Digital Assets and Securities Regulation: Howey, Custody, Exchanges, and Stablecoins

Document type: Article Practice area: Corporate — Securities Jurisdiction: United States (federal and state) Last reviewed: 5 September 2026

The question people ask, and the question that matters

Clients ask: is our token a security?

The question is malformed, and the malformation causes real errors. A token is a data structure. It is not a security or not a security in the way a chair is or is not wooden. What the securities laws reach is a transaction — an offer or sale of a security — and the relevant category, "investment contract," is defined by the circumstances in which an instrument is offered and sold, the expectations it creates, and the relationship between the buyer and whoever is doing something with the money.

The consequence is that the same token can be sold in a transaction that is an investment contract and later traded in transactions that are not, and can move back if the surrounding facts change. Analysis that treats the token as carrying a permanent status will be wrong at least half the time.

The better question is: for each transaction we participate in, what are we selling, to whom, on what representations, and what are they relying on us to do? That question is answerable, and answering it produces the document that actually protects a company.

Verano Labs

Verano Labs is a 40-person company in Austin building a decentralized storage protocol. Dmitri Vasquez-Lindholm is the chief executive; Sadie Okonkwo-Ferreira joined as general counsel eighteen months ago and inherited a plan.

The plan was: raise $22 million by selling tokens to institutional buyers under a simple agreement for future tokens; distribute tokens to early users; list on two exchanges; and use the token as the payment mechanism for storage on the network. The founders' understanding was that because the token had a use — paying for storage — it was a "utility token" and therefore not a security.

That understanding is wrong, and it is the single most common error in this practice. Utility does not answer the question. Orange groves have a use. What made the arrangement in Howey an investment contract was not the absence of oranges; it was the presence of a promoter promising to cultivate them.

The Howey inquiry, done properly

SEC v. W.J. Howey Co., 328 U.S. 293 (1946) construed "investment contract" in Section 2(a)(1) of the Securities Act, 15 U.S.C. § 77b, to mean a contract, transaction, or scheme whereby a person invests money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party. The Court emphasized that the test embodies a flexible rather than a static principle, capable of adaptation to the countless schemes devised by those who seek the use of others' money on the promise of profits.

Courts have since worked the elements as follows.

An investment of money. Broadly construed; it reaches any contribution of value, not only cash. Tokens distributed for free are not obviously within it, though "free" distributions that require the recipient to do something of value for the promoter have been treated as investments.

In a common enterprise. Circuits differ. Some require horizontal commonality — pooling of investor funds with pro rata sharing of profits and losses. Others accept vertical commonality, looking to the relationship between the investor's fortunes and the promoter's efforts or fortunes. In practice, a token sale where proceeds fund a single development effort and all holders' returns depend on that effort satisfies horizontal commonality comfortably.

With a reasonable expectation of profits. United Housing Foundation, Inc. v. Forman, 421 U.S. 837 (1975) is the essential companion case here. Shares in a cooperative housing corporation, called "stock" and carrying voting rights, were held not to be securities, because the purchasers were motivated by the desire to acquire a place to live rather than by an expectation of profits. The Court held that "profits" means either capital appreciation from the development of the initial investment or participation in earnings from the use of investors' funds — and that where a purchaser is motivated by a desire to use or consume the item purchased, the securities laws do not apply.

Forman is the case a token issuer wants, and it is much harder to get to than issuers assume. The question is not whether the token can be consumed; it is what actually motivated purchasers. A token sold at a discount to a future utility price, in quantities far beyond any plausible personal consumption, to buyers who cannot use it because the network does not exist yet, is not being bought to consume.

SEC v. Edwards, 540 U.S. 389 (2004) closed a related escape route, holding that an investment scheme promising a fixed rate of return can be an investment contract. The expectation of profits does not have to be an expectation of variable, market-driven gains.

Derived from the efforts of others. The word "solely" in Howey has been read to mean that the efforts of others must be the undeniably significant ones — the essential managerial efforts affecting the enterprise's failure or success. Some investor effort does not defeat the element.

This is the element that does the work in digital asset analysis, and it is the element that can change over time. Where a small identifiable group develops the protocol, controls the roadmap, holds a large share of the supply, markets the network, and is expected by holders to make the network valuable, the element is satisfied. Where a network is genuinely maintained by a diffuse set of independent participants, no one of whom holders are relying on, the element weakens — and where holders are not looking to any identifiable person's efforts, it may fail.

