SEC's New Crypto FAQ: 3 Answers That Decide Whether Your Token Is a Security — 5 Powers That Expose It

On November 2, the SEC quietly answered the question that decides whether thousands of crypto tokens are securities — and the answer is better news for ordinary holders than almost anyone expected. Voting in a DAO does not make you part of a "central party," the agency's staff said. But a single person who can reverse your transaction, pick who validates it, or rewrite the code does. That line — between a community that governs and a company that controls — is now written down, and it will shape which tokens exchanges can list, which ones can reach an ETF, and which ones live under securities law for years.

The update came from the SEC's Division of Corporation Finance, which added three new answers — questions 1.4 to 1.6 — to its crypto asset FAQ. It is staff guidance, not law, and the Commission has neither approved nor disapproved it. But for anyone holding a token that is not Bitcoin or Ethereum, it is the clearest map the US regulator has ever published of the boundary between a commodity and a security.

What Happened on November 2

On November 2, 2026, staff in the SEC's Division of Corporation Finance added three answers to the crypto asset FAQ the division first published on September 25. The new entries — numbered 1.4, 1.5 and 1.6 — deal with token governance, control over who can take part in a network, and the difference between a system that works and a system that is decentralized.

The update was the second round of staff guidance in barely a month. Three days after the first FAQ appeared, staff amended its answer on token buybacks, so that a buyback announcement avoids being read as a promise of managerial effort only when the system is functional and has no central party — a change that put token buybacks under fresh scrutiny, as CryptoSpiel reported. The November 2 additions go further: they define the test that decides whether a network has a central party at all.

The timing matters. The answers landed two days before the US midterm elections, in which Democrats swept both houses of Congress, and one day after journalist Eleanor Terrett reported that House Democrats are preparing a broader crypto market structure bill that would give the SEC a bigger supervisory role — a story Decrypt covered in detail. Regulation is moving on two tracks at once: the SEC is writing the rulebook in guidance, while Congress argues over who should hold the pen. Our full breakdown of the Democratic bill is here: House Democrats' New Crypto Bill: SEC Takes the Lead, CFTC Steps Back.

The March 2026 Framework in 60 Seconds

To understand the three new answers, you need the framework they build on. On March 17, 2026, the SEC published an interpretive release — Release No. 33-11412 — jointly with the Commodity Futures Trading Commission. It sorted crypto assets into five categories: digital commodities, digital collectibles, digital tools, stablecoins and digital securities. A digital commodity, in the SEC's wording, is tied to a "functional crypto system" with no "central party" — no person, company or group with operational, economic or voting control of the network. Tokens in that category fall outside the definition of a security; tokens that do not can face the full weight of securities law.

That made "central party" the most valuable two words in American crypto regulation. The November 2 FAQ is the staff's attempt to explain, in concrete terms, what counts — and what does not. The background to the legislative fight over the same question is covered in our explainer: CLARITY Act Explained: Why the Senate Blocked America's Crypto Bill and What Happens Next.

The 3 New Answers, Explained

Question	What the SEC staff clarified	Who it affects most
1.4 — Governance: when do voters become a "central party"?	People in a broad-based governance system generally are NOT treated as a coordinated controlling group just because they back the same proposal — as long as they are unaffiliated and have no agreement to act together outside the voting mechanism. Even if voters form a group, they only become a central party if they actually exercise operational, economic or voting control.	DAO voters, token holders, governance delegates
1.5 — Control: what does it mean to "oversee participation"?	Unilateral powers signal central control: granting or restricting access, changing voting mechanics, choosing who validates transactions, modifying code, reversing transactions or revoking access. Operations that run automatically under rules-based code, with no discretionary actor, do NOT reflect unilateral control.	Foundations, core teams, multisig holders, upgrade-key holders
1.6 — Classification: is a working token the same as a decentralized one?	No. A system is "functional" when its native asset can be used as programmed. Decentralization is about autonomous operation with no person, entity or coordinated group holding operational, economic or voting control. A token can work perfectly and still fail the decentralization test.	Token issuers, exchanges, ETF sponsors

Source: SEC Division of Corporation Finance crypto asset FAQ, November 2, 2026, as reported by KuCoin and The Crypto Guide.

Answer 1: Voting Together Is Not Control

Question 1.4 deals with the most common structure in crypto: holders of a native token vote on upgrades, treasury spending and parameter changes. Staff wrote that people taking part in a broad-based governance system generally should not be treated as a coordinated controlling group just because they back the same proposal. The answer points to the facts that support that conclusion: voters who have no affiliation with each other and no formal or informal arrangement to act together outside the voting mechanism. The assessment covers delegation too — handing your votes to a delegate does not by itself create a controlling group. The same logic applies when governance is run through an organization, association or foundation and participation depends on holding the native token.

