SEC Says Token Buybacks and Network Upgrades Aren't Automatically Securities — The Exception Clause Is Where the Risk Lives

Last month I was called in to review a fee-switch implementation — forty lines of Solidity that had been merged, tested, and then quietly abandoned in a protocol's repository for eleven months. The code worked. The gas profile was clean. The problem was that the moment the switch flipped on, the protocol would begin using revenue to buy its own token off the open market, and nobody on the team could answer one simple question: does that make us an issuer of a security? They sat on it. Most teams did. That is what makes the SEC's updated crypto FAQ — released through the Division of Corporation Finance, and paired the same day with a parallel update from the CFTC — worth reading past the headline. For the first time, the staff has written down that a buyback program on an already-operational network does not, by itself, convert a token into an investment contract. The frozen switch in that repository is now legally thawable. But the same paragraph carries a clause most of the bull-market coverage has skipped over, because it is buried in the exception rather than the permission. To understand why two FAQ updates matter more than a dozen enforcement actions, you have to look at the machinery they are touching. The Howey test is the four-element filter U.S. courts use to decide whether something is an investment contract, and therefore a security. Money invested. In a common enterprise. With an expectation of profit. Derived from the efforts of others. All four must be satisfied. Strike any one of them and the asset walks out of securities law entirely. For crypto, element four — "efforts of others" — has been the battleground for a decade. The SEC's older posture treated active core-team development as evidence of centralized control. Every protocol upgrade became, in the worst reading, an admission that the network still leaned on its founders. That reading is why so many teams treated their own maintenance work as a legal liability rather than a product improvement. I watched the Curve team wrestle with the same dynamic in 2020, when I was manually re-deriving their invariant math against the whitepaper and found a precision loss in the amp coefficient. The product was cryptographic. The narrative around it was still being litigated in human language. Before this, the posture was mostly regulation by enforcement. From roughly 2023 onward, the SEC told the industry what it disapproved of by suing over it, and let courts fill in the boundaries afterward. That approach priced uncertainty into every token, every treasury operation, every upgrade. A team could do everything right and still be one subpoena away from irrelevance. The FAQ is the first document in years that tells the industry what is allowed rather than what is punished. For a developer, that inversion matters more than any single carve-out, because it is the difference between a rulebook and a minefield. The March guidance was the first real step away from that posture. This FAQ is the second. And the timing tells you something structural: SEC and CFTC staff releasing same-day clarifications is not two agencies coincidentally tidying up their websites. It reads as a coordinated policy pull. That coordination is the actual story. The individual sentences are just its load-bearing walls. Let me take the four clarifications apart at the level of what they actually release. First: buybacks. The FAQ states that a repurchase program on an operational network does not, on its own, make the token a security. The legal analogy is a public-company stock buyback — an asset-management action, not evidence of an investment contract. Read this against element three of Howey, the expectation of profit, and you can see the staff deliberately weakening the inference that a team buying its own token is signaling an issuer-holder relationship. In the old reading, a buyback was a wink at returns. In the new one, it is closer to a treasury operation. Buybacks are the visible half of the mechanism; burns are the other. Logically, if a repurchase is not automatically a security, then a repurchase followed by a burn inherits the same treatment, which gives deflationary token models their first explicit compliance cover. That cover is thin. The FAQ addresses the security question, not the accounting question, and a burn that reduces supply without a corresponding reduction in valuation is just a slower way of saying the same thing. Second — and this is the sentence I keep re-reading — network maintenance is excluded from "efforts of others." Protecting, maintaining, improving, and enhancing a system, plus promoting network effects, no longer counts as the kind of managerial effort that anchors a securities claim. This is the most consequential line in the whole document. It means an Ethereum Pectra upgrade or a Solana Firedancer rollout is not, by default, evidence that the team sits at the center of the value. The staff has effectively adopted a version of the "sufficient decentralization" logic from the Hinman era and handed it an operational path: once a network is live, its upkeep is just upkeep. Third: the marketing exemption. Marketing a token's existing use, and even statements about future functionality, fall outside the profit-expectation element — unless the promotion touts profit potential. That last clause is the tripwire. You can describe what the network does. You cannot describe how much someone will make holding it. The distance between those two statements is thinner than a footer disclaimer, and I have watched projects cross it with a single line of copy. Fourth, the binary everyone should underline: the relief is built on a distinction between an already-operational network and one that is not yet operational. For a live network, a buyback is an asset-management move. For a network that has not launched, a