SEC & CFTC Crypto Classification Framework: Legal Guide

This is the most structurally significant shift since the SEC’s 2019 framework, and most people are still analyzing it as if nothing changed. 

The guidance reinforces a critical distinction: the legal analysis focuses on the circumstances of the offer and sale, not the digital asset in isolation. While regulators increasingly differentiate between types of crypto assets in practice, Howey remains the governing test for determining when a transaction constitutes an investment contract.

This post breaks down what actually changed, how the new framework works, and where the real legal risks remain.

The SEC and CFTC have jointly issued a new interpretive framework governing the classification of crypto assets under federal law. The release supersedes the SEC’s 2019 Framework for Investment Contract Analysis of Digital Assets and introduces, for the first time, a formal five-category taxonomy. It also provides updated guidance on when a non-security crypto asset may be offered and sold pursuant to an investment contract, and when it is not.

This post is intended as a working reference for legal professionals. It explains each category in detail, identifies the key legal tests and their elements, maps the points at which the new framework departs from the 2019 approach, and flags the doctrinal questions that remain open.

Executive Takeaways

•  Howey still governs. The new release does not replace the Howey test; it explains how the agencies view different categories of crypto assets and how Howey applies to transactions involving them.
• The asset is not the contract. A non-security crypto asset can be sold pursuant to an investment contract without becoming a security itself.
• Secondary markets are meaningfully de-risked. Howey obligations do not automatically follow assets into secondary trading.
• Issuer communications matter more than ever. Public statements, roadmaps, and marketing materials remain central to investment contract analysis.
• Major gaps remain. Pre-launch token sales, yield-bearing stablecoins, and fractionalized structures continue to present significant legal risk.

I. What Changed from the 2019 Framework

The 2019 framework was issued by the SEC’s Strategic Hub for Innovation and Financial Technology (FinHub) as an analytical guide for applying the Howey test to digital assets. It was a thorough Howey analysis tool, but had a significant structural limitation: it treated “digital asset” as a monolithic category and asked only whether a given asset was offered pursuant to an investment contract. It did not distinguish between different types of crypto assets based on their intrinsic characteristics.

The new joint framework corrects this. The core structural change is the introduction of a five-category classification system that, as a threshold matter, determines the type of asset being analyzed before any Howey inquiry begins. The categories do not overlap. Only after classification does the investment contract analysis become relevant, and only for specific categories.

The following table summarizes the major structural differences:

Element	2019 Framework	New Joint Framework
Asset taxonomy	None: all digital assets analyzed under a single Howey framework	Five formal categories: digital commodities, collectibles, tools, stablecoins, digital securities
Issuing agency	SEC (FinHub) only	Joint SEC and CFTC release
CFTC jurisdiction	Not addressed	Expressly allocated: CFTC administers CEA for non-security crypto assets qualifying as commodities
Stablecoin treatment	Not separately addressed	Payment stablecoins under the GENIUS Act are expressly excluded from the definition of ‘security’ if issued by a permitted issuer
Howey test role	Primary analytical framework for all digital assets	Applies only to investment contract analysis; classification analysis precedes Howey and is separate from it
Secondary market	Not expressly addressed	Expressly clarified: Howey obligations do not follow an asset into secondary market transactions absent issuer representations
Named asset examples	None	Specific named assets provided for most categories

Key doctrinal shift: The 2019 framework implicitly treated the investment contract and the underlying digital asset as analytically fused; whether an asset was a security depended on how it was offered. The new framework formally decouples them. A non-security crypto asset offered pursuant to an investment contract does not thereby become a security. The asset and the contract are legally distinct instruments.

By separating asset classification from investment contract analysis, the framework narrows the circumstances in which a crypto asset itself is treated as a security. At the same time, it places greater weight on how assets are offered and promoted, increasing the importance of issuer conduct over asset design.

II. The Five Categories: Definitions, Elements, and Boundary Conditions

Each category is defined by a combination of affirmative characteristics and expresses exclusions. The exclusions are analytically important: every non-security category is defined in part by the absence of “intrinsic economic properties or rights, such as generating a passive yield or conveying rights to future income, profits, or assets of a business enterprise or other entity, promisor, or obligor.” That phrase recurs across all three non-security, non-stablecoin categories and functions as the structural dividing line between non-securities and securities.

