MSTR Cat

Crypto Law/Level III · Tokens and securities law/3.2 US rules in motion/Lesson 1

Regulation by enforcement and its critics

How the SEC applied the Howey test to crypto mainly through lawsuits from 2017 to 2024, why critics called that unfair, and what the courts actually decided.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Cheapest protection against shifting enforcement is to rely on the strongest document: a statute, Commission rule or Commission interpretation (such as Release 33-11412, March 2026) outranks staff statements and speeches, which bind no agency or court, as the Third Circuit noted in 2025.
  2. Anyone may petition the SEC for rulemaking or ask staff for a no-action letter, with no filing fee; Coinbase’s 2022 petition won a 2025 ruling that the denial was arbitrary. The catch: a no-action letter covers only the stated facts and binds only staff.
  3. Keep a dated file of every source relied on, noting who issued it; fair-notice defences failed in Terraform (2023) and Ripple, so contemporaneous good-faith records reduce penalties, not liability. Policy built through enforcement can be reversed by a new Commission.

MaterialsThe Third Circuit’s opinion in Coinbase, Inc. v. SEC, No. 23-3202 (13 January 2025), including Judge Bibas’s concurrenceCommissioner Hester Peirce’s dissent ‘Kraken Down’ (9 February 2023) and the SEC press release 2023-25 on the Kraken staking settlementSection I of the SEC’s March 2026 interpretive release on crypto assets (Release No. 33-11412), where the Commission describes its pre-2025 approach

Wonder

  1. What does ‘regulation by enforcement’ actually mean, and is it against the law?
  2. If the SEC thought most tokens were securities, why did it never write a rule saying which ones?
  3. Did the critics win in court, or did they mostly lose?

Explore

  1. A US agency can make policy in two main ways: by writing rules through the notice-and-comment process of the Administrative Procedure Act (APA), or by bringing cases one at a time, which lawyers call adjudication. Federal law generally lets an agency choose. ‘Regulation by enforcement’ is the critics’ name for the SEC’s crypto approach between 2017 and 2024. After the DAO Report (lesson 3.1.5), the agency applied the Howey test (lesson 3.1.1) mostly through enforcement actions rather than a crypto-specific rule. The SEC’s own March 2026 interpretive release acknowledges that some Commissioners and commentators described its earlier approach exactly that way.
  2. Critics pointed to mixed signals. In a June 2018 speech, William Hinman, then Director of the Division of Corporation Finance, said a digital asset ‘all by itself is not a security’. In September 2022 Chair Gary Gensler said that of nearly 10,000 tokens he believed ‘the vast majority are securities’, and in October 2023 that most crypto assets ‘likely meet the investment contract test’. Meanwhile the agency sued token issuers such as Kik, LBRY and Ripple (lessons 3.1.6 and 3.1.7) and then platforms: on 6 June 2023 it sued Coinbase, alleging that it operated as an unregistered exchange, broker and clearing agency.
  3. Some critics sat inside the SEC. On 9 February 2023 Kraken settled charges that its staking-as-a-service program was an unregistered securities offering, agreeing to stop the program and pay $30 million. Commissioner Hester Peirce dissented in a statement titled ‘Kraken Down’. She argued that crypto offerings were not making it through the SEC’s registration pipeline, so registration was not a realistic option, and that ‘using enforcement actions to tell people what the law is in an emerging industry is not an efficient or fair way of regulating’. The core complaint was fair notice: firms said they could not know the rules until they were sued.
  4. Coinbase tested the point formally. In July 2022 it petitioned the SEC to write rules on when digital assets are securities; the SEC denied the petition in a single paragraph. On 13 January 2025, in Coinbase, Inc. v. SEC (No. 23-3202), the Third Circuit held the denial ‘conclusory and insufficiently reasoned, and thus arbitrary and capricious’, and sent it back for a fuller explanation. The court refused to order the SEC to start rulemaking. Judge Bibas, concurring, wrote that the SEC ‘sues the companies individually’ instead of clarifying its views, and that this strategy ‘raises constitutional notice concerns’.
  5. The critics did not win everything. Agencies may still choose case-by-case enforcement, and the Third Circuit noted that staff speeches reflect only the speakers’ views and bind no agency or court. Judges also rejected fair-notice defences in individual cases: in SEC v. Terraform Labs (S.D.N.Y. 2023), the court said the defendants were trying to ‘manufacture’ a notice problem from a position the SEC never adopted. Supporters of the SEC’s approach argued that Howey is deliberately flexible and that many tokens were sold with promises of profit. So the criticism is mostly about policy and the duty to explain, not a rule that enforcement-led policy is unlawful.
  6. The debate changed the agency. On 27 February 2025 the SEC agreed to dismiss its Coinbase case, and Acting Chairman Mark Uyeda said its crypto views had been ‘largely expressed through enforcement actions without engaging the general public’ (lesson 3.2.2). A practical check for any position you read: identify what kind of document it is, whether statute, Commission rule, Commission interpretation, staff statement, speech or settled order (lesson 1.1.3). A settlement binds only its parties, and a speech binds no one. Policy built through enforcement can be reversed by a new Commission, so date each source and note who issued it.

Key facts

  • In a June 2018 speech, SEC Corporation Finance Director William Hinman said a digital asset ‘all by itself is not a security’.
  • On 9 February 2023 Kraken settled SEC charges over its staking program by agreeing to stop it and pay $30 million, and Commissioner Peirce dissented.
  • The SEC sued Coinbase on 6 June 2023, alleging it operated as an unregistered exchange, broker and clearing agency.
  • On 13 January 2025 the Third Circuit held the SEC’s denial of Coinbase’s rulemaking petition arbitrary and capricious but declined to order rulemaking.
  • In SEC v. Terraform Labs (S.D.N.Y. 2023), the court rejected the defendants’ fair-notice argument.
  • The SEC agreed to dismiss its enforcement action against Coinbase on 27 February 2025.

Exercise nine, six, three, one

9CollectList up to 9 statements about whether a token is a security that you have seen quoted, such as a speech, a staff statement, a court ruling, a settled order or a Commission release (some lists are shorter).
6ClusterSort them into 6 categories: statutes, Commission rules or interpretations, court decisions, settled enforcement orders, staff statements, and speeches or interviews.
3DistillReduce the 6 categories to 3 groups: sources that bind everyone, sources that bind only the parties to a case, and sources that bind no one.
1CrystallizeWrite 1 sentence explaining, in your own words, why a speech by an SEC official is weaker authority than a court ruling on the same token.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS