IOSG says the U.S. Securities and Exchange Commission’s proposed Regulation Crypto Assets, or Reg CA, is not a clean restart for large-scale token issuance in the United States. In its reading, the proposal matters more as a framework for existing tokens to eventually shed securities status than as a launchpad for a new ICO wave.
The SEC released the proposal on Aug. 18, 2026. It was published in the Federal Register on Aug. 21, and the public comment period runs through Oct. 20. The rule has not taken effect and remains a proposal.
IOSG’s core view: not ICO 2.0, but a clearance mechanism for outstanding tokens
The analysis argues that Reg CA will not trigger what the market has been calling ICO 2.0. New token issuance would become easier, but only in a narrow band. The lightest-touch path, Rule 200’s startup exemption, applies to no more than $5 million in cumulative fundraising over four years. The same token can rely on it only once, and airdrops, staking rewards, and governance incentives may count toward the cap. IOSG says that size is too small to carry a full market cycle.
The paper also points to the SEC’s own paperwork burden estimates. The agency projected about 130 crypto-related offerings a year under the two issuance exemptions combined, with 99 under the startup exemption and 31 under the fundraising exemption. IOSG says that estimate does not assume any surge in issuance. It largely maps existing crypto-related activity under Reg D, Reg A, and Reg CF into the proposed regime.
Rule 400, the investment contract safe harbor, points in a different direction. It is open not only to issuers that use Reg CA’s issuance exemptions, but also to issuers that did not. The SEC estimated that 475 issuers a year could rely only on Rule 400 without using either issuance exemption. That is about 3.6 times the combined total for the two offering channels. In IOSG’s view, that ratio shows where the SEC’s center of gravity sits: clearing legal status for outstanding tokens, not boosting fresh capital formation.
The timing: White House support, SEC rulemaking, and CFTC activity in the same week
IOSG places Reg CA inside a broader shift in U.S. crypto policy. On Aug. 19, one day after the proposal was released, Trump met crypto executives at the White House. According to the article, attendees included Coinbase, Gemini, Ripple, Chainlink Labs, Kraken, Anchorage, Grayscale, and OKX. Trump publicly urged Congress to pass what he described as a fair version of the CLARITY Act.
That same week, the Commodity Futures Trading Commission held its first Innovation Advisory Committee meeting. SEC Chair Atkins released Reg CA while also urging Congress to send the CLARITY Act to the president’s desk. IOSG says those events point to the same conclusion: the U.S. approach has shifted from waiting on Congress to an administrative-first model, with the White House setting tone, the SEC writing rules, and the CFTC building parallel support, while legislation follows later.
The market reaction during that week is part of the backdrop in the analysis. Bitcoin was still above $64,000 on Aug. 18, the day the proposal was released. After the White House meeting on Aug. 19, it rose above $70,000 for the first time since late May. Combined with Treasury buybacks, lower long-end yields, and ETF inflows, the intraday high for the week reached $77,600. IOSG says the weekly gain was about 22%, the biggest weekly rise in more than two years.
Why Reg CA appeared: an administrative substitute after legislative delay
IOSG argues that Reg CA did not emerge in isolation. It is an administrative alternative that took shape after the CLARITY Act stalled.
The CLARITY Act passed the House in July 2025 and the Senate Banking Committee in May 2026, but it still had not reached a full Senate vote. On Aug. 8, the Senate filed a cloture motion, then recessed until Sept. 13, missing the pre-recess window. The next key date is Sept. 15, when a motion to proceed is due to face a 60-vote threshold. IOSG says that if the motion passes, legislation still has a path this year. If it fails, the election calendar would make passage materially harder. As of publication, the paper says Polymarket priced the probability of CLARITY passing this year below 20%.
The SEC did not wait for that outcome. In an Aug. 18 statement, Atkins said forcing crypto assets into existing securities rules was like trying to fit a square peg into a round hole. He said that approach had pushed investment offshore and limited protections available to U.S. investors. He described the rule’s goal as a “minimal effective dose, maximum construction freedom, and sustainable certainty,” then said the agency was building a road to bring innovators back to the United States.