A. Digital Commodities

Definition:

A digital commodity is a crypto asset that is intrinsically linked to, and derives its value from, the programmatic operation of a functional crypto system and supply-and-demand dynamics, rather than from the expectation of profits from others’ essential managerial efforts.

Required Elements

• The asset must be the native asset of a crypto system, generated for use on that particular system.
• The crypto system must be “functional”: the native asset must actually be usable on the system in accordance with its programmatic utility. Functionality is a threshold condition; a non-functional system’s native token cannot qualify as a digital commodity.
• The asset must not have intrinsic economic properties that convey rights to income, profits, or assets of a business enterprise or an obligor.

Optional / Permissive Elements

• The system may, but need not, be “decentralized”, defined as functioning autonomously with no person, entity, or group having operational, economic, or voting control. A centralized system can still produce a digital commodity if the asset is functional and its value is not derived from managerial efforts.
• The asset may have “certain other rights” not enumerated in the framework. Governance participation, network fee access, and similar rights that fall short of profit-sharing appear to be within scope.

Named Examples

APT, AVAX, BTC, BCH, ADA, LINK, DOGE, ETH, LTC, DOT, SHIB, SOL, XLM, XTZ, XRP.

Practice note: The inclusion of ETH and XRP as named digital commodities is significant given their enforcement histories. However, named assets are illustrative of the category definition; they do not constitute a safe harbor. The framework explicitly states that classification depends on characteristics, terms, and functions as of the date of release. Asset characteristics can change as networks evolve.

B. Digital Collectibles

Definition

A digital collectible is a crypto asset designed to be collected and/or used that represents or conveys rights to artwork, music, videos, trading cards, in-game items, or digital representations of internet memes, characters, events, or trends. Like physical collectibles, they do not confer on holders legal rights or interests in a business enterprise, promisor, or obligor.

Required Elements

• Designed for collection or use, not for investment in a profit-generating enterprise.
• No intrinsic economic properties generating passive yield or conveying rights to future income, profits, or assets of a business enterprise.
• May provide limited license or IP rights (e.g., display and commercialization rights for artwork NFTs), but these are not economic rights in a business enterprise.

Critical Carve-Out: Fractionalized Collectibles

When a digital collectible is fractionalized or structured to enable the acquisition of fractional ownership interests in a single collectible, the offer and sale could constitute an offer or sale of a security because purchasers may reasonably expect profits from essential managerial efforts. The framework flags this, but does not provide a complete analytical framework for evaluating fractionalized structures.

Practice note: Fractionalized NFT platforms and projects structuring collective ownership of high-value single collectibles face meaningful securities law exposure. The managerial efforts prong of Howey is likely satisfied where a platform actively manages or curates the underlying asset on behalf of fractional holders. The common enterprise prong is likely met by the shared pool structure. Counsel should analyze these structures as presumptive investment contracts unless the facts strongly indicate otherwise.

Named Examples

CryptoPunks, Chromie Squiggles, Fan Tokens, WIF, VCOIN.

C. Digital Tools

Definition

A digital tool is a crypto asset that serves a practical function, such as a membership credential, a title instrument, or an identity badge. Value derives from functionality, not from market appreciation or investment return.

Required Elements

• Performs a defined practical function within or in connection with a crypto system.
• Value derived from functionality, not expectation of profit.
• No intrinsic economic rights in a business enterprise.
• May be issued by a central party or autonomously via programmatic functioning.

Named Examples

Ethereum Name Service (ENS) domain names; CoinDesk’s Microcosms NFT consensus ticket.

Practice note: The soul-bound characteristic is noted but not required. Transferable tokens can qualify as digital tools if the value is genuinely functional. However, transferability combined with a secondary market price driven by scarcity rather than utility will strengthen the argument that the asset functions as an investment asset. The analysis is a facts-and-circumstances analysis, and the line between a functional tool with secondary market value and a speculative asset with minimal utility will be contested.

D. Stablecoins

Framework Structure

Unlike the three categories above, stablecoins are not categorically non-securities. The framework treats them as a broad category that “may or may not be securities depending on their characteristics.” The determinative factor is whether a stablecoin qualifies as a “payment stablecoin issued by a permitted payment stablecoin issuer” under the GENIUS Act, in which case it is expressly excluded from the definition of “security.”

GENIUS Act: Payment Stablecoin Definition

A “payment stablecoin” is a digital asset that is, or is designed to be, used as a means of payment or settlement, where the issuer is generally obligated to convert, redeem, or repurchase it for a fixed monetary value, and represents that it will maintain a stable value relative to a fixed amount of monetary value.

