SEC Crypto Enforcement in 2026: After the Comment Window

The comment window closed, and the hard part began

On October 20, 2026, the US Securities and Exchange Commission shut the public comment window on the most important crypto rule it has ever written. The proposal is called Regulation Crypto Assets, and by the time the docket closed it had drawn more than 170 comment letters from exchanges, asset managers, law professors, consumer groups and state attorneys general. For an agency that spent most of the previous five years regulating this market through lawsuits, the mere existence of a notice-and-comment rulemaking is the story. The SEC is trying to replace litigation with a rulebook.

Closing comments is not the same as finishing a rule. What happens next is slow, technical and legally exposed. A Commission that now seats only two of its five members has to read the record, answer the serious objections, and adopt something a federal court will not throw out. The proposal that drew those letters leaves at least two questions genuinely open: how to treat airdrops, and when a token is finally allowed to stop being treated as a security. Neither has an agreed answer, and both decide who gets to raise money in the United States without registering.

This explainer walks through how the SEC got from suing Coinbase to proposing an on-chain fundraising framework, what the comment letters actually argued, and why the next stage depends as much on the arithmetic of a two-person Commission as on the merits of any rule. The backdrop is a soft market: Bitcoin traded around $77,400 on October 30 and Ether near $2,230, both well below their 2025 peaks, a reminder that regulatory clarity and price are not the same thing.

From 125 lawsuits to a near standstill

To understand the rulebook, start with the lawsuits it is meant to replace. Under former chair Gary Gensler, who ran the agency from April 2021 to January 2025, the SEC brought 125 crypto-related enforcement actions and collected about $6.05 billion in monetary penalties, according to Cornerstone Research. The theory behind most of them was that nearly every token sale was an unregistered securities offering and that the major exchanges were unregistered securities exchanges, brokers and clearing agencies.

That campaign came apart quickly after the change in administration. In early 2025 the Commission voted to dismiss its case against Coinbase, and the SEC agreed to drop the suit without a penalty. Kraken, ConsenSys and Cumberland DRW were dismissed with prejudice in late March 2025. The long-running action against Binance was dismissed with prejudice in May 2025. The Ripple fight, which produced the most-cited crypto ruling of the era, ended when both sides dropped their appeals, leaving an earlier penalty on institutional sales in place and little else.

The numbers tell the rest. Cornerstone counted 13 crypto enforcement actions in fiscal 2025, down about 60 percent from 33 the year before, with digital-asset penalties of roughly $142 million, a small fraction of the prior year’s total. Several of those 13 were filed before Gensler actually left. The registration theory did not lose in court so much as get withdrawn.

What regulation by enforcement actually meant

The phrase the industry used for the Gensler years was regulation by enforcement. In practice it meant that the rules of the road were written inside complaints and settlements rather than in published regulations. A company often learned where the line sat only when it received a Wells notice, the letter telling a firm that the staff intends to recommend charges and inviting a written response. The governing legal test was, and still is, the Howey test, the Supreme Court standard from 1946 that asks whether someone invested money in a common enterprise expecting profits from the efforts of others.

Howey is flexible by design, which is exactly why it became contested. Applied to a token, it can sweep in an early fundraising round while saying little about how the same token should be treated once it trades on secondary markets years later. Issuers complained that they could not register even when they wanted to, because the existing forms were built for stock and bonds, not for software that ships to users. Regulators countered that the law had worked for eighty years and that crypto was not special. That argument, pressed most forcefully by former commissioner Caroline Crenshaw before she left in early 2026, is the one the new Commission set out to overturn.

One thing did not change in the handover: fraud is still fraud. The agency’s largest crypto recovery, the roughly $4.47 billion judgment against Terraform Labs and Do Kwon after the collapse of a stablecoin that erased about $40 billion in value, was entered on a fraud theory, not a registration theory. The pivot was never a retreat from deception cases. It was a retreat from the idea that failing to register is itself the violation.

Regulation Crypto Assets, in plain terms

On August 18, 2026 the SEC published Regulation Crypto Assets, release 2026-76, a proposal of roughly 400 pages. Chair Paul Atkins called it the most historic step yet to modernize federal securities regulations for crypto assets. Stripped of the detail, it does three things: it creates two ways to sell a token without a full securities registration, it offers a safe harbor that can end a token’s status as an investment contract, and it preempts state registration for offerings that use the new framework.

The first exemption is for small raises: up to $5 million over a four-year period, with plain-language narrative disclosure rather than audited financials. The second is larger: offerings up to $75 million in a 12-month period, with financial statements and ongoing reporting. Both carry crypto-specific disclosure built around what the issuer actually promises to do. The structure is spelled out in the proposing release, and the market has read it as something close to a compliant initial coin offering, the thing the 2017 boom never had.

