital assets in the United States is being reshaped by legislation, not just agency action. Two statutes enacted in 2025 are particularly consequential.

The GENIUS Act

The Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act), signed into law on July 18, 2025, is the first federal legislation specifically addressing digital assets. The Act establishes a comprehensive regulatory framework for payment stablecoins, requiring issuers to maintain reserves backing outstanding stablecoins on at least a 1:1 basis with U.S. dollar-denominated assets (primarily cash and short-term U.S. Treasuries). Issuers are prohibited from paying interest or yield on payment stablecoins, and qualifying stablecoins are expressly excluded from the definitions of “security” and “commodity” under federal law.

For crypto startups, the GENIUS Act provides critical clarity: if your product involves a payment stablecoin, the regulatory pathway is now defined by statute rather than by enforcement discretion.

The CLARITY Act

The Digital Asset Market Clarity Act of 2025 (the CLARITY Act) passed the House on July 17, 2025, and is pending in the Senate as of this writing. The Act’s core innovation is a three-part taxonomy that divides crypto assets into digital commodities, investment contract assets, and permitted payment stablecoins, with regulatory jurisdiction allocated between the CFTC and SEC based on classification. The Act would also establish registration pathways for digital asset trading platforms, custodians, and dealers.

If the CLARITY Act becomes law in substantially its current form, it will represent the most significant structural reform of U.S. securities and commodities regulation in decades. Founders should monitor its progress closely and plan for the possibility that the rules governing their tokens, platforms, and business models may change materially within the next legislative cycle.

Enforcement Actions and Investigations

Even in a more favorable regulatory environment, enforcement actions and investigations remain a reality for crypto companies. Having an expectation for the process, understanding how to comply, and knowing what regulators look for is key to mitigating liability. Regulators across administrations have consistently rewarded cooperation and good-faith compliance from companies that demonstrate a genuine effort to operate within the rules.

How Investigations Begin

Investigations can originate from several sources: market surveillance, referrals from other agencies, whistleblower tips, or self-reporting by the company. Understanding how an investigation originated can inform your response strategy and help you anticipate the scope of the inquiry.

Agency Coordination

Agencies routinely coordinate on digital asset enforcement. The SEC and FINRA frequently bring parallel actions, as do the SEC and DOJ (where the conduct implicates criminal law). The CFTC and DOJ similarly coordinate where commodities fraud is alleged. State regulators and international authorities may also be involved, particularly where the company operates across borders.

If a peer company becomes the subject of an investigation, take it seriously: conduct an internal review to determine whether your operations share any of the characteristics that attracted regulatory attention. Proactive self-assessment is far less expensive than reactive defense.

Subpoenas and Formal Requests

Formal investigations typically involve written demands to produce records and information. The DOJ issues grand jury subpoenas; executive agencies issue administrative subpoenas or formal orders of investigation. A critical point: corporations do not enjoy Fifth Amendment protection against self-incrimination, so a corporate subpoena recipient cannot refuse to produce records on that basis.

If you receive an administrative subpoena, engaging in dialogue with the issuing agency can be productive. Depending on the circumstances, negotiation may lead to a narrower scope, an opportunity to present your perspective on the facts, or—in the best case—a decision not to proceed. Retain experienced counsel immediately upon receiving any formal request.

Whistleblowing

Federal whistleblower programs continue to grow in scope and activity. The Dodd-Frank Act’s SEC whistleblower program, Sarbanes-Oxley’s protections for corporate insiders, and the Anti-Money Laundering Act’s expanded Treasury whistleblower program all incentivize individuals to report potential misconduct. The AMLA has particular relevance for crypto companies: it bolstered the whistleblower program within the Treasury Department, with direct implications for companies subject to the Bank Secrecy Act—including money services businesses that deal in virtual currencies.

Your compliance program should include easily accessible whistleblower information and robust anti-retaliation policies. Creating a culture that takes compliance seriously and respects the importance of internal reporting mechanisms is both a legal obligation and a practical necessity.

