The SEC finally wrote the rule: 401 pages, two dollar caps, and one blank threshold

The clause with the most value attached to it is the one the Commission has not finished writing. An issuer can read the startup exemption and know precisely what it buys: five million dollars over four years without full registration ^[3]. The safe harbor is worth more than that to anyone holding a token, and it arrives in conditionals. Projects meeting certain decentralization thresholds "could potentially" be exempt from ongoing securities classification ^[6], and the SEC's own framing puts those thresholds among the two biggest open questions in the proposal, alongside disclosure, because it now has to name metrics and benchmarks ^[10].

What the safe harbor repairs is a status with no termination date. The proposal calls it the Hotel California problem: a project checks into securities law and cannot leave, even once the token is decentralized enough that no single team controls investor outcomes ^[5]. Enforcement-first policy left that open at both ends. A team could not prove it had exited, and could not budget for never exiting.

The two exemptions are not evenly spaced rungs. Averaged over its four-year window the startup tier permits about $1.25m a year; the fundraising tier permits sixty times that annually ^[13], and the price of the jump is financial statements and reporting standards ^[4] plus the infrastructure to produce them ^[11]. That cost does not scale down. It argues for raising either well under the lower ceiling or close to the upper one, with the middle as the expensive place to sit.

Codification is the durable part. Bill Hinman's 2018 remark that Ethereum had become decentralized enough to sit outside securities law was a speech, not a rule ^[9], and eight years separate it from an attempt to write the idea into regulation ^[15]. Counsel cannot paper a token launch with a speech. A threshold in a rule, even an unfriendly one, can be met, or contested somewhere other than a courtroom.

That puts the weight on sixty-three days ^[14]. The proposal did not appear cold: a March 2026 interpretation set out how existing securities law applies to certain crypto assets ^[7], and the 2025 GENIUS Act pointed the same way from Congress ^[12]. A proposal is still not a rule, and the record here supplies a comment deadline and nothing after it ^[8].

There is a second-order effect worth pricing now. Once a metric is named it becomes the design target, and vesting schedules and governance structures will be built to clear whatever line the SEC draws ^[10]. Decentralization that is measured is decentralization that gets managed. The argument in the comment file will not only be about how strict the thresholds are, but about how cheaply they can be satisfied without changing who actually runs the project.