The SEC's proposed Regulation Crypto Assets, published Aug. 21, 2026, sets out how crypto projects can raise money and when an issuer's investment contract ends. DRC filed two comment letters on the proposal this month, calling the proposed exemptions and safe harbor meaningful progress and asking the SEC to add a bright-line safe harbor for when essential managerial efforts have ceased, built on an objective, control-based test. Who decides when a network is decentralized, and by what measure, is a main line of inquiry across DRC's broader set of comments. Sarah Brennan, senior legal advisor at DRC, explains what the letters ask for and why it matters for decentralized networks.

The draft ties the exit to old promises

Under the SEC's draft, exit means the end of the issuer's investment contract, the arrangement that brings a token sale and secondary transactions under securities law. Take two layer 1 networks with the same open, permissionless design. They can reach opposite results. A team that promised only a mainnet launch could exit while it still controls token supply. A team that promised "full decentralization" is judged by its own articulation of what that means and can stay in securities status after its stake has dispersed. For exit, the SEC measures "functional" and "decentralized" only by whether the issuer fulfilled its own promises. The Commission's March interpretive release says whether an issuer achieved decentralization turns on how the issuer defined the term, "not a general market conception," and SEC staff FAQs issued Sept. 25 confirm it.

Proposed Rule 400(a) deems a covered investment contract to have ended when the issuer has completed or permanently ceased all the essential managerial efforts it represented or promised, is not making and does not intend to make new representations or promises of that kind, and files Form TR, a transition report, with the SEC. Essential managerial efforts are the work buyers depend on the team to do. If you no longer control the network or token, you are still beholden to those historical promises.

We want to limit the footprint of the promises test. We would confine the promises that count to those made before the network is functional and to covenants disclosed in public filings, so the promises element is not overweighted. The main line in the sand should be control. Once no person or group controls the network, promised efforts left unperformed cannot be essential, because no one is positioned to perform them.

The earlier decentralization tests never had an outer boundary. "Sufficient decentralization" came from a 2018 SEC staff speech, and the staff's 2019 framework listed factors with no weighting and no path to what the SEC would consider sufficient. Teams had no way to know when continued development stopped counting as essential managerial efforts, and the only safe answer looked like abandonment. "Sufficient decentralization" was never supposed to require that. Without a bright line, teams spent untold resources on structuring advice and efforts to avoid a U.S. nexus, and faced years of enforcement risk. The SEC's current approach does not fix this. Historical tests left decentralization boundless and standardless, measured against a shifting market conception. Tying it instead to each team's own articulation of the standard leaves the market with a different standard for every project. What fixes it is a bright-line test tied to the cessation of essential managerial efforts.

The proposed standard rewards issuers that disclose less

Because exit turns on what was promised, the standard rewards issuers that promise and disclose as little as possible. The goal should be to incentivize building the underlying technology, not launching the ten-thousandth token where effort trickles off to nothing after launch. Teams will pull back on detailed roadmaps, development updates and public commitments. Those are the disclosures securities laws exist to produce, and they let purchasers evaluate progress and risk.

We have already seen where bad incentives lead. The threat of the securities laws has incentivized the creation of valueless tokens. Some teams have stripped out or rerouted token value accrual so the token looks less like a security. The value flows to a privatized equity layer that token holders have no claim on.

Regular token buyers get the least information when they need it most. A secondary purchaser cannot tell whether its purchase is a securities transaction, because the answer turns on a marketing history it cannot observe and a fulfillment determination it cannot verify. In past enforcement actions, retail holders and the broader market bore the losses, while the issuer group kept the funds raised. When the token is the product, rather than part of a network creating sustainable value, holders are left with little once the managerial effort stops.

The control test asks who can change the network

Our letters ask the SEC to add a non-exclusive bright-line safe harbor to Rule 400, built on what we call the control test, for one part of the exit analysis: whether the issuer's essential managerial efforts have ceased. That is a separate inquiry from whether the issuer delivered the functionality and decentralization it promised. Each is necessary for exit, and neither is sufficient on its own. Meet the control test and the essential managerial efforts question is answered. Miss it and the existing analysis from the proposed rule still applies. I have always seen the control test as another articulation of cypherpunk principles, like those set out in Vitalik Buterin's "Make Ethereum Cypherpunk Again." The test asks whether the facts behind a token meet those principles. Can anyone exclude users or censor transactions? Can anyone unilaterally change the rules? Is the code public and auditable? Does value come from the network's operation or from a company's discretion? That keeps the focus on the technology rather than the token. The network is and should be the product, and the goal is to make sure useful things are being built.

