Takeaways from SEC’s First Ever Enforcement Actions Against Cryptocurrency Firms for Failing to Register as a Broker-Dealer and Investment Company

Over the past year, the U.S. Securities and Exchange Commission has ramped up its scrutiny of cryptocurrencies and other digital token offerings. On Sept. 11, 2018, the SEC escalated its crackdown when it announced a pair of settled enforcement actions against non-issuers participating in the offer and sale of cryptocurrencies it deemed unregistered securities. As with prior cryptocurrency cases, the SEC charged the defendants with offering or selling securities without filing a registration statement or having a valid exemption from registration. However, these cases mark the SEC’s first cryptocurrency enforcement actions against non-issuers for failing to register as broker-dealers and investment companies. As such, they highlight the SEC’s continuing efforts to bring the purchase and sale of cryptocurrencies within a regulated framework, including by targeting third parties who facilitate the purchase and sale of such assets.

Rising Scrutiny of Cryptocurrency Offerings

The SEC previously issued a report in July 2017, warning that digital tokens could constitute securities and that unregistered initial coin offerings—or ICOs—could violate the securities laws. In December 2017, the SEC issued a cease and desist order to a company that failed to register an offering of utility tokens, even though there were no allegations of fraud. (Read Fenwick’s prior analysis of these developments in “The SEC and Plaintiffs’ Class Action Attorneys Are Targeting Initial Coin Offerings.”) In 2018, the SEC has continued to target fraudulent and unregistered digital token offerings.


On Sept. 11, 2018, the SEC filed its first enforcement action alleging that an online platform that bought and sold digital assets was operating as an unregistered broker-dealer. The SEC alleged that from July 2017 through late February 2018, a company named TokenLot operated as a broker by facilitating sales of digital tokens offered by nine issuers in ICOs. A self-styled “ICO superstore,” TokenLot operated an online platform where retail investors could purchase digital tokens during and after an ICO. TokenLot marketed the digital tokens; accepted investors’ orders and funds for payment; worked with issuers to transfer purchased digital tokens to investors; and disbursed the proceeds of the sales to the issuer. The company also operated as a broker by listing for sale and participating in secondary sales of digital tokens issued by 145 different issuers. Further, TokenLot operated as a dealer by purchasing digital tokens at a discount during the ICOs and then selling them to retail investors for a profit.

TokenLot earned approximately $344,000 in connection with its activities as an unregistered broker-dealer. In addition, the company earned approximately $127,000 in marketing fees to promote the sale of 40 digital tokens to potential investors, including retail investors, through the company’s website, various social media platforms and forums, email newsletters and other means. Neither TokenLot nor its owners/operators had ever registered with the SEC.

The SEC charged the company and its owners/operators with failing to register as a broker-dealer and for selling unregistered securities. Notably, unlike most of the prior SEC enforcement actions involving cryptocurrencies, the SEC did not allege any fraudulent conduct.

TokenLot and its owners/operators were ordered to pay an aggregate $478,929 in disgorgement and prejudgment interest. The owners/operators were also ordered to pay $45,000 each as a civil penalty and were barred from participating in the securities industry with the right to apply for reentry after three years. The company, which is in the process of winding down, agreed to retain a qualified independent intermediary to take possession of and destroy the remaining digital tokens in TokenLot’s inventory.


On the same day it filed its case against TokenLot, the SEC brought a separate action against Crypto Asset Management. CAM managed Crypto Asset Fund, or CAF, a pooled investment vehicle formed for the purpose of investing in digital assets. The SEC alleged that from August 1, 2017, through December 1, 2017, CAM raised over $3.6 million from 44 investors, most of whom were individuals. There was no pre-existing relationship between CAM and these investors; rather, CAM engaged in a general solicitation of investors through the company’s website, social media accounts and traditional media outlet interviews. Moreover, CAM not only failed to register CAF as an investment company, it also misrepresented that CAF had filed a registration statement with the SEC and that it was the “first regulated crypto asset fund in the United States,” according to the SEC’s findings.

