Regulation Crypto Assets: Three Pathways, One Practitioner

The SEC proposed its first permanent crypto rule today. Coverage is quoting the dollar figures. The dollar figures are the least interesting part.

Three findings a practitioner cannot get from the press coverage:

Of three pathways, one has a practitioner in it. The startup exemption asks for narrative disclosure and no financial statements. The safe harbor asks for a certification from the issuer. Only the fundraising exemption requires audited financial statements. Two thirds of the regime's evidence surface is a document the issuer writes about itself.

The word "audited" is not one thing, and the proposal has not said which one it means. The $75 million ceiling, the audited financials and the semiannual reporting together are Regulation A Tier 2, rebuilt for tokens. Under Tier 2, the audit may be performed under US generally accepted auditing standards or PCAOB standards, and the firm need not be registered with the PCAOB unless the issuer also lists on a national exchange. Whether Regulation Crypto Assets inherits that latitude or closes it is the single most consequential line in the release, and it is not in any summary published so far.

The safe harbor is a self-certification. The determination that decides whether an asset sits inside or outside the securities laws entirely rests on the issuer asserting, about its own conduct, that it has ceased its essential managerial efforts. No engagement is scoped to that assertion. No practitioner opines on it. No standard governs how it is tested.

What was actually proposed, and what it is not

On 18 August 2026 the Commission announced proposed rules titled Regulation Crypto Assets, creating exemptions from Securities Act registration for certain investment contracts involving crypto assets, together with a conditional safe harbor from the term investment contract in the definitions of security in the Securities Act and the Exchange Act.

Four things need saying before anything else, because each is a place where this genre routinely goes wrong.

It is a proposal. Nothing in it binds anyone today. The comment file is open for 60 days from publication in the Federal Register, and the rule that emerges, if one does, can differ from the rule proposed. A structure built today on the assumption that these exemptions exist is built on nothing.

It is not the CLARITY Act. H.R. 3633 remains unenacted. Its mature blockchain mechanism, under which an issuer self-certifies and the Commission has 60 days to contest a rebuttable presumption with appeals to federal court, is a feature of that bill. It is not a feature of this proposal, and the two are being blended in commentary already. During the research for this piece the bill's 60-day objection window turned up in results about the rule and had to be disentangled. If you see that mechanism attributed to Regulation Crypto Assets, the source has conflated a bill with a rule.

It follows an interpretation, it does not replace one. The Commission issued a joint interpretation on how the federal securities laws apply to certain crypto assets and certain transactions in them on 17 March 2026, Release Nos. 33-11412 and 34-105020, File No. S7-2026-09. Today's proposal builds on that classification work rather than redoing it.

Nobody dissented, and that is a fact about the Commission rather than about the rule. The Commission has three sitting members, all of one party, following the departure of its last Democratic commissioner in January 2026. An open meeting scheduled for 14 August was cancelled the evening before, the notice citing an unforeseen scheduling issue, and the proposal was announced four days later. A rulemaking that arrives without a dissenting statement arrives without its weaknesses articulated inside the building. That work now has to happen in the comment file or it does not happen at all.

The three pathways

The three pathways and the evidence each one requires. The dashed columns are the ones where nobody outside the issuer asserts anything.

The word doing all the work

Here is the part that a reader of this site is positioned to see and most commentary is not.

The fundraising exemption's shape is not new. A $75 million ceiling in a 12-month period, audited financial statements, and semiannual reporting to the Commission is Regulation A Tier 2, feature for feature. That is almost certainly deliberate, and it is a sensible thing to copy: Tier 2 is a working, tested, proportionate regime for exactly this size of raise.

But Tier 2 carries a piece of latitude that almost nobody outside the audit profession knows about. Under Tier 2, the audit may be conducted under either US generally accepted auditing standards or the standards of the PCAOB, and the accounting firm need not be registered with the PCAOB unless the issuer simultaneously lists its securities on a national securities exchange. Independence under the Commission's rules is required. PCAOB registration and inspection are not.

Those are two materially different engagements wearing one word.

A PCAOB audit is performed by a firm that is registered with the Board, subject to the Board's inspection program, and working to the Board's standards. A GAAS audit by an unregistered firm is a real audit performed by a licensed CPA under AICPA standards, and it carries no Board inspection behind it. The opinion looks similar on the page. The system standing behind the opinion is not the same system.

So the question that decides how much the fundraising exemption is actually worth as an investor-protection matter is: which of those two does Regulation Crypto Assets require? Nothing published so far answers it. The press release says audited. The coverage says audited. The word alone does not distinguish a Board-inspected engagement from one that is not, and for a first-of-its-kind regime aimed at an asset class with a well-documented history of unreliable self-reporting, the distinction is not academic.

Where the two proposed pathways sit against the exempt-offering regimes they were drafted alongside.

Read the left edge of that chart first. Regulation Crowdfunding and the proposed startup exemption both stop at five million dollars. One of them puts an independent accountant in the picture. The other does not put anyone there.

