SEC's Regulation Crypto Assets: What Issuers Need to Know

Regulation Crypto Assets, the SEC's sweeping proposed rule package released on August 18, 2026, offers crypto-asset issuers something they have been requesting since the enforcement wave of 2017: a clear, purpose-built path to raise capital through covered investment contracts without triggering full Securities Act registration. That is the gift. But Reg CA is not just a capital formation tool. Read the proposal carefully and a second story emerges, one about documentation, certifications, periodic reports and enforcement triggers that make the compliance record this rule requires potentially more dangerous than the fundraising it enables. The new forms are not just paperwork. They are evidence. Issuers who read this as a regulatory clean pass are reading the wrong half of the release.

What Is Regulation Crypto Assets?

On August 18, 2026, the Securities and Exchange Commission released its proposed Regulation Crypto Assets package, a rule framework structured around five operative components designed to give crypto-asset issuers a tailored alternative to conventional Securities Act registration. The Commission's foundational premise is that a crypto asset, standing alone, is typically not a security. The complication arises when the same asset is offered alongside issuer promises of continuing development, network-building or governance work, because those promises can satisfy the Howey test by giving purchasers a reasonable expectation of profit derived from the essential managerial efforts of others.

The Commission spent years building toward this proposal, and the impetus is visible in the structure. Its existing exemptions, Regulation A, Regulation D and Regulation Crowdfunding, were designed for equity and debt offerings, and the disclosure frameworks attached to those exemptions do not ask the questions that actually matter to a crypto investor. A balance sheet does not tell you whether a development team can execute its roadmap. An income statement does not tell you whether proceeds are being deployed as promised or whether a token's economic architecture is sound. Reg CA is the Commission's attempt to build a disclosure structure that actually fits the asset class, starting from the premise that the right investor protection here is progress-based disclosure, not financial statement disclosure.

The proposal builds directly on the Commission's March 2026 Token Taxonomy interpretive release, which addressed when a crypto asset becomes, and later ceases to be, subject to an investment contract. That earlier release established the conceptual separation between the asset itself and the contract surrounding its sale. Reg CA operationalizes that framework through registration exemptions, new forms and a formal cessation safe harbor, five components that collectively reshape how federal securities law applies to crypto-asset issuances from initial offering to token maturity.

What the Commission is really saying with this proposal is that crypto is distinct enough to need its own procedural track, but not distinct enough to escape the substantive rules. That distinction matters more than most issuers appreciate on first read.

The Five-Part Framework and Its Scoping Definitions

What does 'covered investment contract' mean under Reg CA?

Proposed Rule 100 lays the definitional groundwork for the entire regulation. The term 'covered investment contract' does not appear in the 2026 Token Taxonomy and represents the Commission's first formal attempt to codify precisely when a securities law regime attaches to a token sale. To qualify as a covered investment contract under the proposal, the arrangement must involve a crypto asset as the subject of the contract, the issuer or an affiliated person must intend to undertake essential managerial efforts from which purchasers reasonably expect profit, and the asset must be recorded on a cryptographically-secured distributed ledger.

Proposed Rule 104 establishes bad actor disqualification conditions that apply to both exemptions. The issuer and all related persons, directors, executive officers, 20 percent-or-greater beneficial owners, promoters and paid solicitors, must be clear of any disqualifying event under Rule 262, the same standard that governs Regulation A offerings. That disqualification standard is well-litigated and issuers should audit it carefully before filing a single form.

The insignificant deviation provision in Proposed Rule 101(d) offers a limited cure for good-faith technical errors. The release pairs that cure with something issuers should read closely: noncompliance with an exemption's terms is independently actionable by the Commission under Securities Act Section 20. The cure provision is not a general grace period. It applies only when the deviation was insignificant relative to the offering as a whole, the issuer made a genuine attempt at compliance, and the issuer cures the deviation promptly after discovery. Any deviation outside those boundaries exposes the issuer to a registration violation enforcement theory on top of whatever fraud theory might otherwise apply, and potentially opens Section 12(a)(1) rescission exposure from investors.