IOSG says Reg CA and the CLARITY Act are aimed at the same broad problem, but they do not do the same job. The CLARITY Act is legislation. It can amend both the Securities Act and the Commodity Exchange Act, redraw the boundary between the SEC and the CFTC, and create market structure rules. Reg CA is only an administrative rule. It cannot amend statutes, it cannot reach the CFTC side of the market, and a later commission or a court could undo it. The difference in scope matters too. CLARITY covers issuance, trading venues, brokers, and custody. Reg CA is mostly about how tokens can be issued and under what conditions they can stop being securities.
The structure of the proposal: two issuance exemptions, one safe harbor, and a state-law pathway
IOSG says Reg CA is designed to be added to Part 228 of Title 17 of the Code of Federal Regulations. The proposal revolves around four parts: two issuance exemptions, one investment contract safe harbor, and one route for preempting parts of state securities law.
Rule 200: small offerings can start after filing, but only once
Rule 200 covers smaller offerings. Under the proposal, if an issuer raises no more than $5 million in cumulative proceeds over four years, it can begin sales after filing a Form NOR on EDGAR. The SEC would not conduct pre-sale review, and financial statements would not be required. The issuer would instead provide narrative disclosure on the investment contract structure, token specifications, management team, token economics, governance, and risk factors.
IOSG says the most important features are not the $5 million figure alone, but several details around it.
- First, the issuer does not need to be a U.S. entity. The text says an issuer may be an entity, an individual, or a group of individuals or entities. The preamble also says the startup exemption does not require a U.S. entity. That leaves the door open to Cayman foundations, BVI vehicles, or even developer teams that have no formal entity at all.
- Second, covered transactions extend well beyond direct fundraising. Rule 100 expressly includes airdrops and rewards or incentives for operating, governing, or securing a related network. IOSG says that means airdrops, staking rewards, and governance rewards can count toward the $5 million cap.
- Third, the exemption is one-time use, and the restriction reaches affiliates. The same issuer and its affiliates can rely on it only once for the same or a “substantially similar” crypto asset. IOSG notes that “substantially similar” is not defined in Rule 100, and the SEC itself asked in the proposal whether a de minimis threshold should be added.
The analysis also flags a timing issue. The exemption covers only transactions that occur after the Form NOR is filed. Any public communication before that filing could be treated as an unprotected offer.
Rule 300: higher fundraising limits, but with demanding U.S. nexus requirements
For larger offerings, the proposal turns to Rule 300. It creates two tiers. Tier 1 would allow up to $20 million in any 12-month period. Tier 2 would allow up to $75 million in any 12-month period. Both require a Form 1-CRYPTO and SEC qualification before sales can begin, followed by ongoing disclosure. In return, issuers may test the waters before filing.
On financial reporting, Tier 1 requires U.S. GAAP-compliant statements without an audit. Tier 2 requires audited financial statements.
IOSG says the real barrier here is not the amount raised, but the issuer requirements. The rule requires a U.S.-organized entity and imposes three cumulative tests: a majority of officers or directors must be U.S. citizens or residents, more than 50% of assets must be located in the United States, and the business must be primarily managed in the United States. In practice, IOSG argues, that means an offshore team would not qualify by simply adding a Delaware subsidiary. It would amount to a much deeper onshoring of the project.
Retail investment limits are tighter as well. In both tiers, non-accredited investors would be capped at 10% of the higher of annual income or net worth, with no carve-out equivalent to the listed-securities exception under ordinary Reg A. IOSG gives the example of a retail investor with $200,000 in annual income and $500,000 in net worth, whose maximum purchase would be $50,000.
