Who truly controls a crypto project? The answer in the SEC’s new guidance
SEC staff have clarified how co-governance is incorporated into the agency’s cryptocurrency framework. Relevant issues extend beyond token voting to include those who can modify the network, control access rights, and implement decisions after proposals are approved.
- On November 2, SEC staff added three new Q&As regarding crypto governance.
- Questions 1.4 to 1.6 relate to the governance group, participation control, and functionality.
- The related SEC interpretation was released on March 17 and took effect on March 23.
- Uniswap's governance process includes a seven-day vote followed by a two-day delay and a two-day timelock.
- In 2023, the CFTC imposed a fine of $643,542 on Ooki DAO.
SEC staff added three new frequently asked questions on cryptocurrency assets, explaining how governance participation and control over the network factor into token classification.
On November 2, the SEC’s Division of Corporation Finance updated its FAQ, adding questions 1.4 to 1.6. The answers distinguish between general participation in shared governance and a coordinated group with effective control.
The underlying principle is that unrelated participants do not automatically become a controlling group simply by participating in a governance system. The same principle may also apply if governance is conducted through an organization, association, or foundation.
The more critical question is: who actually has the power to act—accepting or excluding users, changing upgrade rules, controlling validators, or modifying code. Token voting is only one part of this assessment; it’s also essential to examine through which permissions decisions are implemented.
This SEC governance update focuses on control, not the responsibility of each voter.
The new answer concerns the definition of "central parties" in the institution's cryptocurrency classification framework. They have not established a general rule that voting on token proposals implies responsibility for all actions of the project.
These guidelines represent only the staff's views, carry no legal authority, and impose no new obligations. The committee has neither approved nor disapproved the content of this FAQ.
As crypto.news previously reported, these three new answers distinguish between functional systems and decentralized systems. A network can support the intended use of tokens while still retaining centralized operational, economic, or voting power.
This update also involves delegated voting. The publicly visible token distribution alone cannot indicate how voting rights become concentrated after holders delegate them.
Imagine a project with 10,000 token-holding addresses. If most voting power is delegated to just a few related entities, counting addresses alone would obscure how decisions are actually made.
The reverse may also be true. Several unrelated trustees may vote on the same proposal without having entered into any coordinated agreement.
These examples highlight different factual issues and do not constitute a legal determination of either system. The November response still leaves the classification outcome to the specific facts and circumstances.
The original explanatory filings for March, Nos. 33-11412 and 34-105020, distinguish between crypto assets and transactions or arrangements involving those assets. A non-security token may also be sold as part of an investment contract due to associated promises and managerial efforts.
Therefore, governance is only part of a broader review of assets, systems, and issuance practices. Focusing solely on voting arrangements may overlook statements made by issuers when people purchase tokens.
The five-category taxonomy for this document includes digital goods, digital collectibles, digital tools, stablecoins, and digital securities. The new FAQ expands on specific parts of this framework rather than providing individual classifications for each governance token.
Voting rights and execution rights can be held by different individuals.
A proposal may receive a large number of votes but still requires a small group to execute it. The associated records include both the voting results and the contracted parties or individuals authorized to implement it.
OpenZeppelin's governance documentation distinguishes between voting power, quorum, tallying, and execution. Developers configure these components when building a governance system; the presence of a Governor contract does not mean every project’s setup is identical.
One system may automatically execute approved proposals after a delay. Another system may require multi-signature approval to implement changes, adding an extra layer of authorization between community decisions and final transactions.
Even though both claim to be token-governed, these are different operational arrangements. The governance page should clearly state whether voting is binding, advisory, or a prerequisite for some independent authorized action.
OpenZeppelin's access control model distinguishes this through ownership and roles: a role can authorize specific functions, while a timelock delays operations assigned to it.
Administrators may have permissions over a specific contract but do not control every aspect of the project. For example, treasury signers may be authorized to disburse approved grants but lack the authority to upgrade the protocol.
Permissions must be tracked individually by function. A single label, such as “admin,” does not indicate whether the holder can modify access rules, spend funds, or is limited to performing a narrow set of tasks.