Two further doctrinal points that matter

The instrument's label is not the answer, in either direction. Landreth Timber Co. v. Landreth, 471 U.S. 681 (1985) held that an instrument bearing the traditional characteristics of stock is a security, and that a Howey-style economic-reality inquiry is unnecessary for such instruments — the sale of 100% of a company's stock is still a securities transaction. The mirror of Landreth is that calling something a "utility token" does not make it one. Substance governs both ways.

Not everything that looks like an investment is a security. Marine Bank v. Weaver, 455 U.S. 551 (1982) held that a federally insured certificate of deposit was not a security, in part because the purchaser was abundantly protected by an alternative regulatory scheme. Reves v. Ernst & Young, 494 U.S. 56 (1990) developed a distinct "family resemblance" test for notes, presuming a note is a security but permitting rebuttal by comparison to a judicially crafted list of exceptions, considering the parties' motivations, the plan of distribution, the reasonable expectations of the investing public, and whether another regulatory scheme reduces risk.

Reves matters for digital assets more than practitioners assume, because a great many arrangements in this market are, functionally, notes: lending programs, yield products, and interest-bearing accounts. Analyzing them under Howey alone is a mistake.

What the answer means for Verano

Okonkwo-Ferreira's analysis broke the plan into four transactions rather than treating "the token" as a single thing.

The institutional raise. Buyers paid $22 million for a right to receive tokens on network launch, in reliance on Verano's development of a protocol that did not yet exist, in quantities no one could consume. Every Howey element is satisfied comfortably. This is a securities offering, and the only questions are which exemption and what the disclosure looks like. Verano used a private placement under Regulation D, sold only to accredited investors, filed the notice, and imposed transfer restrictions.

The user distribution. Tokens given to people who ran storage nodes, in exchange for providing storage. Much stronger facts — the recipients contributed services rather than money, and their motivation is plausibly to use the network. Not free of risk, but a genuinely different transaction.

Exchange listing and secondary trading. Here the analysis is at its most contested. Whether a purchase on an exchange, from an anonymous seller, with no promises made by the issuer to that buyer, is an investment contract is the question the market has been litigating. The elements that are hardest to satisfy in a secondary trade are the common enterprise and the reliance on the issuer's efforts — the buyer has no contract with the issuer and the issuer receives nothing. Reasonable arguments run both ways and the outcome is unsettled. Verano's position was to assume the more conservative answer and to structure accordingly rather than to bet the company on the more favorable one.

Use as payment for storage. Once the network is live and a user buys tokens to pay for storage they actually use, the Forman consumption analysis is at its strongest.

The lesson generalizes. One token, four transactions, four different analyses. A memorandum that says "the VRN token is not a security" is worthless. A memorandum that analyzes each transaction, states the facts relied on, identifies which facts are load-bearing, and says what would change the conclusion is a document that protects the company and its officers.

If it is a security: what follows

Registration or exemption. Section 5 of the Securities Act, 15 U.S.C. § 77e, makes it unlawful to sell a security in interstate commerce unless a registration statement is in effect or an exemption applies. The exemptions in 15 U.S.C. § 77d and the safe harbors in Regulation D are the ordinary route: Rule 506(b) for a private placement without general solicitation, to accredited investors and a limited number of sophisticated non-accredited investors; Rule 506(c) permitting general solicitation but requiring verification of accredited status, not mere self-certification. File the Form D notice. Comply with state notice filings.

Restricted securities and resale. Securities sold in a private placement are restricted, and their resale requires registration or an exemption. This is the point at which token issuers most frequently lose the thread: a token sold under Regulation D and then listed on a public exchange has been resold, and the exemption does not travel with it merely because the asset is fungible and transfers happen on a blockchain. A distribution plan that ignores resale restrictions creates unregistered-distribution exposure for the issuer and its officers.

Disclosure and antifraud. Exemption from registration is not exemption from antifraud liability. Section 10(b) and Rule 10b-5 apply to any purchase or sale of a security. The private placement memorandum, the whitepaper, the website, the founder's conference talk, and the Discord announcement are all statements in connection with the purchase or sale, and they are all actionable if materially false or misleading. Whitepapers are the most under-lawyered disclosure documents in modern finance.

Issuer status obligations. Depending on scale and holder counts, registration and reporting obligations can attach under the Exchange Act. Model this before the cap table becomes unmanageable.

