What Is Sufficient Decentralization Under the SEC Howey Test?

Under the SEC’s 2026 interpretation, a crypto token is sufficiently decentralized under the Howey test when the underlying network “functions and operates autonomously with no person, entity, or group of persons or entities having operational, economic, or voting control.”¹ At that point, buyers are no longer relying on the efforts of a central team to generate returns, the fourth prong of Howey falls away, and the token stops functioning as a security. The SEC’s Release No. 33-11412, issued in early 2026 and coordinated with the CFTC, is the first formal guidance to spell out this transition and to sort crypto assets into a five-category taxonomy that separates “digital commodities” from “digital securities.”²

The Howey Prong Decentralization Actually Disables

The Howey test comes from a 1946 Supreme Court case about Florida orange groves and asks four things: was there an investment of money, in a common enterprise, with an expectation of profits, derived from the efforts of others.³ Most token sales easily satisfy the first three. Buyers pay something of value, their fortunes rise and fall together with the project, and they are hoping the price goes up.

The prong that matters for decentralization is the last one. If you buy a token primarily because you expect a development team to build the network, ship features, attract users, and drive the price up, you are expecting profits from someone else’s labor. The Supreme Court was explicit that labels do not matter; calling a token a “utility token” changes nothing if the financial reality is that buyers are counting on a founding team to deliver value. When no identifiable group is doing that essential work anymore, that fourth element collapses, and with it the investment contract classification.

How the SEC Defines a Decentralized Crypto System

The 2026 release picks apart “control” into three flavors, and any one of them being concentrated is a problem. Operational control is the power to change how the system runs: pushing software updates, altering tokenomics, freezing accounts. Economic control is holding enough stake to dominate outcomes. Voting control is the ability to outvote everyone else in governance decisions.¹

The definition is intentionally qualitative. The SEC does not set a specific number of nodes, a minimum Nakamoto coefficient, or a percentage cap on insider token holdings. It asks whether, looking at the whole picture, the network genuinely runs itself.

When a Token Separates From Its Investment Contract

The 2026 interpretation directly addresses a question earlier guidance left vague: a token that was originally sold through an investment contract can later separate from that contract in two circumstances.¹

First, the issuer fulfills the promises it made to investors about building or managing the project. The team can continue to exist afterward without dragging the token back into securities territory, as long as any remaining work is routine rather than the essential effort buyers originally relied on.

Second, the token separates when a reasonable buyer would no longer expect the issuer to deliver on its original promises. That can happen because the team abandoned the project, went silent long enough that the market stopped expecting follow-through, or publicly stepped back. Either path produces the same result: buyers stop relying on a central team, and the Howey analysis fails on its fourth element.

The SEC’s taxonomy makes the destination concrete. A token that clears these hurdles typically lands in the “digital commodities” category, defined as native network tokens whose value comes from programmatic operation and supply-and-demand dynamics rather than a promoter’s efforts. The interpretation names BTC, ETH, SOL, ADA, and XRP among its examples.

Practical Signals Regulators Look For

Because the SEC’s test is qualitative, the working question for developers and investors is what evidence actually persuades a regulator or a court. A consistent set of indicators has emerged.

Governance Authority

Who can change the rules is the single most telling factor. If a founding company or a small insider group can push software updates, alter tokenomics, or freeze accounts without broader community approval, the network is centralized in the way that matters most. Genuine decentralization means governance has been credibly transferred to a broad group of token holders or validators that does not act as a coordinated unit.

Node Distribution

Nodes are the computers that run the network software and validate transactions. Their geographic and institutional diversity is a practical check on control by any single party. A network where most nodes run on one cloud provider, or where the original development company operates them, remains vulnerable to centralized influence regardless of what governance documents say. The working test is whether the network would keep running if the founding team disappeared tomorrow.

Information Symmetry

Mandatory securities disclosures exist because insiders know things outsiders do not; the Securities Exchange Act of 1934 requires quarterly and annual reports for exactly that reason.⁴ When protocol changes are proposed in public repositories, financial data is visible on-chain, and the founding team has no more insight into the system’s future than any other participant, that information gap closes and the rationale for filings fades with it.

Token Concentration

The SEC’s guidance does not set a numeric threshold, but pending legislation offers one. The Financial Innovation and Technology for the 21st Century Act, which passed the House but has not been enacted, would treat a blockchain as decentralized only if no issuer or affiliated person controls 20 percent or more of the tokens or voting power.⁵ That figure is not binding law, but it reflects the direction regulators are moving and gives projects a concrete number to plan around.

