A Rule Where There Was Only Litigation
For most of the last decade, a US crypto founder trying to figure out whether their token sale was a securities offering had exactly one reliable source of law: whatever the SEC decided to allege in its next enforcement complaint. That changed on August 18, 2026, when the Commission voted to propose Regulation Crypto Assets, its first purpose-built framework for crypto securities offerings, opening a 60-day public comment period once the release is published in the Federal Register (SEC press release).
The proposal does three specific things: it creates a $5 million startup exemption usable once per crypto asset over a four-year period, a $75 million-per-year fundraising exemption with ongoing disclosure obligations, and a conditional safe harbor under which a crypto asset that is "sufficiently decentralized" exits the investment-contract definition — and SEC jurisdiction — entirely (PYMNTS; Journal of Accountancy).
What the Exemptions Actually Allow
The startup exemption is the more permissive of the two: issuers file a notice (Form NOR), post website-based narrative disclosures, and can raise up to $5 million from anyone — including non-accredited retail investors — through general solicitation, without SEC qualification of the offering. The $75 million fundraising exemption asks for more in return: a US-organized issuer, a Form 1-CRYPTO offering statement that the SEC must qualify, audited financial statements, and ongoing periodic reporting for as long as the exemption is in use (securitieslawyer101.com).
The safe harbor is the more structurally novel piece. Rather than asking issuers to prove decentralization up front, it lets a token's status change over time: once an issuer certifies — on a new Form TR — that it has completed or permanently abandoned the "essential managerial efforts" it originally promised investors, the token can exit the investment-contract bucket. Crucially, the safe harbor only closes off that theory of securities status; the SEC still has other tools if a token is later resold or marketed in ways that reintroduce investor reliance on a promoter's efforts, and it retains authority to challenge a certification it believes was false. A companion provision preempts state blue-sky registration requirements for covered offerings, though state antifraud law stays fully intact.
The Case for Caution
Credit is due to the strongest version of the skeptical case. Self-certification regimes have a track record of being gamed: an issuer files Form TR asserting decentralization is complete, raises capital or lists on exchanges on the strength of that filing, and only faces consequences — if ever — after an SEC enforcement action years later, by which point retail investors have already absorbed the losses. Pairing that with a $5 million exemption that explicitly permits general solicitation to non-accredited investors is, on its face, exactly the kind of retail-exposure combination the 1933 Act's registration regime was built to prevent. Investor-protection advocates are right that "decentralized enough to exit federal securities law" is a judgment call with real money behind it, and a certification-and-hope model shifts the timing of enforcement from before the harm to after it.
Why the Trade Is Still Worth Making
But the status quo this replaces was worse, not safer. "Sufficiently decentralized" has functioned as an SEC enforcement theory since the 2018 Hinman remarks without ever being defined in a rule, a no-action letter, or a litigated final judgment that bound anyone beyond the parties to that specific case. Legitimate projects had no forum to test their structure against a standard — only the choice between raising money under total legal ambiguity or not raising it in the US at all. That is precisely why so much crypto issuance activity has migrated to Switzerland, Singapore, and the UAE over the past several years: not because those jurisdictions have weaker investor protection on paper, but because they have a knowable process. A bright-line dollar threshold and a defined certification pathway are inferior to a perfectly calibrated case-by-case test that never actually gets built — but regulation-by-enforcement was never that test. It was closer to no test at all, applied retroactively.
The design also isn't as loose as "self-certify and walk away." Form TR is a certification made under the same securities-law antifraud exposure — including Section 17(a) and Rule 10b-5 liability — that governs every other false SEC filing, and the state-antifraud carve-out means a bad certification remains independently actionable at the state level even after federal preemption of registration. The $75 million tier's audited-financials-and-ongoing-reporting requirement, meanwhile, is not meaningfully lighter than a small-cap Reg A+ offering already used by non-crypto issuers today.
The real test of this proposal will come during the 60-day comment window, where the specific mechanics — what counts as "essential managerial efforts," how quickly the SEC can act on a bad Form TR, whether $5 million is calibrated to actual seed-stage crypto raises — should get sharpened. Commissioner Hester Peirce, a longtime advocate for a crypto safe harbor since her 2020 "token safe harbor" proposal, called this proposal "one step on a long road toward a clear, sensible, enforceable regulatory framework for crypto." That is the right frame: not a finished settlement, but the first rule-of-law alternative to a decade of enforcement-only ambiguity.