Investment Company Act exposure. An entity holding a portfolio of tokens that are themselves securities can meet the definition of investment company under 15 U.S.C. § 80a-3 — a genuine and frequently overlooked problem for treasury entities, foundations, and funds. And a person advising others about securities for compensation can be an investment adviser under 15 U.S.C. § 80b-2, which reaches some token fund managers who do not think of themselves as advisers.

The intermediary questions, which arise regardless

Whether or not a particular token is a security, anyone who holds, trades, or moves digital assets for other people is operating in a regulated business.

Exchange registration. Section 3(a)(1) of the Exchange Act, 15 U.S.C. § 78c, defines an exchange as an organization, association, or group that constitutes, maintains, or provides a marketplace or facilities for bringing together purchasers and sellers of securities. Section 6 requires registration as a national securities exchange, or operation under an exemption such as an alternative trading system. A platform matching orders in digital asset securities is performing exchange functions, and the technical architecture — order book, automated market maker, smart contract — does not change the functional analysis.

Broker-dealer registration. Section 15(a), 15 U.S.C. § 78o, requires registration for a person engaged in the business of effecting transactions in securities for the account of others. The indicia are familiar: receiving transaction-based compensation, soliciting customers, handling customer funds or securities, advising on the merits. Many businesses in this market perform these functions while describing themselves as software providers.

Custody. Holding customer assets is the highest-risk activity in the sector and the one with the most regulatory surfaces. For registered intermediaries, customer protection and custody rules govern segregation, control locations, and reserve computations. For state-chartered trust companies and limited-purpose charters, state banking law governs. Across all of them, the operative questions are the same: whose assets are these, where are the keys, what happens on insolvency, and can we prove segregation?

The insolvency question deserves emphasis, because several failures have turned on it. A custodial arrangement drafted so that customer assets become property of the custodian's estate — because the terms grant the custodian rights to use, lend, or rehypothecate, or because commingling was permitted in fact — converts customers into unsecured creditors. The terms of service and the operational reality both matter, and they must match.

Transfer agent, clearing agency, and other functions may also be implicated depending on the model.

The commodity side

A token that is not a security is not therefore unregulated.

Section 1a of the Commodity Exchange Act, 7 U.S.C. § 1a, defines "commodity" broadly, and the CFTC's jurisdiction under 7 U.S.C. § 2 extends to transactions in commodity futures, options, and swaps, and to certain leveraged retail commodity transactions. Digital assets that function as commodities fall within that framework when traded in those forms.

Critically, 7 U.S.C. § 9 gives the CFTC antifraud and anti-manipulation authority over spot markets in commodities in interstate commerce, even where it lacks registration jurisdiction over spot trading. The practical result is that a token which is not a security, traded on a spot market that requires no CFTC registration, is nonetheless subject to federal anti-manipulation and antifraud enforcement.

Advise clients accordingly. "It's not a security" is a conclusion about one regulator. It is not a conclusion about whether the conduct is regulated, and companies that treat it as one are surprised by an enforcement posture they thought they had analyzed away.

Money transmission and the Bank Secrecy Act

This is the set of obligations that reaches the largest number of businesses in the sector and receives the least attention from founders.

Federal. The Bank Secrecy Act, 31 U.S.C. § 5311 and following, imposes obligations on financial institutions, a term defined in 31 U.S.C. § 5312 to include money services businesses. A business that accepts and transmits value substituting for currency is generally a money transmitter, which is a money services business, which must register with FinCEN, implement an anti-money-laundering program, and comply with the obligations in 31 U.S.C. § 5318 — a designated compliance officer, policies and procedures, training, independent testing, customer identification, recordkeeping, and suspicious activity reporting.

And the criminal provision. 18 U.S.C. § 1960 makes it a federal crime to conduct, control, manage, supervise, direct, or own an unlicensed money transmitting business — including a business that fails to register with FinCEN or that operates without a required state license, whether or not the defendant knew the registration or licensing requirement existed for the federal registration prong. This is not a civil penalty regime. It is the provision that turns a compliance oversight into an indictment, and it is the reason money transmission analysis should be done before launch rather than after volume.

State. Most states license money transmitters, with their own definitions, thresholds, net worth requirements, surety bonds, permissible investment requirements, and examination regimes. A business operating nationally faces a licensing project measured in years and millions of dollars, and several states have adopted digital-asset-specific frameworks with their own requirements. There is no federal preemption to fall back on.

The practical instruction: determine the money transmission position first, before the securities analysis, because it is more likely to apply, more likely to be criminal, and more likely to take eighteen months to fix.

Stablecoins: what is actually being promised

A stablecoin is a promise, and the legal analysis follows from what the promise is.