The control test measures whether the network and token are the alter ego of the initial development group, the team that built them. Is the team puppeting every element of the tech behind the scenes, or is it actually a distributed system?

Token distribution is one thing the test measures. On its own, it shows who holds the token, not who can change the system. A widely held token can still run on contracts that a small team multisig can upgrade overnight, or sit behind governance votes that are advisory or that the team and its investors can carry alone. Buterin's own example of what not to build is a so-called layer 2 that is in fact a centralized system secured by a multisig, with no plan to move past it. A distribution chart would not show that. The control test also measures concentration of consensus, unilateral authority to change or restrict the network, and whether supply and value accrual run programmatically from public code.

Our goal was objective, data-driven criteria rather than subjective legal opinions or an issuer's characterization of its own intentions. Every part of the test can be checked against onchain data, published code and governance records. A team can apply the test in advance, and a market participant can confirm the conditions were met and rely on that determination. For supply and consensus, the test asks whether the initial development group and its related persons still hold a controlling share.

Onchain data cannot show offchain coordination or who beneficially owns which wallets. That is why the test pairs onchain data with an attested disclosure that carries fraud liability, and with beneficial ownership reporting for anyone who acquires control later.

Whoever controls the network carries the obligations

The control test does not add a new requirement. Rule 400 already asks two separate questions: whether the issuer delivered the functionality and decentralization it promised, and whether its essential managerial efforts have ceased. The control test gives the second question an objective bright line. Once the initial development group no longer holds a controlling share of supply or consensus, and no one can unilaterally change or restrict the network, the team's continued efforts cannot be essential, and the team can keep building. The test's goal matches the goal of securities law, which is to protect purchasers who depend on someone with more control and more information than they have.

Some networks are built to stay centralized. Take a layer 1 whose validator set is permissioned and run by the company, or whose admin keys stay with the team. Nothing in it is built to change hands, so it cannot mature, and it may not need a token at all. Projects like that should not be eligible for token sale relief.

A network designed in line with cypherpunk principles faces a different problem: de facto centralization at launch. The team and early investors hold most of the supply and stake, which is often unavoidable for a new project. It decentralizes as tokens reach users, validators and contributors, and control spreads with them. The securities laws have to permit that, through end user distributions, contributor compensation and a path to secondary transfer.

Where we ask for more than the draft, it follows the same line. Until maturity, control persons should face a holding period and disclosure before they sell into the market. Control points have to be disclosed too, including upgrade authority, admin keys and mint authority. If a party acquires control after exit, the obligations come with it. Company-backed tokens, whose value tracks a single company, are excluded from digital commodity status.

We put the onus on the control parties such that we can relax requirements for everyone else, including ordinary secondary trading by unaffiliated holders, end user distributions and continued development after maturity. A decentralization test and a securities rule aimed at control end up drawing the same line. Because that line is objective, the exit can be planned for and durable.

What changes if the SEC adopts the control test

With the control test in the rule, a team would know from launch what the safe harbor requires and could design its network toward it. Once it gets there, the original team can keep building, funding grants and shipping code without creating a new investment contract. Roadmaps and development updates would no longer be conditions on exit, so teams could talk openly about their plans again.

For permissionless networks, the securities laws would permit what decentralization requires. Tokens could reach users, infrastructure providers and contributors through end user distributions and contributor compensation, without using up a capped capital-raising exemption. Exchanges and market makers could check a token's status before listing or supporting it.

The exit could be reopened only for fraud or a material misstatement in the filing. An exit that can be revisited indefinitely provides little more certainty than no exit at all. If someone acquires control later, the obligations follow that party, and the original exit stays closed.

The proposed initial safe harbor fits base-layer networks best. Application tokens and layer 2s need a variant or further rulemaking, and we said so in the letter.

—————

Read DRC's comment letters on proposed Regulation Crypto Assets here:

●  https://www.sec.gov/comments/S7-2026-27/s7202627-1104319-3884406.pdf

●  https://www.sec.gov/comments/S7-2026-27/s7202627-1104159-3884086.pdf