Still, the paper says that 10% limit would be difficult to police in crypto markets. Issuers can rely on investor representations so long as they do not know the statements are false. On-chain, however, issuers usually cannot verify income or net worth, aggregate a buyer’s activity across multiple wallet addresses, or know what the same buyer purchased from other issuers.
IOSG also points to comments filed by a16z and Coinbase with the SEC’s crypto task force. Both asked the SEC to restrict token sales by development teams and affiliates for their own accounts. Coinbase’s submission said teams and affiliates should be limited from selling tokens for their own account until the network or protocol is sufficiently decentralized, in order to preserve economic incentives to complete the project. The SEC acknowledged that risk in the proposal, IOSG says, but chose disclosure over a holding-period requirement.
Rule 400: when a token can stop being a security
IOSG treats Rule 400 as the heaviest part of Reg CA because it addresses the key question directly: when does a token stop being a security?
Under the proposal, the answer turns on two conditions. The issuer must have completed, or permanently ceased, all promised core managerial efforts under the relevant investment contract, and it must make no new such promises. It must then file a Form TR transition report with the SEC. Once that happens, the proposal says the investment contract is deemed no longer to exist, and the crypto asset attached to it would no longer be a security for purposes of the Securities Act and the Exchange Act.
IOSG spells out the practical effects. Future issuance and transfers of the token would no longer need another exemption or registration. Platforms trading that token would not have to register as securities exchanges or brokers solely because of the token. Institutions holding it would no longer be bound by securities custody rules on that basis. The issuer would also stop carrying ongoing reporting obligations under the federal securities laws.
That does not erase all regulation. Federal anti-fraud provisions would still apply, as would commodity regulation, state anti-fraud rules, and consumer protection law. IOSG stresses that the safe harbor is not a license. The proposal states that, like any safe harbor, it applies only to the extent the issuer satisfies its conditions, and the SEC remains free to challenge whether those conditions were actually met.
The paper gives a concrete example. If a project sold tokens through a Reg D 506(c) private offering in 2021 and promised three things in its white paper — launch the mainnet, open-source the client, and hand governance to a DAO — then after all three are completed, it could file a Form TR and state that those commitments have been fulfilled and no new core managerial promises are being made. In that case, the token could be treated as no longer being a security.
The proposal also states that once a related network reaches “functional” status, services to secure, maintain, improve, or enhance the network, including sponsoring or funding development projects, do not count as core managerial efforts. IOSG says that language effectively abandons a central enforcement theory used from 2018 through 2024: that continued foundation-led development means continued managerial efforts.
Using Rule 400 as a rough screen, IOSG groups major tokens into three buckets. One includes assets that likely do not need the rule, such as BTC and ETH, which in practice have not been handled as securities. Another includes what the paper calls classic graduation candidates: tokens that raised capital through a clear token sale, delivered the mainnet and the core functionality promised in their white papers, and still have a foundation or entity that can sign filings. IOSG names DOT, FIL, SOL, NEAR, and AVAX in that category, while expressly saying that this does not mean they have already received legal determinations. The third bucket includes cases that remain hard to fit into the safe harbor. Ripple, IOSG says, is still actively operating and making promises to the market, so “permanent cessation” of core managerial efforts does not do much work there. Tokenized securities and RWA are excluded because the contractual structure ties the token to assets outside the token itself.
For governance tokens such as UNI and AAVE, IOSG says the issue is not distribution. It is the final signature. If a protocol is governed by a DAO, the threshold question becomes who can sign on behalf of the issuer at all.
Rule 500: state-law preemption is crucial, and also exposed
IOSG says Rule 500 addresses the application of state blue-sky laws and may be the single most difficult feature to replicate through existing exemptions.
U.S. securities regulation runs on both federal and state tracks. Clearing the SEC layer does not automatically clear the states. In theory, an issuer must still address registration or exemptions in every state where investors are located. Federal law solves that problem for certain assets through the concept of a “covered security,” which displaces state registration and qualification requirements.
Rule 500 uses a technical route to get there. It redefines “qualified purchaser” to include anyone who buys in a Reg CA offering, and anyone who engages in a covered investment contract transaction with a seller that is not the issuer, an underwriter, or a dealer. Once the buyer falls in that bucket, the asset is treated as a covered security and state registration and qualification rules are preempted.
In practical terms, IOSG says, that means a token issued under Reg CA could later be sold by A to B on Coinbase, and if A is not the issuer, an underwriter, or a dealer, that transaction would not need to be registered or separately exempted state by state. IOSG argues that no current exemption provides that kind of secondary-market effect.
The protection is not fixed forever. It depends on the issuer continuing to file periodic reports, and current reports do not count for this purpose. If those filings lapse, the preemption stops and only resumes after the deficiency is cured. IOSG says that creates a new form of moving compliance risk for secondary-market participants: a token may qualify for state-law preemption today and lose it tomorrow, while holders may not know in real time.
The paper also says Rule 500 is politically fragile because it directly cuts into state regulatory authority. State securities regulators are likely to object during the comment period. The SEC itself asked whether “qualified purchaser” should include income, net worth, or investment-asset thresholds, and whether secondary-market trades should be included at all.
What is actually new compared with existing exemptions
IOSG frames the contrast in historical terms. For roughly 90 years, U.S. companies raising money from the public had two doors. One was registration: file an S-1, go through review, and carry ongoing disclosure and legal liability. The other was an exemption: lighter procedure, but with trade-offs somewhere else. Reg D limits sales to accredited investors. Reg CF imposes a one-year resale lockup. Reg A requires qualification and, in some cases, audits.
Reg CA, IOSG says, is the first framework that tries to cut that leash at the issuance stage for crypto assets only. The paper reduces the difference to three points.
- First, it creates a small-raise pathway that did not exist before. Below $5 million, an issuer could file and start, without prior review, without financial statements, while publicly soliciting, selling to everyone, and allowing immediate transferability.
- Second, it extends state-law preemption into the secondary market. Traditional exemptions generally cover the first sale by the issuer, not later trades.
- Third, and most important, it gives securities status an endpoint for the first time. Shares sold under IPO, Reg A, Reg CF, or Reg D remain securities years later. A token under Reg CA, if it satisfies Rule 400 and files Form TR, could stop being one.
Who benefits most: legacy tokens, U.S. institutions, and professional service firms
IOSG does not agree with the market’s default answer that new issuers are the main winners.
The first real beneficiary, the paper says, is the stock of legacy tokens and the older projects behind them. Using CoinMarketCap figures, IOSG says about 9,746 crypto assets were listed for trading globally from 2013 to 2024, excluding delisted assets, while only 636 issuers completed crypto-related offerings in the United States through existing exemptions from 2016 to 2024. The gap is the point. Most tokens have never had their legal status formally processed one way or the other. Rule 400 creates an administrative endpoint for those assets for the first time.
The second beneficiary is U.S. institutions that hold or want to hold outstanding tokens. For retail buyers, whether a token is a security may look like a legal label. For institutions, IOSG says, it often determines whether they can buy it at all, how they can custody it, how auditors classify it, and whether funds may face Investment Company Act concerns. Rule 400 turns that into a fact that can be checked: has the issuer filed a Form TR or not? IOSG also links the point to spot ETP expansion beyond Bitcoin and Ether. Products tied to SOL or XRP need their underlying assets not to be treated as securities. Rule 400 does not guarantee that result on its own, but IOSG says it supplies a missing prerequisite for many other tokens.
The third beneficiary is quieter: law firms, compliance shops, and accounting firms. The analysis expects real demand for onshore restructurings, reviews of public promises, and Form TR drafting. But it also says those services are low-frequency, one-off, and highly adjacent to existing advisory work, so they may not grow into a separate startup category.
Who probably does not benefit as much as the market thinks
The paper names three groups that it says the market has overestimated.
Projects hoping new token issuance will reopen the U.S. primary market
Issuance does get easier under Reg CA, IOSG says, but the easiest path is capped at $5 million over four years and can be used only once. The paper notes that in 2024 only 99 crypto offerings were in that size range. Any project seeking more capital would have to move into Rule 300 and absorb the cost of a U.S. issuer structure, domestic management and assets, and continuing reporting obligations. IOSG says the proposal does not support a broad ICO 2.0 narrative.
DAOs and protocols that already handed control to the community
IOSG says the rule quietly assumes the existence of an identifiable issuer that can sign, certify, and bear responsibility. Rule 200 does allow a group of individuals or entities to act as issuer, but every member of that group would need to sign the Form NOR and, later, any Form TR, and each member would need to satisfy all compliance conditions, including bad-actor checks under Rule 104.
That becomes difficult for projects that made promises to buyers in the past but have since dispersed decision-making across thousands of token holders. Those are the projects that may need Rule 400 the most, yet they may have the hardest time finding a legally accountable signer.
Institutions focused on RWA and tokenized securities
On this point, IOSG is direct. Reg CA excludes tokenized securities by definition. One of the conditions in Rule 100 is that the crypto asset itself must not be a security. Tokenized U.S. equities, tokenized Treasuries, and tokenized fund interests therefore fall outside the rule’s reach. The proposal itself says digital securities are better suited to registered offerings, and it does not revise the registration framework. IOSG says Reg CA and RWA run on parallel tracks, not the same one.
The other side of the proposal: who takes the uncertainty
IOSG says Reg CA also shifts uncertainty onto other parts of the market.
The first group is secondary-market participants. The proposal does not solve the rest of the market structure stack: trading venues, brokers, custody, or clearing. At the same time, Rule 500’s state-law preemption depends on timely periodic reporting by the issuer. Market makers and platforms would inherit a compliance status they cannot fully verify on their own.
The second group is anyone betting on legal certainty. Reg CA can shape SEC administration, but it cannot control the courts. Even an issuer that satisfies Rule 400 could still face claims under Section 12(a)(1) if a court later concludes the asset remained a security sold without registration or a valid exemption. IOSG describes that remedy as a kind of no-questions-asked return receipt: if the court says it was still a security, the buyer can demand rescission plus interest without proving fraud or fault.
The third group is older projects whose original promises were vague. IOSG says vagueness may once have helped a project argue that its token was not a security. But if that path fails, Rule 400 creates a new problem. Graduation is measured against what was originally promised and whether it has been completed. A project that never committed to clear milestones may have little it can point to as a finished checklist.
Three conditions that could change the conclusion
Although the paper’s main conclusion is that Reg CA favors legacy-token clearance over ICO 2.0, IOSG lists three developments that would force a reassessment.
- First, if the final rule materially loosens the issuance side — for example by sharply raising the $5 million startup cap, allowing repeated use instead of one-time use, or removing key U.S. nexus conditions from the fundraising exemption — then the economics of new issuance would change in a basic way.
- Second, if the CLARITY Act passes this year and a statutory safe harbor replaces Rule 400, the framework for analysis would need to shift to the legislation itself.
- Third, if Rule 500 is removed from the final rule, then even a token that sheds federal securities status could still face state-by-state blue-sky treatment in secondary trading, leaving the legal meaning of “clearance” stronger than the economic one.
Compliance reshaping for issuers: from issuance mechanics to promise management
In the last section, IOSG turns to what the proposal means in practice for issuers and investors. For projects, the key point is that compliance would no longer be concentrated at the issuance date. It would begin in early structural design and continue through the management of public statements and delivery milestones.
Split financing documents instead of bundling equity and tokens
Under Rule 100, a compliant token investment contract cannot be tied to any other asset, including equity or derivative rights. IOSG says the industry’s common structure of combining equity and token warrants, or using a SAFT and equity package inside one financing document, would cause a project to lose eligibility under the Reg CA framework. Projects that may want to issue under Reg CA later would need to separate those legal structures as early as the seed or Series A stage.