Fiat-backed, fully reserved, redeemable at par. The issuer holds reserves and promises redemption on demand. That is functionally a deposit-like or payment instrument, and the questions are: what are the reserves actually invested in; are they segregated and bankruptcy-remote from the issuer; who has a claim on them and in what priority; is redemption a legal right or a discretionary practice; and what disclosure and attestation supports the representation of full backing?

Whether such an instrument is a security is contested and depends on the promises made. Whether the issuer is a money transmitter is much less contested — issuing and redeeming a payment instrument is close to the core of that definition. And a federal framework for payment stablecoin issuance has been the subject of sustained legislative attention; check the current state of the law rather than relying on a description written earlier.

Yield-bearing. An instrument that pays holders a return moves sharply toward Howey and Reves. The return has to come from somewhere, and wherever it comes from, holders are relying on someone's efforts to generate it. Fixed returns do not help, after Edwards.

Algorithmic or crypto-collateralized. Stability maintained by a mechanism rather than by reserves. Holders are relying entirely on the design and management of that mechanism, which is a reliance on the efforts of others. These arrangements have also failed spectacularly, which shapes both the regulatory and the litigation environment.

For any of them, the operative disclosure questions are the same: what backs it, who holds the backing, what is the redemption right, what happens in stress, and who bears the loss. An issuer that cannot answer those in a paragraph should not be issuing.

Halcyon Digital: the intermediary's version of the problem

Verano is an issuer. Most companies in this sector are not; they are intermediaries, and the analysis they need is different.

Halcyon Digital is a 200-person company in Chicago that operates a digital asset trading venue, holds customer assets, and offers a yield product. Its general counsel, Renata Oyelaran-Whitcombe, ran the four questions that matter for an intermediary, in the order that matters.

Question one: are we a money transmitter? Yes, in substance — Halcyon accepts customer value and transmits it. FinCEN registration, an anti-money-laundering program meeting 31 U.S.C. § 5318, customer identification, recordkeeping, and suspicious activity reporting. Then the state licensing project: definitions, thresholds, net worth, surety bonds, permissible investments, and examinations, in every state where customers are. Eighteen months and several million dollars, and it is the workstream that should have started first because of 18 U.S.C. § 1960.

Question two: are we operating an exchange or acting as a broker? Halcyon lists assets. If any listed asset is a security, Halcyon is providing a marketplace bringing together purchasers and sellers of securities under 15 U.S.C. § 78c, which implicates registration under 15 U.S.C. § 78f or operation as an alternative trading system, and Halcyon's order routing and customer handling raise broker-dealer status under 15 U.S.C. § 78o.

The listing committee is therefore a legal function, not a product function. Every listing decision is a decision about whether Halcyon is trading securities. Halcyon's committee requires a written analysis per asset, a named approver, a documented monitoring plan, and a delisting trigger. That structure is the single most consequential thing an intermediary can build.

Question three: what does our custody actually look like? The questions are whose assets, where are the keys, and what happens on insolvency. Halcyon's answers had to be consistent across three documents that were written by three different teams: the customer terms of service, the operational reality of key management and segregation, and the accounting treatment. They were not consistent. Reconciling them took four months, changed the terms in two material respects, and is the work that determines whether customers are owners or unsecured creditors if the company fails.

Question four: what is the yield product? Halcyon offered customers a return on deposited assets. That is a note or an investment contract by almost any reading — customers give value, expect a return, and rely on Halcyon to generate it. Reves supplies the framework for the note analysis, and Edwards forecloses the argument that a fixed rate saves it. Halcyon discontinued the product for retail customers rather than register it, which is the decision most firms in its position have reached.

The sequencing lesson. Halcyon spent its first two years on the securities analysis and its third on money transmission, which is exactly backwards. Money transmission applies more broadly, carries criminal exposure, and takes the longest to remediate. Do it first.

Decentralization, and the honest version of that argument

The most common structural argument in this market is that a network has become sufficiently decentralized that no holder is relying on the efforts of any identifiable person, so the Howey efforts element fails. The argument is real, and it is also the most abused proposition in the sector.

What the argument actually requires. Not a slogan, but a factual showing across several dimensions, each of which is measurable:

Development. Who writes the code? Who merges it? How many independent contributors, from how many organizations, over what period? Is the roadmap published by one entity, or does it emerge from a process no single party controls?

