DeFi and SEC Regulatory Enforcement.

While the notion of decentralization is central to the DeFi movement, it does not provide a statutory exemption from federal securities laws. The SEC’s jurisdiction covers securities, regardless of whether the underlying issuer or platform is centralized or decentralized. The following are some examples of the ways the SEC can assert jurisdiction over the various aspects of a DeFi transaction:

• If a token is classified as a security under the securities laws, then the token’s name, label, or branding has no bearing on the legal classification.
• Howey classification depends on the transaction’s underlying economics, and the SEC may look to the economic realities of a DeFi transaction to determine whether a security has been sold.
• The SEC can assert jurisdiction over DeFi issuers, advisers, broker-dealers, funds, platforms, exchanges, executives, promoters, and other participants.
• This jurisdiction is not limited to the underlying tokens or platforms; any entity or individual that offers or sells securities without registration may be liable for liability under the federal securities laws.
• In addition, the SEC’s enforcement jurisdiction is not limited to the issuance and sale of securities; any entity or individual that provides investment advice without registration may also be liable.

What Does it Mean for a Token to be “DeFi” or a Platform/Application to be “Decentralized”?

The SEC has not yet formally adopted a particular definition for these terms, but for purposes of securities law enforcement, the SEC takes the approach of looking past these labels to evaluate the actual facts and circumstances at hand. For example, while a token may be called a “utility token” or a platform may be marketed as “decentralized,” if the token is sold on an investment contract basis or if a party is centrally controlling the platform’s operations and marketing, then the SEC can hold the issuer, promoter, or platform owner liable.

This approach may lead to a presumption of guilt in any case involving DeFi tokens or platforms, as all token sales and DeFi platform operations include some level of centralization or interdependence.

What are the Limits of the SEC’s Jurisdiction over the DeFi Markets?

As a general matter, the SEC will not hesitate to assert jurisdiction over any entity or person offering or selling securities that are not duly registered. However, there are a few key limitations to the SEC’s enforcement jurisdiction over the DeFi markets.

First, the SEC is subject to limits imposed by the legislative branch. While the SEC has a rule-making authority that is delegated to it by Congress, it cannot unilaterally decide that a DeFi transaction constitutes an illegal securities transaction. If the legislative branch has not yet enacted a federal statute that prohibits certain activities in the DeFi markets, the SEC cannot assert jurisdiction.

Second, the SEC is subject to limits imposed by the judicial branch. When a federal district court reviews an SEC enforcement action against a DeFi issuer, platform, or token, it is bound to apply applicable securities law principles to determine whether the SEC’s enforcement action was justified. If the court finds that no liability exists, then the SEC can be barred from prosecuting any additional claims based on the same set of facts and circumstances.

How Does the SEC Classify DeFi Tokens and Transactions?

The SEC assesses howey classification on a transaction-specific basis. Under the Howey Test, a transaction involves an investment contract when (i) there is an investment of money (ii) in a common enterprise (iii) with a reasonable expectation of profits (iv) derived from the efforts of others. In DeFi token cases, this generally involves considering the investor’s motivations for purchasing a token, the issuer’s promotions and marketing efforts, the token’s promised function and utility, and the token holder’s control over the token’s profits.

The Reves Test, while traditionally applying to notes, also requires a transaction-specific analysis. Under the Reves Test, a transaction involves a security when a party issuing or purchasing a note or other evidence of indebtedness does not fit into one of four general categories. If a transaction does not fit into one of these four categories, then the token or evidence of indebtedness will be classified as a security regardless of whether the parties to the transaction intended it to be a security.

Staking arrangements also trigger a transaction-specific Howey analysis. The SEC has adopted the position that it will not categorize stakers as “validators” (i.e. not security holders) simply because the staking arrangement does not involve a specific type of blockchain protocol or validation function. Instead, the SEC evaluates each staking arrangement on a case-by-case basis, and it has been holding participants accountable in cases involving staking arrangements that reward users for their validation efforts.

Are DeFi Token Sales and Staking Arrangements Subject to the Securities Act of 1933?

In essence, yes. If a transaction involves an investment contract, note, other evidence of indebtedness, or another form of security, then the transaction will fall within the scope of the Securities Act of 1933. The Securities Act includes registration requirements for securities offerings and resales, and it provides for various securities offering exemptions. In addition, it contains a broad anti-fraud provision that applies in all transactions.

What are the Registration Requirements for DeFi Token Sales and Staking Arrangements?