What Changes Once a Token Is Sufficiently Decentralized

Reclassification is not cosmetic. It moves an asset out from under the SEC’s disclosure regime and into the CFTC’s narrower jurisdiction over commodities. The 2026 joint interpretation formalized this handoff, with the CFTC agreeing to administer the Commodity Exchange Act consistently with the SEC’s token taxonomy.²

Under CFTC oversight, there are no 10-K filings, no audited financial statements, and no registration requirements for the asset itself. The CFTC’s focus is on fraud and manipulation in the markets where the commodity trades. Its authority over spot commodity markets, however, remains narrower than its authority over derivatives. Congress has considered expanding that authority through legislation like FIT21, but until a bill is signed into law, the CFTC’s enforcement tools for spot digital commodity trading are more limited than what the SEC wields over securities.⁵ If you trade on a platform that is not registered as a futures exchange, the protections you receive may be thinner than you assume.

Airdrops of a Non-Security Token

The interpretation is explicit that a free airdrop of a non-security crypto asset does not create an investment contract, because nobody made an “investment of money.” If you receive tokens without paying cash, handing over other tokens, or performing a service for the issuer, the first Howey element is missing and the analysis stops.¹

The exception is wider than it looks. If the airdrop requires you to follow social media accounts, write posts, refer users, or run bug tests, the SEC views those actions as consideration. That satisfies the investment-of-money prong, and the full Howey analysis applies.

Protocol Staking

Staking on proof-of-stake networks is not a securities transaction under the 2026 interpretation, so long as the arrangement stays within specified boundaries. The dividing line is whether the service provider is performing “essential managerial efforts” or merely handling administrative tasks. Solo staking, custodial staking, and liquid staking all sit outside securities law when the provider does not guarantee reward amounts, does not choose how much to stake without direction, and does not exercise discretion over the staking strategy.¹ Rewards are treated as payment for a service you provide the network, not as profits from someone else’s management. A platform that guarantees a fixed return regardless of actual protocol rewards, or pools tokens and makes discretionary decisions, pushes the arrangement back toward securities territory.

The Proposed Startup Safe Harbor

Decentralization is a process, not a switch, and the SEC has acknowledged the catch-22 that has haunted crypto projects since Howey was first applied to tokens: a network needs broad participation to become decentralized, but distributing tokens to attract that participation can itself trigger securities registration.

In March 2026, SEC Chairman Paul Atkins outlined a proposed startup exemption giving developers up to four years to build toward decentralization while raising up to $5 million. Projects would make principles-based disclosures similar to a white paper, posted on a public website, with notices filed to the SEC when entering and exiting the exemption.⁶ Atkins said the proposal was expected to be released for public comment in the weeks after his remarks. Until it is adopted, it is a signal of direction rather than an available compliance path.

How We Got Here: Hinman and Ripple

The idea of sufficient decentralization first entered the regulatory conversation through a 2018 speech by William Hinman, then the SEC’s Director of the Division of Corporation Finance. He proposed that once a network becomes distributed enough that no central group’s efforts drive value, the token may no longer be an investment contract.⁷ The speech was influential but was framed as his personal views rather than official SEC policy, a caveat that became contested during the Ripple litigation, where FOIA disclosures revealed internal SEC debate over its status.

The Ripple case itself showed how these questions play out in court. A federal judge found that Ripple’s direct sales of XRP to institutional buyers satisfied the Howey test, while anonymous secondary-market purchases on exchanges did not, because those buyers had no direct connection to Ripple’s promises. The case ended in 2025 with Ripple paying roughly $125 million in civil penalties and agreeing to an injunction, after both sides dropped their appeals.⁸ That result left the broader legal question partially unresolved by courts, which is why the SEC’s 2026 interpretation, and its explicit framework for when a token separates from its investment contract, carries the weight it does today.

1
U.S. Securities and Exchange Commission. Application of the Federal Securities Laws to Certain Types of Crypto Assets and Certain Transactions Involving Crypto Assets
2
U.S. Securities and Exchange Commission. SEC Clarifies the Application of Federal Securities Laws to Crypto Assets
3
Justia. SEC v. W.J. Howey Co., 328 U.S. 293 (1946)
4
Legal Information Institute. Securities Exchange Act of 1934
5
Congress.gov. H.R.4763 – Financial Innovation and Technology for the 21st Century Act
6
U.S. Securities and Exchange Commission. Regulation Crypto Assets: A Token Safe Harbor
7
U.S. Securities and Exchange Commission. Digital Asset Transactions: When Howey Met Gary (Plastic)
8
U.S. Securities and Exchange Commission. Ripple Labs, Inc., Bradley Garlinghouse, and Christian A. Larsen