Taken as a whole, the scoping definitions do something the crypto industry should notice: they extend the Commission's reach beyond straightforward token sales to distributions, incentives and rewards that most projects have never characterized as securities transactions. The definitional net is wider than the headline exemptions suggest.

• The investment contract must involve a crypto asset as the subject of the contract
• The issuer or an affiliated person must intend to undertake essential managerial efforts
• Purchasers must reasonably expect to profit from those managerial efforts
• The crypto asset must be recorded on a cryptographically-secured distributed ledger

The Startup Exemption in Practice

How does the SEC crypto startup exemption work?

The SEC crypto startup exemption targets early-stage projects that need capital while still working toward the promises they made investors. The exemption permits an issuer to raise up to a proposed cap in covered investment contracts over a single four-year window, after which the window closes permanently for that crypto asset. Neither the issuer nor its affiliates may have previously used the exemption for the same or a substantially similar crypto asset. The issuer structure is deliberately inclusive: the proposal states the issuer 'may be an entity, an individual, or a group of individuals or entities,' with each group member required to sign, certify and independently satisfy every condition.

Before making any sales, the issuer files a Form NOR (notice of reliance) with the SEC. The substantive principles-based disclosure required under Proposed Rule 103 does not go on EDGAR. It goes on a publicly accessible website the issuer identifies in its Form NOR, must remain freely available for the entire exemption period, and must be updated within 30 calendar days after each calendar year end whenever material changes have occurred. That setup keeps EDGAR cleaner for Commission staff but changes nothing about antifraud exposure. Inaccurate or stale website disclosures are still actionable as misrepresentations under the full body of existing enforcement doctrine.

The Form NOR itself carries its own separate amendment obligation. It must be updated as soon as practicable after any material mistake or material change. Letting an inaccurate Form NOR sit without correction is a distinct compliance failure that can independently jeopardize the exemption's availability, entirely separate from any fraud theory the Commission might pursue. At the end of the four-year period, the issuer files a Form TR transition report, which simultaneously ends both the exemption and the annual update obligation.

The scope of 'covered transaction' under the startup exemption is broader than many projects will expect. It reaches beyond conventional capital-raising sales to include distributions made in exchange for, in recognition of, or as an incentive for past or future use of the network or application, as well as rewards for operating, governing or securing it. Airdrops, staking rewards and governance incentives all fall within the exemption's ambit. Teams that have been treating those distributions as outside the securities law framework should revisit that analysis before Reg CA is finalized.

Issuers using the startup exemption are not subject to ongoing periodic reporting or a Commission qualification review before commencing sales. They do remain subject to the antifraud provisions of the federal securities laws in full force. The exemption reduces procedural burden. It does not reduce substantive liability. That distinction will matter when the first enforcement action hits an issuer who thought Form NOR filing was the end of the compliance story.

The Fundraising Exemption's Two Tiers

Modeled in part on Regulation A, the fundraising exemption structures itself into Tier 1 and Tier 2, each with distinct offering caps and assurance requirements governing what issuers can sell and to whom. Tier 1 permits offerings up to a specified cap within any 12-month period, including a sub-limit on affiliated selling securityholder participation, and requires financial statements in the offering circular that need not be audited. Tier 2 permits a larger offering amount and requires audited financial statements. Across both tiers, selling securityholder participation is capped at 30 percent of the aggregate offering price in an issuer's first offering and in any offering qualified within a year of that first offering.

Eligibility for the fundraising exemption is intentionally narrower than for the startup exemption. The issuer must be organized under United States law, with a majority of officers or directors who are US citizens or residents, more than 50 percent of its assets located in the US, and its principal business operations administered domestically. Blank check-style development companies, investment companies, business development companies and issuers subject to a Section 12(j) revocation order within the prior five years are all excluded, and the issuer must be current on all prior reports. Foreign projects with primarily non-US teams will generally not qualify.

