The SEC Defined Decentralization in Three New Answers. None of Them Ask Who Holds the Tokens.

On Monday, November 2, the SEC's Division of Corporation Finance quietly added three new entries to its crypto asset FAQs, numbered 1.4, 1.5 and 1.6. Together they answer the question every token team's lawyer has been asking since the Commission's March interpretive release: when does a network with token voting stop counting as controlled by somebody?

The answers are generous. Holders who vote through a protocol's governance system generally don't count as a "group" if they aren't affiliated and have no agreement to act together. A foundation can run governance without automatically becoming the boss. And, as Coin Edition summarized it, once a network is functional and no central party controls it, its creators' statements no longer create a new investment contract.

Three answers. Not one question about who holds the tokens.

The SEC built a decentralization test around who can push the buttons, and left out the people who own the votes.

Read the new entries closely and a pattern shows up. Staff describe a "central party" by what it can do: decide who gets access, set "the voting processes for software upgrades, protocol changes, or distributions," or "reverse transactions, or revoke access." Q1.6 defines a decentralized system as one that runs autonomously with no person, entity or group in charge. These are tests of permissions, of admin keys and kill switches.

What the document never discusses is vesting schedules, lockups or insider allocations. In a system where voting power equals tokens held, that omission matters more than anything the FAQs do say.

In token governance, the cap table is the governance.

Under the new guidance, a governance system counts as broad-based only if participation and decision-making authority are not "concentrated directly or indirectly," in the words of a footnote to the FAQs. That's the right instinct. The trouble is that the FAQs offer no way to measure it, and the evidence on how concentrated these systems already are is not encouraging.

In March, a European Central Bank working paper looked at Aave, MakerDAO, Ampleforth and Uniswap. Tens of thousands of addresses held each governance token, but the top 100 controlled more than 80% of supply in every case. Delegation concentrated power further: the top 20 voters in Ampleforth wielded 96% of delegated voting power, the top 10 in MakerDAO held 66%, and the top 18 in Uniswap held 52%. About a third of the top voters couldn't be publicly identified at all.

None of those protocols would fail the SEC's new test on its face. Nobody holds an admin key that reverses transactions. Votes go through an onchain process. Yet a few dozen wallets decide outcomes, and the public can't say who most of them are.

The unlock calendar decides how centralized a token is, month by month.

The concentration in those snapshots wasn't an accident. It traces back to how tokens get allocated and released. Team and investor allocations usually come with a cliff and then a long linear release, so the share of voting power held by insiders changes on a schedule that's set at launch.

Take Hyperliquid, one of the most-watched tokens of the year. According to Tokenomics' allocation data, core contributors hold 23.8% of the 1 billion HYPE supply, on a 12-month cliff followed by 36 months of linear vesting. The next release, on November 29, frees about 14.2 million HYPE, or 1.4% of supply. Every one of those monthly releases moves voting power. Whether it moves toward insiders or away from them depends on whether the recipients hold, sell or delegate, and the FAQs don't ask about any of it.

This is the variable the SEC's framework skips. A network can satisfy every "who can push the buttons" test in Q1.5 while a single group's share of the supply grows each month on a schedule the public may never see in full. Projects that put team and investor tokens in public, verifiable vesting contracts make this visible to anyone. Plenty of projects still don't, and the new guidance gives them no reason to start.

The founder-statement carve-out raises the stakes.

The old risk for a token team was that its own marketing could turn a token into a security. The FAQs change that. Promoting what a network can already do generally isn't a promise of profits, and talk about future features doesn't automatically create an investment contract. The September 25 version of the FAQs had already covered buybacks, and a September 28 revision says a buyback announcement isn't an "essential managerial efforts" representation if the system is functional and has no central party.

Put those together and the regulatory question narrows to a single gate: is there a central party? Pass it, and founders can talk, announce buybacks and pitch roadmaps with far less securities risk. That makes the definition of "central party" the most valuable piece of paper in crypto right now. A definition that ignores who holds the supply lets through exactly the teams whose holdings give them the most influence.

Concede the SEC's point, then look at where the burden lands.

The best case for the staff's approach is a fair one. Token ownership and control are different things. A venture fund sitting on 10% of supply that never votes isn't running anything. Exchanges hold huge balances for customers and often don't vote them at all. When Cointelegraph covered the ECB paper, the Uniswap Foundation pushed back: the data was from 2023, the largest holders included the DAO's own treasury and exchange cold wallets that don't take part in governance, and excluding them, it said, concentration falls to no more than 43%. A rule that counted every large balance as control would get those cases wrong.

The staff also wrote the answers as fact-specific, not formulaic. The footnote banning concentration "directly or indirectly" gives the SEC room to look through a pile of delegate wallets to the insiders behind them. And these are staff views that the FAQs themselves say carry no legal force.

All true, and the thesis still holds, for three reasons.

First, "fact-specific" with no number means the first people to apply the test are the issuers' own lawyers. Every project will read the footnote in its own favor, and nothing in the FAQs requires them to show their work.

Second, the people the securities laws exist to protect can't run the test themselves. A buyer can see that a network has no admin key. That buyer usually can't see which top voters are the team's friends, or what share of next year's voting power is still locked in a contract that releases to insiders.

Third, the Uniswap rebuttal proves the point rather than refuting it. Whether a protocol is 80% concentrated or 43% concentrated depends entirely on knowing which wallets belong to whom. That's a disclosure problem, and the guidance doesn't touch disclosure at all.

The right place to fix this is the rule still being written.

The FAQs don't stand alone. In August the Commission proposed Regulation Crypto Assets, which would exempt offerings of up to $5 million for four years and up to $75 million for one year, plus a safe harbor for assets whose issuers have "ceased all managerial efforts." The SEC's own announcement calls it a "fit-for-purpose framework." On October 1 it proposed a crypto custody framework for advisers and funds, and this week the American Bankers Association and five other groups asked for 45 more days to comment on it, ahead of a December 7 deadline. Meanwhile the CLARITY Act, which would split oversight between the SEC and CFTC, is still stuck in Congress.

That leaves the agency writing the market's rules one release at a time. A safe harbor for issuers who've "ceased all managerial efforts" is only as good as the disclosure behind it, and the cheapest, most checkable disclosure in crypto is a vesting schedule: who got what, when it unlocks, and where it sits. It's already onchain for any project willing to put it there.

The SEC spent three answers describing who can't hold the keys. The next rule should ask who holds the tokens.