Section 5 of the Securities Act of 1933 generally requires issuers of securities to register with the SEC, and Section 15 of the Securities Exchange Act of 1934 generally requires the registration of securities brokers and dealers. While registration is mandatory absent a registration exemption, registering with the SEC is subject to lengthy procedural requirements and costs.

The SEC requires that issuers or platforms file registration statements that meet the disclosure and reporting requirements of the SEC’s regulations, and it will review these registration statements prior to granting approval. While issuing or offering a security is not prohibited, doing so without registration exposes the issuer to liability under the Securities Act of 1933.

What are the Registration Exemptions for DeFi Token Sales and Staking Arrangements?

Various registration exemptions apply to DeFi token sales and staking arrangements depending on the circumstances. While registering with the SEC is a costly and time-consuming process, offering a registered security is a legitimate way to sell a security without triggering penalties and liability under the federal securities laws. The most common registration exemptions for DeFi transactions include:

• Regulation D offers, which are generally limited to offerings in private placement transactions,
• Regulation S offers, which are generally limited to offshore transactions, and,
• Section 4(a)(1)(A) “safe harbor” offerings, which are generally limited to transactions with limited offerings to small numbers of accredited investors.

While the SEC has been scrutinizing these exemptions more closely recently, offering a security without registration is still prohibited, and issuers should seek the services of an experienced securities lawyer to determine whether an exemption is available.

Do Securities Offering Exemptions Eliminate DeFi Issuers’ Liability?

No. Even where registration exemptions are available, and where issuers of securities properly rely on these exemptions to sell their securities without registration, issuers are not exempt from federal antifraud liability. Under the Securities Act of 1933 and the Securities Exchange Act of 1934, issuers of securities are liable for fraud, including fraud in connection with the sale or purchase of a security, regardless of whether the transaction is registered with the SEC.

When Can Developers and Governance Participants Face Liability?

Exchange Act Section 20(a) and the Investment Advisers Act of 1940 also impose liability on control persons. As a general matter, liability under these provisions requires: (i) (a) violation of a provision of the Securities Act of 1933, (b) provision of the Securities Exchange Act of 1934, or (c) provision of a related federal statute; and (ii) a qualifying relationship between the person or entity in question and the issuer, broker-dealer, investment adviser, or other entity facing the enforcement action.

Exchange Act Section 20(e) and other provisions of the federal securities laws also provide for aiding and abetting liability. As a general matter, imposing liability for aiding and abetting an issuer’s, broker-dealer’s, or investment adviser’s (i) unregistered offerings or sales, (ii) unregistered trading of securities, (iii) offering unregistered advisory services or proxy solicitation, and/or (iv) other violations requires: (i) knowledge or recklessness, and (ii) substantial assistance with respect to the subject transaction or transaction.

In DeFi cases, the fact that a particular person or entity has legal title to the relevant token or platform is important, but it is not enough on its own to prove liability. Rather, the government must prove each element of liability with respect to that person or entity.

What is Functional Protocol Control?

For purposes of determining the existence of a “control relationship” under Section 20(a) of the Exchange Act, the SEC is examining whether particular developers, governance participants, or promoters have “functional control” over the relevant token or platform. While administrative keys and upgrade powers of various DeFi tokens and protocols provide evidence of functional protocol control, these facts have been challenged in various pending cases.

Even if protocol code is considered “immutable,” this does not eliminate liability for any person or entity involved in its development or sale. While it may be difficult to remedy certain violations, such as the sale of an unregistered security, it may not be possible to return that security to the investor, the SEC can still seek injunctions and civil monetary penalties against the responsible persons.

Do Software Developers, Bitcoin Mining Companies, and Other Individuals Face Liability?

Software developers that design, promote, and sell tokens alongside their software products have faced scrutiny from the SEC. As a result, many blockchain software developers have been under investigation, and various investors have reported that their assets are being frozen pending further scrutiny from the SEC.

Bitcoin mining companies that are listed on public exchanges have faced investigations from the SEC as well. While the SEC generally focuses its enforcement on the offering and trading of securities in the DeFi markets, there are a few areas where the SEC has expanded its enforcement efforts beyond registered offerings of unregistered securities.

This expansion includes targeting certain individuals in relation to crypto promotions involving celebrity brand ambassadors.

Must DeFi Protocols Register as Securities Intermediaries?