White paper promises become future graduation criteria
Rule 103 requires disclosure of core managerial efforts. Those disclosures later become the record used in a Rule 400 filing to show that promised efforts have been completed or permanently stopped. IOSG says this creates a hard trade-off. If a white paper is too vague, a project may have an easier time early on arguing that no security exists, but later it may struggle to prove it has graduated. If the commitments are more concrete, the early securities analysis may be tougher, but the later evidentiary path becomes clearer.
Entity location should match target users and offering route
Rule 300’s public fundraising channel for U.S. retail buyers requires a U.S. issuer, U.S.-based management, and U.S.-based assets. Rule 200 and Reg D 506(c), by contrast, do not require a domestic entity. IOSG says projects whose growth depends heavily on U.S. retail users should make onshoring decisions early, before restructuring costs become too high. Projects relying on Reg D 506(c), with a view to using Rule 400 later, may still fit within conventional offshore foundation structures such as Cayman or BVI.
Functional delivery matters more than performative decentralization
Reg CA says maintenance, updates, and funding after a network or application becomes functional do not count as core managerial efforts, but it also says no new promises can be made. IOSG reads that as a shift in the risk window. Before functionality is reached, risk accumulates through promises. After functionality is reached, the main risk is restarting the compliance clock through new promises. That is why the paper suggests tighter controls over roadmaps, social media, and AMA statements before functionality, and formal review processes for new public statements after functionality, with evidence of completed performance archived for a future Form TR.
Investor takeaways: sector selection, valuation, and diligence all change
For investors, IOSG says the first impact is on sector preference. Rule 400 favors projects whose promises can actually end. A chain can launch. A protocol can be deployed. Those projects may fit the safe harbor more naturally. Consumer applications and constantly iterating platforms, by contrast, may struggle because their business model depends on making fresh promises over time.
The second impact is valuation. IOSG argues that whether a token can eventually de-securitize becomes a variable that belongs inside pricing. Two projects at the same fully diluted valuation may not deserve the same price if one can graduate under Rule 400 and the other likely cannot. That also means term sheets may begin to include “graduation” clauses, requiring founders to preserve evidence of delivered commitments and to control new roadmap promises after launch.
The third impact is on diligence itself. Instead of focusing only on code, team quality, or decentralization, investors will also need to inspect what IOSG calls the project’s “promise archive”: old white paper versions, X posts, AMA transcripts, and Discord announcements. Under Rule 400, the paper says, every public promise can become a liability that stays on the balance sheet until it is discharged.
For existing portfolio companies, IOSG suggests ranking projects against Rule 400’s conditions and checking completion of public commitments and product launches rather than relying on decentralization narratives or founder departure alone. Investors should also try to limit new public promises after functionality is reached and encourage projects that are already live to archive evidence of performance now, ahead of any future Form TR filing.
A bridge, not the endpoint
IOSG’s closing view is that Reg CA looks more like a bridge than a final destination. As an administrative rule, it cannot replace legislation and cannot solve the market structure issues on the CFTC side.
The paper still says the proposal has a meaningful chance of becoming a final rule. All three sitting SEC commissioners — Atkins, Peirce, and Uyeda — support it, and the White House has publicly backed it. Atkins is also treating it as a signature project of his tenure. Even so, IOSG expects the final rule to arrive later than the market hopes and in narrower form than the current draft. With public comments and congressional review still ahead, and with Rule 500 cutting into state authority, the earliest finalization point in the analysis is 2027.
That leaves IOSG with a blunt takeaway. If the market treats Reg CA as a switch that turns on a new token bull market, it may miss what the proposal is actually built to do. The old question was who gets to issue a token. The new question, in IOSG’s framing, is who gets to graduate. The answer depends less on generic decentralization claims and more on what was promised at the start, whether those promises can be verified as completed, and whether the network has already become functional.