Read all 402 pages and the Commission tells you what it thinks this rule is for. Not in the summary, where it talks about capital formation. In the Paperwork Reduction Act tables, where it has to put numbers on how often each provision will be used.
It expects 99 issuers a year under the startup exemption and 31 offerings a year under the fundraising exemption. One hundred and thirty issuers raising money.
It expects 475 issuers a year to file a Form TR under Rule 400(b), the investment contract safe harbor. Four hundred and seventy-five issuers taking a crypto asset out of the securities laws.
By its own arithmetic the Commission expects Regulation Crypto Assets to be used as an exit roughly three and a half times more often than as an offering regime. Everything else in the release follows from reading it that way.
Five findings from the text:
Tier 1 is $20 million on unaudited financial statements, and no state regulator will ever look at it. Under Rule 300(a) the fundraising exemption has two tiers on Regulation A's limits. Tier 1 permits $20 million in a 12-month period, and for Tier 1 offerings there is no financial statement assurance requirement. The statements are US GAAP but need not follow Regulation S-X, and an issuer that does not obtain an audit must label them unaudited. Regulation A has exactly this tier. What Regulation A also has is state review of it: the release's own citation to Lindeen v. SEC describes the Commission's preemption as applying to Tier 2 Regulation A offerings. Subpart E of this proposal preempts both tiers. The bargain that made an unaudited $20 million offering tolerable in 2015 was that fifty state securities regulators could still qualify it. That half of the bargain is not carried across.
Tier 2's audit may be GAAS or PCAOB, and this is now on the record. The financial statements in a Tier 2 offering must be audited in accordance with either US GAAS or the standards of the PCAOB, by an auditor independent under Rule 2-01 of Regulation S-X, with the report complying with Article 2. No PCAOB registration requirement appears. The latitude is real and it is the most consequential line in the financial statement article. One word, audited, covers two different systems of oversight, and the section below on vocabulary sets out how far apart they are.
The safe harbor is a certification with an analysis attached, not a bare assertion. Rule 400(b) requires the issuer to file a Form TR containing a certification that it has satisfied Rule 400(a) and an analysis supporting that certification, clear and detailed enough for a reasonable investor to follow. Nobody examines it. But the release preserves two checks a bare certification would not have, and request for comment 130 asks whether to drop the analysis and accept the certification alone. That question deserves an answer from people who do this work.
The Commission saw the gap and filled it with disclosure. In the reasonable alternatives the Commission explains why Tier 1 issuers must file ongoing reports when Regulation A Tier 1 issuers need not, and the third reason it gives is that "the proposed preemption of State registration and qualification requirements would apply to Tier 1 offerings as well, which supports providing investors with ongoing disclosures." It noticed exactly the asymmetry described above and answered it. It answered it with more reporting. Across the whole reasonable alternatives section for the fundraising exemption, the two alternatives weighed are the levels of periodic reporting and the offering limits. No alternative touching the assurance level of either tier appears.
Airdrops count, and small entities get no relief. Two things the rule text settles. A covered transaction under the startup exemption expressly includes transactions "referred to as 'airdrops'" made in exchange for, in recognition of, or as incentive for past or future use of a network, so an airdrop consumes the $5 million ceiling. And the regulatory flexibility analysis, which expects at least 89 small entities a year, considered exempting small entities from all or part of the requirements and declined: because small entities are more likely to have relatively high information asymmetries, their investors have a particular need for the information. The Commission is willing to hold small issuers to disclosure. It is the assurance lever it never reaches for.
The three pathways
The three pathways as the release describes them. The one solid box is the only place an auditor is required.
PROPOSED. Not law. Comments due 60 days after publication in the Federal Register. Nothing in this file describes an obligation that currently binds anyone.
| Pathway | Ceiling | Financial statements | Ongoing reporting | Assurance |
|---|---|---|---|---|
| Startup exemptionRule 200, proposed 17 CFR 228.200, Subpart B | $5,000,000aggregate offering price plus gross proceeds from all prior and current covered transactions | None. The release states the startup exemption does not require disclosure of financial information or narrative disclosure of the issuer's financial condition in a Commission filing. | No periodic reports. A transition report on Form TR no later than four years after the notice of reliance is filed. | no practitioner |
| Fundraising exemptionRules 300 through 307, proposed 17 CFR 228.300-307, Subpart C | $20M (Tier 1) / $75M (Tier 2)during each 12-month period, issuer and affiliates aggregated | US GAAP, both tiers. Tier 1: no assurance requirement, not required to follow Regulation S-X, and must be labelled unaudited. Tier 2: audited under either US GAAS or PCAOB standards by an auditor independent under Rule 2-01 of Regulation S-X, report complying with Article 2, statements following Article 8 as if a smaller reporting company. | Both tiers. Annual on Form 1-KC, semiannual on 1-SC, current on 1-UC, and a transition report on Form TR. Regulation A imposes ongoing reporting on Tier 2 only. | T1 none / T2 audited |
| Investment contract safe harborRule 400, proposed 17 CFR 228.400, Subpart D | not a capital-raising pathwayn/a | None. | Filing the Form TR terminates the issuer's ongoing reporting obligation, because there is no longer a covered investment contract. | self-certified |
no practitioner Startup exemption Rule 200, proposed 17 CFR 228.200, Subpart B
No practitioner appears anywhere in this pathway, and the release states it as a design choice rather than an omission: burdens are kept commensurate with the $5 million limit and the four-year duration, and the justification would be undermined if the duration were extended. The only attestation-shaped object is the issuer's own certification on Form NOR that the information is true, complete and correct and that it intends to fulfil, within four years, the essential managerial efforts it promised.
