US Tokenization Regulation: SEC, CFTC, Howey Test, and the Path to Compliance

Overview

US digital asset regulation is defined by jurisdictional overlap, enforcement-led development, and the foundational ambiguity of the Howey test — a 1946 Supreme Court doctrine that has become the primary analytical tool for determining whether a token is a security. The result is a compliance environment that demands legal precision, documented analysis, and an enforcement-aware design philosophy.

Despite legislative progress — the Financial Innovation and Technology for the 21st Century Act (FIT21) passed the House in May 2024 — the US remains without comprehensive digital asset legislation at the federal level. Compliance officers must navigate a dual-regulator landscape (SEC for securities, CFTC for commodities), a state-level money transmission regime with 50-jurisdiction variance, and an evolving bank regulator posture on digital asset custody and settlement.

The market stakes are enormous. BlackRock’s BUIDL tokenized Treasury fund reached $1.7 billion in AUM within months of its March 2024 launch. Franklin Templeton’s BENJI fund, WisdomTree’s tokenized funds, and Ondo Finance’s OUSG demonstrate that the institutional tokenization market is operational in the US — built on legal frameworks assembled through private legal analysis rather than express regulatory authorization.

Primary Regulators

SEC (Securities and Exchange Commission): Jurisdiction over securities and the entities that issue, trade, or provide investment advice with respect to them. Chairman Gensler’s SEC (2021–2025) pursued aggressive enforcement action against digital asset businesses on the theory that most tokens are unregistered securities. The 2025 SEC transition has signaled a more permissive posture, rescinding SAB 121 (replaced by SAB 122 in January 2025) and creating a dedicated crypto task force.

CFTC (Commodity Futures Trading Commission): Jurisdiction over commodities and derivatives. Bitcoin and Ether have been treated as commodities by the CFTC, giving it regulatory jurisdiction over spot and derivatives markets in those assets. The CFTC has also asserted jurisdiction over DeFi protocols involving commodity derivatives.

OCC (Office of the Comptroller of the Currency): Regulates national banks and federal savings associations. Has issued a series of interpretive letters (IL 1170, 1172, 1174, 1179) clarifying that banks may custody cryptocurrency, participate in blockchain networks, and issue stablecoins.

FinCEN (Financial Crimes Enforcement Network): Administers the Bank Secrecy Act (BSA). Crypto exchanges and wallet providers qualify as Money Services Businesses (MSBs) and must register with FinCEN, implement AML programs, file SARs, and comply with the Travel Rule for transfers over $3,000.

The Howey Test and Security Token Classification

The Howey test, derived from SEC v. W.J. Howey Co. (1946), determines whether an instrument is an “investment contract” and therefore a security subject to SEC registration. A token is likely a security if:

1. There is an investment of money
2. In a common enterprise
3. With a reasonable expectation of profits
4. Derived primarily from the managerial efforts of others

Application to tokens is contested and fact-specific. The SEC’s position — most extensively articulated in its complaint against Ripple (filed December 2020) — is that most tokens satisfy the Howey test and therefore constitute unregistered securities.

Ripple (XRP) partial win (2023): Judge Torres’s July 2023 ruling in SEC v. Ripple Labs found that XRP sold to institutional investors via contracts was a security, but XRP sold on exchanges to retail investors (programmatic sales) was not — because retail buyers could not reasonably be expected to have invested with expectation of profits from Ripple’s efforts. This “split” ruling has created significant analytical complexity for issuers.

For tokenized real-world assets (tokenized Treasuries, tokenized equity, tokenized bonds), the Howey analysis is typically straightforward: the underlying instrument is a security, and the token representing it inherits that classification. The more complex questions arise for utility tokens, governance tokens, and tokens with mixed characteristics.

Registration Exemptions for Security Token Issuance

Because SEC registration is a lengthy and costly process (and is effectively unavailable to most digital asset issuers under current SEC posture), token issuers relying on securities classification typically structure offerings under registration exemptions:

Regulation D (Rule 506(b) and 506(c)): The primary exemption for private placements. 506(b) limits to 35 non-accredited investors; 506(c) allows general solicitation to verified accredited investors only. No dollar cap. Not available for resale to the public; secondary market liquidity is constrained (Rule 144 one-year holding period for affiliates).

Regulation A+ (Tier 2): Permits public offers to non-accredited investors up to $75 million per 12-month period, with SEC qualification (not full registration). Requires offering circular, audited financials, and ongoing reporting. More burdensome than Reg D but permits retail distribution.

Regulation S: Exempts offers and sales made outside the United States to non-US persons. Standard tool for international distribution alongside Reg D. Requires Category 1, 2, or 3 compliance depending on issuer type and target market.

Regulation CF (Crowdfunding): Up to $5 million per 12-month period via registered crowdfunding platforms. Low cap limits utility for institutional tokenization.

Most institutional tokenized products (BlackRock BUIDL, Franklin Templeton BENJI, Ondo OUSG) are structured as Reg D 506(c) private placements, restricting investors to qualified purchasers ($5M+ investable assets) and leveraging on-chain whitelisting (ERC-3643 or Tokeny-compatible) to enforce transfer restrictions.

