Free Strategy Call

Security vs. Commodity Classification

The security versus commodity distinction determines which US regulator oversees a crypto asset: the SEC regulates securities under the Howey test, and the CFTC regulates commodities. The same token can fall on either side depending on what it represents, what rights it carries, and how it is sold. Classification follows substance, not branding.

Classification is a design decision before it is a legal one. Whether a token carries a claim on revenue and whose work drives its value are set at mechanism-design time, and they decide the regulatory regime the token triggers.

Security vs commodity classification — two-axis analysisCommon enterpriseProfit mechanismManaged by issuerUser-controlledPooled capitalSecurityclassic STOLikely securitysubstance > formIndividual useUnclearcontext mattersCommodity / utilityCFTC / utility

Scroll to see the full diagram

Classification depends on substance, not labels. Pooled capital managed by the issuer for a return is the clearest security fact pattern.

The four components that frame the analysis

Security under the Howey test: an asset sold as an investment contract, meaning an investment of money in a common enterprise with an expectation of profit from the efforts of others. Securities fall under SEC jurisdiction and carry registration or exemption requirements plus disclosure obligations.

Commodity under the CFTC: a good traded in interstate commerce under the Commodity Exchange Act. The CFTC has treated Bitcoin as a commodity since 2015, and federal courts have upheld that position. Commodity derivatives face full CFTC oversight; commodity spot markets face CFTC anti-fraud and anti-manipulation authority rather than securities registration.

The classification tests that decide: courts apply the four-prong Howey test to the economic reality of each transaction, not to the token in isolation. The SEC's 2019 digital-asset framework adds detailed factors, with one question at the center: whose efforts drive the expected profit?

What determines which a token is: the rights the token carries, the promises made when it was sold, and how dependent holders are on a central team's continued work. Labels carry no weight. A utility token sold on profit expectations can still be an investment contract.

What the Howey test asks

The Howey test comes from SEC v. W.J. Howey Co., a 1946 Supreme Court case about Florida citrus groves sold with service contracts. The Court defined an investment contract by four elements, and all four must be present: an investment of money, in a common enterprise, with a reasonable expectation of profit, derived from the efforts of others.

The fourth prong does most of the work in crypto. If holders expect the token to appreciate because a central team is building the product, running the treasury, and marketing the network, the fourth prong points toward a securities analysis. Where no identifiable promoter's efforts drive the value, it points away.

Why Bitcoin is treated as a commodity

The Commodity Exchange Act defines commodities broadly. The CFTC first stated that Bitcoin and other virtual currencies fit that definition in a 2015 enforcement order (In re Coinflip, Inc.), and a federal court agreed in CFTC v. McDonnell (2018), holding that virtual currencies are commodities under the Act. SEC leadership has repeatedly said the agency does not view Bitcoin as a security, on the reasoning that no central promoter's efforts drive its value.

The market structure reflects this. CME has listed Bitcoin futures since 2017 and Ether futures since 2021, both under CFTC oversight.

Classification runs transaction by transaction: the Ripple ruling

In July 2023, the federal court in SEC v. Ripple Labs granted partial summary judgment for each side. The court held that Ripple's direct sales of XRP to institutional buyers were unregistered securities offerings, while its programmatic sales on exchanges, where buyers did not know they were buying from Ripple, were not securities transactions. The asset was identical in both cases. The transaction context decided the outcome.

That ruling made explicit what the Howey framework had always implied: the test applies to transactions, not to tokens in the abstract. A token is not permanently stamped security or commodity at issuance.

Decentralization and the efforts of others

In a June 2018 speech, William Hinman, then Director of the SEC's Division of Corporation Finance, said that in his view current offers and sales of Ether were not securities transactions, because the Ethereum network had become sufficiently decentralized that no central third party's efforts were key to the enterprise. The speech stated personal views, not an official rule, and the SEC has never formalized a decentralization threshold.

Congress has moved toward codifying one. FIT21, the Financial Innovation and Technology for the 21st Century Act, passed the House of Representatives in May 2024 and would allocate jurisdiction between the SEC and CFTC based in part on whether a blockchain is decentralized. Where that framework stands when you read this is a question for counsel.

What this means at design time

The classification factors are visible in the design itself. A token that promises yield paid from a team's efforts, carries a claim on protocol revenue, or is marketed on price appreciation gives the Howey analysis material to work with. A token that represents redeemable ownership of an underlying asset, pays no yield, and trades at a market-set price presents a different profile. The SEC's 2019 framework and the case law above name these factors directly.

Classification should be an input to mechanism design, not a defense mounted afterward. Whether a specific design qualifies is fact-specific and jurisdiction-specific, and that call belongs to your legal team. This page is reference material. It is not legal advice, and it is not a recommendation to buy, sell, or hold any asset.

See Token Classification and Compliance Guide for how this applies in practice.

Know the terms but not sure how they apply to your project? That is what an engagement is for. We design, document, and stress-test the whole token economy inside the Tokenomics Data Room.

Book a discovery call

80+ projects advised. Complete tokenomics in 4 to 6 weeks.