That is not necessarily wrong. There is a defensible argument that a token sale to a distributed set of buyers, with narrative disclosure and a hard four-year aggregate cap, is a different animal from an equity crowdfunding round and should carry a different evidence burden. But it is a choice, it has a cost, and the cost lands on whoever later has to work out what actually happened. The proposal is the right place to argue about it, which is what a comment file is for.

The safe harbor is an assertion

The third pathway is the one with the most at stake and the least evidence behind it.

Under the safe harbor, an issuer that has completed or permanently ceased the essential managerial efforts it promised under the investment contract can certify that fact to the Commission and, if the other conditions are met, the crypto asset is no longer treated as subject to an investment contract, and therefore no longer within the Commission's authority over it.

Consider what that sentence is asking. The question of whether the efforts of others prong of Howey is still satisfied has, for a decade, been resolved by litigation, with discovery, testimony, and a judge. The proposal converts it into a filing. That is a genuine improvement in predictability, and predictability has real value; a compliance checklist a founder can read beats a subpoena they cannot anticipate.

But the mechanism by which the checklist is satisfied is the issuer's own statement about the issuer's own conduct. Set that beside the vocabulary this site uses for everything else:

Who asserts, who examines, under what standard, and what the reader actually receives.

An assertion with nothing examining it is a claim. That is not an argument against claims. A dated, public, signed claim by an issuer about its own decentralization is worth considerably more than the silence that preceded it, and the proposal deserves credit for extracting one. It is an argument about what a reader is entitled to conclude from it, and the answer is: what the issuer says, and no more.

The comparison that makes this concrete is the one from the 12 August no-action letter for a blockchain-native registered money market fund, covered in the RWA regulatory map. There, the staff granted relief from the paragraphs of Rule 17f-2 that assume a vault and a paper certificate, and kept the independent accountant: verification at least three times each fiscal year, two of them unannounced. Six days apart, the same agency preserved an examination requirement in one context and created a self-certification in another. That is not necessarily inconsistent, because the contexts differ. It is a contrast worth someone explaining on the record.

The assurance ladder

What a comment letter should ask

Sixty days from Federal Register publication. Five questions that a person with an assurance background is better placed to ask than almost anyone else who will file:

One. Which auditing standards? Does the fundraising exemption require PCAOB standards and a PCAOB-registered firm, or does it carry Regulation A Tier 2's latitude to use US GAAS with an unregistered firm? If the latter, say so in the release, because the market will otherwise read "audited" as the stronger of the two.

Two. What is the subject matter of the audit? Financial statements of the issuing entity are one thing. Whether the tokens outstanding match what the issuer says it issued is a different assertion entirely, and a financial statement audit does not reach it. If the token supply is not in scope, the release should say that plainly so nobody infers otherwise.

Three. Is anything examined in the safe harbor? If not, is that a considered choice, and what does the Commission expect a counterparty to do with a certification nobody has tested? An agreed-upon procedures engagement over the specific factual conditions would be cheap relative to a $75 million raise and would produce something a court could later read.

Four. What happens after certification? Decentralization is not a permanent state. If control re-concentrates, what obligation, if any, does the issuer have to say so, and who would notice?

Five. Does the startup tier's zero-practitioner design create an arbitrage against Regulation Crowdfunding? Two regimes, the same five million dollar ceiling, materially different evidence burdens. If the answer is that tokens warrant lighter treatment, the release should make that argument explicitly rather than leave it implicit in a table.

What is not known

How this was researched, and what that limits

This piece was written the day the proposal was announced, and it was written without reading it.

The research environment's network egress proxy refuses sec.gov, so the proposing release could not be retrieved and not one line of it has been seen. Everything above is assembled from search results observed on 18 August 2026 and stated in my words. There are no quotation marks around source text anywhere in this article or its dataset, because presenting a search summary as a quotation from a rulemaking release is exactly the failure this discipline exists to prevent.

That has consequences a reader should hold onto. The release number in the URL this was written against, 33-11434, could not be corroborated by any search and is carried as supplied. The page count is single-sourced and was reported before publication. Whether the audit standard question is answered somewhere in four hundred pages of text I have not read is, itself, unknown: it may well be addressed on page 212, and if it is, this article's central question is already answered and I could not see it. That possibility is the honest reading of my own limitation, and it is stated here rather than buried.

What this piece can offer is the question worth taking to the document, and the vocabulary for reading the answer when you get there. Pull the release. Find the financial statement article. See which standards it names. That single line will tell you more about how much the fundraising exemption is worth than every number in the coverage.

The machine-readable version of every provision above, with per-item source, channel and open questions, is at /research/data/regulation-crypto-assets.json.

This is a personal research piece about a proposed rule. It is informational only, is not investment advice, is not legal advice, is not an assurance opinion, and is not affiliated with or endorsed by any employer. It describes a proposal's structure, grades no entity, and predicts no entity's failure. Nothing in the proposal binds anyone today.