Who Really Controls a Crypto Project? Inside the SEC’s New Guidance
A crypto project may have thousands of token holders, while a much smaller group holds the power to upgrade code, pause operations, move funds or carry out votes. New SEC staff guidance says that assessing control means looking beyond who votes and asking who can put decisions into effect.
- Token voting alone does not show who controls a system.
- Delegation, privileged permissions and execution roles can concentrate power.
- The SEC FAQ is nonbinding staff guidance, not project approval or a safe harbour.
- DAO structures do not resolve separate questions of legal liability.
What the SEC guidance covers
On November 2, 2026, the SEC’s Division of Corporation Finance added questions 1.4 to 1.6 to its crypto asset FAQ. The answers address shared governance, controls over participation and a system’s functionality when considering whether a central party has effective control.
Control in this context is more than the ability to cast a vote. It can also mean the authority to change code or access rules, control privileged permissions, direct validators (the operators or systems that help process and confirm transactions), or carry out a governance decision.
Taking part in governance does not automatically make unrelated token holders a coordinated controlling group. The question is whether participants are acting together or otherwise hold meaningful authority over the system. The answer depends on the facts, including how powers are distributed and exercised.
The FAQ reflects staff views. It has no legal force and creates no new obligations. The Commission has neither approved nor disapproved its contents. The FAQ does not approve any project or token, and it is not a blanket exemption from securities laws.
The guidance builds on an SEC interpretive release issued March 17 and effective March 23, identified as releases 33-11412 and 34-105020. That release sets out five categories: digital commodities, digital collectibles, digital tools, stablecoins and digital securities. It also distinguishes a crypto asset from the transaction or arrangement in which it is sold. An asset that is not itself a security may still be sold as part of an investment contract, depending on the promises made and the managerial efforts buyers are led to expect.
Governance is one part of that analysis. It is not a standalone test for whether a token or sale is a security. The FAQ makes no project-specific findings about Uniswap, Aave, Arbitrum, ENS or other named systems.
Delegated votes can hide concentrated influence
Wallet counts can mislead. With delegated voting, a holder assigns voting power to a representative but keeps ownership of the tokens. The delegate may have more influence than their own token balance suggests.
To assess voting power, it can be more useful to look at delegation recorded at the relevant voting snapshot (the point in time used to determine voting rights for a proposal) than to count current wallet balances. Imagine a project with 10, 000 token-holding addresses, where most voting power is delegated to a small number of related organisations. The address count alone would not show how widely decision-making power is distributed.
Consider another hypothetical example. A system has 100 million voting tokens, of which 40 million are delegated. One delegate controls 12 million, or 30% of delegated power and 12% of the total supply. If 20 million votes are cast and the delegate uses all 12 million, it accounts for 60% of votes cast. These figures measure different things: total supply, delegated power and participation in a particular vote.
Quorum rules matter, too. Quorum is the minimum participation required for a proposal to count as valid. A proposal may win a majority of votes cast but still fail to reach quorum. Even a proposal that passes may need a separate step before the system changes.
Passing a vote and executing it are different
Uniswap’s specified on-chain governance route includes a two-day waiting period, a seven-day vote and a two-day timelock. A timelock delays execution after approval, giving participants time to review a proposed change. The vote and the later execution are separate events.
Some systems require an authorised account to submit the execution transaction. Others may require several signers to approve it through a multisig. A vote might trigger a change directly, require another actor to act, or simply recommend an action. Each setup gives voters a different degree of practical authority.
Arbitrum’s constitution assigns chain-owner privileges to governance and a Security Council. It allows emergency action with a nine-of-twelve threshold and requires a transparency report after an emergency intervention. So it matters not only who controls routine decisions, but who can act quickly outside the ordinary process.
Project documentation can show other divisions of authority. Aave’s materials distinguish proposition power, voting power and emergency-guardian roles. ENS documentation sets out delegation requirements and different proposal types. These examples illustrate governance mechanics, but they are not SEC findings about those projects.
Functionality is a separate consideration. A system may operate as intended even while voting, economic or operational authority remains concentrated. Whether a network works and who can change or intervene in it are related, but separate, questions.
