Whether a cryptocurrency is a security depends on how it’s sold and what buyers expect from it, not on what the project calls its token. Federal courts and the SEC apply the Howey test, a four-part standard from a 1946 Supreme Court case, to decide. A token is a security when a buyer puts money into a common enterprise expecting profits from the efforts of a promoter or third party. If any of those four elements is missing, the token generally isn’t a security, though it may still be regulated as a commodity or something else.
The Howey Test
Federal securities law lists “investment contract” as one type of security but never defines it.1Office of the Law Revision Counsel. 15 USC 77b – Definitions; Promotion of Efficiency, Competition, and Capital Formation The Supreme Court filled that gap in SEC v. W.J. Howey Co., describing an investment contract as a scheme where a person invests money in a common enterprise and expects profits solely from the efforts of a promoter or third party.2Justia Law. SEC v. W.J. Howey Co. 328 U.S. 293 (1946) The Court made the definition deliberately flexible so it could reach “the countless and variable schemes devised by those who seek the use of the money of others on the promise of profits.” That flexibility is why a test designed for Florida orange groves applies to blockchain tokens.
All four elements must be present:
- Investment of money. You contribute something of value. Dollars count; so does Bitcoin or another cryptocurrency used to buy the token.
- Common enterprise. Your financial outcome is tied to other investors or to the people running the project, usually because funds are pooled or because everyone’s returns rise and fall with the same efforts.
- Expectation of profits. You’re buying because you expect the asset to appreciate or generate returns, not because you plan to use it immediately for a practical purpose.
- Derived from the efforts of others. Those expected profits depend on the work of the project’s founders, developers, or managers, not on your own actions.
Courts look past labels and marketing at what the buyer actually gets and reasonably expects. A “utility token” can still be a security if the economics look like a startup investment.
What Pushes a Crypto Token Toward Security Status
The SEC’s Division of Corporation Finance published a Framework for “Investment Contract” Analysis of Digital Assets in April 2019 to help issuers evaluate their own projects.3U.S. Securities and Exchange Commission. Framework for Investment Contract Analysis of Digital Assets It’s staff guidance, not a regulation, but it shows how the enforcement division reads Howey.
Several traits weigh toward security status:
- Secondary market trading. When holders can resell on exchanges, regulators read that as evidence of profit motive rather than consumptive use.
- The project is still being built. If the token has no current practical function and the team is using buyer capital to develop the network, the purchase looks like funding a startup.
- Concentrated developer holdings. Pre-mined or reserved tokens align the founders’ financial interests with buyers, creating the promoter-investor relationship Howey targets.
- Marketing focused on appreciation. Promoting a token’s potential for capital gains, rather than its use for payments or access to a service, signals an investment contract.
- Bulk or discounted sales. Selling tokens below the value of the goods they can access, or in quantities beyond any personal use, suggests the real purpose is speculation.
The more of these are present, the stronger the case that the token is a security regardless of what it’s called.
Digital Assets the SEC Has Said Are Not Securities
Recent Division of Corporation Finance statements have carved out several categories. These are staff views, not binding Commission rules, but they signal how enforcement is thinking.
Covered Stablecoins
In April 2025, the Division stated that “Covered Stablecoins” — those pegged one-to-one to the U.S. dollar, fully backed by low-risk liquid reserves, and redeemable on demand — are not securities. Buyers use them for payments and storing value, the issuer pays no interest or profit share, and reserves are segregated from business operations. The Division did not address algorithmic stablecoins, which maintain their peg through supply adjustments rather than dollar reserves.4U.S. Securities and Exchange Commission. Statement on Stablecoins
Protocol Staking
In May 2025, the Division stated that staking crypto directly on a proof-of-stake network, solo or through a custodian, is not a securities offering. Staking rewards come from validating transactions, an administrative function, not from anyone’s entrepreneurial or managerial efforts, so the “efforts of others” prong isn’t met.5U.S. Securities and Exchange Commission. Statement on Certain Protocol Staking Activities The guidance covers protocol staking specifically and may not extend to all staking-as-a-service platforms where an intermediary pools funds and manages the process.
Most NFTs
NFTs don’t get a blanket exemption. A one-of-a-kind digital collectible sold outright, where the seller gives up control, generally doesn’t meet Howey because there’s no common enterprise and no ongoing reliance on the seller. Fractional NFTs are different: splitting ownership into tradeable shares creates a pool of investors whose returns depend on the underlying asset’s performance, and promotional language about earning potential returns checks most of the Howey boxes. The more the seller retains managerial control after the sale, the stronger the case for security status.
Bitcoin and Commodities
Digital assets that don’t satisfy Howey may fall under CFTC jurisdiction as commodities. The Commodity Exchange Act defines a commodity broadly.6Office of the Law Revision Counsel. 7 USC 1a – Definitions Bitcoin is the clearest example. The CFTC has treated Bitcoin as a commodity in enforcement actions since at least 2015, and no federal authority has seriously contested that view. There’s no central issuer, no founding team making ongoing development promises, and the network is maintained by a decentralized group of miners. Commodities don’t carry the registration, disclosure, or ongoing reporting obligations that apply to securities.
Ethereum sits in a related but less formal position. The SEC approved spot Ethereum ETFs and removed Ethereum from its 2026 enforcement and examination priorities. No formal classification has been issued, but the practical treatment suggests regulators aren’t treating ETH as a security.