There is an important second half. Even where voters do form a group, staff added, they become a central party only if they actually exercise operational, economic or voting control. Agreement alone is not enough; control is the test. A footnote adds that qualifying governance should be transparent and rules-based, with diverse stakeholders independently contributing — and the usual caveat applies that the outcome turns on facts and circumstances.

For ordinary holders, this is the most reassuring of the three answers. Simply voting on a proposal — or delegating your vote — does not turn you into a regulated controlling person. For the industry, the reading from a16z general counsel Miles Jennings is significant: he interprets the answer as leaving room for legal entity structures such as a DUNA, a Decentralized Unincorporated Nonprofit Association, meaning that using an entity for governance does not equal abandoning decentralization, as Binance Square's summary notes.

Answer 2: The 5 Powers That Make You a Central Party

Question 1.5 is the sharp edge of the update. It lists the unilateral powers that indicate a party "oversees participation" in a network — and therefore counts as a central party:

• Granting or restricting access to the network: deciding who is allowed to use the system at the protocol, validator or user level.
• Changing how votes and upgrades work: setting or altering the mechanics for protocol changes, upgrades or token distributions.
• Choosing who validates transactions: picking, or blocking, the validators who confirm activity on the network.
• Modifying the code or reversing transactions: the power to change the rules after the fact, or to undo a transaction that already settled.
• Revoking access outright: cutting a user, validator or application out of the system unilaterally.

The contrast the staff draws is just as important. Material operations that run automatically under rules-based code — with no discretionary actor pulling the levers — do not reflect unilateral control. Where discretion exists but is exercised only through the system's own governance process, that may be permissible, so long as the governance participants themselves are not a central party.

There is also a warning aimed squarely at foundations. The division cautions that an association or foundation could still control a system by setting operating parameters for applications built on the underlying network — even if it never touches the base layer. If your coins live on a chain whose foundation can freeze an app, change validator rules or rewrite parameters on its own, your token sits on the wrong side of this test.

Answer 3: Working Is Not the Same as Decentralized

Question 1.6 settles a confusion that has run through crypto for years. A system is "functional" when its native asset can be used according to its programmed utility — it pays gas, it accesses services, it does what the white paper promised. Decentralization is something else: autonomous operation with no person, entity or coordinated group holding operational, economic or voting control.

A token can work perfectly and still fail the decentralization test. That distinction decides classification. A beautifully engineered network with a single admin key, a foundation that can halt the chain, or a core team that can reverse transactions is functional — and centralized. Under the March framework, its token struggles to qualify as a digital commodity. Staff also limited question 1.4 to digital-commodity classification under Section III of the March interpretation, noting it does not apply to other securities-law provisions — for example, the Exchange Act definitions of an exchange.

What Most People Get Wrong About the New FAQ

Myth: the FAQ is law, so tokens are now safe. It is not, and they are not. The SEC's page states plainly that the FAQ has no legal force, is not a rule, and that the Commission has neither approved nor disapproved it. As staff guidance, it can be revised or revoked later — including by a future SEC with different views. Lawyer Avi Lev cautioned that the guidance may not reduce pressure on lawmakers to pass formal legislation, precisely because it can be undone.

Myth: voting in a DAO makes you a controlling person. The opposite is now the staff's stated position. Broad-based, unaffiliated governance participation generally does not create a central party. The risk sits with coordinated groups that actually exercise control — not with ordinary voters.

Myth: if the token works, it must be decentralized. Question 1.6 exists to kill this idea. Functionality and decentralization are separate tests, and a token must pass both to qualify as a digital commodity.

Myth: foundations and multisigs are automatically fine. They are not. A multisig that can unilaterally change code or reverse transactions is a central party by the staff's own examples. A foundation that sets operating parameters for apps on the network can control the system even without touching the base layer.

Which Tokens Are Most Exposed

Bitcoin and Ethereum sit furthest from the line. Bitcoin has no foundation that can reverse transactions and no admin key; Ethereum's governance is famously diffuse, and the network has operated for years without a single party able to halt it unilaterally. That is one reason both already have spot ETFs in the United States — and why our guide to the long-term case still holds: Is Bitcoin a Good Investment in 2026? An Honest Guide to the Risks, Returns and Smart Allocation.

The exposed end of the spectrum is newer networks where a foundation or core team still holds upgrade keys, controls validator admission, or can pause the chain. Many layer-1 and layer-2 projects launched with exactly those powers as safety rails — and the FAQ now labels those rails as central control. The practical question for each project is whether it has a credible path to removing them, and on what timetable.