Aave's governance documentation distinguishes between proposal rights and voting rights, and separates the protocol emergency guardian from the governance emergency guardian. Suspending protocol activities and rescinding malicious or erroneous proposals correspond to different responsibilities.
Its documentation provides a concrete example illustrating that actions matter more than titles: two entities both called "Guardian" can assume different responsibilities, each corresponding to distinct failure scenarios.
The SEC's recent update did not make a project-level determination regarding Aave's arrangements. It merely outlines which public records can be referenced when reviewing who can propose changes, who can approve changes, and who can block or enforce changes.
Orders can centralize power without transferring tokens.
Delegation allows token holders to assign voting rights while retaining ownership of the underlying assets. As a result, the final voting distribution may differ significantly from the token ownership distribution.
OpenZeppelin's Votes module describes voting units and their delegation to representatives. Representatives can aggregate multiple voting rights delegated to them by holders and use them for governance decisions.
This is a practical response to participation constraints: not every holder will follow every technical proposal. However, final authority should still be measured based on delegated voting and relevant snapshots, not merely wallet balances.
The ENS governance process requires holders to delegate their voting rights before voting or submitting proposals, even allowing delegation to oneself. It distinguishes between executable proposals and other governance decisions.
This arrangement illustrates that unassigned holdings and actual voting are not the same metric. A project may have many holders, but only a subset of potential voting power may be available for a specific decision.
Assume a total supply of 100 million voting tokens. If 40 million are delegated, and a single validator controls 12 million of those delegated votes, they hold 30% of the delegated voting power but only 12% of the total supply.
Neither of these ratios can be directly equated to the actual percentage of votes cast in a proposal. If a vote receives only 20 million votes, then the same 12 million votes would represent 60% of participation, assuming all those votes are cast.
Each denominator addresses different questions regarding control and participation. Reporting a percentage without specifying the denominator may make the influence appear greater or smaller than what the actual voting record supports.
The quorum in the governance system introduces another condition: a proposal may fail even if it receives majority support among votes cast, if it does not meet the required level of participation set by the rules.
Uniswap’s governance glossary distinguishes between delegates, quorum, proposals, and timelocks. These definitions help readers connect token distribution with the actual pathway by which proposals become protocol actions.
Therefore, critical evidence is time-stamped: the delegation weight of the relevant block, the actual number of votes, whether quorum was reached, and the execution status. Current wallet rankings cannot automatically reconstruct the power available during a past vote.
A properly functioning network may still retain powerful administrators.
Functionality refers to whether an asset can be used as intended by the system design. Decentralization concerns who retains operational and decision-making control; therefore, an active product cannot simultaneously answer both questions.
One network may continuously process transactions while a designated entity controls the list of validators. Another network may permit open validation but still retain a privileged upgrade key for a central contract.
These are hypothetical configurations, not labels assigned to specific tokens. They illustrate that trading activity, software availability, and governance permissions describe different aspects of the system.
The Arbitrum charter provides a clear case of administrative authority. It grants chain ownership powers to the Governance and Security Committee and sets a threshold of 9 out of 12 votes for emergency actions.
The charter also requires a transparency report to be submitted after an emergency intervention. Thus, its governance framework acknowledges exceptional human decisions while also recognizing the network’s routine automated operations.
Emergency mechanisms can be designed to protect users, but they remain a privilege that warrants scrutiny. Their existence should be clearly described, including who controls them and whether normal delays can be bypassed.
L2BEAT's evaluation of rollups treats upgrade permissions and emergency powers as distinct risk dimensions from verification and data availability. This framework helps differentiate the network's technical verification from its remaining trust assumptions.
This comparison does not determine securities status but provides an operational-level description of powers for legal analysis under the applicable framework.
Uniswap’s disclosed governance process includes a 2-day waiting period on the chain, a 7-day voting period, and a 2-day timelock. A successful vote and the expiration of the execution delay remain two distinct events.
This delay provides participants with a clear time window before the approved action is executed. Whether every privileged action must follow this process depends on the permissions granted by the actual contract.
Therefore, complete instructions should list both exceptions and standard procedures. Permissions that allow immediate suspension, cancellation, or escalation cannot be inferred from the general schedule that applies to ordinary proposals.
