The SEC proposed Regulation Crypto Assets on August 18, 2026, setting out a $5 million startup exemption, $20 million and $75 million fundraising tiers, and an investment contract safe harbor that could reshape how eligible token projects raise capital under US federal securities law. Regulation Crypto Assets remains a proposal, not a rule in force, and public comments close on October 20, 2026.
Key takeaway: Regulation Crypto Assets would create defined capital-raising paths for certain crypto investment contracts, but each path depends on precise eligibility, disclosure, filing, and operational commitments that teams must be ready to evidence.
What does SEC Regulation Crypto Assets actually cover?
SEC Regulation Crypto Assets would apply only to a “covered investment contract”: an arrangement involving a crypto asset that is not itself a security and where no other asset is subject to the same investment contract. Tokenized stocks, digital securities, and offerings bundled with equity or other assets fall outside the proposal and would need another available securities-law route.
The proposal appears in Release Nos. 33-11434 and 34-106150, File No. S7-2026-27, published in the Federal Register on August 21, 2026. Its four components are:
- A startup exemption under proposed Rule 200.
- A fundraising exemption under proposed Rule 300.
- An investment contract safe harbor under proposed Rule 400.
- A qualified purchaser definition under proposed Rule 500 that would preempt specified state registration and qualification requirements.
The legal framing matters. Under Regulation Crypto Assets, the security is the investment contract rather than the token itself. The proposal treats one unit of a covered investment contract as equivalent to one unit of the subject crypto asset for pricing and offering-limit calculations.
Whether an investment contract exists remains governed by the SEC’s March 2026 interpretation, Release 33-11412. That interpretation distinguishes digital commodities, digital collectibles, digital tools, stablecoins, and digital securities. Regulation Crypto Assets therefore does not replace the threshold legal analysis of a token’s facts, marketing, promised efforts, and distribution structure.
For Web3 teams, this means the first compliance question is not which exemption has the largest ceiling. The first question is whether the planned issuance fits the narrower definition of a covered investment contract at all. Structuring a token sale with tokenized equity, revenue rights, or another asset alongside the token may take the offering outside this framework.
Projects preparing an issuance should align technical design, public documentation, and legal analysis before marketing begins. Soken’s Web3 legal and compliance services can help teams connect token mechanics, disclosures, and offering structure without treating compliance as a document drafted after launch.
Which capital-raising path fits a crypto project?
The proposed Rule 200 and Rule 300 exemptions serve materially different issuer profiles: Rule 200 offers a single $5 million four-year route with lighter filing requirements, while Rule 300 offers $20 million and $75 million routes per 12-month period but requires SEC qualification, US nexus, and ongoing EDGAR reporting.
| Proposed path | Offering limit | Issuer eligibility | Main filing and timing | Financial statement requirement |
|---|---|---|---|---|
| Rule 200 startup exemption | $5,000,000 over one period of up to four years | Company, individual, or group, with no proposed US domicile, management, or asset test | Form NOR before any sale, then Form TR at the end of the period | No financial statements required |
| Rule 300 Tier 1 fundraising exemption | $20,000,000 per 12-month period | US-organized entity with US management, more than 50 percent of assets in the US, and business principally administered in the US | Form 1-CRYPTO must be qualified before sales | Two fiscal years of US GAAP financial statements, not required to be audited |
| Rule 300 Tier 2 fundraising exemption | $75,000,000 per 12-month period | US-organized entity with US management, more than 50 percent of assets in the US, and business principally administered in the US | Form 1-CRYPTO must be qualified before sales | Audited financial statements required |
The startup exemption is a one-time route for an issuer and its affiliates with respect to the same token or a substantially similar crypto asset. It is not a rolling four-year allowance. The clock starts when the issuer files Form NOR and ends at the earlier of four years after that filing or the filing of Form TR.