Self-Reporting

Self-reporting—voluntarily disclosing potential violations to regulators—can provide tangible benefits. Leadership from both the SEC and DOJ has emphasized that self-reporting often leads to reduced penalties or declinations. A secondary benefit is control: by acting first, your company can shape the narrative and direction of any resulting inquiry, rather than being in a purely reactive posture.

Self-reporting should not be undertaken without a careful cost-benefit analysis. Factors to consider include the magnitude of the suspect activity, the likelihood it will be detected through other means, the legal risk involved, the costs of cooperation, the potential reputational impact, and the effect on shareholders and investors. Not every compliance gap warrants voluntary disclosure to federal regulators.

Preserving Data

The moment you become aware of a potential investigation, you must take immediate steps to preserve all relevant information. Document destruction—even of seemingly inconsequential data—can lead to obstruction charges, adverse inferences, and separate penalties that may exceed the liability for the underlying conduct. Legal holds should be implemented promptly, automated deletion processes should be suspended, and employees should be notified of their preservation obligations.

Crypto companies should be particularly diligent about communications hygiene. The SEC, CFTC, and FINRA have made recordkeeping a priority enforcement area, levying substantial fines against financial institutions whose employees conducted business on unapproved messaging platforms. If your team works remotely—as most crypto companies’ teams do—ensure that business communications occur on approved, monitored, and retained platforms.

Internal Investigations

Internal investigations are a powerful tool when facing regulatory scrutiny. By independently gathering facts and assessing the situation, you position the company to respond more effectively, cooperate more credibly, and control the narrative. Without an internal investigation, cooperation with regulators is harder to calibrate, and the process is more likely to produce unfavorable outcomes.

The downside is cost. Before launching an internal investigation, assess whether the expense is justified by the magnitude of the risk. And if you proceed, ensure the investigation is conducted by qualified outside counsel with experience in the relevant regulatory area. A poorly executed internal investigation—one that appears biased, incomplete, or sloppy—can do more harm than no investigation at all.

Attorney-Client Privilege

The attorney-client privilege protects communications made for the purpose of obtaining legal advice. Upon learning of a potential investigation, take immediate steps to ensure that privileged communications are preserved and not inadvertently disclosed. Retaining outside counsel is advisable for several reasons: it creates a clearer privilege boundary than in-house communications (which may be characterized as business rather than legal advice), it adds credibility with regulators, and it provides access to specialized expertise.

Be cautious about disclosing privileged information in exchange for leniency. Once the privilege is waived, it is waived permanently—and the disclosed information may be used by third parties in ways you did not anticipate. The preferred approach is to compile a factual presentation based on the results of your internal investigation without revealing work product or internal legal analysis.

Cooperation Frameworks

Every major federal agency has its own framework for crediting cooperation. Understanding what each agency expects is essential for any company navigating an enforcement inquiry.

DOJ

Federal prosecutors evaluate cooperation under the Filip Factors—eleven considerations that guide charging decisions for corporate criminal violations. The cooperation standard requires disclosure of complete factual information about the individuals substantially involved in or responsible for the misconduct. This is a high bar, but the Department recognizes that access to information may be limited in some circumstances.

SEC

The SEC’s Seaboard Report (2001) establishes the framework for crediting cooperation. Key factors include the extent to which the company was self-policing before the violation was discovered, whether the company self-reported the violation, the extent of remedial efforts taken after discovery, and the degree to which the company worked with law enforcement. Companies that score well across these factors may receive reduced sanctions or even a recommendation of no action.

CFTC

The CFTC has made clear that ordinary cooperation is insufficient for credit. Cooperation must be “sincere, robustly cooperative and indicative of a willingness to accept responsibility.” The agency evaluates the value of the cooperation to the investigation, its value to the CFTC’s broader enforcement interests, and the culpability of the company.

