Initial Coin Offerings (ICOs) and other digital currency financing events have enjoyed explosive growth in 2017, with hundreds of millions of dollars invested with little to no regulation or government oversight. That era appears to be coming to a close, as the Securities and Exchange Commission (SEC) is poised to apply U.S. federal securities laws to ICOs and other digital currency offerings. That guidance came in the form of a landmark report this week, in which the SEC confirmed that tokens or coins sold in ICOs constitute securities under the Securities Act of 1933 (the Securities Act) and the Securities Exchange Act of 1934 (the Exchange Act) and are subject to registration requirements, unless an exemption applies.

The SEC guidance affects both entities conducting ICOs and digital currency exchanges. Issuers of “blockchain technology-based securities” will be required to register offers and sales pursuant to U.S. securities laws. Cryptocurrency exchanges also will fall under the purview of federal securities laws and must register as national securities exchanges, unless an exemption applies.

The report came in response to the creation and sale of virtual currency tokens by The DAO (Decentralized Autonomous Organization) and a related German corporation, Slock.it UG. The DAO sale is considered to be one of the original ICOs. It raised more than $150 million in ether (the virtual currency supported by the Ethereum Network) in April and May 2016. However, after hackers managed to steal $60 million worth of ether from The DAO, an SEC investigation began to raise questions regarding the application of U.S. federal securities laws.

The report focuses on the threshold question of whether DAO tokens constitute securities, and whether U.S. federal securities laws apply to the use of “distributed ledger technology” by “virtual organizations” to raise capital. However, it does so with the express purpose of demonstrating the “application of existing U.S. federal securities laws to this new paradigm.” The SEC is sending a clear signal that ICOs and any exchanges hosting the accompanying tokens will no longer be able to fly under the radar of U.S. regulators.

Under Section 2(a)(1) of the Securities Act, an investment contract constitutes a security. The three-prong test for an investment contract under federal law looks to whether there is [i] an investment of money in a common enterprise [ii] with a reasonable expectation of profits [iii] to be derived from the entrepreneurial or managerial efforts of others. See SEC v. Edwards, 540 U.S. 389, 393 (2004).

First, the SEC found that the contribution of ether to The DAO in exchange for DAO tokens was an investment of money. Courts have interpreted money to include contributions other than cash. Second, the SEC looked to whether investors purchasing DAO tokens had an expectation of profits. The DAO offered holders opportunities to democratically vote on and fund projects in exchange for a share of the potential profits. This was sufficient according to the SEC’s analysis to constitute a reasonable expectation of profits.

Third, the SEC found that the token holders’ profits would be derived from the managerial efforts of others. Slock.it and its founders promoted the functionality of The DAO funding model, provided forums for answering investor questions, and provided expertise on the Ethereum protocol. Thus, the SEC found that investors had relied on the founders to provide “significant managerial efforts.” Accordingly, the tokens satisfied the three-prong test and were found to constitute securities.

The SEC concluded that, as an issuer of securities pursuant to Section 5 of the Securities Act, The DAO’s offering was subject to registration requirements. While the SEC is not pursuing an enforcement action against The DAO or Slock.it, it has indicated that future offerings face a significant risk of penalties by failing to fully comply with U.S. federal securities laws. Violations do not require proof of intent, meaning negligence or a misunderstanding of securities laws will not provide a valid defense.

Generally, entities raising capital via an ICO will need to accompany the offer or sale of tokens with a “full and fair disclosure” and a statutory investment prospectus, pursuant to Section 5 of the Securities Act. Entities will need to provide information on their financial condition, the identity and background of management, and the price and amount of tokens to be offered. This places far more onerous – and expensive – burdens on organizations interested in launching an ICO, and significantly shifts the cost-benefit calculus. Legal fees and regulatory compliance will become significant line items in all future offerings, and the effect that this will have on the high-growth ICO market remains to be seen.

Moreover, the ruling subjects any exchanges hosting transactions involving ICO tokens to Section 5 of the Exchange Act. Exchanges must register as a national securities exchange or, more likely, operate under an exemption as an alternative trading system (ATS). Under the Exchange Act, an exchange can qualify as an ATS by registering as a broker-dealer and filing a Form ATS. In any event, the additional regulatory burdens may affect the market for exchanges willing to host ICO tokens.

The first SEC enforcement action against an entity funded by an ICO or an exchange is certainly forthcoming, and will be instructive in fleshing out how and when securities laws will apply to ICOs. However, the SEC report is a shot across the bow to any operators in the space that are planning an ICO or operating an exchange, and it will be crucially important to consult with attorneys specializing in federal securities laws to ensure prompt compliance and mitigate the risk of being the SEC’s first test case.