Rule 200(b) sets six conditions: four-year duration running from the notice of reliance; issuer eligibility, which permits an entity, an individual, or a group of individuals or entities; one-time use per subject crypto asset or a substantially similar asset, applying to affiliates as well; the $5 million offering limit; the disclosure and filing requirements of Rule 200(c), (d) and (e); and the general conditions of Subpart A including the Rule 104 bad actor disqualification.
Release pages 75-88 · document-verified
T1 none / T2 audited Fundraising exemption Rules 300 through 307, proposed 17 CFR 228.300-307, Subpart C
The whole assurance question in the package lives here, and it splits. Tier 1 at $20 million carries financial statements with no assurance requirement at all: no auditor, no Regulation S-X, and a required label saying unaudited. Tier 2 at $75 million must be audited under either US GAAS or the standards of the PCAOB. The Commission states the proposed assurance provisions are the same as the assurance requirements in Regulation A. If a Tier 1 issuer obtains an audit voluntarily it must file it, and there the auditor may be independent under either the AICPA standards or Rule 2-01, a looser independence test than Tier 2 requires.
Issuer must be an entity organised under US law, with a majority of executive officers or directors who are US citizens or residents, more than half its assets in the United States, and its business administered principally in the United States. Blank-check and development stage companies without a business plan, registered investment companies and business development companies, and issuers subject to a section 12(j) order within five years are excluded. Non-accredited purchasers are capped at 10 percent of the greater of annual income or net worth, and unlike Regulation A that limit applies to both tiers with no carveout for exchange-listed offerings.
Release pages 104-139 · document-verified
self-certified Investment contract safe harbor Rule 400, proposed 17 CFR 228.400, Subpart D
Rule 400(a) requires that the issuer has completed or permanently ceased all essential managerial efforts it represented or promised, and is not making and does not intend to make new ones. Rule 400(b) requires the Form TR certification and a supporting analysis, filed publicly. No practitioner examines any of it. The release preserves two checks that a bare certification would not have: the Commission is not precluded from challenging whether the conditions were in fact satisfied, including where an issuer misrepresents intentionally or otherwise, and the safe harbor governs only the Commission's administration of the securities laws, so private parties may still assert that a crypto asset is subject to an investment contract. Request for comment 130 asks whether the supporting analysis should be dropped and a bare certification accepted instead.
Non-exclusive, and available to any issuer meeting the conditions, including issuers that never used either exemption.
Release pages 162-170 · document-verified
What the Commission expects to happen
The Commission's own estimates of how often each pathway will be used.
The 475 is not a criticism. A safe harbor that nobody used would be a failed safe harbor, and the ten years of litigation this replaces were worse for everyone than a filing. It is a statement about what the rule mostly is. A regime whose busiest provision is the one that ends regulation is a deregulatory instrument with an offering regime attached, and it should be read and commented on as one.
Two further numbers make the point sharper. The startup exemption is estimated at 56 burden hours per issuer. The fundraising exemption is estimated at 1,510 burden hours per offering, twenty-seven times as much. At the $635 hourly rate the Commission applies in its own totals that is roughly $35,560 against roughly $959,000. The cheap path is the one with no financial statements, and it is the one the Commission expects to be used three times more often than the expensive one.
And the ledger itself: monetized costs of $42,766,883 a year, $310 to $370 million in present value over ten years, against monetized benefits reported as not applicable at both discount rates. That is ordinary in rulemaking, and the release says plainly that there are benefits it cannot monetize. It is still the shape of the quantified record. As a footnote to the same numbers, $42.8 million sits below the $100 million line that would make this a major rule under the Congressional Review Act, and the Commission asks for data on whether a final rule would cross it.
Which pathway, and what will nobody check
The rule has real eligibility conditions, and they are checkable. This walks the ones written in the release and ends where a checklist never does: on the assertions that, if you take the path, nobody is required to examine.
A reading aid for a proposed rule, not advice, and it determines nothing. Regulation Crypto Assets is a proposal; comments are due 60 days after Federal Register publication and the rule that emerges, if one does, can differ from the rule proposed. Every answer below cites the release page the condition was read on, and every available pathway ends by naming what nobody is required to examine.
Pathways still open
0 of 7 answered
The rules behind the tool
The whole rule set, so the tool is auditable rather than a black box. This is also what renders with JavaScript off and what prints. The evaluation is one pure function, and a set of pinned scenarios fails the site build if any outcome below moves.
