The SEC's new guidance draws a clear line: token sales, staking, and airdrops can fall under securities law, even if projects claim decentralization or utility.
Crypto projects that try to dodge U.S. securities law by calling their tokens "utility" or "governance" assets are running out of room. The SEC's latest guidance makes it clear: what matters is how a crypto asset is sold or used, not what it's called or whether it trades on a decentralized exchange.
The SEC still relies on the Howey test. This legal standard asks if people are putting money into a common project, expecting profits mainly from someone else's work. The U.S. Supreme Court set this rule, and the SEC uses it to decide if a crypto asset sale or distribution is an investment contract-and therefore a security that falls under federal law.
In its March 2026 framework, the SEC introduced a five-category taxonomy for crypto assets: digital commodities, digital collectibles, digital tools, stablecoins, and digital securities.
Focus on the transaction, not just the token
The SEC's latest FAQ draws a hard line between the token itself and how it's issued, sold, or promoted. A blockchain token might be used for payments, access, or governance. But if the sale is set up to raise money from the public with promises of future value, it can still count as a security offering. The SEC warns that even free airdrops and staking programs can trigger securities rules if they create profit expectations or ask users to provide something valuable, like services or data.
Trading on secondary markets doesn't wipe away securities risk. If investors still depend on a project's team to boost token value, or if marketing talks up price gains, buybacks, or dividends, the risk stays high. The SEC says a token's legal status can change over time, depending on how it's used and what investors expect. A token isn't locked into one category at launch.
How the Howey test works in crypto
To apply the Howey test, the SEC looks at four main questions: Did investors put in money or something else of value? Are their interests tied together? Do they expect profits? Are those profits coming from the work of others? The SEC doesn't just read technical docs or white papers. It digs into project marketing, investor updates, and how money and control actually move.
Take a project that raises money through a token sale and promises to use the funds to build a platform. That project will get close attention from regulators. If the main team keeps control over upgrades, the treasury, or governance-even if there's a DAO or open-source code-investors may still be counting on that team for returns. On the other hand, if a network is truly decentralized and tokens are mainly used for access, the securities analysis can shift.
The SEC's September 2026 FAQ clarified that for already functional networks without a central controlling party, token buybacks and promises to support or upgrade the network do not automatically create an investment contract. This guidance, while not legally binding, has been seen as reducing risk for decentralized protocols.
Staking, airdrops, and the decentralization question
Staking and airdrops aren't off the hook. The SEC warns that staking programs run by a central platform, which pay out returns from lending, trading, or other business, can look like investment products. Even if smart contracts automate the process, securities rules may still apply if users are counting on a core team's management. Airdrops that ask users to do tasks, give up data, or promote a project may not be truly free-and if they create profit expectations, they can fall under securities law.
Decentralization matters, but it's not a free pass. The SEC checks who controls upgrades, the treasury, and governance. Can users really run the network without the core team? Just having a DAO, a governance token, or open-source code doesn't guarantee you're outside securities law if the main team still calls the shots.
What the SEC's new stance means for projects
The SEC is moving away from token labels and toward a close look at each transaction. Projects can't just tweak white papers or token mechanics to avoid attention. They need to look at how they raise money, how they talk about returns, and who really controls the network. If marketing focuses on price gains, buybacks, or team-driven value, regulators will notice.
For both projects and investors, the main lesson is that decentralization claims or free token giveaways don't erase regulatory risk. Every step-design, launch, operations, and trading-needs a careful look at how the token is used, who controls it, and what investors are told to expect. As reported earlier, even tokens that switch networks or change governance need to be checked one by one.
The SEC's FAQ gives guidance, but it doesn't settle the law. Only courts or formal regulatory actions can say for sure if a token or transaction is a security. For now, projects that want to lower risk should focus on real utility, open governance, and honest communication with users-instead of relying on technical details or marketing tricks to avoid oversight.
Regulatory pressure has picked up, along with more enforcement and market caution. Public filings show the SEC has brought several cases against token issuers and platforms in the past year, targeting both initial sales and ongoing staking or yield programs. Some exchanges have responded by delisting tokens or blocking U.S. users. Others have changed their marketing and disclosures to address securities issues.
Knowing the difference between a token's code and the legal setup of its sale is now essential for anyone in crypto. The SEC's changing approach means projects must be ready for ongoing review, and investors need to look past token labels to judge real risk. Blockchain tech alone no longer offers a shield. The market now wants substance, not just clever wording. Projects that last will be the ones built on solid legal and operational ground.
When deciding if a crypto asset is a security, the Howey test is still the main legal yardstick in the U.S. It looks at the real-world economics of a deal, not just the tech. A token can be used for payments, access, governance, or investment-and its legal status can shift as the project changes. The SEC's guidance makes it clear: decentralization, open-source code, or a DAO don't automatically mean a project is exempt from securities law. Regulators will look at who controls the network, how money is raised and spent, and what investors are told to expect. For both projects and users, understanding these lines is key to navigating crypto's changing regulatory landscape.