The Commission grounds the fundraising exemption in Securities Act Section 28, its broader discretionary exemptive authority, rather than Section 3(b), which is limited to enumerated eligible securities that do not include covered investment contracts. Section 28 asks whether an exemption is 'necessary or appropriate in the public interest' and 'consistent with the protection of investors.' The practical implication is that the Commission retains considerably greater latitude, under Section 28, to tighten or revoke eligibility conditions later than it would under Section 3(b)'s more categorical framework. Issuers should factor that structural flexibility into any long-term reliance planning.

Issuers using either tier must file a publicly available offering statement on new Form 1-CRYPTO and may not begin sales until that statement is qualified. A non-public staff review track is available as a pre-filing accommodation, but the offering statement must ultimately be filed publicly before qualification and sales proceed. Non-reporting issuers must also deliver a preliminary offering circular at least 48 hours before sale to anyone who expressed interest in purchasing. Non-accredited investors face an investment limit capped at 10 percent of the greater of their annual income or net worth, or for entities, the greater of revenue or net assets.

Once the offering closes, the compliance obligation does not. Ongoing reporting follows on Forms 1-KC (annual), 1-SC (semiannual) and 1-UC (current events). Each periodic filing is a fresh opportunity for a material misstatement or omission claim. For projects whose tokenomics or development roadmap evolve quickly, the interval between filing deadlines is a window of accumulating disclosure risk. Issuers should build internal controls for keeping these disclosures current from day one of the offering, not as a late-stage operational add-on.

Proposed Rule 306 gives the Commission a powerful mid-offering tool: it can suspend an issuer's ability to rely on the exemption entirely, including on reason-to-believe grounds that the offering violates Section 17 of the Securities Act or Reg CA's own terms. A suspension is more disruptive than a post-closing enforcement action because it cuts off an active raise before it closes. The Commission can deploy that tool on a reasonable belief, not a proven violation. That standard deserves serious attention from issuers who plan ongoing fundraising rounds under this exemption.

Rule 400 Safe Harbor: Does the Investment Contract Ever Actually End?

What is the investment contract safe harbor under Reg CA?

Proposed Rule 400 creates a non-exclusive investment contract safe harbor crypto issuers can invoke to formally certify that a covered investment contract has ceased to exist. The safe harbor is available whether or not the issuer used either registration exemption, and it codifies the cessation concept from the Commission's March 2026 Token Taxonomy interpretive release. The mechanics require the issuer to certify on Form TR that the promised managerial efforts have been completed or abandoned and to provide a supporting legal analysis. Form TR also requires basic background and organizational information, a description of the covered investment contract and crypto asset, and a certification that meets the standards in proposed Rule 400(a).

The release is unusually candid about what happens when that certification turns out to be wrong. If an issuer files a Form TR that misrepresents, and the release uses the phrase 'either intentionally or otherwise', that cessation conditions have been satisfied, the Commission may take the position that the covered investment contract has not ceased to exist, that registration and reporting requirements continue to apply, and that the issuer remains exposed to enforcement. The Commission need not prove scienter to disregard the certification. A good-faith analytical error in the Form TR analysis is sufficient to unwind the safe harbor's benefit.

That creates two simultaneous problems for any issuer that files a premature or analytically flawed Form TR. First, the investment contract continues to exist for securities law purposes, exposing the issuer to ongoing obligations it may have long since stopped honoring. Second, the misrepresentation in the Form TR, whether intentional or negligent, becomes an independent enforcement target. A separate antifraud claim would require its own scienter showing, but liability under Securities Act Section 17(a)(2) and Section 17(a)(3) requires only negligence, not intent. Those are the sections that do not require the government to prove willful conduct.

Rule 400 also addresses only one moment in a token's lifecycle, specifically the cessation of managerial efforts. It provides no front-end certainty about whether a given token sale qualified as an investment contract in the first place. That threshold question continues to turn on the multifactor Howey analysis and the Commission's 2026 interpretive guidance on how marketing and promotional conduct affect that analysis. Issuers, secondary trading platforms and market makers should expect continued case-by-case Commission scrutiny of go-to-market messaging and any post-sale conduct that could be read as an implied promise of continuing effort, wholly independent of whether the issuer uses Reg CA for the primary sale.