How Decentralization Changes the Answer
In June 2018, then-Director of Corporation Finance William Hinman argued in a speech that a digital asset initially sold as a security could stop being one if the network becomes sufficiently decentralized.7U.S. Securities and Exchange Commission. Digital Asset Transactions: When Howey Met Gary (Plastic) The reasoning: once no central group’s efforts drive the asset’s value, the “efforts of others” prong falls away. Hinman specifically discussed Bitcoin and Ethereum as assets that had reached or were approaching that point.
Sufficient decentralization means the community, rather than a founding team, maintains and governs the network. No single group holds unique power over protocol upgrades, token supply, or direction. The information imbalance securities laws exist to correct, where promoters know far more than buyers, largely disappears at that point.
The concept is harder to apply to DAOs. The SEC’s 2017 DAO Report found that limited governance rights didn’t give token holders meaningful control. A DAO where broad community voting drives decisions that execute automatically through smart contracts pushes back on that conclusion, but where the line sits is legally unresolved. Decentralization also isn’t permanent. A project that recentralizes, by giving a small team control over treasury funds or protocol changes, can slide back into security territory. Regulators look at current operational reality, not original design.
What Courts Have Actually Held
The most consequential ruling came in July 2023, when a federal judge in the Southern District of New York split SEC v. Ripple Labs. Ripple’s direct sales of XRP to institutional investors through written contracts were unregistered securities offerings: those buyers knew they were funding Ripple’s development and expected profits from that work. But “programmatic sales” of XRP on public exchanges did not satisfy Howey, because those buyers had no idea they were purchasing from Ripple and couldn’t tie their profit expectations to Ripple’s specific efforts.8United States District Court Southern District of New York. Order in SEC v. Ripple Labs, Inc., et al.
In May 2025, the SEC and Ripple settled. The original civil penalty of over $125 million was reduced to $50 million, the injunction against Ripple was vacated, and both parties dismissed their appeals.9U.S. Securities and Exchange Commission. Ripple Labs, Inc., Bradley Garlinghouse, and Christian A. Larsen Neither side sought to disturb the summary judgment ruling, so the institutional-versus-programmatic distinction survives as precedent in that court.
The SEC’s June 2023 case against Coinbase, which alleged the platform operated as an unregistered exchange because it listed tokens the SEC said were securities,10U.S. Securities and Exchange Commission. SEC Charges Coinbase for Operating as an Unregistered Securities Exchange, Broker, and Clearing Agency was dismissed in February 2025. The dismissal wasn’t on the merits; it reflected the new Crypto Task Force’s development of a different regulatory approach, and the order explicitly stated it didn’t reflect the Commission’s position on any other case.11U.S. Securities and Exchange Commission. SEC Announces Dismissal of Civil Enforcement Action Against Coinbase
What Happens if a Token Is a Security
Selling a security without registering the offering or qualifying for an exemption violates Section 5 of the Securities Act. Consequences come from several directions at once.
- Disgorgement. The SEC can require the issuer to return net profits from the offering. Under Liu v. SEC, disgorgement is limited to net profits after legitimate business expenses.
- Civil penalties. Tiered penalties apply per violation. Base statutory amounts range from $5,000 per violation for a natural person up to $500,000 for an entity where fraud caused substantial losses, adjusted upward annually for inflation.12Office of the Law Revision Counsel. 15 USC 78u-2 – Civil Remedies in Administrative Proceedings
- Investor rescission. Buyers may have the right to demand their money back, plus interest, if the offering wasn’t properly registered. For a large token sale, rescission alone can be existentially expensive.13U.S. Securities and Exchange Commission. Consequences of Noncompliance
- Injunctions. Courts can bar the company and its officers from future securities offerings.
Not every security has to go through full public registration. Regulation D Rule 506(c) allows broad solicitation if every buyer is verified as accredited.14SEC.gov. General Solicitation – Rule 506(c) Regulation A+ permits offerings up to $20 million (Tier 1) or $75 million (Tier 2) in a 12-month period, with Tier 2 requiring audited financials and ongoing reporting.15SEC.gov. Regulation A Some crypto projects have used these paths, though compliance costs and resale restrictions make them impractical for many smaller sales.
Where the Rules Are Heading
The SEC established a Crypto Task Force in January 2025, led by Commissioner Hester Peirce, with a mandate to draw clearer lines between securities and non-securities, craft disclosure frameworks for digital assets, and create realistic registration paths for crypto companies.16U.S. Securities and Exchange Commission. Crypto Task Force The agency removed cryptocurrency from its 2026 enforcement and examination priorities entirely. That doesn’t mean Howey no longer applies. It means the agency is prioritizing rulemaking over enforcement while the framework is being rebuilt.
Congress is also working on comprehensive legislation, though nothing has been signed into law as of early 2026. The Financial Innovation and Technology Act (FIT21) passed the House in May 2024; the Digital Asset Market Clarity Act passed the House in July 2025. Both would give the CFTC authority over spot markets for digital commodities while preserving SEC jurisdiction over tokens that function as securities. The GENIUS Act, focused on stablecoins, is moving separately. Until one of these bills becomes law, the Howey test and existing agency guidance remain the governing framework, and the answer to whether any given token is a security still turns on the same four questions the Supreme Court laid out in 1946.