OFAC

The Office of Foreign Assets Control evaluates cooperation based on whether the organization self-disclosed voluntarily, provided all relevant information, investigated and disclosed all potential violations, and responded to the agency’s requests in a timely manner. OFAC sanctions can carry severe penalties, and proactive cooperation is one of the most effective mitigants available.

Looking Ahead

The regulatory environment for crypto and digital assets is in a period of rapid, structural change. The enforcement-heavy posture of the prior administration has given way to an affirmative effort to build fit-for-purpose regulatory frameworks through legislation, rulemaking, and interagency coordination. The GENIUS Act and CLARITY Act represent the first wave of statutory reform. Project Crypto and the SEC’s forthcoming token taxonomy represent the agency-level counterpart. And the coordination between the SEC and CFTC under their current leadership suggests that the jurisdictional turf wars that plagued the industry for years may finally be giving way to a more coherent regime.

None of this means that compliance is less important. If anything, the transition from enforcement-first to framework-first regulation raises the stakes for companies that fail to engage with the emerging regime. The companies that will benefit most from the new regulatory landscape are those that have been building compliance infrastructure all along—maintaining clear records, making good-faith classification decisions, engaging with counsel, and positioning themselves to take advantage of safe harbors and exemptions as they become available.

For crypto founders, the message is clear: the regulatory environment is more favorable than it has ever been, but it is still just as complex.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts (or in this case, the thoughts of the guest poster), should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.

Founder and Employee Equity

Founder Issuances

Founders need to be compensated for their work in building the company. Most founders receive a substantial equity issuance during the company’s earliest stages. The terms of this issuance, including transfer restrictions, vesting schedules, repurchase rights, and any lock-up provisions, should be negotiated carefully and memorialized in a stock purchase agreement or restricted stock agreement.

Because every shareholder must pay adequate consideration for their shares, corporations typically issue shares to founders at par value—the lowest permissible price. Founders should consult with tax counsel regarding the tax implications of any issuance below fair market value. An alternative approach is for founders to pay for their shares with the value of intellectual property or other assets contributed to the enterprise, though valuation in this context requires careful documentation.

It is important that founders retain independent counsel during equity negotiations, particularly where the interests of co-founders or early investors diverge. The terms set at inception (board composition, protective provisions, anti-dilution protections) compound over time and become very difficult to renegotiate later.

Employee Stock Plans

Stock plans allow employees to acquire ownership in the company over time, aligning their incentives with the company’s performance. Employees typically contribute through payroll deductions that accumulate until a designated purchase date, at which point shares are purchased at a discount. Beyond the retention incentives, equity-based compensation enjoys favorable tax treatment compared to equivalent cash outlays, making it an efficient tool for startups operating with limited cash reserves.

The board must determine how many shares to reserve for the employee equity pool and approve the plan, which then requires written consent from the stockholders. The size of the equity pool is a negotiation point in every funding round: investors want it large enough to attract talent but small enough to limit dilution.

Stock Option Agreements

Stock option agreements grant employees the right to purchase shares at a specified exercise price for a defined period. If the share price appreciates above the exercise price, the employee realizes a gain upon exercise. Options are the most common form of employee equity compensation in venture-backed startups because they provide meaningful upside without requiring employees to invest capital upfront.

Two varieties dominate: Incentive Stock Options (ISOs), which receive favorable tax treatment under Section 422 of the Internal Revenue Code but are limited to employees and carry annual exercise limits, and Non-Qualified Stock Options (NQSOs), which can be granted to employees, advisors, and consultants without the same restrictions but are taxed as ordinary income on exercise.

Token Plans

Many crypto companies reward employees with tokens in addition to or instead of traditional equity. Functionally, token plans operate similarly to stock plans—but the regulatory analysis is different. Because the SEC does not treat all tokens identically, and because the securities classification of a given token may depend on the state of the network at the time of distribution, companies issuing tokens to employees must consult with counsel to determine whether the issuance triggers registration requirements or qualifies for an exemption.