Legal entities and service providers are part of the picture
A foundation or legal association does not, on its own, prove that a project is centralised. A decentralised legal label does not prove that authority is widely shared, either. Agreements, permissions, vote records, treasury activity and service-provider contracts can help show who has power in practice.
The Uniswap Foundation describes DUNI as a Wyoming decentralised unincorporated nonprofit association intended to give governance-related activity legal recognition. Its stated purposes include entering contracts and managing funds.
Under the published summary of DUNI’s association agreement, membership is linked to UNI ownership and engagement with the governance protocol. Membership alone does not authorise someone to sign contracts or represent the association. Members also have no ownership claim on DUNI’s assets or profits.
DUNI’s agreements assign specific financial, tax and payment-administration tasks to Administrator Services, a Cowrie subsidiary. The documents distinguish those tasks from David Kerr’s separately authorised role signing tax returns. The ministerial-agent agreement also lets DUNI terminate the arrangement through a valid governance proposal, while the agent may leave without cause on 60 days’ written notice.
Those terms do not prove that a provider controls DUNI. They do clarify the practical questions: who can instruct the provider, approve spending, change the agreement or end the relationship? Formal governance rules and day-to-day authority may differ.
DAO structure does not settle liability
The SEC FAQ addresses classification within the SEC’s framework. It does not decide separate questions about state-law entities, partnership claims or liability for particular conduct. Court cases involving DAOs concern different legal issues.
In a November 18, 2024, order in the Lido dispute, case 23-cv-06492-VC, a district court rejected the argument that DAO structure alone made the organisation immune from suit. At the motion-to-dismiss stage, the court found that the plaintiff had adequately alleged a general partnership and allowed claims against certain institutional participants to proceed. The court did not rule after a trial that every LDO holder was liable.
In the Ooki DAO case, the CFTC described a judgment imposing a $643, 542 civil penalty, trading and registration bans, and website-related relief. The court held that the DAO could be treated as a person under the Commodity Exchange Act. That decision concerns a different legal question from the SEC’s guidance on governance and crypto asset classification.
Neither case means every DAO voter is automatically liable. But “DAO” describes a coordination model, not a universal legal shield. A group’s conduct, structure and governing law can all matter.
What the proposed fundraising rules would, and would not, do
On August 18, the SEC proposed Regulation Crypto Assets. The proposal would create two registration exemptions with crypto-specific disclosure requirements and a conditional investment-contract safe harbour. It describes a startup route of up to $5 million over four years and a separate fundraising route of up to $75 million in a rolling 12-month period.
Those limits and protections are proposed terms, not exemptions adopted through the November FAQ. The documents have different procedural statuses: the March release is an interpretation, the August rulemaking is a proposal, and the November FAQ contains staff answers. Treating them as one sweeping change, or assuming a proposed safe harbour is already available, would get ahead of what has been issued.
Key questions about crypto project control
-
Does token voting automatically make holders a controlling group?
No. Ordinary participation by unrelated holders does not, by itself, prove coordinated control. Relevant facts include relationships among participants, voting concentration and who can carry out decisions.
-
Does a functional network prove that control is decentralised?
No. A system can work as designed while important voting, operational or emergency powers remain concentrated.
-
Did the SEC approve Uniswap, Aave or another project?
No. The FAQ gives general staff views and makes no project-specific finding or token approval.
-
What records can help show who has authority?
Relevant evidence can include delegated voting power at the applicable snapshot, access permissions, governing agreements, vote and execution records, treasury activity, emergency powers and service-provider contracts.
-
Does the FAQ eliminate DAO participant liability?
No. SEC classification and liability under other laws are separate issues. The FAQ does not resolve them.
-
Are the proposed fundraising exemptions available now?
No. Regulation Crypto Assets remains a proposal, separate from the November FAQ.
For any project, the most useful governance question is specific: who can change the rules, restrict access, exercise emergency powers, direct service providers and execute approved decisions? Comparing those powers with the project’s public claims is a better starting point than counting wallets or taking a decentralisation label at face value.
