Regulators delivered a week of practical guidance touching token classification, market access, sanctions compliance, and custody risk, according to a review of crypto legal developments. The SEC's staff clarified how it assesses decentralized governance and functional networks, the CFTC pressed its position on state-level barriers to regulated markets, and OFAC and the Justice Department highlighted risks where digital assets meet trusted intermediaries.
SEC Staff Clarifies Functional Networks and Governance
On November 2, the SEC's Division of Corporation Finance added three questions to its crypto-asset FAQs, offering more detail on the agency's 2026 classification framework. The staff said participants in a broad-based governance system generally will not be treated as a single "central party" when they are unaffiliated and have no agreement, formal or informal, to act together outside that system.
The guidance also described when a central party "oversees participation," including unilateral authority to restrict access, select validators, change voting processes, alter code, reverse transactions, or revoke access. The update emphasized that functionality and decentralization are distinct: a system may be functional because its native asset has programmatic utility, while the degree of decentralization still depends on who holds operational, economic, or voting control.
The staff advised that labels such as "DAO-governed" or "permissionless" remain insufficient. Governance documents, delegation arrangements, validator admission, upgrade keys, emergency powers, and reward distribution should be mapped against the staff's control factors. The FAQs are staff views, not a Commission rule, and expressly create no new legal obligations, but they offer a diligence checklist for token launches, listings, disclosures, and restructuring.
Canton Coin Receives Fact-Specific No-Action Position
On November 3, the Division of Corporation Finance issued a no-action response concerning Canton Coin. Relying on counsel's representations, the Division viewed the token as a "digital commodity" under the Commission's March 2026 interpretation.
The staff highlighted two points: Canton Coin's value was represented as arising from the network's programmatic operation and supply-and-demand dynamics rather than essential managerial efforts, and the Canton Network was represented as having no central party. The Division said it would not recommend enforcement if Canton Coin is minted programmatically by Super Validators, Validators, and application providers as described, without Securities Act Section 5 or Exchange Act Section 12(g) registration.
The response is not a ruling that every utility or governance token is a non-security. It states that different facts could produce a different conclusion and expresses an enforcement position, not a legal conclusion. Projects seeking similar treatment should expect scrutiny of minting mechanics, control rights, value drivers, and whether managerial promises, rather than present utility alone, create a reasonable expectation of profit.
CFTC Directs Contract Markets to Remove Domestic Geographic Barriers
On November 5, the CFTC issued an interpretation of designated contract markets' impartial-access obligations. It said DCMs generally may not bar an otherwise eligible participant solely because that person is located in a particular U.S. state or region.
DCMs were directed to cease noncompliant domestic geographic restrictions within 30 days, or explain to the Division of Market Oversight why compliance is not feasible. They should also address restrictions imposed through intermediaries.
The interpretation follows the CFTC's lawsuit challenging Utah's attempt to apply state gambling law to federally regulated event contracts. This week, the Commission articulated a nationwide access position under Core Principle 2 and Regulation 38.151, rather than relying only on litigation against one state.
The guidance is immediately relevant to prediction-market DCMs, but its reasoning reaches any DCM offering crypto derivatives or other products through state-sensitive onboarding. Platforms and intermediaries should review geofencing, residency exclusions, account terms, and position-management controls. The document is interpretive guidance, not a statute, and the CFTC said any enforcement decision would depend on the particular facts and circumstances.
OFAC Targets Eight Canadian Money Services Businesses
On November 6, OFAC designated eight Canada-based money services businesses under Executive Order 13902 for operating in Iran's digital-asset sector. Treasury alleged that the businesses converted Iranian rials and other currencies into digital assets and that several transacted with sanctioned Iranian exchanges or addresses associated with the Islamic Revolutionary Guard Corps, terrorism, or sanctioned drug trafficker Ryan Wedding. The action was coordinated with FinCEN, Canada's FINTRAC, and the DEA.
The designations block property and interests in property in the United States or held by U.S. persons, extend to entities owned 50 percent or more by blocked persons, and generally prohibit U.S.-nexus transactions involving the targets absent authorization or exemption. Treasury also reiterated that OFAC may impose civil penalties on a strict-liability basis.
For exchanges, stablecoin businesses, OTC desks, and MSBs, the action shows why sanctions controls cannot stop at a customer-name screen. Effective compliance should combine ownership analysis, wallet and counterparty screening, transactional monitoring, geographic and service-risk review, and escalation procedures for indirect exposure to designated exchanges or addresses.
Former FBI Agent Pleads Guilty to Crypto Theft
On November 5, former FBI agent Patrick Steven Yaroch pleaded guilty to wire fraud and money laundering arising from his misuse of cryptocurrency credentials held in FBI systems. According to the agreed facts described by the Justice Department, Yaroch made about 100 unauthorized transfers involving credentials connected to 35 investigations, including at least one FBI operational wallet, and obtained approximately $2.47 million. He then exchanged and moved the assets to obscure their source and ownership. Sentencing is scheduled for March 4, 2027; the court has not yet imposed a sentence.
The case underscores that private keys and recovery credentials remain bearer-like assets even inside sophisticated institutions. Exchanges, custodians, receivers, bankruptcy estates, law firms, and investigators handling recovered crypto should use split knowledge or multi-party approval, role-based access, immutable audit logs, rapid credential rotation, and independent reconciliation. Asset-recovery planning should address insider compromise as well as external hacking, because attribution and tracing do not themselves prevent a person with valid credentials from moving funds.
