Are Cryptocurrencies Securities? The Howey Test, SEC Rules, and What It Means for You in 2026

Imagine buying a coin on a Tuesday. By Wednesday, the government tells you it’s actually a stock. Does that change how you trade it? Does it change whether you can hold it at all? For years, this exact confusion has haunted the cryptocurrency market. If you are holding tokens today, you might be wondering: is my asset a commodity like gold, or is it a security like Apple stock? The answer isn’t just legal jargon-it determines which agency watches your wallet, what taxes you pay, and whether your exchange can even list your favorite project.

In 2026, the lines are still blurry, but they are becoming clearer through court battles and new legislation. Understanding where your crypto sits on this spectrum is no longer optional for serious investors. It is essential survival knowledge.

The Core Question: What Makes Something a Security?

To figure out if a cryptocurrency is a security, we have to look back nearly 80 years. In 1946, the U.S. Supreme Court established a framework known as the Howey Test. This test was designed to determine if an arrangement constitutes "an investment of money in a common enterprise with a reasonable expectation of profits to be derived from the entrepreneurial or managerial efforts of others."

Let’s break that down into plain English. For a crypto token to be classified as a security under the Howey Test, it must meet four criteria:

1. Investment of Money: You paid something (cash, other crypto) to get the token.
2. Common Enterprise: Your fate is tied to the success of the project or the people running it.
3. Expectation of Profit: You bought it because you think its value will go up.
4. Efforts of Others: That profit depends on the work of a central team, developers, or promoters-not just you using the network.

If a token ticks all four boxes, the U.S. Securities and Exchange Commission (SEC) argues it is a security. This means it needs to be registered, audited, and disclosed to the public before being sold. If it doesn’t tick those boxes-especially the last one about "efforts of others"-it might be considered a commodity or a utility.

The Regulatory Tug-of-War: SEC vs. CFTC

The biggest headache for crypto users comes from two federal agencies fighting over who gets to rule the digital asset space. On one side, you have the Securities and Exchange Commission (SEC). Under Chairman Gary Gensler, the SEC has taken an aggressive stance, arguing that most cryptocurrencies beyond Bitcoin are unregistered securities. They believe that without strict oversight, retail investors are vulnerable to fraud and manipulation.

On the other side stands the Commodity Futures Trading Commission (CFTC). The CFTC regulates commodities like oil, wheat, and gold. They have consistently argued that major cryptocurrencies like Bitcoin and Ethereum function as commodities because they are traded on open markets and don’t rely on a single central promoter for their value.

This creates a jurisdictional mess. When the SEC says a token is a security, exchanges often delist it to avoid massive fines. When the CFTC says it’s a commodity, derivatives traders can bet on its price. As of early 2026, this divide remains unresolved, leaving projects in a gray area where they might face enforcement actions from either agency depending on how they operate.

Bitcoin and Ethereum: The Exceptions That Prove the Rule

Not all cryptos are treated equally. Bitcoin is widely accepted as a commodity. Why? Because it launched in 2009, long before the ICO boom, and it is now sufficiently decentralized. There is no central team managing Bitcoin’s development in a way that drives its price; the network runs itself via miners and node operators. Therefore, the "efforts of others" prong of the Howey Test is largely absent.

Ethereum is trickier. For years, the SEC hinted that Ether could be a security. However, the approval of spot Ethereum ETFs in March 2025 signaled a tacit acceptance of its commodity status by regulators. Like Bitcoin, Ethereum has become highly decentralized. While Vitalik Buterin and the Ethereum Foundation guide development, the network’s utility and market dynamics are driven by thousands of independent participants, not a single corporate entity promising profits.

Most newer tokens, however, do not enjoy this safe harbor. If a project launches with a centralized team, a whitepaper promising future upgrades, and a marketing campaign focused on price appreciation, the SEC is likely to view it as a security.

