When Are Cryptocurrencies Securities and What Should Be Done?

Last week’s reports that the Securities and Exchange Commission (SEC) is probing whether one of the world’s largest cryptocurrency exchanges is listing unregistered securities once again highlights the unsettled state of crypto regulation in the U.S. It’s high time that policymakers provide clear, practical answers to the perennial questions of whether cryptocurrencies are securities and, if so, what to do about it. In the briefing paper, “Practical Legislation to Support Cryptocurrency Innovation,” released today, Jennifer Schulp and I propose legislative amendments for doing just that. Our framework provides (1) a clear test for whether crypto tokens are securities and (2) a common‐​sense registration option for those that are but whose projects are on the path to decentralization.

Rules for cryptocurrencies should be made to fit the risks that come with them, such as fraud, deception, and manipulation by developers, sellers, or promoters who still run a crypto project. In order to decide if a crypto token is a security, we look at whether the token's creators, sellers, or promoters will be in charge of the project. This test is in line with long-standing precedents (like the often-mentioned Howey test) and the goals of securities laws, which are to protect investors from the risk that managers have information that investors don't and act against their best interests.

We want Congress to make it clear that securities laws do not apply to crypto tokens that are not controlled by a central authority. This means that securities laws wouldn't apply to tokens where the developer, seller, or promoter doesn't promise to do the work needed to deliver the token and its benefits, i.e. act like a manager. For example, this could mean making software or trying to get users or merchants to use it. When developers promise to do these things, the crypto project is centralized, and security measures should be put in place. But if the project can work as planned without the help of managers, it's decentralized, and securities laws don't apply to the sale of its tokens.

Cryptocurrencies want to get rid of the need for centralized bodies that securities laws were made to control. In this way, technology can be used to reduce management risks. But, as SEC Commissioner Hester Peirce put it, the current system has "created a regulatory Catch-22": startup crypto projects may not be decentralized enough to avoid securities laws, but following those laws makes it hard for them to sell tokens to raise money and build the user networks they need to become decentralized over time. Our framework tries to solve this problem by giving decentralized projects a way to register that fits their needs and gives buyers of crypto tokens the information they need.

Importantly, for projects to be able to use the tailored disclosure option, they must be on the way to becoming decentralized. This means they must be building a system with technical features that support decentralized operations, such as an open-source, permissionless, publicly readable, and cryptographically secure distributed ledger that can verify stores or transfers of tokens without the need for middlemen. Projects that qualify can sign up by putting information on a public website that buyers of tokens would find useful,  including:

• who the developers, sellers, and promoters are;
• how many tokens the developers, sellers, and promoters hold;
• relevant technical documents (such as white papers and yellow papers) and marketing materials;
• a link to the project’s public code repository, as well as a block explorer (a tool for searching the project’s transaction history);
• information on how the project will achieve decentralization;
• the protocols for recording and validating transactions and the applicable consensus mechanism;
• the governance mechanism for updating the project’s code;
• any promised benefits of the token; and
• the known or reasonably foreseeable risks of holding the token, including a concise risk statement to be provided during public token sales.

Eligible projects would still have to follow securities law protections against fraud, false statements, and important omissions. This includes misleading disclosures and management efforts that aren't made public. Also, under our plan, developers who make promises on top of those they made when they registered wouldn't be able to use this simplified framework because their new promises create new risks and fail the framework's security test all over again.

The main innovation of cryptocurrencies is that they can reduce risks through decentralized technology. When they do, they shouldn't have to go through extra steps to follow the rules. To encourage projects that use this potential, Congress should come up with a practical way to tell if a project is decentralized and a way for projects on their way there to share information.

==========