The CLARITY Act’s proposed taxonomy—distinguishing digital commodities from investment contract assets—may eventually provide clearer guidance for token-based compensation. Until formal rules are finalized, companies should err on the side of compliance and document the basis for their classification decisions.

Vesting

The Purpose of Vesting

Vesting allows the company to stagger or delay equity issuances according to how long an employee or founder has been with the company. The standard structure is a four-year vesting schedule with a one-year cliff: no shares vest until the first anniversary of the commencement date, at which point 25% of the granted shares vest, with the remainder vesting monthly or quarterly over the subsequent three years.

Vesting serves two purposes. It incentivizes retention—the longer an individual stays, the more equity they earn. And it protects the company: unvested shares can be forfeited or repurchased (typically at cost) if the individual departs, preventing former employees from retaining a disproportionate share of the company’s equity.

What Investors Expect

Investors will expect founders to vest their shares. The rationale is straightforward: vesting ensures that founders remain incentivized to continue building the company, rather than walking away with a large equity stake. It is customary for founders to begin vesting from the date of incorporation, which provides credit for the work already invested in getting the company off the ground.

Acceleration Clauses

Founders should negotiate for acceleration provisions that accelerate vesting upon the occurrence of specified trigger events. Single-trigger acceleration vests all or a portion of shares upon a single event—typically an acquisition or change of control. Double-trigger acceleration, which venture investors generally prefer, requires two events: a change of control and the termination of the founder’s employment without cause within a specified window following the transaction. Double-trigger provisions protect investors from founders who might be incentivized to pursue an acquisition solely to accelerate their vesting.

83(b) Elections

Section 83(b) of the Internal Revenue Code permits individuals who receive restricted property (including unvested stock) to elect to recognize the income at the time of receipt rather than at the time of vesting. The practical effect is that the individual pays taxes on the fair market value of the shares at grant—typically a very low amount for early-stage companies—rather than on the potentially much higher value at the time each tranche vests.

To make a valid 83(b) election, you must file a written election with the IRS within 30 days of receiving the restricted stock. This deadline is absolute and cannot be extended. File three copies: one with the IRS, one with your employer, and one for your personal records. Use certified mail with return receipt requested.

For founders receiving shares at par value in an early-stage company, the 83(b) election is almost always advisable—the tax cost at filing is nominal, and the potential savings as the company appreciates can be substantial. However, the analysis changes if the shares are not purchased at a nominal price or if there is meaningful risk the company will fail before the shares vest. Consult with tax counsel before making or declining to make an 83(b) election.

Non-U.S. residents should be aware that they can still be subject to U.S. taxation on equity received from U.S. companies. The interaction of 83(b) elections with foreign tax obligations requires specialized advice.

Raising Outside Capital: The Exemption Landscape

Companies that need capital beyond what founders can contribute must raise it from outside investors. Unless your company has reached the scale and maturity to justify a registered public offering, you will rely on exemptions from SEC registration. Understanding the exemption landscape is essential for any crypto founder planning a fundraise.

Regulation D

Regulation D is the most commonly used exemption framework for private capital formation. It offers three pathways, each with distinct parameters.

A note on bad actors - if key individuals or entities associated with your company have prior securities law violations, the company may be disqualified from using certain exemptions (including Rules 506(b) and 506(c)). The disqualification provisions are broad, covering the issuer, its directors, officers, general partners, managing members, and holders of more than 20% of the outstanding voting equity. The violations that trigger disqualification are serious—criminal convictions, regulatory orders, SEC disciplinary actions. So, be carefuly who you do business with.

Rule 504

Rule 504 permits offerings of up to $10 million with no limit on the number of investors. General solicitation is prohibited unless the issuer meets specific state law requirements. Rule 504 is less commonly used by venture-backed startups but can be useful for smaller raises where the accredited investor restrictions of Rule 506 are impractical.