DeFi is caught in the middle. A genuinely autonomous protocol, running on rules-based code with no discretionary actor, fits the staff's description of a system without unilateral control. But many DeFi front-ends, admin multisigs and emergency pause functions look a lot like the powers listed in question 1.5. If you use DeFi, our primer explains the mechanics: What Is Yield Farming in Crypto? A Complete Beginner's Guide to Earning DeFi Yields in 2026. Stablecoins sit in their own category under the March framework — and their story moved separately this autumn, when the Senate cut a deal on stablecoin yield, putting an estimated $300 billion in rewards at stake: Senate Just Cut a Deal on Stablecoin Yield: $300B in Rewards at Stake.

What This Means for Your Coins: A 5-Point Checklist

Before you buy — or keep holding — a token that is not Bitcoin or Ethereum, run it through the test the SEC staff just published:

• Check who holds the upgrade keys: if a single team or multisig can change the code unilaterally, the network has a central party by the staff's own definition.
• Check who picks the validators: permissioned validator sets and foundation-controlled admission are red flags under question 1.5.
• Check for pause and reversal powers: an emergency pause or transaction-reversal function is exactly the unilateral power the FAQ names.
• Check the foundation's real powers: a foundation that sets operating parameters for apps on the network can control the system without touching the base layer.
• Check the decentralization roadmap: teams with a dated, public plan to burn admin keys and hand control to broad-based governance are moving toward the safe side of the line — teams with no plan are not.

None of this is a reason to panic-sell. A token that fails the staff's test is not banned, and the FAQ is guidance, not law. But it is a reason to know what you hold: tokens on the wrong side of the line face a harder path to exchange listings, ETF approval and institutional adoption.

What Happens Next

Three dates decide what this FAQ becomes. The first is the lame-duck session: the CLARITY Act, which passed the House 294–134 in July 2025 and failed a Senate cloture vote 49–50 on September 15, dies when this Congress ends on January 3 unless the lame-duck session revives it. The second is January itself, when Representative Maxine Waters — the top Democrat on the House Financial Services Committee — is in line to take the gavel, and the Democratic market structure bill becomes the live alternative. The third is the next round of SEC staff guidance: the FAQ has been updated twice in five weeks, and each round has leaned harder on the "central party" phrase.

The deeper question is whether guidance is enough. The FAQ can be revised by a future SEC; a statute cannot. That is why the industry keeps pushing for a market structure law — and why the Democratic bill and the CLARITY Act are rival answers to the same question: who polices crypto, and by what test? For now, the test is written down. Voting together is not control. A single unilateral power is. And a token that works is not automatically a token that is free.

Frequently Asked Questions

Is the SEC's November 2 crypto FAQ legally binding?

No. It is staff guidance from the Division of Corporation Finance. The SEC's page states it has no legal force, is not a rule, and that the Commission has neither approved nor disapproved it. A future SEC can revise or revoke it. It matters because it shows how staff currently apply the March 2026 framework — not because it changes the law.

Does voting in a DAO make me part of a "central party"?

Generally no, according to question 1.4. Participants in a broad-based governance system are generally not treated as a coordinated controlling group if they are unaffiliated and have no formal or informal agreement to act together outside the governance system. Even a group only counts as a central party if it actually exercises operational, economic or voting control.

What is a "central party" in the SEC's crypto framework?

Under the SEC's March 17, 2026 interpretive release, a central party is a person, entity or group holding operational, economic or voting control over a crypto system. A functional system with no central party can qualify its native token as a digital commodity, outside the definition of a security.

Can a token be functional but still centralized?

Yes — that is exactly what question 1.6 says. A system is functional when its native asset can be used as programmed. Decentralization requires autonomous operation with no person, entity or coordinated group holding control. A network can work perfectly and still fail the decentralization test if, for example, a foundation can halt it or a multisig can reverse transactions.

Does the new FAQ affect Bitcoin or Ethereum?

Not directly. Neither network has a foundation or team that can unilaterally reverse transactions, pick validators or rewrite the code, so both sit furthest from the "central party" line. The FAQ matters most for newer tokens, DeFi protocols with admin powers, and projects whose foundations still hold upgrade keys.

What should token holders do now?

Nothing changes in your wallet today, and the FAQ endorses no token. The practical step is diligence: check who holds the upgrade keys, who picks validators, and whether a foundation or multisig can pause or reverse the network. Projects with a public, dated plan to remove those powers are moving toward the safe side of the SEC's line.

Conclusion

The SEC's November 2 update will not move Bitcoin's price tomorrow, and it changes nothing in your wallet today. Its importance is structural: for the first time, the regulator has written down, in plain examples, where governance ends and control begins. That clarity cuts both ways. It protects ordinary DAO voters from being treated as controlling persons, and it gives well-built projects a checklist to aim for. But it also puts a spotlight on every foundation, multisig and admin key in the market — and in a week when Congress is about to change hands, the spotlight is only going to get brighter. The tokens that thrive under the new test will be the ones that can prove, power by power, that nobody is in charge.