Rule 200 also has an operational consequence that token teams may overlook: distributions beyond conventional cash sales can count toward the $5 million cap. Conditional airdrops, use rewards, staking rewards, governance distributions, and token-based compensation may be included in the offering total. Airdrops without consideration, as described in the SEC’s March 2026 interpretation, do not require reliance on the exemption.
The Rule 200 framework allows retail participation, general solicitation, and unrestricted tokens. It sets no per-investor investment cap and requires no financial statements. Yet communications before Form NOR is filed may constitute offers outside the exemption. A public teaser campaign, token allocation announcement, or fundraising thread should therefore be reviewed before publication.
The Rule 300 fundraising exemption takes a more formal approach. A project cannot solicit or accept money or other consideration before Form 1-CRYPTO is qualified, although testing the waters is allowed. Both Rule 300 tiers limit a non-accredited investor to 10 percent of the greater of annual income or net worth.
Rule 300 also limits resale-style participation. Affiliate selling securityholders are capped at $6 million in Tier 1 and $22.5 million in Tier 2. In an issuer’s first fundraising offering, and offerings qualified within one year of that first offering, all selling securityholders together cannot account for more than 30 percent of the offering.
In Soken’s experience auditing smart-contract systems, a token’s legal disclosures are only reliable when they match live permissions, upgrade controls, allocation logic, vesting behavior, and administrative authority on-chain. A compliance pathway cannot compensate for a protocol whose implemented controls contradict its published commitments.
What must issuers disclose and report?
Regulation Crypto Assets would require both startup and fundraising issuers to make plain-language disclosures across ten defined topics, including token economics, source code and security, governance permissions, conflicts, development plans, and risk factors. Rule 300 issuers would additionally face recurring EDGAR reporting after a qualified offering.
The ten disclosure areas cover:
- The investment contract and progress toward promised managerial efforts.
- Offering terms and use of proceeds.
- The subject crypto asset.
- Management and conflicts of interest.
- The network and development plan.
- Security and source code.
- Token economics, allocations, pricing, lockups, and release schedules.
- Governance and smart-contract permissions.
- The surrounding ecosystem.
- Specific risk factors.
The proposal requires consistency between formal disclosure and a project’s website, official social-media channels, and whitepapers. This requirement turns public communications into a governance issue. A technical roadmap, contributor announcement, token unlock dashboard, or claim that a protocol is decentralized can create a discrepancy if it conflicts with Form NOR, Form 1-CRYPTO, or the required public disclosures.
For Rule 200, the disclosure is not filed on EDGAR. The issuer must post it free of charge on a public website, keep it available throughout the exemption period, and update it within 30 calendar days after each calendar year ends if material changes occurred.
For Rule 300, ongoing reporting applies in both tiers:
| Required Rule 300 report | Form | Deadline |
|---|---|---|
| Annual report | Form 1-KC | Within 120 days after fiscal year end |
| Semiannual report | Form 1-SC | Within 90 days after the end of the first six months of the fiscal year |
| Material-event report | Form 1-UC | Within four business days of specified events |
| Transition report | Form TR | At transition or termination circumstances described in the proposal |
This reporting structure is more demanding than a simple offering filing. It introduces recurring operational requirements for legal, finance, security, product, and communications teams. A protocol cannot sensibly assign token-economics disclosure to one function and smart-contract permission disclosure to another without an established review process.
The proposal does not mandate an insider lockup, but issuers must disclose lockups that exist. The SEC asks whether a one-year insider holding period should become mandatory. The Regulation A bad-actor disqualification framework would also apply, while pre-effective-date events would require written disclosure to purchasers rather than triggering disqualification.
The security-disclosure category deserves close attention. Teams should be able to substantiate statements about source-code access, privileged roles, upgradeability, oracle dependencies, emergency pause controls, multisignature arrangements, governance execution, and third-party infrastructure. A technical security assessment can give issuers a defensible inventory of those controls before disclosures become public commitments.
How does the Form TR safe harbor work?
The Rule 400 investment contract safe harbor would deem a covered investment contract to have ended only after an issuer has completed or permanently ceased every essential managerial effort it promised, makes no new such promises, and files Form TR with a certification and supporting analysis. Rule 400 is an exit mechanism, not a new fundraising exemption.