Permitted Payment Stablecoin Issuer: Three Qualifying Structures

• A subsidiary of an insured depository institution approved to issue payment stablecoins under Section 5 of the GENIUS Act;
• A Federal qualified payment stablecoin issuer; or
• A State qualified payment stablecoin issuer.

All three must be formed in the United States. A permitted issuer is expressly prohibited from paying any form of interest or yield to holders solely in connection with holding, using, or retaining the payment stablecoin.

Practice note: The yield prohibition is the critical dividing line. Stablecoins that remunerate holders for holding, whether described as interest, rewards, rebates, or yield, fall outside the GENIUS Act carve-out and require independent Howey analysis. The framework does not resolve whether yield-bearing stablecoins are securities per se; it simply excludes them from the safe harbor. Counsel advising stablecoin issuers should treat any yield-bearing feature as a significant red flag requiring a complete securities law analysis.

E. Digital Securities (Tokenized Securities)

Definition

Digital security is a financial instrument that falls within the statutory definition of “security” and is formatted as or represented by a crypto asset, with the record of ownership maintained, in whole or in part, on or through one or more crypto networks. Tokenization does not change the underlying security’s legal status.

Two Structural Variants

• Issuer-tokenized: Securities tokenized by or on behalf of the issuer of the underlying security. Holder rights generally track the underlying.
  
• Third-party tokenized: Securities tokenized by unaffiliated third parties, who may issue a separate security deriving its value from or linked to the subject security. The rights of a holder of the tokenized instrument may differ materially from those of a holder of the underlying security, including with respect to economic and voting rights.

Practice note: The third-party tokenized variant raises significant unsettled questions: whether the tokenized instrument is itself a separate security requiring independent registration or an exemption; what disclosure obligations apply; and how shareholder rights provisions interact with the tokenized structure. Practitioners advising on third-party tokenization programs should conduct a full securities law analysis of the tokenized instrument independent of the underlying security.

III. The Investment Contract Analysis: Updated Howey Application

The framework’s most practically important contribution may be its clarification of how Howey applies to non-security crypto assets, and when it does not.

A. The Decoupling Principle

The framework formally adopts a decoupling principle: a non-security crypto asset can be offered and sold pursuant to an investment contract without the asset itself becoming a security. The investment contract is the security; the underlying asset is not. This resolves a persistent ambiguity: whether the Howey analysis attaches to the asset itself or to the manner of its offering.

The practical consequence is significant: the same digital commodity can be offered pursuant to an investment contract during a pre-launch or fundraising phase, and simultaneously traded as a non-security commodity in secondary markets. Classification is context- and offering-specific, not asset-inherent.

B. When an Investment Contract Exists

An investment contract is formed when an issuer offers a non-security crypto asset by inducing an investment of money in a common enterprise with representations or promises to undertake essential managerial efforts from which a purchaser would reasonably expect to derive profits.

The framework emphasizes that a purchaser’s reasonable profit expectations must be grounded in the issuer’s representations or promises, not in the purchaser’s subjective beliefs. Absent such representations being conveyed to purchasers, it is not reasonable for a purchaser to expect profits. This narrows the inquiry toward objective communication rather than subjective investor belief.

Factors Increasing the Likelihood of Investment Contract Finding

• Explicit, unambiguous representations of the essential managerial efforts the issuer will undertake.
• Representations with sufficient detail demonstrating the issuer’s ability to implement the proposed project.
• Explanation of how the issuer’s efforts will produce the profits purchasers reasonably expect.
• Business plans with detailed milestones, timelines, personnel information, and funding sources.
• Public statements linking holder profits to issuer efforts — including roadmaps, social media, and whitepapers.

Practice note: This factor analysis has direct implications for whitepaper drafting, token sale marketing, investor presentations, and founder public statements. The more detailed and explicit the issuer’s promises about what it will build and how holders will profit, the stronger the investment contract argument. All public-facing communications, including social media, should be reviewed through this lens before and during any primary issuance.

C. Secondary Market Transactions

A non-security crypto asset subject to an investment contract does not remain subject to that contract in secondary market transactions where purchasers would not reasonably expect the issuer’s original representations or promises to remain connected to the asset.

This means secondary buyers trading a functional asset in liquid markets, without issuer-originated representations attached, are not in an investment contract relationship with the original issuer. Howey does not travel with the asset in perpetuity.