One additional constraint deserves explicit attention. The Supreme Court's 2024 Loper Bright decision overruled Chevron deference. The Commission's determination that a covered investment contract has ceased to exist may receive little or no deference from courts evaluating that question independently. Private plaintiffs and the DOJ are not bound by that determination at all. An issuer that satisfies every safe harbor condition can still face civil suits or criminal prosecution arguing the investment contract never actually ended. The safe harbor's finality is conditional, not absolute.

Antifraud Stays Intact, and Trading Platforms Are Left Exposed

Reg CA proposes extending the 'qualified purchaser' definition under Section 18 of the Securities Act to cover all persons purchasing covered investment contracts under either exemption, as well as specified secondary market transactions. Unlike Regulation A, which limits preemption to Tier 2 offerings, the proposed preemption covers both Tier 1 and Tier 2 fundraising offerings. Secondary market transactions are also preempted even when the covered investment contract was not initially issued under a Reg CA exemption, provided the issuer satisfies an exemption and remains current on disclosure, filing and reporting obligations. Fall out of compliance and preemption disappears until the defect is cured.

The preemption has a sharp limit. The release is explicit that states retain jurisdiction to bring antifraud enforcement actions. State securities fraud claims, common law fraud, and state consumer protection and unfair practices statutes all remain fully available regardless of federal qualification. In a framework where federal merit review of the offering is deliberately reduced, state AGs and state securities regulators arguably become more active enforcement participants rather than less, because the federal government has stepped back from pre-screening issuers. Issuers should build a unified factual and disclosure record capable of withstanding simultaneous scrutiny from the SEC, state regulators and civil plaintiffs.

On the antifraud question, the release leaves no ambiguity. For both exemptions, the text states that issuers 'remain subject to the antifraud and antimanipulation provisions of the Federal securities laws.' Every enforcement doctrine the SEC developed in prior crypto fraud cases continues to apply in full force. The new principles-based disclosure obligations create fresh categories of affirmative statements about progress on managerial efforts, use of proceeds and tokenomics evolution. Each of those statements is a potential misrepresentation or omission theory that would not have existed without the disclosure obligation. Issuers are not reducing their exposure surface by using Reg CA. They are expanding it.

Reg CA is also deliberately silent on trading venues. The release acknowledges in a footnote that commenters urged the Commission to exempt exchange, broker and dealer registration definitions from covered investment contract activity, and notes that Commissioner Peirce's 'Running on Empty' statement had raised similar concerns. The Commission's answer is terse: 'This proposal does not address those recommendations.' Until further action materializes, a platform that facilitates trading in a covered investment contract before the issuer's managerial efforts have concluded is transacting in what the Commission still classifies as a security, with no bespoke accommodation available. An issuer's full compliance with Reg CA does nothing to resolve an intermediary's own registration exposure. The trading layer remains in regulatory limbo.

Criminal Exposure Runs Independently of Reg CA

Nothing in Reg CA touches the DOJ's independent authority. Wire fraud under 18 U.S.C. Section 1343 and mail fraud under 18 U.S.C. Section 1341 do not require the government to prove that a crypto asset was ever a security or part of an investment contract. They require proof of a scheme to defraud carried out through the mails or interstate wires. That is precisely why these statutes have been the primary charging tools in prior crypto offering prosecutions: they sidestep the Howey analysis entirely and can be brought regardless of whether the issuer satisfied every Reg CA condition in good faith.

An issuer that clears every requirement of the startup exemption, the fundraising exemption and the Rule 400 safe harbor gains zero insulation from a wire fraud indictment premised on the same underlying misrepresentations. Reg CA compliance is irrelevant to that charge. Willful violations of the Securities Act's own provisions also carry criminal penalties under Securities Act Section 24, and Exchange Act Section 32 covers willful violations on the exchange side. 18 U.S.C. Section 1348 (securities fraud) reaches schemes to defraud 'in connection with' a security, a category that squarely includes a covered investment contract before any safe harbor cessation has been established.

