By Thomas Przybylowski, Securities & Litigation Attorney
At a Glance
- On March 17, 2026, the SEC and CFTC issued a joint interpretive release clarifying how federal securities laws apply to crypto assets.
- The new framework sorts crypto assets into five categories, with only digital securities treated as securities outright.
- SEC v. W.J. Howey Co. remains the binding legal test and is not displaced by the new guidance.
- Interpretive guidance reduces agency enforcement risk, but it does not bind federal courts or limit private securities litigation.
- Thomas Przybylowski is a litigation attorney who advises companies on securities and crypto-asset risk, including how courts apply Howey to digital assets.
For most of the last decade, the rules for crypto were written in enforcement actions rather than regulations. That changed in 2026, but the change is narrower than the headlines suggest.
On March 17, 2026, the SEC, joined by the CFTC, issued a joint interpretive release that finally lays out how the federal securities laws apply to crypto assets. It is the most authoritative guidance the agencies have produced on the subject, and for companies that have spent years operating in a fog of regulatory uncertainty, it is a meaningful development. But interpretive guidance is not a statute, and it is not binding on the federal courts where most disputes actually get decided. Companies that read the new framework as a green light without understanding its limits are setting themselves up for trouble.
Here is what the framework changes, what it leaves unresolved, and where the real risk still lives.
The Transaction, Not the Token, Is the Unit of Analysis
The central principle of the new framework is one that courts had already been converging on for years: a crypto asset is not itself a security. Whether the securities laws apply depends on the transaction and the promises made around it, not the technical characteristics of the token.
This matters because it reframes the entire compliance question. Under the interpretation, the agencies adopt a five-category taxonomy of crypto assets, with only digital securities treated as securities outright, while digital commodities, digital collectibles, and digital tools generally fall outside the securities framework. A token can be sold as part of an investment contract and become subject to the securities laws, and then separate from that investment contract once the issuer fulfills its representations or enough time passes that buyers can no longer reasonably expect the issuer’s continued efforts to drive value. For companies, that means the analysis is not a one-time classification exercise. It is an ongoing assessment of how an asset is marketed, sold, and represented over its entire lifecycle.
Howey Still Governs, and It Is Still Fact-Specific
The interpretation does not displace SEC v. W.J. Howey Co. The Supreme Court’s test for what constitutes an investment contract remains binding precedent, and the new guidance is essentially the agencies’ view of how Howey applies to digital assets.
That distinction has real consequences. An interpretive release tells you how the SEC and CFTC intend to administer the law, including in their own enforcement decisions, but a federal judge evaluating a private claim is not bound by it. The investment-contract analysis remains intensely fact-specific, and the same conduct that the agencies might decline to pursue can still anchor a lawsuit brought by private plaintiffs. Companies that treat the framework as a safe harbor are misreading what it is. It narrows agency enforcement risk in defined areas. It does not rewrite the statute or foreclose the case law.
Mining, Staking, Airdrops, and the Limits of the Safe Zone
The guidance provides some of its most concrete relief on specific activities. It indicates that protocol-level mining, certain staking arrangements, wrapping, and airdrops of non-security crypto assets generally fall outside the securities laws. Airdrops, for instance, typically fail Howey’s first element because recipients do not invest money when they receive an asset for free.
The caution here is in the word “generally.” The relief is conditioned on how each activity is actually structured. A staking program that involves managerial or entrepreneurial efforts beyond routine technical functions can look very different from one that does not, and an airdrop conditioned on the recipient providing consideration or services may not qualify at all. The companies most likely to get caught are the ones that read the favorable headline and skip the structural analysis underneath it. The details of how a program operates, not the label attached to it, will determine whether it sits inside or outside the framework.
Why Private Litigation Risk Has Not Gone Away
This is the point that gets lost in the coverage, and it is the one I would stress most to any company operating in this space. The interpretation applies prospectively and does not affect prior enforcement actions or ongoing litigation, and it does nothing to limit the private plaintiffs’ bar.
Reduced agency enforcement does not mean reduced legal exposure. Private securities class actions testing token classifications under Howey remain active, including cases targeting token issuers and the platforms that facilitate their sales. Where the GENIUS Act forecloses securities and commodities theories for payment stablecoins, plaintiffs are already pivoting toward consumer protection statutes and other theories of liability. In practice, a clearer regulatory map often redirects litigation rather than ending it, and the firms and individuals bringing these cases are sophisticated and well-resourced. A company that has satisfied itself on the agency-enforcement question has answered only part of the risk equation.
What Companies Should Actually Do
The practical takeaway is not to celebrate or to panic. It is to do the work. Companies should reassess how they classify their tokens under the new taxonomy, review public statements and marketing materials that could create profit-expectation dynamics under Howey, and evaluate staking, rewards, and airdrop programs for features that could be characterized as investment contracts.
Just as important, companies should document the analysis. If a dispute lands in federal court, the question will not be whether the SEC would have brought a case. It will be whether the conduct satisfies Howey on the facts, and a contemporaneous, well-reasoned record of how the company evaluated its own assets and programs is far more valuable than an after-the-fact reconstruction. The regulatory environment will keep evolving, particularly if Congress acts on pending market-structure legislation, so this is a process to maintain, not a box to check once.
The Bottom Line
The 2026 framework is a genuine step toward clarity, and it meaningfully reduces agency enforcement risk in defined areas. But it is interpretive guidance built on a Supreme Court test that remains binding and fact-specific, it does not bind the federal courts, and it leaves the private litigation landscape fully intact. For companies, the right response is disciplined analysis and careful documentation, because in crypto, regulatory clarity and litigation risk are not the same thing.
Frequently Asked Questions
Is a crypto asset itself a security under the SEC’s new framework?
No. Under the SEC and CFTC’s 2026 interpretation, a crypto asset is not itself a security. Whether the securities laws apply depends on the transaction and the promises made around it — the same token can be a security in one context and not in another, depending on how it is marketed, sold, and represented over its lifecycle.
Does the SEC’s interpretive release bind federal courts?
No. An interpretive release tells the public how the SEC and CFTC intend to administer the law, but it does not bind a federal judge evaluating a private claim. SEC v. W.J. Howey Co. remains the controlling precedent, and the investment-contract analysis stays intensely fact-specific.
Are airdrops and staking rewards securities?
Generally not, but the word “generally” matters. Protocol-level mining, certain staking arrangements, wrapping, and airdrops of non-security crypto assets generally fall outside the securities laws. An airdrop typically fails Howey’s first element because recipients do not invest money, but a staking program with managerial or entrepreneurial efforts beyond routine technical functions can be characterized differently.
Does regulatory clarity reduce private securities litigation risk?
Not necessarily. The interpretation applies prospectively and does not affect prior enforcement actions or ongoing litigation, and it does nothing to limit the private plaintiffs’ bar. Private securities class actions testing token classifications under Howey remain active, and where the GENIUS Act forecloses certain theories for payment stablecoins, plaintiffs are already pivoting to consumer protection statutes instead.
About the author
Thomas Przybylowski is a litigation attorney with extensive experience in commercial litigation, securities disputes, and complex high-stakes matters. He previously practiced at Pomerantz LLP and Schulte Roth & Zabel LLP and was named a Super Lawyers Rising Star in 2020 and 2021. He is admitted to practice in New York and New Jersey. His securities litigation practice includes matters testing how courts apply the Howey test to crypto assets and digital securities.
Learn more about Thomas Przybylowski in his Q&A with CityBiz and his Inspirery interview.