Governance and upgrade authority. Who can change the protocol? Are there admin keys, upgrade keys, or emergency pause functions, and who holds them? A network with a multisignature upgrade key held by the founding team is a network whose holders are relying on that team, whatever the marketing says. Token-weighted governance where the founding entities hold a controlling share is not decentralized governance; it is centralized governance with a voting ceremony.

Token distribution. What share is held by founders, the company, insiders, and early investors, and on what vesting? Concentration is evidence of continuing dependence and of the ability to move the market.

Economics. Does the company still fund development from the treasury? Does it capture value from network activity? Is there a foundation, and is the foundation genuinely independent or a wholly controlled affiliate?

Public communications. This is the dimension companies control entirely and manage worst. Every statement about roadmap, listings, partnerships, burns, buybacks, supply mechanics, or price is evidence that the market looks to the company. A team that has spent two years telling holders what it will build next cannot credibly say holders are not relying on it.

Actual use. What proportion of network activity is genuine third-party utilization rather than speculation, farming, or wash trading? A network with real users is a materially different network.

Three honest cautions to give the client.

Decentralization is not a status you declare; it is a set of facts a fact-finder assesses. There is no filing, no certification, and no safe harbor that makes it so.

It is a spectrum and it can move backwards. A network that reintroduces an upgrade key, or whose development consolidates back into one company after a funding round, has moved back toward reliance.

And the initial sale does not become retroactively lawful. Even a genuinely decentralized network today was, at the time of its token sale, a promise by identifiable people to build something. The analysis of the original transaction is fixed by the facts as they were then. Decentralization affects the analysis of present and future transactions, not past ones — a distinction that has repeatedly surprised issuers who assumed maturity cured the launch.

What a defensible token analysis memorandum looks like

Okonkwo-Ferreira wrote one, and it is the most valuable document Verano produced that year — more valuable than the whitepaper, because it is the document that will be read by a regulator, an acquirer, an underwriter, or a plaintiff's lawyer.

It analyzes transactions, not the token. A separate section for each: institutional sale, user distribution, exchange listing, secondary trading, network use, treasury sales.

It states the facts relied on, specifically. Not "the network is decentralized" but: the number of independent node operators, the distribution of token supply, who controls the code repository and the upgrade keys, who funds development, what the company has said publicly about its plans, and what proportion of network activity is genuine third-party use.

It identifies which facts are load-bearing and says what would change the conclusion. "This analysis depends on the company ceasing to control protocol upgrades by Q3. If that does not occur, the conclusion in Section 4 does not hold."

It addresses the adverse authority and the adverse facts. A memorandum that does not mention the founder's tweet about price is not a memorandum; it is marketing. Regulators and plaintiffs will find the tweet.

It covers all the regimes, not just securities. Money transmission and Bank Secrecy Act status. Commodity-side exposure and § 9 antifraud reach. State licensing. Investment company and adviser status. Tax characterization. Sanctions screening.

It is dated, and it is updated. The analysis is a snapshot of facts that change. A memorandum from three years ago describing a network that has since centralized or decentralized is worse than none, because it documents a conclusion the company can no longer support.

And it is written to be read by someone hostile. That is the standard. Write for the enforcement lawyer, and the document will also serve the acquirer, the exchange listing committee, and the board.

Non-fungible tokens and the collectible problem

A brief word on an asset class that gets analyzed badly in both directions.

A one-off digital artwork sold to a buyer who wants to own it is not obviously an investment contract. The buyer contributed money, but the common enterprise element is weak — there is no pool — and the Forman consumption reasoning has real force where the purchaser's motivation is to hold or display the thing.

But most non-fungible token projects are not that. A collection of ten thousand algorithmically generated items, sold simultaneously at a uniform price, by a team that promises a roadmap, a treasury, future utility, floor-price support, royalty revenue sharing, or a "community" whose value the team will build — that is a promoter raising money from a pool of buyers who expect the promoter's efforts to make their holdings more valuable. Every Howey element is available on those facts, and the fact that each token is technically unique is not responsive to any of them.

The load-bearing facts are the same as everywhere else in this article: what was promised, what buyers were led to expect, whether returns depend on an identifiable person's continuing efforts, and whether the purchase is plausibly consumptive. A project that sells art and delivers art is in a very different position from one that sells art and promises a company.

Two adjacent issues worth flagging. Royalty arrangements enforced by contract or marketplace policy rather than by the token itself create expectations that may not be honored, which is a disclosure problem before it is anything else. And the underlying intellectual property rarely transfers with the token unless someone says so — buyers routinely believe they acquired copyright in the artwork, and they usually did not. Say what is being sold, in the terms, in words a buyer will read.