| The question | Options | Why it gates | Release pages |
|---|---|---|---|
| Is a crypto asset the only asset subject to the investment contract, and is that crypto asset not itself a security? |
| Regulation Crypto Assets reaches only a covered investment contract, which the rule text defines with three requirements: a crypto asset is subject to the investment contract, that crypto asset is not itself a security, and no asset other than that crypto asset is subject to it. Bundle a token with a share of stock and the definition fails. | 322-323 |
| How much are you raising in a 12-month period, counting airdrops? |
| The rule text makes airdrops covered transactions when made in exchange for, in recognition of, or as an incentive for past or future use of the network, so they consume the ceiling. The startup exemption's $5 million limit is an aggregate across the whole four-year period and counts prior covered transactions. | 107-108, 323 |
| What is the issuer? |
| The startup exemption permits an entity, an individual, or a group of individuals or entities, because early teams often have not formed one. The fundraising exemption requires an entity organized under US law, which the release ties to the reporting entity concept in US GAAP. | 80-81, 110-113 |
| Are a majority of officers or directors US citizens or residents, are more than half the assets in the US, and is the business administered principally in the US? |
| Three further conditions on the fundraising exemption, drawn from part of the definition of foreign private issuer. They do not apply to the startup exemption. | 110-113 |
| Have you or an affiliate already relied on the startup exemption for this crypto asset, or a substantially similar one? |
| The startup exemption is available once per subject crypto asset, and the limitation reaches affiliates. | 75-88 |
| Any bad-actor disqualifying event, a section 12(j) order in the last five years, or is the issuer a blank-check company, a registered investment company or a BDC? |
| Rule 104 carries Regulation A's Rule 262 disqualification standard into both exemptions, and the fundraising exemption separately excludes development-stage companies with no business plan, registered investment companies, business development companies, and issuers subject to a section 12(j) order within five years before filing. | 67-71, 110-111 |
| Have you completed or permanently ceased all essential managerial efforts you represented or promised, with no intention of making new ones? |
| This is the whole of Rule 400(a). The safe harbor is available to any issuer meeting it, including issuers that never used either exemption. | 164-166 |
What each pathway needs
| Pathway | Opens when | Release pages |
|---|---|---|
| Startup exemptionRule 200 | Covered investment contract, raising no more than $5 million aggregate over four years counting airdrops and prior covered transactions, first use for this crypto asset including by affiliates, not disqualified under Rule 104. The issuer may be an entity, an individual, or a group. | 75-88 |
| Fundraising exemption, Tier 1Rules 300-307 | Covered investment contract, raising no more than $20 million in 12 months, issuer is an entity organized under US law meeting the three US nexus conditions, not disqualified and not an excluded issuer type. | 107-113 |
| Fundraising exemption, Tier 2Rules 300-307 | The Tier 1 conditions, with a ceiling of $75 million in 12 months. An issuer raising less may elect into this tier and its audit requirement. | 107-113 |
| Investment contract safe harborRule 400 | Covered investment contract, all essential managerial efforts represented or promised completed or permanently ceased, with no intention of making new ones. Available whether or not either exemption was used. | 164-166 |
The vocabulary this turns on
Four terms do most of the work in what follows, and two of them are used interchangeably in coverage of this rule although they are not the same thing. If you already work in assurance, skip to the next section.
US GAAP, Generally Accepted Accounting Principles, is the accounting rulebook: how the numbers are prepared, what counts as revenue, how an asset is measured. It is set by the Financial Accounting Standards Board. Both tiers of the fundraising exemption require GAAP statements.
US GAAS, Generally Accepted Auditing Standards, is an auditing rulebook: how an independent accountant examines those numbers and what they must do before signing. It is set by the Auditing Standards Board of the AICPA, the accounting profession's own body. This is the standard under which private company audits are performed.
PCAOB standards are the other auditing rulebook, set by the Public Company Accounting Oversight Board, which Congress created in the Sarbanes-Oxley Act of 2002 after Enron and WorldCom. Firms auditing public companies must register with the Board and submit to its inspections of their completed work.
So GAAP governs the statements. GAAS and PCAOB standards are two different rulebooks for the audit of those statements, and the choice between them is not cosmetic:
| Audit under US GAAS | Audit under PCAOB standards | |
|---|---|---|
| Standards set by | The accounting profession, through the AICPA | A federal oversight board created by statute |
| Firm must register with a federal regulator | No | Yes |
| Firm's completed audits inspected by that regulator | No | Yes, on a recurring cycle |
| Ordinarily used for | Private company audits | Public company audits |
Both produce a document headed with the word "audit" and an opinion in recognisable language. Only one of them sits inside a federal inspection regime. When a rule says financial statements must be "audited" without saying which rulebook applies, it has not yet said how much the word is worth.
Which of the two applies is not a free choice, and it is worth knowing why the proposal lands where it does. PCAOB registration attaches to a firm because of who it audits: the obligation runs to firms auditing an issuer as Sarbanes-Oxley uses that term, which is a matter of Exchange Act filer status rather than of size or of anyone's preference. An offering made under an exemption does not confer that status. A Regulation A offering statement is qualified, not declared effective, and Regulation A's ongoing reports are filed under Regulation A rather than under the Exchange Act, so a Tier 2 issuer does not become a Sarbanes-Oxley issuer by using the exemption. That is the whole reason Tier 2 can accept a GAAS audit from a firm that is not registered with the Board, and it is why the one carve-out in Regulation A is an issuer that simultaneously lists on a national securities exchange: listing brings Exchange Act registration, which brings the status, which brings the Board.
Read Regulation Crypto Assets against that and the assurance level is not a drafting choice the Commission made loosely. It follows from building the regime as an exemption. The release reinforces it from the other direction by stating its view that covered investment contracts are not equity securities and therefore sit outside Exchange Act section 12(g), and asking whether to codify that. So the honest way to put the finding is not that the Commission was careless with the word audited. It is that choosing an exemption chooses the lighter audit regime along with it, automatically and without the release ever having to argue for it.
Regulation S-X is the SEC's own rulebook on the form and content of financial statements filed with it. Four parts of it appear below. Article 8 is the scaled-down version for smaller reporting companies. Article 2 governs the accountant's report and qualifications. Rule 2-01 is the SEC's auditor independence standard, which is stricter than the AICPA's on several points, notably around non-audit services and relationships with the client. Rule 2-02 governs what the accountant's report must contain.
One further distinction matters because the proposal skips a rung. Assurance is a ladder, not a switch:
- No assurance. Management prepares the statements and nobody outside the company examines them. The reader has the company's word.
- A compilation. An accountant assembles the statements into proper form and expressly provides no assurance on them.
- A review. An accountant performs limited procedures, mostly enquiry and analysis, and reports limited assurance: nothing came to their attention suggesting the statements are materially misstated. Substantially cheaper than an audit.
- An audit. The accountant gathers evidence sufficient to express reasonable assurance and issues an opinion on whether the statements are fairly presented. The highest rung, and the most expensive.