Rule 506(b)

Rule 506(b) permits an unlimited raise from an unlimited number of accredited investors and up to 35 non-accredited investors per 90-day period. The critical limitation is a ban on general solicitation: the issuer cannot advertise the offering or sell to investors with whom it has no pre-existing substantive relationship. Rule 506(b) is the workhorse exemption for early-stage fundraising, particularly for companies that rely on warm introductions and established investor networks.

Rule 506(c)

Introduced by the JOBS Act, Rule 506(c) permits general solicitation and advertising, provided that all investors are accredited and the issuer takes reasonable steps to verify their accredited status. Verification requires more than self-certification—issuers must review income documentation, net worth statements, or third-party verification letters. Despite the solicitation benefit, many issuers prefer 506(b) to avoid the verification burden, though 506(c) has become more attractive as verification services have become cheaper and more streamlined.

Regulation A+

Regulation A+ provides a scaled pathway for companies that want access to non-accredited investors without a full registration. It offers two tiers.

Tier 1 permits offerings of up to $20 million in a 12-month period. Tier 1 issuers must register their offering with each state in which they sell securities, which adds cost and complexity. Tier 2 permits offerings of up to $75 million and preempts state registration requirements, but imposes ongoing SEC reporting obligations and limits non-accredited investor participation. Both tiers require a qualified offering statement—a process less burdensome than a full S-1 registration but more involved than a Reg D filing.

Reg A+ has found a niche with crypto and digital asset companies that want broader retail participation in their offerings. Several token issuers have used Tier 2 offerings to distribute tokens to both accredited and non-accredited investors with SEC qualification.

Regulation Crowdfunding (Reg CF)

Reg CF, enacted as part of the JOBS Act, permits offerings of up to $5 million in a 12-month period through SEC-registered online funding portals. Individual investment limits apply: investors with annual income or net worth below $124,000 may invest the greater of $2,500 or 5% of the lesser of their income or net worth. Investors above that threshold may invest up to 10% of the lesser of their income or net worth, capped at $124,000 per year. Accredited investors are not subject to these limits. Reg CF securities are subject to a 12-month resale restriction.

Reg CF has become an increasingly popular tool for early-stage crypto companies that want to build community ownership alongside their product. The funding portal requirement adds a layer of oversight but also provides a structured distribution channel.

Regulation S

Regulation S exempts offerings conducted entirely outside the United States from SEC registration. To qualify, the offer must be an offshore transaction—meaning the offer is not made to a person in the United States, and the buyer is outside the United States at the time the buy order originates—and there can be no directed selling efforts within the United States. Reg S is commonly used by crypto projects with global user bases that want to distribute tokens to non-U.S. participants without triggering SEC registration requirements.

A Note on Simple Agreements for Future Equity (SAFEs)

SAFEs, popularized by Bay area accelerator, Y Combinator, are the standard instrument for early-stage equity fundraising. A SAFE “note” is not debt: it is an agreement that converts into equity upon a future financing event, typically at a discount or subject to a valuation cap. SAFEs have become the default instrument for pre-seed and seed rounds because (in theory) they are fast, cheap, and avoid the complexity of pricing a round before the company has meaningful traction.

Intrastate Exemptions

The SEC provides exemptions for purely intrastate offerings under Section 3(a)(11) and Rules 147 and 147A. These require that all purchasers reside within a single state and that the issuer is incorporated in and conducts significant business within that state. Given the inherently borderless nature of most crypto businesses, intrastate exemptions are rarely viable for digital asset companies.

Rule 701

Shares issued to employees under a compensatory stock plan may qualify for exemption under Rule 701. Companies can sell at least $1 million in securities under this exemption regardless of their size, with higher thresholds available based on total assets or outstanding securities. Rule 701 is not available to publicly reporting companies.

Token-Specific Fundraising

Just as traditional companies issue stocks and bonds to fund their operations, many crypto companies issue tokens. Token issuances present unique legal challenges because the securities classification of a token depends on its specific characteristics, the state of the underlying network, and the expectations of purchasers at the time of the distribution.