The safe harbor is the novel part, and it is where the proposal stops being an ordinary offering rule and starts making a claim about the nature of tokens themselves.

The idea that a token can stop being a security

American securities law has never had a clean way to say that something once sold as an investment contract has stopped being one. A share of stock is a security forever. Crypto advocates have argued for years that a token is different: at launch, buyers may be betting on a founding team, but once a network is live and nobody is steering it, the original bargain is gone. The safe harbor tries to turn that argument into a rule. If an issuer completes the work it promised, or permanently abandons it, makes no new promises and files a status report, the investment contract tied to the token is treated as ended. The token keeps trading, now outside the securities perimeter.

This builds on a joint SEC and CFTC interpretive release from March 2026 that laid out a five-category view of crypto assets: digital commodities whose value comes from how a network runs, digital collectibles such as NFTs, digital tools such as memberships and credentials, payment stablecoins, and tokenized securities. That release named sixteen tokens, including Bitcoin, Ether, Solana and XRP, as digital commodities rather than securities, and said that mining, staking rewards and ordinary airdrops are not, by themselves, securities transactions. Regulation Crypto Assets is the operational version of that worldview.

The question the letters kept returning to is deceptively simple: when, exactly, has an issuer done enough to let go? Set the bar too high and no token ever qualifies, and the rule is decorative. Set it too low and any promoter can declare the work finished and walk away from disclosure. The proposal picks a standard; the commenters do not agree it picked the right one.

Flashpoint one: airdrops

An airdrop is a distribution of tokens to users who did not pay money for them, usually as a reward for using a protocol. Airdrops have become the default way crypto projects hand ownership to their communities, and they sit awkwardly inside a framework built around dollar caps on fundraising. If a free distribution counts against a $5 million or $75 million ceiling, how do you value tokens that had no sale price? The proposal supplies no method and instead asks commenters for one.

The industry’s answer was to carve airdrops out. In its comment letter, the Hyperliquid Policy Center urged the SEC to provide clearer protections for airdrops that reward network participation, along with guidance on token buybacks, and warned that the safe harbor as drafted could arrive too late in a project’s life to matter. Other deregulation-minded commenters asked the agency to exclude non-fundraising distributions, such as airdrops and staking rewards, from the caps entirely, on the logic that giving something away is not raising capital.

The counterargument is that airdrops are rarely pure gifts. They can prop up a token’s price, reward insiders, and come wrapped in promises about future development that look a lot like the pitch in a fundraising round. A token that trades actively after a free distribution can still move real money long after anyone is building anything; HOGE Wire has traced how one abandoned AI fund’s token kept trading on autopilot across two tickers. Deciding whether that activity needs disclosure is not a technicality. It is most of the point of the rule.

Flashpoint two: when the safe harbor actually lets go

The second fight is about the exit itself. For the safe harbor to work, someone has to be able to tell, from the outside, that an issuer has genuinely finished or abandoned its promised work. Bitwise Asset Management, which wants to build products around these tokens, asked the SEC for a standard that investment managers can apply using publicly available information, and for guidance on what to do when a token has filed no status report at all. The request is practical: a fund cannot hold an asset whose legal character nobody can verify.

Consumer advocates read the same provision as an escape hatch. Public Citizen called the safe harbor a regulatory loophole, arguing that letting an issuer declare the investment contract over, and preempting state law on top of it, effectively shields bad actors from the rules everyone else follows. A group of five securities-law scholars, including John Coates and John Coffee, went further and told the Commission that Regulation Crypto Assets as proposed is deeply flawed, contending that the startup exemption breaks with nearly a century of securities-law tradition and that tweaks to existing small-offering rules would do the job without inventing a new regime.

Underneath both positions is an old crypto problem: how decentralized is decentralized enough? The exit presumes that at some point control is diffuse enough that no one is making the managerial efforts Howey cares about. Measuring that is genuinely hard, and the stakes are not abstract. Governance tokens can concentrate power quietly even when a project looks community-run, a dynamic HOGE Wire has documented in gaming DAOs. A safe harbor that treats a captured network as a finished one would hand a disclosure exemption to exactly the projects that need watching.

Washington versus the states

The most constitutionally loaded piece of the proposal is preemption. Offerings made under Regulation Crypto Assets, and certain secondary-market trades that follow, would be treated as covered securities, which means state securities registration and merit review no longer apply. States would keep their antifraud authority but lose the power to make a crypto issuer register at the state level. For an industry that has spent a decade dealing with roughly fifty separate state regulators, that is close to the main prize.

State regulators see it as federal overreach. The North American Securities Administrators Association urged the SEC to scrap the proposal outright over preemption. New York Attorney General Letitia James, whose office filed its own comment letter in the docket, has been among the loudest voices arguing that stripping states of registration authority removes a layer of investor protection that has caught frauds federal regulators missed. Her objection carries weight because her office is not theorizing about enforcement; it is doing it, as the Celsius settlement discussed below shows.