Regulation Crowdfunding uses three of those four rungs, stepping up with offering size. The proposal uses two: nothing, and audit. There is no review tier anywhere in it.
The rung that lost its counterweight
Regulation A's two-tier design is a deliberate trade, and it has been argued over for a decade.
Tier 1 lets an issuer raise $20 million with unaudited financial statements. That is genuinely light. The reason it survived is that Tier 1 issuers still go through state securities regulators, who review and qualify the offering under their own merit standards. The federal government does not demand an audit; the states get to ask their own questions. Tier 2 makes the opposite trade: audited statements, ongoing reporting, and preemption of state law. The release cites Lindeen v. SEC on exactly this point, describing the Commission's preemption as reaching Tier 2 offerings, and quotes the legislative history of NSMIA saying states should generally retain authority over small, regional or intrastate offerings.
Regulation Crypto Assets takes Tier 1's number, takes Tier 1's absence of assurance, and gives it Tier 2's preemption.
The Commission's reasoning for that is stated and it is not unreasonable. Crypto offerings are not regional or intrastate: as the release puts it, activity in digital asset markets is often borderless, source code is public in all fifty states at once, and state-by-state qualification of an asset whose information cannot be confined to one geography is inefficient. Fair enough. But look at how the release then justifies the preemption. It lists the investor protections that "could address potential concerns that may arise as a result of the preemption of State securities laws." One of them is:
Financial statement disclosure and assurance requirements under the fundraising exemption
That protection does not exist in Tier 1. The assurance requirement is precisely what Tier 1 does not have. The list is offered for the exemption as a whole, and for Tier 2 every item on it is real. For a $20 million Tier 1 offering, the item is not.
To be fair to the proposal, the same list contains two things Regulation A does not give Tier 1 investors, and they are real additions:
Ongoing reporting applies to both tiers. Regulation A Tier 1 issuers file nothing after the offering. Here, both tiers file annual, semiannual and current reports.
Investment limits apply to both tiers. A non-accredited purchaser may not pay more than 10 percent of the greater of annual income or net worth. Regulation A applies that limit to Tier 2 only, and carves out exchange-listed offerings; this proposal has no such carveout. That is a genuine strengthening.
So the honest accounting is not that the Commission has been careless. It is that it moved three levers at once, tightened two, loosened one, and the one it loosened is the one nobody outside the audit profession will notice.
The pairing at $20 million is the finding. Same ceiling, same assurance rung, one fewer party looking.
What the economic analysis concedes, and what it costs
The economic analysis is where a proposal argues with itself, and this one argues honestly.
On preemption it concedes the point without hedging. The Commission recognizes that preemption "may remove an additional layer of investor protection provided by their review process," including protections arising from state regulators' own resources in detecting fraud and facilitating issuer compliance, and notes that merit-based review by some states "may, in some cases, provide a level of investor protection different from the disclosure-based review undertaken by Commission staff." A footnote balances that against the academic argument that merit regulation is paternalistic. Both sides are on the page.
It also prices what preemption removes. The Commission has no updated data, but cites a prior rulemaking estimate that an issuer registering in all fifty states would incur $80,000 to $100,000 in legal fees, across what it counts as 54 US jurisdictions including the District of Columbia and the territories. It cites a 2012 GAO report finding that state compliance was among the reasons the original Regulation A went unused. Those are real costs, and a $20 million issuer paying a hundred thousand dollars for fifty reviews is a defensible thing to want to fix.
Then there is the number I did not expect to find. The estimated cost of filing a Form TR to take a crypto asset outside the federal securities laws under the safe harbor is $19,431 per issuer, being 30.6 burden hours at $635 an hour. For an issuer that already filed a Form TR under one of the exemptions, there is no incremental cost at all. The exit from the securities laws is cheaper than a Tier 2 audit, and for some issuers it is free.
What the alternatives section weighs is instructive. For the fundraising exemption the Commission considered two things: whether Tier 1 should have ongoing reporting, and whether the Tier 2 ceiling should be $50 million or $150 million rather than $75 million. It considered making the securities restricted and rejected it on liquidity and network-effect grounds. It considered a one-year insider lockup, cited evidence that ICOs have lower failure rates when insiders are locked up, and chose disclosure of whether a restriction exists instead. It considered a time limit on the safe harbor and an express functionality-and-decentralization test with a supporting analysis, and rejected both.
Every one of those is a real alternative, seriously weighed. None of them is about assurance. The word does not appear as an alternative for either tier in the section as supplied.
There is one moment where the release comes close to contemplating a third party. Discussing the decentralization alternative it notes that issuers "may need to retain the services of legal and technical professionals to verify that they meet the conditions of the safe harbor." That is a professional retained by the issuer, for the issuer's own comfort, reporting to nobody. It is the shape of an examination without any of its properties.
The safe harbor, stated precisely
The safe harbor is easy to describe as a bare self-certification. Rule 400 is more than that, and the difference matters.
Rule 400(a) requires that the issuer has completed or otherwise permanently ceased all essential managerial efforts it represented or promised under the covered investment contract, and is not making and does not intend to make any new such representations.
Rule 400(b) requires a transition report on Form TR, filed on EDGAR, containing issuer identification, a description sufficient to identify the security and asset, a certification that Rule 400(a) is satisfied, and an analysis supporting that certification. The release says the analysis should be clear and detailed enough that a reasonable investor could understand how the issuer reached its determination, and that the issuer would be expected to refer to its Rule 103(b)(1) progress disclosure in making it.