The SEC charged CAM and its owner with several violations of the securities laws, including:

  • Offering or selling unregistered securities
  • Failing to register CAF as an investment company
  • Making material misrepresentations or omissions in connection with the offer or sale of securities, and
  • Making material misrepresentations or omissions to prospective investors in a pooled investment vehicle

The SEC ordered CAM and its owner to pay $200,000 in civil penalties. According to the SEC, the monetary penalty reflected the cooperation and remedial acts undertaken by CAM, which included:

  • An immediate halt to the offering
  • A review of CAM’s website, marketing materials and offering procedures
  • Verification of the accredited status of investors
  • Disclosure of CAM’s previous misstatements to investors and potential investors, and
  • A rescission offer to each accredited investor

In addition, beginning in January 2018, CAM began offering securities pursuant to a Regulation D Rule 506(c) exemption from registration.

Key Takeaways

Entities and individuals need to analyze the risk that transactions in a given digital token or cryptocurrency are likely to involve the offer or sale of a security. The test to determine whether or not a given transaction involves an investment contract, and thus implicates the federal securities laws, was articulated by the U.S. Supreme Court in SEC v. W.J. Howey (1946). There are no bright-line rules. Rather, the test is a highly fact-specific inquiry considering whether the transaction (1) is an investment of money (2) in a common enterprise (3) with a reasonable expectation of profits (4) derived from the managerial efforts of others.

Senior SEC officials indicated in June that established, well-functioning and decentralized cryptocurrencies such as Bitcoin and Ethereum are not themselves securities. However, many digital tokens—and the platforms used to transact in such tokens—are much less developed and more dependent on the efforts of the issuer for success. In such cases, purchases of the token are more likely to be considered investments, and the token itself likely constitutes a security. And the enforcement action against CAM confirms that even transactions involving Bitcoin and Ethereum may implicate a security if they are packaged as part of fund for investment.

The SEC’s enforcement actions against TokenLot and CAM underscore that the agency has expanded its enforcement beyond cryptocurrency issuers and is now scrutinizing the actions of third parties who facilitate sales of cryptocurrencies that, in the SEC’s view, are unregistered securities without a valid exemption from registration. At the outset, firms and entities wishing to transact in digital tokens and cryptocurrencies must apply the Howey test and analyze the economic substance of the transaction to understand the risk that it may implicate a security, thus triggering the various disclosure and registration requirements under the federal securities laws.

Entities and individuals that transact in cryptocurrencies must consider whether they are required to register with the SEC. Separate and apart from selling unregistered securities, TokenLot and CAM were also charged with failing to register as a broker-dealer and an investment company, respectively. Cryptocurrency transactions that implicate securities may trigger SEC registration requirements, not just for the underlying cryptocurrency offering, but also potentially for third parties that are in the business of various types of cryptocurrency transactions.

Entities and individuals that are engaged in the business of buying, selling or investing in securities, including applicable cryptocurrencies should consider whether they need to be registered with the SEC. This includes brokers (i.e. those who are in the business of facilitating securities transactions for the accounts of others), dealers (i.e., those who are engaged in the business of buying and selling securities for their own account), and investment companies (i.e., issuers that are primarily engaged in the business of investing, reinvesting or trading in securities). It does not include traders who generally buy for their own account, either individually or as a fiduciary, but not as part of a regular business.

The SEC is targeting not just entities, but individuals, and the consequences can be severe. Finally, it’s worth noting that in TokenLot and CAM, the SEC brought charges not just against the entities but also against the control persons behind the entities individually. In the case of TokenLot, the two individual respondents were barred from associating with a broker-dealer, investment adviser, or investment company for a minimum of three years. In addition, the individuals are on the hook (along with the TokenLot entity, jointly and severally) to pay the SEC over $475,000 in disgorgement and interest. Further, they were required to shutter TokenLot and destroy any cryptocurrencies it held. In CAM, the entity’s owner was required to pay a $200,000 penalty, jointly and severally with the entity. Notably, in both cases, the SEC said that the sanctions would have been more severe but for the remedial efforts of the respondents.

The sanctions against the individual owners of TokenLot and CAM are a reminder that an SEC investigation can quickly turn into an enforcement action with serious individual consequences. Accordingly, individuals engaged in cryptocurrency activities should seek legal advice from experienced practitioners when structuring their businesses, and should engage experienced SEC counsel should their activities draw the unwanted attention of the agency’s enforcement division.