On May 3, 2022, the US Securities and Exchange Commission (SEC) announced the expansion of its newly styled Crypto Assets and Cyber Unit (Unit) (formerly known as the Cyber Unit), housed within its Division of Enforcement.1 The Unit, which is responsible for protecting investors in digital assets and for policing cyber-related threats to the market, will add 20 positions, nearly doubling in size from 30 to 50 dedicated staff members. According to the announcement, the Unit has brought more than 80 enforcement actions involving fraudulent and unregistered crypto asset offerings and platforms, resulting in more than $2 billion in monetary relief.

The announcement also noted that the Unit, which has already brought enforcement actions against SEC registrants and public companies for failing to maintain adequate cybersecurity controls and appropriately disclose cyber-related risks and incidents, will continue to protect investors from cyber-related threats. The Unit’s commitment to “tackle the omnipresent cyber-related threats to the nation’s markets” echoes the predecessor Cyber Unit’s warning in November 2021 of increased cybersecurity enforcement “to ensure clear cyber risk disclosures and solid internal controls.”2

The Unit will specifically target securities law violations involving crypto asset offerings, crypto asset exchanges and decentralized finance (DeFi) platforms, crypto asset lending and staking products, non-fungible tokens (NFTs), and stablecoins.

Crypto asset offerings: The Unit’s stated focus on crypto asset offerings is unsurprising given public statements by Commissioners and the SEC’s continued enforcement in this space. In his April 2022 remarks to the Penn Law Capital Markets Association Annual Conference, SEC Chair Gary Gensler was direct: “Without prejudging any one token, most crypto tokens are investment contracts under the Howey test.”3 He also recently flagged that there is “a crypto market now where many tokens may be unregistered securities, without required disclosures or market oversight.”4 The Enforcement Division has also brought a number of recent cases related to crypto asset offerings.5 The SEC is looking to further cement its ability to regulate crypto assets in the highly anticipated case, SEC v. Ripple, in which the SEC alleges that Ripple Labs and two executives sold $1.3 billion in cryptocurrency tokens in an unregistered securities offering. The outcome of that case could have far-reaching implications for future SEC enforcement of potential securities violations involving crypto assets.

Crypto asset lending and staking products: The SEC also has already taken notable enforcement action related to crypto asset lending and staking products. In February 2022, the SEC brought an enforcement action and, together with state securities regulators, levied $100 million in civil penalties against BlockFi Lending, a major cryptocurrency exchange, finding that its crypto lending product, which was offered and sold to US investors, was a security requiring registration.6 Last year, Coinbase put a similar crypto-lending product on hold after the SEC allegedly informed Coinbase that it would bring an enforcement action if it proceeded.7 The Unit’s focus on crypto asset lending and staking products is predictable given these recent developments.

Cryptocurrency Exchanges and DeFi: Although there has been more limited SEC enforcement activity against cryptocurrency exchanges and DeFi platforms to date8, many have expected an increase in this area. The SEC recently proposed a rule that could expand what constitutes an “exchange” as defined in Rule 3b-16(a) and make it easier to subject cryptocurrency exchanges and DeFi platforms to SEC regulation.9 In addition, SEC Commissioner Caroline Crenshaw noted the potential compliance issues related to unregistered centralized bitcoin exchanges.10 In April 2022, Chair Gensler opined that “crypto trading and lending platforms, whether they call themselves centralized or decentralized (DeFi)” are likely trading securities: “many of the tokens trading on these platforms may well meet the definition of ‘securities.’ While each token’s legal status depends on its own facts and circumstances, given the Commission’s experience with various tokens that are securities, and with so many tokens trading, the probability is quite remote that any given platform has zero securities.”11 Chair Gensler further stated that he had asked SEC staff to work on “getting the platforms themselves registered and regulated much like exchanges.”12 Finally, it has been reported that the SEC has already opened an investigation into one of the largest DeFi platforms.13

NFTs: While the SEC has already brought cases relating to the categories listed above, it has not yet waded into NFTs through guidance or enforcement. Recently, it was reported that the SEC was looking into probing how companies are using NFTs, and particularly fractional NFTs.14 Listing NFTs as a focus of the expanded Unit indicates that the SEC is exploring the applicability of securities laws to NFTs and likely forecasts enforcement of securities violations involving NFTs.

Stablecoins: Stablecoins are a type of cryptocurrency that purportedly offer more stability than other cryptocurrencies because they are backed by fiat currencies. For that reason, they have generally been considered outside the realm of the SEC’s jurisdiction. But Chair Gensler previously remarked that the SEC will regulate any stablecoin deemed to be a security, especially because there may be investor protection issues and possible illicit activity associated with stablecoins.15 Given these recently-expressed concerns, it is unsurprising that the Unit will focus on securities violations involving stablecoins.

Immediately following announcement of the Unit’s expansion, SEC Commissioner Hester Peirce, often referred to as Crypto Mom due to her generally favorable stance towards cryptocurrency, again voiced her concern that the SEC is engaging in regulation by enforcement: “The SEC is a regulatory agency with an enforcement division, not an enforcement agency. Why are we leading with enforcement in crypto?”16 This is not the first time she has expressed this frustration. In January 2021, she remarked: “Enforcement actions can indeed provide clarity, but it’s not the right way to do it from my perspective. . . .We want to provide people clear guidelines ahead of time and then they can figure out how they can do something so that it is legal.”17

* * *

Since taking the helm of the SEC last year, Chair Gensler has repeatedly expressed his view that the SEC has jurisdiction over nearly all aspects of the crypto market. Prior to this announcement, that was borne out in various enforcement actions and rule proposals. But this dramatic increase in resources for the Division of Enforcement shows that the SEC is walking the walk when it comes to asserting its authority over crypto. The enlarged Unit will enhance its ability for deeper and broader investigations in the crypto space—for example, possibly examining whether any token traded on a DeFi platform is a security. Players in the crypto industry should prepare for increased investigations and enforcement activity.