And the safe harbor is bounded in two ways worth stating plainly, because they are the difference between a safe harbor and a trapdoor:
The Commission is not precluded from challenging it. If an issuer misrepresents satisfaction of the Rule 400(a) conditions, "either intentionally or otherwise," the Commission may take the position that the covered investment contract has not ceased to exist and the securities laws continue to apply. Not negligence-proofed, not a one-way ratchet.
Private parties keep their claims. The safe harbor controls the Commission's administration of the federal securities laws. It "would not prevent other parties from asserting that a crypto asset is subject to an investment contract."
So the accurate picture is: a public, dated, signed determination with reasoning attached, no practitioner anywhere near it, and two channels through which it can later be tested adversarially rather than professionally.
That is a defensible design. It is also worth noticing that request for comment 130 asks whether even the analysis should go:
Should Form TR require issuers to include an analysis supporting their determination with respect to the proposed condition in Rule 400(a)? Alternatively, should we allow issuers to certify that they have made this determination without requiring them to include any analysis?
The difference between those two options is the difference between a document a court can read and a checkbox. Anyone who has ever had to reconstruct a determination years after the fact should file on that question.
Three of four rows carry an assertion with nothing examining it.
What the release says
Read from the proposing release, with the page each was read on. Dataset 1.1.0, compiled 2026-08-18.
Release Nos. 33-11434 and 34-106150, File No. S7-2026-27, RIN 3235-AN38. Amendments to or additions in 17 CFR Parts 200, 201, 228, 230, 232 and 239. Regulation Crypto Assets would be codified as a new 17 CFR part 228, Rules 100 through 500.
Release pages 1, 3-4, 32 · document-verified
The regime's scoping term. A covered investment contract is a contract, transaction or scheme that constitutes an investment contract, provided that a crypto asset is subject to it, that crypto asset is not itself a security, and no asset other than that crypto asset is subject to it. The security being offered is the covered investment contract, not the crypto asset.
Release pages 8 note 4, 36-37, 39 · document-verified
Crypto asset means any digital representation of value recorded on a cryptographically-secured distributed ledger. The release states this definition is identical to the definition of Digital Asset in section 2(6) of the GENIUS Act, Pub. L. 119-27, 139 Stat. 419, enacted 18 July 2025.
Release pages 8 note 3, 38 note 122 · document-verified
Covered investment contracts sold under either exemption would not be restricted securities. Absent a contractual holding period, purchasers could sell immediately upon acquisition. The startup exemption would also not limit sales to retail investors and would permit general solicitation. The release is explicit that these features are intended to avoid impeding network effects.
Release pages 60, 75 note 194 · document-verified
The release expresses the view that covered investment contracts are not equity securities and therefore are not subject to Exchange Act section 12(g), and asks whether to codify that view.
Release pages 84 request for comment 45 · document-verified
Subpart E would define qualified purchaser for purposes of Securities Act section 18(b)(3) so that State securities law registration and qualification requirements are preempted for offers and sales under a Regulation Crypto Assets exemption, and for certain secondary market transactions in those covered investment contracts.
Release pages 31 · document-verified
Six new forms: Form 1-CRYPTO, the offering statement, at 17 CFR 239.600; Forms 1-KC, 1-SC and 1-UC, the periodic and current reports, at 239.601 through 603; Form TR, the transition report, at 239.604; and Form NOR, the notice of reliance for the startup exemption, at 239.605.
Release pages 3-4, 34 · document-verified
Form NOR must be filed publicly on EDGAR before any covered transaction and carries a certification that the information is true, complete and correct and that the issuer intends to fulfil, within four years of filing, the essential managerial efforts it represented or promised to investors. Filing starts the four-year clock.
Release pages 86-87 · document-verified
Under Rule 200(b)(2) the issuer may be an entity, an individual, or a group of individuals or entities, each member signing the notice of reliance and transition report and being responsible individually and collectively for the conditions. The release explains that early-stage teams may not have formed an entity.
Release pages 80-81 · document-verified
Rule 103(b) covers non-financial narrative information across ten topics: the covered investment contract; the offering; the subject crypto asset; management, related persons and conflicts; the associated network or application and plan of development; security and source code; the subject crypto asset's economics and allocation; governance; its ecosystem; and risk factors. Requirements are principles-based rather than line-item.
Release pages 54 · document-verified
Rule 103(b)(1) requires the issuer to describe its representations or promises to engage in essential managerial efforts and its progress with respect to them. The release states the Commission expects issuers may refer to this disclosure in determining whether they have satisfied the conditions of the investment contract safe harbor, including for their transition report obligations.
Release pages 55-56 · document-verified
The proposal builds on the Commission's interpretation of how the federal securities laws apply to certain crypto assets and transactions, Release No. 33-11412, 17 March 2026, published at 91 FR 13714 on 23 March 2026, referred to throughout as the 2026 Interpretation.
Release pages 9 note 9 · document-verified
Rule 102 would adjust the offering limits for inflation on an ongoing, predetermined basis by reference to the Consumer Price Index for All Urban Consumers, periodically but no less than once every five years, without notice-and-comment rulemaking each time.
Release pages 32, 49 requests for comment 22-25 · document-verified
Comments are due 60 days after publication in the Federal Register. Submissions reference File No. S7-2026-27.
Release pages 2 · document-verified
Where consideration is not cash, the offering limit is measured on fair value as determined by an accepted standard. Request for comment 10 asks whether the Commission should require a standard for determining fair value, whether it should be US GAAP, and whether the rule should list permitted standards. The Commission is asking the measurement-standard question rather than answering it.
Release pages 35, 41 request for comment 10 · document-verified
The CLARITY Act, H.R. 3633, is cited in the release as draft legislation and as the source of an alternative three-year duration that the Commission considered and declined in favour of four years. Its mature blockchain self-certification, under which the Commission has 60 days to contest a rebuttable presumption, belongs to that bill and not to this proposal.