buyback pitched as a source of holder returns can still be securities conduct. The staff did not quantify what "operational" means. There is no decentralization threshold, no metric, no checklist. That omission is a loaded gun sitting on the table, and I will come back to it. What unsettles me is that this central distinction — operational versus not-yet-operational — is the same phrase the industry has never been able to define. In my 0x-era audit work, I learned to distrust any specification that hinges on an undefined term, because the ambiguity always migrates to the point of maximum financial leverage. Here, that point is the buyback. A project can argue it is "operational" the moment its mainnet produces blocks. The staff clearly intends something stricter — a network that does not depend on the issuer's efforts — but "clearly intends" is not code. That is not a loophole; it is the absence of a definition, which is worse. Until there is a number, every team will self-certify as operational and dare the agency to disagree. There is a mechanics layer here that the coverage keeps missing. A fee switch plus a buyback loop is not a marketing gesture; it is a supply-curve intervention with a real balance sheet behind it. If you have ever modeled the gas cost of an automated repurchase against a protocol's daily fee revenue, you know the loop only works when fees exceed the cost of execution. That means the legal clarity arrives exactly when the economics are only feasible for protocols that already have product-market fit. The FAQ does not create that condition. It removes a reason to avoid it. The CFTC's half deserves its own paragraph, because it is where the quieter leverage sits. The derivatives regulator opened two doors: letting futures commission merchants invest customer funds in tokenized versions of permitted assets — read that as tokenized treasuries and tokenized money-market funds — and permitting blockchain-based recordkeeping, with the condition that records remain retrievable even if the chain itself fails. That second clause is the one people will misread as bureaucratic paperwork. It is not. "Provide the records even if the blockchain is unavailable" is the regulator admitting, in writing, that a blockchain is an acceptable substrate for regulated recordkeeping. It is the same move as accepting a database, just with a suspicious side-eye. Code is law, but bugs are the human exception — and here the staff is quietly planning for the bug before it happens. The tokenized-asset opening is the piece the market has under-weighted. If a futures commission merchant can hold customer funds in a tokenized money-market fund, then the compliance rail for tokenized treasuries stops being hypothetical and becomes usably regulated. That is the bridge between traditional balance sheets and on-chain settlement, and it is being built from the custody side inward — the opposite of how most RWA narratives assumed it would happen. Pull the four SEC clarifications and the two CFTC openings together and you get a tax cut on compliance friction. The two clearest beneficiaries are protocols with real revenue that want to run a fee-switch-plus-buyback loop, and regulated financial firms that need a tokenized custody rail. DeFi governance tokens get their value-capture mechanism un-handcuffed. The RWA side gets a compliant entry point for government paper. Neither of these is a price target. Both are mechanism unlocks. The distinction matters, because only one of them survives a market cycle. Here is the part the bull case is pricing wrong. Every one of these clarifications is staff guidance — an FAQ, not a rule. It did not go through notice-and-comment. It does not bind a future SEC. The March guidance it builds on was not a rule either. The legislative vehicle that would have made any of it durable, the Clarity Act, has not moved in the Senate. So what the market is treating as a new floor is really an unpinned commit: it compiles today, and the next leadership can revert it without a migration path. Guidance is a commit without a tag. It compiles; it does not persist. That has a concrete second-order effect. There is no safe harbor in this document. The FAQ says, in its own words, that outcomes still depend on the facts of each case. Guidance that says "it depends" while lifting a burden is a promise with a revocation clause. In capital markets, a promise with a revocation clause is priced as duration risk, not as certainty. If you are underwriting a token's legal status on the strength of an FAQ, you are underwriting the tenure of the people who wrote it, not the durability of the rule. And the buyback clause has a hole the size of a treasury. The staff clarified that a buyback is not automatically a security. It said nothing about where the money for that buyback has to come from. A protocol buying its token with real fee revenue and a protocol buying its token with tokens pulled from its own reserve are legally identical under this FAQ and economically opposite. One is value capture. The other is a ponzi wearing a compliance badge. The regulation asks whether a repurchase is a security; it does not ask whether the repurchase is sustainable. That question has just been handed to the investor, and most of the market will not pick it up. The signal worth tracking is not the next press release. It is the first enforcement case where a project cites this FAQ and survives, because that is when the guidance grows teeth. Until then, watch three things: whether Clarity Act language re-enters the Senate, whether the SEC follows with disclosure rules on buyback funding, and whether the "operational network" threshold ever gets an actual number. My posture stays where it was in 2017, staring at the 0x contracts before mainnet: ignore the deck, read what is enforced. The ledger remembers what the wallet forgets — and right now the ledger records the buyback, not whether it was funded by anything real.