DUNI distinguishes its legal entity from its service providers.
The SEC mentioned organizations and foundations in response to a practical issue facing DAOs: shared governance may require contracts, tax management, and other work outside the blockchain.
The Uniswap Foundation describes DUNI as a Wyoming-decentralized unincorporated nonprofit association, designed to grant legal recognition to governance. Its purposes include entering into contracts, managing funds, and protecting participants from liability arising from the collective actions of the organization.
The foundation's position is that legal structures and community governance can coexist. It does not present this legal entity as a substitute for the token voting process.
The DUNI association agreement outlines its purpose and membership criteria, linking membership to UNI ownership and participation in the governance protocol, including participation in specified forms.
The document also separately defines the treasury and governance principles. These definitions establish legal relationships surrounding governance activities, rather than making all companies serving the ecosystem part of a single organization.
The proposal establishes distinctions among the association agreement, the administrator agreement, and the transactional agency agreement. On-chain preparations include content hashes used to link proofs to off-chain documents.
This structure provides participants with verifiable records to confirm permissions. The service provider’s contractual responsibilities can be compared against decisions reserved for governance and on-chain approved instructions.
It also raises questions that cannot be answered by the DUNA label alone: who can modify the protocol, direct service providers, terminate relationships, or approve expenditures depends on governance documentation and actual permissions.
The regulations enacted by Wyoming provide a state legal framework for decentralized unincorporated nonprofit associations. The state legislature's 2026 amendments address matters such as conversion, definitions, and liquidation requirements.
The mere existence of a state-law entity does not resolve the federal classification of tokens. The powers of the entity and the obligations of participants stem from a different set of criteria than those used by the SEC in its analysis of assets and investment contracts.
Therefore, public documents must be read together. A DAO’s use of a legal wrapper only indicates its organizational structure; it does not prove which entity holds effective operational control or whether a particular transaction complies with federal securities laws.
The service agreement outlines what the administrator can actually do.
DUNI's disclosed protocols are more detailed than mere "legal wrappers." They specify concrete administrative tasks, compensation, responsibilities, and termination arrangements beyond the on-chain governance structure.
The administrator engagement agreement entrusts Administrator Services (a subsidiary of Cowrie) with the preparation of financial statements, tax matters, and the management of designated payments. The disclosed engagement period extends until the completion of the 2026 tax filing, expected in the third quarter of 2027.
These documents distinguish the company’s administrative services from David Kerr’s individual authorization to sign tax forms. They also establish fiduciary duties for the stated functions and arrange a transition period for replacing the administrator.
This falls under task-based permissions. Preparing accounts or executing authorized tax payments does not equate to changing the protocol's consensus rules or redirecting its treasury without approval.
The agency agreement for transactions separately records the relationship with the designated agent. It outlines independent performance and obligations related to the financial responsibilities assigned under the agreement.
Different contracts can assign varying responsibilities without treating each service provider as the same governing entity. They also create records that can be used to verify the actual behavior of service providers.
The foundation’s protocol summary distinguishes ordinary members from administrators or agents authorized to perform specific tasks. It states that membership alone does not grant anyone the authority to sign contracts or act on behalf of the association.
Membership does not grant any claim to the assets or profits of DUNI. Therefore, in this structure, governance participation, legal membership, and economic rights are distinct concepts.
Imagine a member voting in favor of a budget but lacking the authority to sign contracts with service providers. The vote records their participation in organizational decision-making; appointments and agreements specify who can subsequently bind the organization.
Subsequently, administrators may be granted the authority to pay approved invoices from the designated account. Reviewing this authority requires examining the agreement and authorization decisions, rather than assuming that all participants who voted can make independent payments.
This structure also leaves open a factual question: how real-world instructions operate. A precisely worded authorization can be compared against the transactions it generates, determining whether a given expenditure falls under an existing agreement or requires a new governance decision.
The service agreement includes a monthly base fee of $100, plus the amounts specified for accepted tasks. Based on the monthly fee outlined in the agreement, the total for 12 months amounts to $1,200, excluding any additional tasks.
This figure represents the compensation for the specified role, not the total cost managed by DUNI. Other hires, tax-related work, and approved expenses each have their own terms and should not be quietly merged into this single number.