Release pages 80 note 202 · document-verified
Recorded explicitly because a bill's mechanism was nearly attributed to the rule during the version 1.0 research, and describing a proposal as law is the most common failure in this genre.
Rule 300(a) sets two tiers on Regulation A's limits. Tier 1 permits up to $20 million in a 12-month period including no more than $6 million from affiliate selling securityholders; Tier 2 permits up to $75 million including no more than $22.5 million from affiliates. The release states that a key difference between the two tiers is that for Tier 1 offerings there is no financial statement assurance requirement. Rule 300(a)(3) also caps selling securityholder participation at 30 percent of the aggregate offering price in an issuer's first offering and in offerings qualified within a year of it.
Release pages 107-108 · document-verified
Subpart E would preempt state registration and qualification for offers and sales under any Regulation Crypto Assets exemption, and for secondary market transactions by any person other than an issuer, underwriter or dealer. Secondary market preemption reaches contracts initially sold under a Regulation Crypto Assets exemption or another federal exemption, and continues only for the period during which the issuer keeps satisfying the disclosure, filing and periodic reporting requirements. States retain fraud and deceit enforcement, notice filings and fees, and the power to suspend for failure to file or pay under section 18(c).
Release pages 170-175 · document-verified
The release lists the investor protections it says could address concerns arising from preemption. One of them is the financial statement disclosure and assurance requirements under the fundraising exemption. That protection does not reach Tier 1, which has no assurance requirement, and Tier 1 is preempted all the same.
Release pages 174-175 · document-verified
Non-accredited purchasers may not pay more than 10 percent of the greater of their annual income or net worth, or for non-natural persons the greater of revenue or net assets. Unlike Regulation A, the limit applies to both tiers and there is no carveout for offerings listed on a national exchange. The issuer may rely on the purchaser's representation unless it knows it to be untrue.
Release pages 116-117 · document-verified
The safe harbor is non-exclusive and governs only the Commission's administration of the federal securities laws. The Commission is not precluded from challenging whether an issuer satisfied the conditions, including where the Form TR misrepresents them intentionally or otherwise, and other parties are not prevented from asserting that a crypto asset is subject to an investment contract.
Release pages 167-168 · document-verified
The Commission addressed the Tier 1 asymmetry directly, and chose disclosure rather than assurance to answer it. In the reasonable alternatives it explains why Tier 1 issuers get ongoing reporting when Regulation A Tier 1 issuers do not: it does not anticipate that Tier 1 offerings under the proposed rule will be more local than Tier 2 offerings, it does anticipate secondary markets in Tier 1 securities, and, lastly, the proposed preemption of State registration and qualification requirements would apply to Tier 1 offerings as well, which supports providing investors with ongoing disclosures. The loss of state review is named as a reason to require more reporting.
Release pages 273-274 · document-verified
The reasonable alternatives considered for the fundraising exemption are two: the levels of periodic reporting for Tier 1 against Tier 2, and the offering limits, where the Commission weighs a $50 million and a $150 million Tier 2 ceiling. No alternative addressing the assurance level of either tier appears in that section. The Commission asked whether Tier 1 should report more; the record in these pages does not show it asking whether Tier 1 should be reviewed or audited.
Release pages 273-275 · document-verified
Asserted from its absence across the reasonable alternatives section as supplied, not from a statement that no such alternative was considered.
The economic analysis concedes the point plainly: the Commission recognizes that preemption may remove an additional layer of investor protection provided by the State review process, including protections arising from State regulators' resources in detecting fraud and facilitating compliance, and notes that merit-based review by some States may provide a level of investor protection different from the Commission's disclosure-based review. A footnote balances this against academic criticism of merit regulation as paternalistic.
Release pages 259-260 · document-verified
Where the economic analysis lists the investor protection requirements that could mitigate a higher cost of capital from preemption, it names public disclosure including ongoing periodic reporting, investment limits, offering limits, the four-year duration under the startup exemption, issuer eligibility requirements, and disqualification provisions. Assurance does not appear on that list, although it does appear on the corresponding list in the legal discussion at pages 174 to 175.
Release pages 260 · document-verified
The list is introduced with including, so it is not necessarily exhaustive. Recorded as a difference between two lists rather than as a deliberate omission.
The Commission puts a number on what preemption removes. It has no updated data, but cites a prior rulemaking estimate that an issuer seeking State registration in 50 states would incur $80,000 to $100,000 in legal fees. There are 54 US jurisdictions counting the states, the District of Columbia and the territories. It also cites a 2012 GAO report finding that State compliance was among the factors behind the infrequent use of the original Regulation A.
Release pages 256 · document-verified
The cost of formally taking a crypto asset outside the federal securities laws is estimated at $19,431 per issuer, being 30.6 burden hours at $635 per hour for the Form TR filing under Rule 400(b) and the associated Form ID burden. For an issuer that already filed a Form TR under one of the exemptions there is no incremental cost.
Release pages 254 · document-verified
Two alternatives to the safe harbor were considered and rejected. A time limit on completing essential managerial efforts, rejected because it could force issuers to rush or take on more risk. And an express functionality and decentralization test as a Rule 400(a) condition, under which Form TR would carry a statement that the asset achieved required functionality and the network required decentralization plus an analysis demonstrating how, rejected as potentially costlier and hard for issuers to determine. In discussing that alternative the release notes issuers may need to retain legal and technical professionals to verify that they meet the safe harbor conditions, which is the closest the supplied pages come to contemplating a third party, and it is retained by the issuer for its own comfort rather than reporting to anyone else.
