SEC Regulation Crypto Assets: Security, Code and Governance

Video transcript

The SEC's proposed Regulation Crypto Assets would ask issuers to describe security, supply and smart contract permissions. Those are engineering facts.

The SEC proposed it on August 18, 2026. As of November 5, it has not been adopted, and a final rule could differ.

A startup exemption would allow up to five million dollars over four years. A fundraising exemption would allow twenty or seventy five million every twelve months. Both require the same disclosures.

Item b six asks for material aspects of security and a link to any public code. Strong answers draw on repositories, verified addresses, audits and key custody.

Item b seven covers supply and the mechanisms for generating and destroying tokens. Map every mint and burn path, including bridges, and make supply verifiable.

Item b eight asks who may be empowered to make changes. List owners, upgrade authority and pause powers, and whether a multisig, timelock or governor holds each.

As proposed, its audit requirements cover financial statements, not code. OpenZeppelin recommended disclosing third-party security audits. Whether a final rule names them is open.

Guardian's Technical Evidence builds this record: deployment verification, a privileged role map, configuration drift tracking, and audits and pentests. Your counsel owns the disclosure.

Read the full article, or talk to Guardian at guardian.security about building the record behind your disclosures.

The SEC proposed Regulation Crypto Assets on August 18, 2026, in Release No. 33-11434. Comments closed on October 20, 2026.

As of November 5, 2026, it has not been adopted. The Federal Register and the SEC's rulemaking page list only the proposal.

Most of the release is offering law. Three of its disclosure items are engineering facts, and they are the subject of this post.

This article explains the technical and security side of the SEC's proposed Regulation Crypto Assets. It is not legal advice; confirm how it applies to you with counsel.

Status and Timeline

A final rule could differ from what is described here.

Two Exemptions, One Disclosure Rule

The proposal would add two exemptions from Securities Act registration, plus a safe harbor. Both exemptions require the same Rule 103(b) disclosures.

Rule 400 would deem the investment contract ended once the issuer completes or permanently ceases its promised efforts, makes no new promises and files Form TR. Our safe harbor explainer covers it.

How Rule 103 disclosure works

Rule 103(b) has ten items. Items (b)(1) to (b)(5) cover the contract, the offering, the asset, management and conflicts, and the network and its plan of development.

Items (b)(6) to (b)(8) are technical. Items (b)(9) and (b)(10) cover the ecosystem and risk factors.

Rule 103(a) says disclosure should be:

• Tailored to the issuer, the asset and its network or application.
• Clear and concise, "without overly relying on technical terminology or jargon."
• Consistent with the issuer's website, official social media and whitepapers.
• Clear about what exists now and what is only planned.

An item need not be answered where it does not apply, or the facts are unknown or not reasonably available.

The consistency principle reaches engineering. If your docs or whitepaper promise a timelock or an audit, the disclosure should say the same.

Rule 103(b)(6): Security and Source Code

Item (b)(6) asks for "the material aspects of the security" of the token and its network or application.

If the issuer has made its source code public, it must also give the web address where the code is.

The SEC says this would help investors check whether the system "may operate consistently with the issuer's description," and assess cybersecurity risks.

Publishing code is not required. The release expects many issuers to publish it before any offering.

The rule lists no contents. A description an engineer can stand behind would draw on:

• The repository, and the commit or tag behind each deployed contract.
• Deployed addresses per chain, with verified source.
• Audits: scope, commit, findings and fix status.
• How admin and treasury keys are held and signed.
• Monitoring, incident response and any bug bounty.
• Past incidents, and how they were fixed.

Rule 103(b)(7): Supply, Mint and Burn

Item (b)(7) covers token economics: supply, pricing, lockups, distribution methods, related-person holdings and release schedules.

Two parts are code: the "mechanisms for generating and destroying" tokens, and "methods to verify the subject crypto asset's transaction history."

The SEC's aim is that investors can assess how many tokens "may be outstanding at a given point in time."

• Mint paths: every minter role, cap and emission schedule, including bridge mints on other chains.
• Burn paths: user burns, admin burns and bridge burns.
• Lockups: enforced by a vesting contract, or only by agreement. Say which.
• Related persons: the rule's definition is broad, from founders to contractors and advisors. Map their wallets.
• Verification: contract addresses, explorer links and a supply query anyone can rerun at a given block.