The termination clause also specifies who can end this relationship. DUNI may be terminated through a valid governance proposal under the agreement, while an agent’s termination without cause requires 60 days’ prior written notice.
These terms establish a continuous oversight mechanism that differs from token holders' ability to vote on protocol upgrades. The organization needs both to replace individuals executing off-chain instructions and to modify the process for adjusting software parameters.
The contract does not grant each participant the right to unilaterally terminate the service provider. Individual objections and governance decisions that comply with governance requirements are two distinct events.
These records both demonstrate the boundaries of discretion and the existence of discretion. The service provider performing specific accounting tasks is not the same as the party that can unilaterally determine the project’s operational rules.
The SEC’s FAQ does not classify an arrangement solely because it involves a contract. It asks, under the applicable framework, who has control; the contract provides evidence of what responsibilities the participants actually assumed.
This distinction is bidirectional. Forming an association does not prove that power is decentralized; appointing someone to perform a specific service does not prove that they control the entire system.
The public terms make the issue more specific: which decision is delegated, what conditions limit it, and which entity can replace the service provider? The answers may differ among financial management, protocol upgrades, and grant allocation.
Past DAO cases raised different legal issues.
Token holders have reason to distinguish the SEC’s classification guidance from litigation regarding whether an organization is subject to prosecution. The facts may overlap, but the legal tests are different.
The Lido controversy began when an investor alleged that LDO was sold as an unregistered security. The initial investor lawsuit raised claims regarding the token sale and the participants' roles within the organization.
A November 2024 district court ruling rejected the argument that an organization is immune from litigation solely due to its DAO structure. This historic ruling must be distinguished from the final determination of each defendant’s individual liability.
The court’s order issued on November 18 in case 23-cv-06492-VC addressed the motion to dismiss. The court found that the plaintiff had adequately alleged a general partnership and permitted claims against certain institutional participants to proceed.
The litigation stage is emphasized because the court at that time assessed whether the alleged facts were sufficient to support a claim, rather than determining through trial that every LDO holder was a partner responsible for all actions of the protocol.
The proposal in Lido governance to appoint litigation counsel highlights another practical issue: the proposal suggests funding a limited-purpose legal entity while explicitly addressing whether the DAO is legally recognizable as a partnership or association.
Therefore, an organization may need mechanisms to respond to litigation while challenging the legal theories on which the lawsuit is based. Appointing a representative is not the same as acknowledging the underlying claims.
Ooki DAO took a different path. After missing the deadline to respond, the CFTC sought a default judgment against the organization.
In its June 2023 statement, the agency stated that the ruling includes a civil penalty of $643,542, a trading and registration ban, and related remedies concerning the website. The court determined that a DAO can be considered a “person” under the Commodity Exchange Act.
This outcome applies only to the organization and the conduct alleged in the case, and should not be interpreted as a general ruling applicable to every voter in any DAO.
The staff Q&A on November 2 did not claim to overturn these cases or rewrite state partnership laws; it addressed the classification of crypto systems under the SEC framework and the role of central parties within them.
The proposed financing rules address another part of the issue.
The SEC's November staff update proceeds alongside another rulemaking process. Its August 18 proposal, Regulation Crypto Assets, pertains to offerings related to certain crypto investment contracts.
The proposal would establish two registration exemptions, accompanied by cryptocurrency-specific disclosure requirements, and a conditional safe harbor for investment contracts. These are proposed rules, not new exemptions created in the November FAQ.
The financing framework includes a startup pathway with a maximum of $5 million over four years, and an independent financing pathway with a maximum of $75 million over a rolling 12-month period. These thresholds apply to their respective proposed pathways.
A project cannot assume it qualifies for an exemption solely because its token holders vote independently. Eligibility depends on compliance with applicable rules, including required disclosures and other restrictions that apply if a proposal is adopted.
In his statement on the proposal, SEC Chairman Paul Atkins said the effort aims to align capital-raising rules with non-security crypto assets sold as investment contracts. This distinction preserves separate review of the sale arrangements.
Commissioner Mark Uyeda’s statement addressed the difficulties issuers face when using registration processes designed for other securities. Both statements explain the agency’s policy rationale; however, neither replaces the actual conditions outlined in the proposal.