FIT21: Financial Innovation and Technology for the 21st Century

The House passed FIT21 (H.R. 4763) in May 2024 by a bipartisan 279-136 vote — the most significant legislative milestone for US digital asset regulation since the Bank Secrecy Act’s extension to MSBs. Key FIT21 provisions:

• Establishes a framework for determining whether a digital asset is a security (SEC jurisdiction) or a commodity (CFTC jurisdiction) based primarily on whether the underlying blockchain is “functionally decentralized”
• Creates a “digital commodity” category under CFTC jurisdiction for sufficiently decentralized networks
• Provides a registration pathway for digital asset exchanges dealing in both securities and commodities — a single-window approach
• Requires customer asset segregation, disclosure, and operational standards for registered digital asset exchanges

As of February 2026, FIT21 had not been enacted into law. The Senate trajectory and administration policy have shaped a more incremental implementation via regulatory agency action rather than comprehensive legislation.

SAB 121 and SAB 122

SAB 121 (Staff Accounting Bulletin 121, issued March 2022) required public companies custodying crypto assets on behalf of clients to record those assets as liabilities on the balance sheet — effectively making bank custody of crypto economically prohibitive by inflating leverage ratios. Major bank custodians (BNY Mellon, State Street) were restricted from scaling crypto custody services under SAB 121.

The SEC replaced SAB 121 with SAB 122 in January 2025, withdrawing the blanket balance sheet treatment and permitting companies to assess crypto custody obligations using existing accounting frameworks (ASC 450, IAS 37). SAB 122 substantially reduces the accounting disincentive for bank custody of tokenized assets and is expected to accelerate institutional entry into crypto custody.

OCC Crypto Custody Guidance

The OCC has progressively authorized national banks to:

• Hold cryptocurrency as custodians for clients (IL 1170, July 2020)
• Participate as nodes in blockchain networks (IL 1174, January 2021)
• Hold reserve assets backing stablecoins (IL 1172, September 2020)
• Use public blockchains and stablecoins for payment activities (IL 1179, January 2021)

These interpretive letters, while not having force of law, provide the legal foundation for major bank custody programs. BNY Mellon, the world’s largest custodian by AUC, received SEC no-action relief in 2022 to custody digital assets for investment manager clients.

State-Level Requirements: Money Transmission and BitLicense

In addition to federal requirements, tokenization businesses must comply with state money transmission laws in each state where they operate. The 50-state licensing landscape is the most operationally burdensome aspect of US digital asset compliance:

Money Transmitter Licenses (MTLs): Required in most states for any business transmitting money or value on behalf of others. Digital asset exchanges and wallet providers typically require MTLs. Costs range from $1,000 to $500,000+ in aggregate across all states.

BitLicense (New York): The New York Department of Financial Services (NYDFS) BitLicense, in force since 2015, is the most demanding state-level digital asset license in the US. Requirements include: minimum capital (case-by-case), bonding, a compliance officer, AML program, cybersecurity program per NYDFS Part 500, and annual third-party audits. The NYDFS Limited Purpose Trust Charter is an alternative for custodians (used by Paxos, Gemini Trust).

Conference of State Bank Supervisors (CSBS) Model Law: The Money Services Businesses Modernization Act model framework has been adopted by multiple states, creating some harmonization, but 50-state compliance remains standard practice for nationally operating businesses.

FinCEN MSB Registration and Travel Rule

MSB registration with FinCEN is required for any crypto exchange or money transmission business operating in the US. Registration is free and takes approximately 30–60 days but triggers BSA compliance obligations:

• AML Program: written policies, designated compliance officer, internal controls, training, and independent testing
• Suspicious Activity Reports (SARs): filed for transactions of $5,000+ involving suspected criminal activity
• Currency Transaction Reports (CTRs): for cash transactions over $10,000 (rarely applicable to crypto)
• Travel Rule (31 CFR 1010.410(f)): Originator and beneficiary information for transactions of $3,000 or more must be collected and retained; transmission to receiving institution required above $3,000

Compliance Checklist: US Tokenization Operations

• Conduct and document Howey test analysis for each token — retain securities law counsel; consider private letter ruling process with SEC for novel instruments
• If token is a security: select registration exemption (Reg D 506(c) for accredited/QP-only; Reg A+ for retail access up to $75M; Reg S for offshore)
• Register as MSB with FinCEN; implement BSA/AML program
• Implement Travel Rule compliance for transfers of $3,000+ — integrate approved compliance technology solution
• Complete state MTL analysis; obtain required money transmitter licenses or apply for NY BitLicense if serving New York residents
• For broker-dealer operations in security tokens: pursue FINRA-member broker-dealer registration or alternative trading system (ATS) registration
• Review OCC custody guidance (SAB 122 landscape) if planning institutional custody operations
• For tokenized fund products: structure as Reg D fund; engage registered transfer agent for tokenized share recordkeeping; implement investor whitelist (ERC-3643 or equivalent)
• Monitor FIT21 legislative developments and SEC crypto task force guidance
• Engage securities counsel on state Blue Sky law compliance for Reg D offerings with general solicitation

Authority References

• FCA crypto guidance (cross-reference)
• BIS — Crypto policy and tokenization

For comparison of US Reg D vs. MiCA CASP licensing for cross-border tokenized product distribution, see the Licensing Matrix. For analysis of US tokenized fund platforms, see Platform Benchmarks. For Howey test and securities law terminology, see the Regulatory Encyclopedia. See also our detailed MiCA analysis for EU comparison.