The safe harbor has no independent offering cap and no time limit. It is available to issuers that used the proposed exemptions and to issuers that never used either exemption. That breadth does not eliminate the evidentiary burden. The issuer must show what it promised, explain how those efforts were completed or permanently ceased, and support the Form TR certification.
The relevant decentralization benchmark is project-specific. Rule 400 does not ask whether a network satisfies an abstract industry definition of decentralization. Instead, it evaluates decentralization against how the issuer itself defined or described the promised transition.
This creates a practical recordkeeping requirement. If a project describes a roadmap containing validator distribution, governance migration, source-code releases, protocol parameter handover, or withdrawal of administrator powers, those representations may later become evidence in a Rule 400 analysis. Product releases, governance proposals, multisignature changes, and administrative-key removals should be documented as part of the same compliance record.
Rule 400 binds the SEC only. It would not prevent other parties from asserting that a crypto asset remains subject to an investment contract. The safe harbor should therefore not be described as a universal declaration that a token is no longer a security.
A false Form TR certification carries direct consequences. If the SEC determines that a project misstated satisfaction of the safe harbor conditions, the SEC may treat the covered investment contract as continuing to exist and apply securities-law requirements accordingly.
For protocols with mutable contracts, the technical and legal questions are tightly linked. If an issuer promises to relinquish upgrade authority but retains an upgrade path, emergency owner role, or unbounded governance override, the disclosed endpoint and implemented endpoint may diverge. Teams should maintain a formal map of every permission before making transition commitments. Soken’s security and smart-contract review work is relevant where the Form TR narrative must be reconciled with deployed control architecture.
What does state preemption solve, and what does it leave open?
Proposed Rule 500 would classify people offered or sold tokens under Regulation Crypto Assets as qualified purchasers, preempting state registration and qualification requirements for covered offerings and specified secondary trades. Rule 500 would not displace state antifraud authority or resolve crypto custody, exchange, broker, dealer, or intermediary obligations.
The preemption would apply to both the Rule 200 startup exemption and Rule 300 fundraising tiers. That distinguishes the proposal from Regulation A, under which Tier 1 offerings do not receive the same state preemption.
Secondary-market preemption would extend to transactions by persons other than issuers, underwriters, or dealers when the issuer remains current in required filings. If an issuer falls out of compliance, the preemption pauses until the issuer cures the defect. For Rule 200 issuers, state preemption for secondary trading also stops after the exemption period if the investment contract remains in existence.
The proposal leaves several market-structure questions outside its scope. It does not answer whether a platform may list a token, how a custodian must handle it, whether an intermediary requires a particular registration, or how broader trading obligations apply. A valid offering pathway is therefore not equivalent to an end-to-end operating license for token markets.
The SEC estimates about 130 offerings annually under the proposed rules, comprising 99 startup-exemption offerings and 31 fundraising-exemption offerings. The SEC also estimates about 475 issuers each year could use the safe harbor without using either exemption. Those projections underline the proposal’s intended relevance, but they do not convert the framework into current law.
The rulemaking also asks 154 numbered questions across a 401-page release. Comments in the public file as of October 12, 2026 included divergent views on the proposal’s scope, definition of essential managerial efforts, and broader legal structure. The comment deadline is October 20, 2026, and submissions must reference File No. S7-2026-27.
Treat Regulation Crypto Assets as a design constraint now, rather than a completed regulatory solution. The concrete next step for a token issuer is to build a single evidence file mapping every promised managerial effort, token allocation, smart-contract permission, public statement, and planned disclosure update against either Rule 200, Rule 300, or the eventual Form TR analysis.
That exercise exposes the gap that matters most: the difference between what a protocol says it will deliver and what its contracts, governance processes, and reporting controls can prove. Teams following this proposal can track related analysis through the Soken research hub while the SEC’s rulemaking process remains open.