Where Verano landed, and what it cost to change course

Okonkwo-Ferreira's analysis changed the plan in four respects, and the changes are the useful part of the story.

The institutional raise was restructured. The original plan was a token sale to institutional buyers with a "utility token" characterization and no exemption analysis. It became a private placement of a simple agreement for future tokens under Regulation D, accredited investors only, with verification, a real risk-factor disclosure document, transfer restrictions, and a Form D filing. The raise closed at $19 million rather than $22 million because three prospective buyers declined the restrictions. Vasquez-Lindholm regarded the $3 million as the cheapest insurance the company ever bought.

The distribution plan changed. The original plan listed the token on two exchanges four months after the institutional sale. That would have been a resale of restricted securities into a public market. The revised plan extended lockups, staged the network launch so that genuine third-party use preceded liquidity, and deferred listing.

The communications policy changed most. Verano adopted a rule that nobody at the company — founders included — discusses token price, listings, supply mechanics, burns, or returns, in any forum, ever. That rule cost the company marketing momentum it valued and eliminated the single largest category of evidence that holders were relying on the company's efforts.

And the money transmission analysis came first. Because Verano does not custody customer assets or operate a venue, the answer was comparatively simple — but the answer was reached in month one rather than month twenty, which is the general lesson.

What it cost: about $340,000 in legal fees, four months of delay, and $3 million of forgone raise. What it bought: a documented, dated, transaction-by-transaction analysis that survived diligence in the company's next financing without a single follow-up question, and a set of facts the company can still support.

Okonkwo-Ferreira's own summary: "We did not make the token not a security. We stopped pretending that was the question, and started building a record of the questions we actually had to answer."

The regimes people forget

Six more that reach this sector and that founders reliably discover late.

Sanctions. Blocking obligations apply to transactions with sanctioned persons, jurisdictions, and — significantly for this sector — specifically designated wallet addresses. A business that transmits value must screen counterparties and addresses, and the obligation is strict liability in character: intent is not an element of the prohibition. Screening, blocking, rejecting, and reporting are operational requirements, and the enforcement record in this sector is substantial.

Tax. Digital assets are treated as property for federal income tax purposes, which means every disposition is a realization event and every payment in tokens is a barter transaction with a fair market value. Token issuances to service providers raise compensation and timing questions. Staking rewards, airdrops, forks, and lending returns each have their own characterization issues, some unsettled. And broker reporting obligations for digital asset transactions are a live and evolving area — check the current requirements rather than a description from a prior year.

Consumer protection. FTC Act § 5 reaches unfair and deceptive practices, and state consumer protection statutes reach further. Marketing claims about returns, safety, insurance, and backing are the exposure. So is the gap between what a terms of service says about customer assets and what customers were told in advertising.

Commodity Exchange Act retail rules. Leveraged, margined, or financed retail commodity transactions are subject to their own framework unless actual delivery occurs within a defined period. Many "margin trading" offerings in this market sit inside that framework without their operators realizing it.

Bankruptcy and creditor law. Rehypothecation rights, commingling, and terms granting the custodian use of customer assets determine whether customers are owners or unsecured creditors. This analysis should be done at the drafting stage, by someone who has actually litigated an insolvency, not at the point of failure.

State securities regulation. Blue sky laws apply independently of federal law, with their own registration and exemption structures and their own enforcement staffs. Several state regulators have been considerably more active in this sector than their federal counterparts, and a company that has cleared the federal analysis has cleared half the problem.

What to tell the client

One: the question is about transactions, not tokens. The same asset can be sold in a securities transaction on Monday and traded in a non-securities transaction on Tuesday. Analyze each.

Two: "utility" is not an answer. Forman turns on what actually motivated purchasers, and buyers who cannot use a product that does not exist are not consumers.

Three: not a security does not mean not regulated. Section 9 of the Commodity Exchange Act reaches spot market fraud and manipulation, and the money transmission regime reaches almost everyone who moves value for others.

Four: money transmission first. It is more likely to apply than the securities analysis, it is criminal under 18 U.S.C. § 1960, and state licensing takes years.

Five: if you custody, the insolvency analysis is the whole ballgame. Whose assets, where are the keys, what do the terms say, and does the operational reality match them.

Six: write the memorandum. Not for the conclusion — for the discipline of assembling the facts, and for the record it creates that the company thought seriously before it acted. Every enforcement action in this sector reads better for the company that has one.