The Ripple Case: A Turning Point for Token Classification

You cannot talk about crypto securities without mentioning Ripple Labs and its token, XRP. The SEC sued Ripple in December 2020, claiming XRP was an unregistered security. This case became the most important legal precedent for the industry.

In July 2023, Judge Analisa Torres issued a landmark ruling. She agreed that institutional sales of XRP were securities offerings. However, she ruled that secondary sales of XRP on public exchanges were not securities. This distinction was huge. It suggested that a token could be a security when sold directly by a company to investors, but cease to be one once it trades freely on a decentralized market.

As of mid-2026, the case is in the remedies phase. The final penalty amount and specific restrictions on Ripple are still being determined. Yet, the core legal principle-that decentralization matters-has shifted how many projects structure their launches. Many teams are now trying to "decentralize-and-morph," aiming to reach a state where no single entity controls the network, hoping to escape SEC scrutiny.

Utility Tokens vs. Investment Contracts

Many projects launch as "utility tokens," claiming they are just keys to access a service. For example, you might buy a token to pay for cloud storage or to vote on governance decisions. The idea is that if the token has real-world use, it shouldn’t be a security.

However, the SEC looks past the label. If you market a utility token by promising that its value will rise as the platform grows, you’ve triggered the "expectation of profit" clause. In 2017, the DAO Token was deemed a security despite being called a utility token because investors bought it expecting returns from the project’s management.

In 2025, the American Institute for Economic Research (AIER) proposed a simpler test: only tokens programmed to make payments should be classified as digital securities. Their analysis suggested that under this stricter definition, only 22% of ERC-20 tokens would qualify as securities. While the SEC hasn’t adopted this view yet, it highlights the growing frustration among developers who feel current rules stifle innovation.

What This Means for Investors in 2026

If you are holding crypto, here is what you need to watch for:

• Exchange Listings: Exchanges like Coinbase and Kraken face billions in fines for listing unregistered securities. If a token is delisted suddenly, check if the SEC has filed an action against it.
• Staking Services: The SEC has targeted staking services, arguing that offering staking as a managed service makes the rewards a security. Self-custody staking is generally safer, but centralized staking providers are under pressure.
• Stablecoin Regulations: The Clarity for Payment Stablecoins Act passed in 2023, creating a federal framework for stablecoins. While not securities, they are now heavily regulated for reserve transparency. Stick to fully collateralized options like USDC or PYUSD to avoid risks seen with algorithmic failures like TerraUSD.
• Legislative Changes: The Responsible Financial Innovation Act introduced in January 2026 aims to clarify these rules. If passed, it could move more assets under CFTC jurisdiction, providing clearer guidelines for what constitutes a security versus a commodity.

The cost of compliance is rising. In Q1 2025 alone, Coinbase reported $109 million in regulatory expenses. These costs trickle down to users through higher fees or reduced product offerings. Projects that ignore regulations risk existential threats, as seen with the $1.2 billion settlement involving Telegram’s TON token in 2020.

Navigating the Gray Areas: DeFi and DAOs

Decentralized Finance (DeFi) protocols and Decentralized Autonomous Organizations (DAOs) exist in the deepest regulatory fog. Since there is often no central company to sue, the SEC struggles to apply traditional securities laws. However, they have started targeting the developers and foundations behind these protocols.

In 2024, the SEC took enforcement actions against several lending platforms, returning $3.2 billion to investors. The message was clear: even if your code is open-source, if you act like a bank or a broker-dealer, you might be regulated as one. For DAOs, the lack of clear liability structures means that 89% avoid U.S. participation entirely, according to recent reports. This pushes innovation offshore, potentially leaving U.S. investors with fewer opportunities.

For the average user, the safest path is to focus on assets with clear commodity status (Bitcoin, Ethereum) or those backed by transparent reserves (regulated stablecoins). Newer tokens with vague roadmaps and heavy marketing hype carry significant regulatory risk.