Release pages 275-277 · document-verified
Making the securities restricted was considered and rejected. The Commission acknowledges the investor protection benefit, then weighs it against slower network effects, decreased liquidity, and an illiquidity discount at initial purchase that would raise the issuer's cost of capital. An insider lockup of one year for related persons was also considered, and rejected in favour of disclosing whether any restriction exists, the release citing evidence that ICOs have lower failure rates when insiders have a lockup or vesting period.
Release pages 266-269 · document-verified
Not preempting at all, and preempting only initial sales or only resales, were both considered and rejected, on the grounds that responding to multiple State reviews would raise issuer time and compliance costs and that absence of preemption for resales would limit secondary market liquidity and therefore network effects.
Release pages 277-278 · document-verified
The Commission's own usage estimates are the most striking numbers in the release and they point away from capital formation. It estimates 99 issuers a year under the startup exemption and 31 offerings a year under the fundraising exemption, being 130 issuers raising capital. It estimates 475 issuers a year filing a Form TR under Rule 400(b) to rely on the investment contract safe harbor. By the Commission's own arithmetic the dominant use of Regulation Crypto Assets is not raising money under it. It is leaving the securities laws through it, by a factor of roughly three and a half to one.
Release pages 304, 310 · document-verified
The two capital-raising pathways are priced 27 times apart. The Commission estimates 56 burden hours per issuer under the startup exemption and 1,510.412 burden hours per offering under the fundraising exemption. At the $635 hourly rate the release uses in its own totals, that is roughly $35,560 against roughly $959,000 per offering. The cheaper path is the one with no financial statements, and it is the one the Commission expects to be used three times more often.
Release pages 310 note b · document-verified
Per-issuer dollar figures are computed from the Commission's own arithmetic in note b to Table 8, which applies $635 to all burden hours; the release states the totals rather than the per-issuer amounts.
Table 8 and Table 9 report monetized benefits as not applicable at both the three percent and seven percent discount rates. Monetized costs are $370,241,903 and $310,712,064 in present value over ten years from 2026, and $42,766,883 annualized at either rate. The Commission notes there are other benefits and costs it is not able to monetize, which is ordinary in rulemaking, but the quantified ledger has a cost column and an empty benefit column.
Release pages 310-311 · document-verified
A rule is major under the Congressional Review Act at an annual effect on the economy of $100 million or more. The Commission's own annualized cost estimate is $42.8 million, below that line, and it solicits comment and data on whether any final rule would be major.
Release pages 312 · document-verified
The regulatory flexibility analysis expects at least 89 small entities to conduct offerings under the proposed rules each year, a small entity being one with total assets of $5 million or less making an offering not exceeding $5 million. The Commission considered exempting small entities from all or part of the requirements and declined, reasoning that because small entities are more likely to have relatively high information asymmetries, their investors have a particular need for the information. It also chose design standards over performance standards deliberately.
Release pages 315-318 · document-verified
The regulatory flexibility analysis names the professional skills compliance may require: lawyers, accountants and auditors, financial managers, and information technology managers. Auditors appear in the release's cost column. They do not appear in its list of investor protections.
Release pages 315 · document-verified
The rule text settles a question practitioners have argued over for years. A covered transaction under the startup exemption expressly includes transactions referred to as airdrops, made in exchange for, in recognition of, or as incentive for past or future use of an associated crypto network or application. Airdrops count against the $5 million ceiling.
Release pages 323 · document-verified
Where consideration is not cash, the rule text requires the aggregate offering price to be based on the value of the consideration established by bona fide sales made within a reasonable time, or in the absence of sales on the fair value as determined by an accepted standard, and states that valuations of non-cash consideration must be reasonable at the time made. Accepted standard is left undefined in the text, which is why request for comment 10 asks whether to name one.
Release pages 322-323 · document-verified
Why the assurance level is what it is, which the release never has to argue because the structure decides it. PCAOB registration attaches to a firm because of who it audits: an issuer as Sarbanes-Oxley uses the term, which turns on Exchange Act filer status. An exempt offering does not confer that status; a Regulation A offering statement is qualified rather than declared effective, and its ongoing reports are filed under Regulation A rather than the Exchange Act. That is why Regulation A can accept a GAAS audit from an unregistered firm, and why its single carve-out is an issuer that simultaneously lists on a national securities exchange, listing being what brings Exchange Act registration. Building this regime as an exemption therefore selects the lighter audit regime automatically. The release reinforces it from the other side by stating that covered investment contracts are not equity securities and so fall outside Exchange Act section 12(g), and asking whether to codify that in Rule 12g5-1.
Release pages 84, 139 · document-verified
The Regulation A treatment and the section 12(g) view are read in the release at the pages cited. The Sarbanes-Oxley issuer mechanism that explains them is the standard analysis and is the author's, not language quoted from the release.
The assurance ladder
Where the two proposed exemptions sit against the exempt-offering regimes the release names as its models. The column that matters is the last one.