The SEC considers whether particular activities trigger the registration requirements of exchange platforms, broker-dealers, investment advisers, and clearing agencies. To assess whether a platform or application is engaged in securities exchange functions, the SEC refers to Exchange Act Rule 3b-16. If the application’s operation creates the potential for contract completion between buyer and seller, then it qualifies as a securities exchange under the rule.

The definition of broker under Exchange Act Section 3(a)(4) also imposes potential registration requirements for particular DeFi applications and platforms. Specifically, Section 3(a)(4) includes entities and individuals that effect securities transactions for another party.

Under Exchange Act Section 3(a)(5), dealers are defined as entities or individuals engaged in the business of buying and selling securities for their own accounts. In DeFi cases, this will typically be true where the application or platform is engaging in trading activities on its own behalf.

Exchange Act Section 3(a)(23) defines a clearing agency, while the term “custodian” is defined in Section 211(a)(6) of the Investment Company Act of 1940. A DeFi application or platform will qualify as a clearing agency or custodian if it executes one of five specific clearing or custodial functions as specified in the statutes.

Under Section 202(a)(11) of the Investment Advisers Act of 1940, any business or person that provides investment advice to another person for compensation is required to register as an investment adviser with the SEC. This will typically include DeFi companies that provide advice about securities to their customers.

As a general matter, any application, platform, or company that falls under these statutory definitions must register as a securities intermediary under either the Exchange Act, the Investment Advisers Act of 1940, or the Investment Company Act of 1940.

The Securities Exchange Act of 1934 also requires that any alternative trading system (ATS) register as a broker-dealer and file Form ATS with the SEC. While Form ATS is a relatively simple form that only requires the applicant to disclose certain basic information about the ATS, registering as a broker-dealer is a costly and time-consuming process.

Recently, several digital-asset platforms that offer crypto derivatives or other DeFi instruments have faced allegations of operating as unregistered securities exchanges. In addition, the SEC has asserted that some digital-asset platforms are operating as unregistered broker-dealers, and some asset managers that manage funds which invest in digital tokens have faced scrutiny over unregistered securities offering violations.

Todd Spodek is the managing partner of Spodek Law Group, a second generation criminal defense firm that has been practicing since 1976.

Which regulators can investigate a DeFi project?

Question: Does a DeFi project also face CFTC or FINRA scrutiny?

In general, the CFTC regulates commodity derivatives, and the SEC regulates securities and security-based swaps. Although the CFTC has authority over spot-commodity transactions as well, the CFTC primarily uses this authority as a basis for pursuing fraud and manipulation enforcement rather than using this authority as a basis for requiring registration of trading platforms or brokerage firms.

The FINRA’s jurisdiction arises through membership and authority delegated by the SEC as a self-regulatory organization.

State authority can arise independently of federal authority, based upon state laws, including the “blue-sky laws,” and state laws governing money transmission businesses.

The Office of Foreign Assets Control (OFAC) has jurisdiction to enforce sanctions against U.S. persons who participate in decentralized protocols, and U.S. persons cannot insulate themselves from OFAC sanctions obligations simply by utilizing decentralized protocols.

While not strictly a regulatory authority, the Department of Justice (DOJ) may pursue criminal investigations alongside the SEC’s enforcement efforts, and federal criminal investigations may also present additional liability.

Question: How common is it for a DeFi project to face investigation by multiple regulators?

It is relatively common for a DeFi project to face investigation by multiple regulators. In addition to the SEC, DeFi projects may face investigations by the CFTC, FINRA, DOJ, state attorneys general, and various state securities and banking regulators.

Recently, FINRA and New York state regulators have both pursued enforcement actions against certain registered broker-dealers for their cryptocurrency trading practices. Further, New York County District Attorney Cyrus Vance, Jr. recently filed criminal charges against cryptocurrency companies for allegedly aiding and abetting money laundering violations.

These enforcement actions and investigations are often triggered by allegations from investors that particular DeFi platforms and applications are engaging in fraud, money laundering, or other unlawful activity. As a result, we recommend that cryptocurrency and DeFi industry professionals promptly consult with an experienced securities litigation lawyer if they become aware of any current or pending enforcement action or investigation involving their business.

What Happens After the SEC Starts Investigating DeFi?

Question: What are the SEC’s methods of investigating DeFi companies?

SEC inquiries can be informal or they can proceed under formal investigative orders authorized by the Commission. However, these are different from SEC examinations, which generally involve reviews of DeFi companies’ compliance with the SEC’s rules and regulations. During the examination process, the SEC’s staff may refer findings to the Division of Enforcement for enforcement purposes.