Practice note: The framework does not define when secondary-market transactions are sufficiently disconnected from the original issuer’s representations to break the investment contract chain. Issuers who continue making active representations to secondary holders through ongoing social media, development updates, or roadmap communications may maintain an investment contract relationship with secondary purchasers. The analysis is fact-specific and ongoing; it is not a one-time determination made at the time of original issuance.

Practical Implications for Founders and Operators

• Be precise in public communications. Statements about future development, value creation, or expected returns can independently give rise to an investment contract—even where the underlying asset is not a security.
• Do not assume pre-launch structures are safe. Early-stage token distributions tied to development efforts remain high-risk under Howey.
• Secondary market trading is not automatically regulated. However, continued issuer involvement and messaging can reintroduce securities risk.
• Token design alone is not determinative. Legal exposure will often turn on how the asset is marketed and sold, not just its technical characteristics.

IV. Open Questions and Doctrinal Gaps

The framework resolves significant ambiguities but leaves several important questions open:

• Functionality threshold: The framework defines a “functional” system as one in which the native asset can be used in accordance with its programmatic utility, but it does not specify minimum functionality thresholds, what happens when functionality is partially degraded, or how to analyze assets on networks undergoing active development. Pre-launch and early-stage token sales remain analytically complex.
  
• Decentralization gradations: The framework defines decentralization but does not address partial centralization. Many networks occupy a spectrum between fully centralized and fully decentralized. The framework’s silence on gradations leaves a significant open question for assets on networks with meaningful but not total central control.
  
• Yield-bearing stablecoins: Expressly excluded from the payment stablecoin safe harbor but not affirmatively classified. The framework does not resolve whether they are securities per se or subject to a case-by-case analysis under Howey.
  
• Third-party tokenized securities: The framework identifies the category and notes that holders’ rights may differ materially from those of the underlying security, but does not address disclosure, registration, or exemption implications for the tokenized instrument itself.
  
• Fractionalized collectibles: Identified as a potential securities issue, but without analytical guidance on evaluating the managerial efforts prong in the fractionalization context, or whether fractionalization is the operative factor or a proxy for investment intent.
  
• “Certain other rights” for digital commodities: The framework states digital commodities may have “certain other rights” without enumerating them. Governance rights, staking rewards, and fee-sharing mechanisms occupy uncertain territory under this language and will likely be the subject of future guidance or enforcement activity.

Conclusion

The joint SEC-CFTC framework is the most structural shift in U.S. crypto markets in years. Regulators are increasingly distinguishing the asset itself from the transaction involving the asset, and Howey applies to the transaction.

By introducing a threshold classification system and formally separating assets from investment contracts, the framework narrows certain categories of risk while sharpening others. The result is not less legal uncertainty, but a more clearly defined set of pressure points, particularly around issuer conduct, pre-launch activity, and ongoing market communications.

---

Legal References

1. SEC v. W.J. Howey Co., 328 U.S. 293 (1946). Established the foundational four-part test for determining whether a contract, transaction, or scheme constitutes an “investment contract” and therefore a security under the Securities Act of 1933. The test requires: (1) an investment of money, (2) in a common enterprise, (3) with an expectation of profits, (4) derived from the efforts of others.
2. U.S. Securities and Exchange Commission & U.S. Commodity Futures Trading Commission, Application of the Federal Securities Laws to Certain Types of Crypto Assets and Certain Transactions Involving Crypto Assets (2025). Joint release establishing the five-category classification framework for crypto assets and superseding the 2019 FinHub framework. Sets out the updated investment contract analysis and secondary market clarification discussed in this post.
3. U.S. Securities and Exchange Commission, Strategic Hub for Innovation and Financial Technology (FinHub), Framework for “Investment Contract” Analysis of Digital Assets (Apr. 3, 2019). Prior SEC guidance applying the Howey test to digital assets. Superseded by the 2025 joint release. Relevant for understanding the analytical shift introduced by the new framework, particularly the move from a unitary Howey approach to a threshold classification system.
4. Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act), Pub. L. No. 119-___ (2025). Federal legislation establishing a comprehensive regulatory framework for payment stablecoins. Defines “payment stablecoin” and “permitted payment stablecoin issuer,” prohibits yield payments to holders, and expressly excludes qualifying payment stablecoins from the definition of “security.” Cited in the 2025 joint framework as the operative authority for stablecoin classification.