| Regime | Ceiling | Assurance | State law | What that means |
|---|---|---|---|---|
| Startup exemptionproposed, not law | $5M | no practitioner | preempted | No financial information at all, by design. Retail permitted, general solicitation permitted, not restricted securities. |
| Regulation Crowdfunding | $5M | tiered by size | preempted | Financial statements stepping from officer-certified to reviewed to audited by offering size. One-year resale restriction. |
| Regulation A, Tier 1 | $20M | unaudited | state review | Unaudited statements, no ongoing reporting, and state securities regulators review and qualify the offering. The state review is the counterweight to the absent audit. |
| Fundraising exemption, Tier 1proposed, not law | $20M | unaudited, no S-X | preempted | US GAAP statements with no assurance requirement, not required to follow Regulation S-X, labelled unaudited. Ongoing reporting applies and non-accredited investment limits apply. State registration and qualification are preempted. |
| Regulation A, Tier 2 | $75M | GAAS or PCAOB | preempted | Audited under US GAAS or PCAOB standards, ongoing reporting, state law preempted. |
| Fundraising exemption, Tier 2proposed, not law | $75M | GAAS or PCAOB | preempted | Audited under US GAAS or PCAOB standards by an auditor independent under Rule 2-01, report complying with Article 2. The Commission states these provisions are the same as Regulation A's. |
| Registered offering | no ceiling | PCAOB, registered | preempted | Audit by a PCAOB-registered and inspected firm under PCAOB standards, with the full Exchange Act reporting stack. |
What a comment letter should ask
Sixty days from Federal Register publication, File No. S7-2026-27. Five questions, now that the text has been read:
One. Assurance is missing from the alternatives analysis. The Commission reasoned carefully about Tier 1: because preemption reaches it, Tier 1 issuers should file ongoing reports even though Regulation A Tier 1 issuers do not. That is the right instinct applied to one lever. The same reasoning points at the assurance lever and the alternatives section never picks it up. The two alternatives weighed for this exemption are reporting levels and offering limits. A commenter can supply what the record lacks: if preemption justifies more reporting for Tier 1, does it also justify a review-level engagement, and if not, why does the argument stop at disclosure? Request for comment 148 invites cost estimates for the fundraising exemption, which is the opening.
Two. Price the review. Regulation Crowdfunding puts an independent accountant at the review level well below $20 million. The Commission priced the blue sky regime it is removing at $80,000 to $100,000 and priced a Form TR at $19,431, so it is willing to put numbers on things. A review engagement for an early-stage issuer sits in that same range and the gap between nothing and a full audit is wide enough to hold one. Anyone who has scoped such an engagement should file the number.
Three. Impose the PCAOB condition, or explain the choice not to. Not "clarify which applies", because that is already settled by the structure. PCAOB registration attaches to firms auditing an issuer as Sarbanes-Oxley defines it, which turns on Exchange Act filer status, and an exempt offering does not confer it. That is why Regulation A permits GAAS by an unregistered firm and why it flips only when the issuer simultaneously lists on an exchange. The live question is different and it is a policy one: given that Subpart E preempts state review of both tiers, should the Commission impose PCAOB standards, or registration, as a condition of the exemption even though the statute does not compel it? Conditions above the statutory floor are ordinary. Regulation A declined to impose this one and had state qualification of Tier 1 as a counterweight. This proposal does not. There is also a conditional trigger worth flagging: the release states its view that covered investment contracts are not equity securities and so fall outside Exchange Act section 12(g), and asks whether to codify that in Rule 12g5-1. If that view does not hold, or an issuer has other securities registered under section 12, the issuer becomes an issuer for Sarbanes-Oxley purposes and the audit regime changes underneath the exemption. Separately, the Tier 1 asymmetry is worth a line: a voluntary Tier 1 audit may use an auditor independent under either the AICPA standards or Rule 2-01, while Tier 2 requires Rule 2-01. Two independence tests inside one exemption invites confusion.
Four. Keep the analysis in Form TR. On request for comment 130, the answer from anyone who has reconstructed a historical determination is that the reasoning is the entire value of the filing. A certification without an analysis cannot be evaluated by an investor, a court, or a successor auditor.
Five. What is the subject matter, and is token supply in it? Financial statements of the issuing entity do not reach whether tokens outstanding match what the issuer says it issued. If that is out of scope, the release should say so, because nobody will infer it from the word audited.
Six. Is the exit priced correctly? If 475 issuers a year are expected to leave the securities laws at 30 burden hours and $19,431 each, that is the busiest provision in the rule and the cheapest per use. Request for comment 149 asks for cost and benefit estimates for the safe harbor. Anyone who thinks a determination of that consequence warrants more than thirty hours of work should say so with a number attached.
One measurement note for anyone in valuation: request for comment 10 asks whether the Commission should require a standard for determining fair value of non-cash consideration, whether it should be US GAAP, and whether the rule should list permitted standards. The Commission is asking rather than answering, which is an opening.
Scope of the reading
Read from the complete proposing release, all 402 pages. Everything cited to a rule, a page or a paragraph below was read on that page, and the page is recorded with it. Where an entry states that the release does not contain something, that is asserted from its absence across the section named rather than from a statement that the thing was never considered, and the entry says so.
Held: 1-402 of 402, complete. Read: The whole release: summary and introduction; Subparts A through E and their proposed rules; the economic analysis including benefits, costs, effects on efficiency, competition and capital formation, and reasonable alternatives; the Paperwork Reduction Act analysis and its burden tables; the present values and annualized values of monetized benefits and costs; the Congressional Review Act statement; the initial regulatory flexibility analysis; statutory authority; and the text of the proposed amendments beginning at page 320. Not held: None. The full release was supplied.
complete Nothing in this dataset is unread.
Every entry above was read in the proposing release itself and carries the page it was read on. The full 402-page release was read, so this article states nothing it could not check.
How this was researched
This article is written against the complete proposing release, all 402 pages of it, and every claim above carries the release page it was read on. Where the article states what the Commission said, it is quoting or restating text I read. Where it states what the Commission did not say, that is asserted from its absence across the section named, not from a statement that the thing was never considered.
The machine-readable version, with a page citation for every provision, is at /research/data/regulation-crypto-assets.json.
This is a personal research piece about a proposed rule. It is informational only, is not investment advice, is not legal advice, is not an assurance opinion, and is not affiliated with or endorsed by any employer. It describes a proposal's structure, grades no entity, and predicts no entity's failure. Nothing in the proposal binds anyone today.