The preemption fight is also why the comparable legislation stalled. The CLARITY Act, the market-structure bill that would have put much of this on a statutory footing, failed a Senate cloture vote, 49 to 50, in September 2026, blocked in part by the same dispute over whether Washington should override state crypto rules. With the legislative route closed for now, the SEC is attempting through rulemaking what Congress could not pass, which is precisely what makes the preemption claim legally fragile.

Who filed, and what they wanted

For a rule this consequential, the docket was modest: 171 comment letters by the close, a number that says something about how specialized the audience is. One analysis of the coded letters found that about 70 percent offered conditional support, roughly 5 percent backed the proposal outright, around 8 percent opposed it, and the rest were mixed or procedural. In other words, most of the market likes the direction and wants changes to the details, while a smaller, sharper camp wants the whole thing reconsidered.

The supportive letters came with conditions. Nasdaq endorsed the framework but asked the SEC to make clear that tokenized stocks, bonds and ETF shares stay subject to the existing registration and trading rules, so that wrapping a security in a token cannot dodge the law. Ava Labs called the proposal an important first step while arguing the crypto-asset definition was too broad. SkyBridge and Coinbase were broadly in favor. The opposition was led by the five securities scholars and by consumer and markets groups; Better Markets filed what it framed as a shadow SEC comment picking the economic analysis apart.

The pattern matters for what comes next. A rule supported with conditions is one the agency can adopt after making targeted fixes. A rule opposed on first principles by respected academics and by the states is one a court may be asked to unwind. The SEC now has to decide which letters to answer and which to absorb.

A two-person Commission does the math

Whatever the record says, the body that has to act on it is unusually thin. Hester Peirce, the commissioner most associated with crypto and the head of the agency’s Crypto Task Force, left the SEC on October 2, 2026 to take a law-school post. Her departure dropped the Commission to two sitting members, Chair Paul Atkins and Commissioner Mark Uyeda, both Republicans, on a body designed for five. Three seats are vacant, and the White House has not nominated anyone to fill them.

Two members is the bare minimum to function. The agency amended its own quorum rule just before Peirce left so that a single non-recused commissioner can constitute a quorum when the others are disqualified, a change critics described as a Commission of one. With only two votes available, a single disagreement or a single recusal can freeze a decision, and the long-standing expectation that the five seats split so that no more than three come from one party means any nominee the administration sends up invites a fight over balance. Confirmations take months, so the practical reality is that this rulebook may be written and finalized by two people.

That matters because adopting a rule is not a vote on vibes. The Administrative Procedure Act requires an agency to respond to the significant comments it received and to explain its choices, or risk having the final rule struck down as arbitrary and capricious. Answering 171 letters, including a detailed academic broadside and a states’ revolt, with two commissioners and a reduced staff is the kind of task that runs long. A final Regulation Crypto Assets is realistically a 2027 event, if it survives at all.

Enforcement went back to basics, and custody became a rulebook

None of this means the enforcement division went quiet. David Woodcock, who became director of the Division of Enforcement in May 2026, used his first public remarks to describe a back to basics program focused on quality over quantity, aimed at offering frauds, accounting and disclosure violations, insider trading and market manipulation rather than technical paperwork cases. Crypto fraud sits squarely in that lane. The agency’s Cyber and Emerging Technologies Unit has kept filing cases against Ponzi schemes and fake-AI-trading pitches, including a late-September 2026 pair of actions over schemes that solicited victims through messaging apps.

State enforcers are busy too, and they are the reason the preemption fight is not academic. On October 9, 2026, New York Attorney General Letitia James secured up to $35 million and a permanent ban from New York’s securities, commodities and crypto markets from former Celsius chief executive Alex Mashinsky, who is already serving a 12-year federal sentence. That case ran on fraud and state authority, exactly the powers the states say Regulation Crypto Assets would leave them while taking away the registration tools they use earlier in a scheme’s life.

The SEC has also moved to convert its biggest non-fraud lever into a rule. A separate proposal from October 1, 2026 would modernize custody for investment advisers and funds, adding state-chartered trust companies, banks and broker-dealers to the list of permitted custodians and allowing limited self-custody only when an adviser determines quarterly that no qualified custodian is available. Custody, not Howey, is where crypto enforcement actually bit in the FTX, Celsius and BlockFi failures, where customer assets vanished because someone controlled the keys and misused them. The lesson of 2026’s wallet attacks points the same way: most losses trace to control of keys and people, not to broken cryptography, as HOGE Wire found in both the $387 million Bitget incident and the October wallet wave. Writing custody down as a rule is an attempt to prevent the next one.