The certification requirements Reg CA creates generate a distinct and underappreciated criminal exposure. Form NOR and Form TR are federal filings signed under certification by named individuals. A knowing false statement in either could independently implicate 18 U.S.C. Section 1001 (false statements to a federal agency), regardless of any securities law consequence. Unlike the civil safe harbor standard, which can be disregarded for a certification that is inaccurate 'either intentionally or otherwise,' a Section 1001 charge requires proof that the statement was knowingly false. That higher burden slightly favors issuers on the criminal side specifically, but it does nothing to reduce civil exposure for negligent errors, and the same underlying investigative record frequently supports both civil and criminal theories simultaneously.

Individual officers, directors and signatories bear this exposure personally and separately from the issuer entity. Because Form NOR and Form TR require individual certification, and because the DOJ has emphasized individual accountability in corporate and crypto-asset enforcement in recent years, the natural persons who sign these filings are natural targets of any subsequent criminal referral. SEC and DOJ investigations of crypto offerings frequently proceed in parallel, with the Commission's civil investigation, including the very disclosures and certifications Reg CA requires, generating much of the factual record a criminal referral would rely on. The compliance process and the prosecution evidence-building process are not as separate as most issuers assume.

That parallel investigation structure is probably the most consequential enforcement reality in the entire proposal. Every Form NOR amendment, every annual website disclosure update, every Form 1-KC filing becomes part of a contemporaneous record that both agencies can use. Issuers who think of these filings as administrative formalities are underestimating the arsenal they are building.

What Issuers Should Do Before the October 20 Comment Deadline

The public comment period runs 60 days from the August 18 release date, closing on October 20, 2026. Clients evaluating whether and how to use Reg CA should approach it as a compliance and disclosure discipline exercise as much as a capital-raising opportunity. The documentation this rule requires, Form NOR filings, publicly hosted disclosure, Form 1-CRYPTO offering statements, periodic reports and Form TR certifications, creates a paper trail the SEC and DOJ can use in both directions.

For issuers considering the startup exemption, the most critical near-term task is auditing covered persons under the Rule 262 bad actor disqualification standard before any Form NOR is filed. A single disqualified officer or major beneficial owner voids the exemption's availability entirely. The issuer should also map every planned token distribution against the 'covered transaction' definition, because the four-year window covers airdrops, staking rewards and governance incentives as well as straightforward token sales. Many projects will discover that distributions they considered routine fall within the exemption's scope.

For issuers considering the fundraising exemption, the ongoing compliance architecture is heavier and the obligations persist long after the offering closes. Forms 1-KC, 1-SC and 1-UC create recurring disclosure touchpoints that should be integrated into the issuer's operational rhythm from day one, not bolted on at the deadline. Any project whose tokenomics or development roadmap is likely to evolve should build internal controls for disclosure currency before it signs anything, not after the first 1-KC is due.

The Rule 400 safe harbor deserves separate, careful attention regardless of which exemption path an issuer takes. The decision to file a Form TR is consequential. A premature or analytically flawed certification can leave the investment contract alive for enforcement purposes, generate a misrepresentation claim on the certification itself, and, if the statement was knowing, implicate Section 1001. Issuers should treat the Form TR cessation analysis as the legal equivalent of a going-concern opinion: it requires rigorous substantive support, not a checkbox, and the Commission has already signaled it will scrutinize those certifications closely.

Reg CA represents the most significant proposed expansion of tailored capital-formation relief for crypto-asset issuers to date, and that framing is accurate. But it is equally true that Reg CA is the first time the Commission has built a formal documentation and certification infrastructure specifically designed around the crypto-asset offering lifecycle. Every form this rule requires is also a potential exhibit in a future enforcement proceeding. Issuers who approach this primarily as a fundraising tool, rather than also as a compliance architecture with real litigation consequences attached, are going to find that out at the worst possible time.