Initial Coin Offerings (ICOs)

ICOs were the dominant fundraising mechanism for crypto projects from roughly 2017 through 2019. An ICO functions like a public offering of tokens: the project publishes a white paper describing the proposed network or application, and purchasers acquire tokens using fiat currency or other cryptocurrency. The SEC’s 2017 Report on The DAO established that ICOs can constitute securities offerings, and the subsequent enforcement wave made unregistered ICOs effectively untenable for projects with meaningful U.S. exposure. While the regulatory environment has become more nuanced under the current administration, the lesson remains: token offerings that satisfy the Howey test are securities offerings, regardless of their label.

Initial Exchange Offerings (IEOs)

IEOs are administered by registered cryptocurrency exchanges, which conduct due diligence on the issuing project and facilitate the token sale through their platform. The exchange’s involvement adds a layer of vetting that ICOs lack, and the listing provides immediate secondary market liquidity. However, IEOs do not automatically resolve the securities analysis—if the underlying token is a security, the exchange may need to be registered as a broker-dealer or alternative trading system.

Simple Agreements for Future Tokens (SAFTs)

SAFTs emerged around 2017 as a response to the regulatory uncertainty surrounding token issuances. A SAFT is an investment contract that gives the holder a right to receive utility tokens upon the occurrence of a future event—typically the launch of a functional network. The theory was that the SAFT itself is a security (and can be offered under a Reg D exemption to accredited investors), but the utility tokens delivered upon network launch are not securities because they have functional utility rather than investment characteristics.

The SAFT framework has been debated extensively, and its viability depends on the specific facts of each token and network. Courts and regulators have not uniformly endorsed the SAFT model, but it remains a widely used structuring tool, particularly for projects that anticipate a transition from centralized development to decentralized operation.

At this point, I rarely ever see SAFTs, with the most common playbook being a combination of a SAFE and a “Token Warrant” which grants the holder the right to a certain portion of future token supply, based on their as-converted equity holdings.

Certain Other Investment Concepts

Rights of First Refusal

Investors invariably seek rights of first refusal (ROFRs) to protect against dilution. A ROFR requires any shareholder who wishes to sell their shares to first offer them to the rights-holder before entertaining outside offers. ROFRs are standard in venture financing and should be expected in every institutional round.

Lock-Up Provisions

Lock-up provisions restrict the ability of founders, employees, and early investors to sell their shares for a specified period, typically 180 days following a liquidity event. Lock-ups protect against a flood of insider selling that could depress the market price and undermine investor confidence.

Convertible Instruments

In addition to SAFEs, convertible notes are the most common instruments in early-stage fundraising. Convertible notes are debt instruments that convert into equity upon a future financing event, typically at a discount to the price paid by new investors. The note accrues interest and has a maturity date, though maturity is usually extended or waived if a qualifying financing has not occurred. SAFEs, as noted above, accomplish a similar conversion without the debt structure. In either case, the conversion mechanics (discount rate, valuation cap, and qualifying financing thresholds) are the key negotiation points.

A Plea For Proper Recordkeeping

Meticulous recordkeeping of all securities issuances is not optional. Your company must maintain a stock ledger, copies of all stock purchase agreements, evidence of all securities filings, and records of all option and token grants. Delaware permits uncertificated record keeping through electronic means, which can reduce costs and improve efficiency. The capital table should be treated as a living document, updated in real time as issuances, exercises, and transfers occur. Investors will scrutinize your cap table during due diligence, and errors or gaps erode confidence quickly.

What kind of lawyer would I be without a disclaimer?

Everything I post here constitutes my own thoughts, should only be used for informational purposes, and does not constitute legal advice or establish a client-attorney relationship (though I am happy to discuss if there is something I can help you with). I can be reached via email at dlopezkurtz@crokefairchild.com on telegram @davidlopezkurtz on twitter @lopezkurtz and on LinkedIn here.