SEC guidance distinguishes functional crypto networks from decentralized systems, making operational control a central consideration. Arbitrum’s 9-of-12 emergency upgrade mechanism illustrate
A cryptocurrency network can operate without interruption while a small group retains the power to change its underlying rules. For projects navigating U.S. securities law, that distinction matters more than the number of people holding its governance token.
The Securities and Exchange Commission’s digital-asset framework examines whether a central party retains material authority over a network and whether purchasers depend on that party’s essential managerial efforts.
The agency’s cryptocurrency FAQs, published in September 2026, elaborate on its March interpretive framework. The publicly available FAQ page identifies September 28 as its latest revision, so a separately reported November 2 update should not be treated as confirmed without an official document.
A decentralized autonomous organization may distribute voting rights broadly while retaining concentrated technical authority.
The distinction becomes important when evaluating governance arrangements, administrator privileges and the promises made to token purchasers.
The SEC’s framework separates network functionality from decentralization. A functional network can support its intended operations, but that fact alone does not establish the absence of centralized control.
Its September FAQs also clarify that assessing whether an issuer fulfilled promises concerning functionality or decentralization depends on the representations actually made to purchasers.
That creates a more specific inquiry than simply counting governance participants.
SEC · NETWORK CONTROL Where Network Control Resides 01 Governance Outcomes Voting concentration, affiliations and delegation arrangements 02 Protocol Upgrades Upgrade permissions, multisig thresholds and timelocks 03 Validator Participation Admission requirements and discretionary restrictions 04 Emergency Intervention Exceptional powers, oversight and revocation procedures Source: SEC digital-asset guidance. No single indicator independently determines securities status.No universal voting percentage or multisig threshold automatically establishes whether a token transaction falls within securities law.
Arbitrum illustrates how a network can combine token-holder governance with exceptional technical permissions.
Under the ArbitrumDAO Constitution, a 12-member Security Council can execute certain emergency actions with nine signatures, bypassing the ordinary governance delay.
Non-emergency actions also require nine signatures but must pass through a delayed execution process. The DAO retains constitutional mechanisms to modify or eliminate the council’s authority.
The structure addresses a genuine security problem. A critical software vulnerability may require intervention before a conventional governance vote can conclude.
However, those emergency capabilities also identify a limited group with authority to make consequential technical changes.
A regulatory assessment would need to examine the scope of those powers, the circumstances permitting their use and the extent of governance oversight.
It would also need to distinguish emergency security functions from authority over the network’s broader economic operation.
The existence of a Security Council does not establish that Arbitrum is centrally controlled under SEC standards or determine ARB’s legal classification. Rather, it demonstrates why the distribution of governance tokens cannot substitute for examining executable permissions.
Ethereum provides a contrasting example at the validator level.
Its official staking documentation describes a system in which participants can operate solo validators by running the required software and depositing 32 ETH.
Participation follows protocol-defined conditions rather than discretionary approval by a designated admissions authority.
That distinction is relevant when assessing who can control network participation.
However, permissionless validator entry does not establish decentralization across every dimension. Staking concentration, software development and other dependencies require separate consideration.
The SEC’s September FAQs also distinguish routine maintenance from essential managerial efforts. Under the circumstances addressed in the Commission’s interpretation, work to maintain, secure or improve an already functional network generally does not constitute the type of managerial activity that creates the relevant expectation of profit.
For established protocols, this distinction helps separate ongoing technical development from promises that purchasers rely upon when entering an investment contract.
The SEC’s framework gives developers and governance participants a practical reason to examine their actual control structures.
Administrator privileges: Identify accounts and multisigs capable of upgrading contracts, pausing activity or changing critical parameters. Document signer thresholds, timelocks and emergency exceptions.
Delegated voting: Review major voting blocs, affiliated entities and coordination agreements. Concentrated voting power warrants examination but does not independently prove coordinated control.
Validator admission: Determine whether participation follows publicly defined technical requirements or depends on approval by an identifiable operator.
Governance execution: Verify whether approved decisions can be implemented through documented procedures and whether exceptional powers remain subject to oversight.
Documentation should reflect the network’s actual operation. A governance framework that describes distributed decision-making may provide an incomplete picture if separate administrative permissions allow material decisions to be overridden.
Eliminating emergency controls solely to strengthen a decentralization claim could also introduce security risks without resolving the securities-law analysis.
The SEC’s regulatory activity has continued alongside congressional efforts to establish a broader cryptocurrency market-structure framework.
Its March interpretation, September staff FAQs and proposed regulatory changes address different questions and carry different legal consequences.
The March release expresses the Commission’s interpretation of existing law. The FAQs provide staff explanations and explicitly state that they do not create additional legal obligations.
Neither replaces legislation or eliminates the need to assess individual transactions under applicable securities law.
For token issuers and investors, the distinction is consequential. A network’s technical architecture can inform the analysis, but it cannot independently determine whether a particular token offering or transaction involves an investment contract.
The most useful evidence is therefore concrete: who controls critical permissions, how that authority is constrained and what purchasers were promised.
Those questions offer a more rigorous basis for evaluating decentralization than token-holder counts or governance labels alone.
The post SEC Crypto Guidance Puts DAO Control and Admin Keys Under Scrutiny appeared first on ETHNews.