If one role can mint without a cap, the economics description should say so.

Rule 103(b)(8): Governance and Permissions

Item (b)(8) asks for "governance mechanisms, smart contract governance mechanisms, and permissions" of the token and its network or application.

The SEC's reason: investors should understand the conditions under which changes may be made, and "who may be empowered to make such changes."

That is a permission inventory, read from the deployed contracts:

• Owners, admins and role admins, and who can grant roles.
• Proxy admins and upgrade authority.
• Pause, freeze, blacklist and rescue functions.
• Minter and parameter-setting roles.
• Each holder: EOA, multisig with threshold and signers, timelock with delay, or governor.
• Safe modules that can act without the signer threshold.
• Offchain powers: relayers, keepers, sequencers and oracle operators.

The same inventory also informs the central party questions in the SEC staff FAQs. See which admin powers count and when a foundation is a central party.

Keep it current. Startup issuers would update for material changes each year; fundraising issuers would file periodic and current reports.

Ecosystem, Risk Factors and Audits

Item (b)(9) covers the current and anticipated ecosystem, "onchain" and "offchain," including technology infrastructure and other parties and systems that use the token.

That can include front ends, RPC providers, oracles, bridges, custodians and sequencers.

Item (b)(10) asks for risk factors specific to the issuer, the token and its network. The description must avoid generalized statements.

Compare "smart contracts may contain bugs" with "a 3-of-5 team multisig can upgrade the token contract with no delay." Only the second is specific.

Audits in the record

The proposed rule does not require a code audit. Its audit requirements concern financial statements, not code.

In input to the SEC's Crypto Task Force, OpenZeppelin recommended disclosing third-party security audits and their methodology. The release cites it.

Figure Markets suggested ongoing disclosure of material changes "such as protocol updates, security audits, and network performance metrics."

The release asks whether to add disclosure requirements or non-exclusive examples (questions 28 and 29). Whether a final rule names audits is open.

How Guardian Builds the Record

Guardian's Technical Evidence turns engagement results into artifacts a reviewer can trace back to the system.

• Deployment verification: deployed bytecode matched to the audited commit, useful for (b)(6).
• Privileged role and upgrade path map: every role that can move value, upgrade, pause or freeze, with holder, threshold and timelock, useful for (b)(8).
• Contract configuration drift: parameters, roles and upgrades compared with what was reviewed, each change dated.
• Audits and pentests: onchain and offchain findings, each pentest closed out with a retest.

Your counsel owns the disclosure and the legal analysis.

Frequently Asked Questions

Has the SEC adopted Regulation Crypto Assets?

No. As of November 5, 2026, it is a proposed rule. The SEC proposed it on August 18, 2026, comments closed on October 20, and the Federal Register lists no final rule.

What does Rule 103(b)(6) require?

A description of the material aspects of the security of the token and its network or application. If the issuer has made the source code public, it must also give the web address where the code is.

Does Regulation Crypto Assets require a smart contract audit?

Not as proposed. Its audit requirements concern financial statements, not code. In input to the Crypto Task Force, OpenZeppelin recommended disclosing third-party security audits, and the release asks whether to add disclosure requirements.

How much can issuers raise under the proposed exemptions?

Up to $5 million over four years under the startup exemption. Under the fundraising exemption, up to $20 million (Tier 1) or $75 million (Tier 2) in each 12-month period.

Sources

• Federal Register: Regulation Crypto Assets, proposed rule, Release Nos. 33-11434 and 34-106150, 91 FR 54510 (Aug. 21, 2026)
• GovInfo: Federal Register Vol. 91, No. 161, FR Doc. 2026-17183, full text of the proposal (Aug. 21, 2026)
• SEC: Regulation Crypto Assets rulemaking page, File No. S7-2026-27 (viewed Nov. 5, 2026)
• SEC: Comments on File No. S7-2026-27
• Guardian: The SEC Crypto Safe Harbor Proposal: Rule 400 and Form TR
• Guardian: The SEC Central Party Test: Which Admin Powers Count
• Guardian: Regulatory and Compliance Assessment