Key Takeaways
- • The SEC's Division of Corporation Finance narrowed crypto token buyback guidance on September 28, 2026, by adding a "no central party" requirement to its official FAQ, converting a functionality-based test into a governance architecture requirement.
- • Protocols seeking to execute buybacks without triggering securities law must now demonstrate that all treasury operations are governed entirely by on-chain code with no human actors holding override authority over parameters, operations, or outcomes.
- • Protocols retaining the ability for foundations, companies, or development teams to modify parameters, pause operations, or intervene in results—even if software functions properly—now fail to qualify under the revised guidance and risk securities classification.
- • The revision reframes buyback compliance through the lens of the Howey test's "efforts of promoter or third party" prong, establishing that investor returns dependent on centralized entity management constitute investment contracts subject to securities regulation.
- • The distinction between permissible and regulated treasury operations is now a structural governance question rather than a functional performance question, creating material compliance implications for DeFi protocol teams worldwide.
Summary
Three days after publishing its inaugural FAQ on crypto asset classification, the SEC's Division of Corporation Finance substantially revised its guidance on token buybacks on September 28, 2026, introducing a structural governance requirement that represents a significant tightening of the regulatory framework. The revision, made through a quietly updated FAQ on the SEC's official website, inserted language requiring "no central party" control—a condition that elevates buyback compliance from a simple operational functionality check into a more demanding architectural examination of governance structures.
The revised guidance establishes that a protocol qualifies for permissible treasury operations only when all operations are governed entirely by on-chain code with no human actor—whether foundation, company, or development team—retaining the ability to modify parameters, pause operations, or intervene in outcomes. Conversely, protocols where software functions correctly but where centralized entities retain override authority or intervention capabilities no longer meet the standard, regardless of operational performance. The SEC staff framed this distinction as the demarcation line between permissible treasury management and potential securities offerings.
This revision directly invokes the Howey test framework established in a 1946 Supreme Court decision concerning Florida citrus groves. Under Howey, an "investment contract"—and therefore a security under the Securities Act of 1933—exists when investors commit capital to a common enterprise and expect profits "predominantly from the efforts of the promoter or a third party." The presence of centralized authority in protocol governance triggers this prong: investor returns dependent on managerial decisions by a central entity satisfy the conditions for securities classification. The SEC staff's revision targets precisely this vulnerability, making the absence of central party control the critical test for avoiding securities characterization.
For DeFi protocol teams, the practical implication is substantial. Protocols relying on foundation governance, developer discretion, or centralized parameter adjustment now face regulatory risk in executing buybacks. Only protocols with fully decentralized, code-based governance structures—where no human override exists—can operate buyback programs without triggering potential securities regulation. This governance-first approach marks a material shift in how the SEC evaluates token economics and treasury management in the crypto ecosystem.
The revised guidance establishes that a protocol qualifies for permissible treasury operations only when all operations are governed entirely by on-chain code with no human actor—whether foundation, company, or development team—retaining the ability to modify parameters, pause operations, or intervene in outcomes. Conversely, protocols where software functions correctly but where centralized entities retain override authority or intervention capabilities no longer meet the standard, regardless of operational performance. The SEC staff framed this distinction as the demarcation line between permissible treasury management and potential securities offerings.
This revision directly invokes the Howey test framework established in a 1946 Supreme Court decision concerning Florida citrus groves. Under Howey, an "investment contract"—and therefore a security under the Securities Act of 1933—exists when investors commit capital to a common enterprise and expect profits "predominantly from the efforts of the promoter or a third party." The presence of centralized authority in protocol governance triggers this prong: investor returns dependent on managerial decisions by a central entity satisfy the conditions for securities classification. The SEC staff's revision targets precisely this vulnerability, making the absence of central party control the critical test for avoiding securities characterization.
For DeFi protocol teams, the practical implication is substantial. Protocols relying on foundation governance, developer discretion, or centralized parameter adjustment now face regulatory risk in executing buybacks. Only protocols with fully decentralized, code-based governance structures—where no human override exists—can operate buyback programs without triggering potential securities regulation. This governance-first approach marks a material shift in how the SEC evaluates token economics and treasury management in the crypto ecosystem.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.