The CFTC’s parallel track

The SEC is not the only agency writing crypto rules by proposal. The Commodity Futures Trading Commission, now chaired by Michael Selig, issued an advance notice of proposed rulemaking on October 5, 2026 for two frameworks: Regulation CTX, covering retail crypto transactions offered on a leveraged, margined or financed basis, and Regulation CAM, a new registration category for the exchanges that offer them. Comments are due by December 14, 2026, and Selig has framed the effort as building a federal pathway with the authority the agency already has, rather than waiting for Congress.

The division of labor is the one US crypto has argued about for years. The SEC claims assets that look like investment contracts; the CFTC claims commodities and the derivatives written on them. The two signed a memorandum of understanding in March 2026 to coordinate, but the seams still show, and they show most clearly in leveraged trading venues where the same product can look like a security to one agency and a commodity derivative to the other. The real cost of that ambiguity lands on traders, in fees and uncertainty, something HOGE Wire has broken down for perpetual-futures DEXs. Regulation CAM is the CFTC’s bid to claim that ground before the SEC’s secondary-market rules do.

How durable is any of this?

The deepest question about the 2026 pivot is whether it lasts. Almost all of the friendly guidance that preceded Regulation Crypto Assets, the staff statements on staking and the interpretive release on classification, is non-binding. Staff views can be withdrawn by the next set of staff, and no court is bound by them. A final rule is sturdier, but it can be repealed by a future Commission or unwound in litigation. The whole edifice rests on the current leadership staying aligned and in place.

A Supreme Court decision quietly raised the stakes. In Trump v. Slaughter, decided in June 2026, the Court overturned a 1935 precedent that had shielded the heads of independent agencies from being fired at will by the president. The near-term effect on crypto policy is small, because the current chair already aligns with the administration. The long-term effect is that the structural independence which made this pivot look permanent is gone; a future president can reshape the SEC far more directly than before. Durability now depends on politics, not insulation.

The contrast with Europe is stark. The European Union’s Markets in Crypto-Assets regulation is already law and already in force, with licensed providers and a harmonized rulebook that does not have to survive a comment period or a court challenge. The United States is trying to reach a similar destination by a more precarious road.

For anyone holding, building or trading, the practical reading is simple. The direction of travel is friendlier, but nothing is settled: watch for a final Regulation Crypto Assets vote, the December 14 close of the CFTC comment period, the custody rule, and any move to nominate a third commissioner. And treat the fraud rules as unchanged, because the one thing every version of this SEC agrees on is that deception still gets prosecuted. As Duke lecturing fellow Lee Reiners put it, the risk is a rulebook that reads like policymaking by crypto, for crypto; whether the final version earns that label is the test the next year will set.

Frequently Asked Questions

What is Regulation Crypto Assets?

Regulation Crypto Assets is a rule the SEC proposed on August 18, 2026 that would let projects sell tokens without a full securities registration, using two new exemptions (up to $5 million over four years, or up to $75 million over 12 months) plus a safe harbor that can end a token’s treatment as an investment contract. It also preempts state registration for offerings that use it. The public comment period closed on October 20, 2026, and a final rule is not expected before 2027.

Did the SEC stop enforcing crypto rules?

No. The SEC dropped its registration cases against exchanges such as Coinbase, Kraken and Binance in 2025, but it has kept bringing fraud cases, and enforcement director David Woodcock has said the division is focused on offering frauds, Ponzi schemes and market manipulation. State attorneys general also remain active, as New York’s October 2026 settlement with former Celsius chief Alex Mashinsky shows.

What are the two unresolved issues in the proposal?

The comment letters centered on two questions. First, airdrops: how to value and treat free token distributions inside a framework built around fundraising caps. Second, the safe harbor’s exit: how to tell from the outside that an issuer has finished or abandoned its promised work, so a token can stop being a security without creating a loophole. The SEC has not settled either.

How does the two-commissioner SEC affect the timeline?

After Hester Peirce left on October 2, 2026, only Chair Paul Atkins and Commissioner Mark Uyeda remain, with three seats vacant and no nominees. The Administrative Procedure Act requires the agency to answer significant comments and justify its choices, which is slow work for a reduced Commission and staff. That pushes a final Regulation Crypto Assets into 2027 and raises the risk that any rule faces a court challenge.

How does the US approach compare with the EU’s MiCA?

The European Union’s Markets in Crypto-Assets regulation is already law and in force, with licensed providers and harmonized rules across member states. The United States has no crypto statute after the CLARITY Act failed its Senate vote in September 2026, so the SEC and CFTC are building frameworks through proposed rules that still must survive comment review, a thin Commission and possible litigation. The destinations are similar; the US path is less settled.

Anneke de Vries covers crypto regulation and market structure for HOGE Wire.