Proposal document 33-11434 provides a detailed framework for the proposed exemptions and safe harbors. It is not the same document as the interpretive release from March or the subsequent staff FAQ.
Therefore, these three documents are at different stages of the process: the March document states the committee’s interpretation, the August document proposes the rule, and the November FAQ provides staff responses to questions arising under that interpretation.
Mixing them together and claiming that the SEC has granted new exemptions to every DAO would obscure the status and scope of each action. The relevant question is: Which document applies to the asset, issuance, or governance arrangement under review?
The same rigor applies to legislation. Staff responses cannot complete congressional voting, establish statutory registration categories, or replace conditions that lawmakers may ultimately enact.
Documents revealing control have been made public in many projects.
Effective review should begin with contracts and agreements that assign authority, then cross-reference them with actual decisions. The project’s own descriptions should be verified against who proposed, approved, canceled, and executed the most significant recent changes.
The governance contract will specify voting rules and proposal statuses. Access control logs will identify privileged roles. Treasury transactions will show who released assets and where they were sent.
The terms of service further clarify which decisions can be made independently by the service provider and which require community approval. The separate DUNI agreement explains why the legal responsibilities of administrators should be distinguished from governance itself.
For the delegation system, influence should be measured at the relevant snapshot time. The weight currently held by a representative may differ from the weight available when a previous proposal was passed.
Aave's explanation of voting describes voting power as qualified balances and delegations on Ethereum. Its proposal guidelines distinguish approval requirements from the cross-chain process used to execute successful decisions.
Therefore, the gap between voting and execution may involve both time and infrastructure. A proposal may pass on one chain, but the message still needs to be delivered to a contract on another chain.
The records also reveal the boundaries of powerful entities. A role that can cancel malicious proposals may not have access to the treasury, and a treasury administrator may not be able to modify the protocol software.
These boundaries are specific, verifiable facts that the project can publicly disclose and readers can check. They offer a more precise description than statements such as the number of token holders or "all governance is on-chain."
The November FAQ leaves certain categories open to specific circumstances. It does not list an approved list of governance tokens, provide a general waiver of responsibility, or endorse any set of emergency permissions at the project level.
Its footnote defines the broad governance characteristics associated with staff: timely public recordkeeping, pre-established procedures, and participation that is highly centralized without reliance on or coordination by intermediaries, including delegation.
What should you pay attention to?
- Permission changes: Have upgrades, access controls, and emergency roles been transferred or removed?
- Voting Concentration: Voting power at the snapshot time of the proposal, along with the associated entities and coordinating arrangements that have been recorded.
- Execution record: Has the approved proposal taken effect according to the published process and waiting period?
- Physical agreement: Decisions that can be made independently by the foundation, association, administrator, or service provider.
- Regulation status: Subsequent committee actions regarding Regulation on Crypto Assets are separate from the staff FAQ update.
Frequently Asked Questions
What did SEC staff change on November 2?
They added questions 1.4 to 1.6, covering governance groups, participation control, and the distinction between functionality and decentralization.
Does voting automatically make someone a central party?
No. The guidance distinguishes between ordinary participation by unrelated holders and coordinated arrangements and effective control; the outcome depends on the facts.
Can a foundation coexist with decentralized governance?
The staff's response allows for this possibility. The organizational structure alone does not prove who controls the system.
Is a fully functional network necessarily decentralized?
No. Tokens can operate according to their programmed purposes, but operational, economic, or voting rights may still be centralized.
Has the SEC approved Uniswap or other governance tokens?
The FAQ provides general responses from staff and does not grant individual approvals or general exemptions for any specific token.
Will these responses absolve DAO participants of responsibility?
They address classification issues within the SEC framework. Issues related to state law entities, specific behaviors, and court claims still require separate analysis.
Have crypto assets been made available as a new exemption?
The August document discussed here is a proposal with separate conditions and procedures; it was not adopted in the November FAQ.
What records help prove who controls a project?
Related records include role permissions, delegated voting, governance protocols, and executed proposal transactions. This article is for educational analysis only and does not constitute investment advice.