Question: When does the SEC issue subpoenas?

Generally, the SEC staff will not issue a subpoena unless and until it has been granted formal investigative authority by the Commission. While it may issue requests for information informally in some cases, any demand for the production of information under the SEC’s rules and regulations will generally require the issuance of a subpoena.

Question: What is a Wells notice?

A “Wells notice” is a preliminary staff recommendation for enforcement action. Receipt of a Wells notice does not mean that the SEC has concluded that you are liable for liability under the federal securities laws. Instead, receipt of a Wells notice triggers your right to make a representation to the SEC’s staff explaining why enforcement action is not warranted.

Question: What is the SEC’s Seaboard framework?

The SEC’s “Seaboard framework” is a body of guidelines that the SEC’s staff uses when considering whether to decline to recommend enforcement action or to seek a reduced sanction. Factors considered under the Seaboard framework include: (i) whether the party self-reported the conduct to the SEC; (ii) whether the party cooperated during the SEC’s investigation; (iii) whether the party took remedial action; and, (iv) whether the party had internal policing measures in place that were designed to detect violations.

Question: Does self-reporting protect a party against SEC enforcement?

While self-reporting and voluntary cooperation may potentially assist a party in avoiding liability, these actions will not automatically result in a declination or reduced sanction. Furthermore, in all cases, seeking the assistance of experienced securities defense counsel is the best way to determine what action(s) should be taken in order to protect yourself from liability.

Question: What is a Wells submission?

The issuance of a Wells notice triggers the “Wells submission” stage of the SEC’s enforcement process. At this stage, issuers can explain to the SEC staff why an enforcement action is not warranted.

Question: What is a staff declination?

A staff declination is a written notification from the SEC staff to the subject of an investigation stating that the staff will not be recommending that the Commission take enforcement action.

Have Recent Court and Agency Changes Reduced the SEC’s Ability to Pursue Enforcement Against the DeFi Industry?

To a limited extent. While the SEC has not significantly cut back on its enforcement efforts, a combination of legislative, administrative, and judicial developments has reduced the SEC’s enforcement jurisdiction in several key areas. These include:

• Administrative changes. In June 2025, the SEC withdrew its proposed amendments to Exchange Act Rule 3b-16, which would have expanded the definition of “exchange” to reach DeFi trading systems.
• Loper Bright. The Second Circuit has begun applying Loper Bright Enterprises v. Raimondo, 603 U.S. 369, 144 S. Ct. 2244 (2024) (superseding Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc., 467 U.S. 837 (1984)), with implications for how the SEC may derive substantive jurisdiction for DeFi enforcement actions. In Loper Bright, the Court held that the Administrative Procedure Act requires courts to exercise their own independent judgment in deciding whether an agency has acted within its statutory authority, and that courts may not defer to an agency’s interpretation of the law simply because a statute is ambiguous.
• Expiration of regulatory authority. In November 2024, a federal court vacated the SEC’s expanded “dealer” rules (Exchange Act Rules 3a5-4 and 3a44-2) on the ground that they exceeded the SEC’s statutory authority under the Exchange Act.
• Staff guidance. In April 2025, the SEC staff issued a statement on DeFi activities that involved a reference to “fully reserved dollar stablecoins.” However, the SEC staff’s statement specifically only covered DeFi participants that “offer, buy, sell, or trade in an effort to increase the amount of a fully reserved dollar stablecoin that an investor purchases.”

The SEC staff’s DeFi guidance only reflects the SEC staff’s view of how it will evaluate DeFi token transactions and platforms, and it is not binding on the SEC’s Commissioners or on the federal courts.

Additionally, while various cryptocurrency and blockchain legislation has been introduced in Congress, these bills currently have no legal effect.

• Dismissal of SEC’s case against Richard Heart. Recently, in a related case, a federal district court dismissed the SEC’s case against Richard Heart, ruling that the SEC had not established personal jurisdiction over him or a sufficient domestic nexus for its claims.
• Formation of the SEC’s Cross-Border Task Force. Conversely, the SEC’s Cross-Border Task Force, announced in September 2025, represents a serious risk to DeFi participants around the world. While targeting foreign entities, the team has not yet publicly disclosed its enforcement jurisdiction. This team also represents an expansion of the SEC’s enforcement efforts that could lead to increased scrutiny of DeFi industry players worldwide.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.