A REGULATORY CLASSIFICATION OF DIGITAL ASSETS: TOWARD AN OPERATIONAL HOWEY TEST FOR CRYPTOCURRENCIES, ICOS, AND OTHER DIGITAL ASSETS M. Todd Henderson & Max Raskin* Digital assets are hot right now. Whether cryptocurrencies, like bitcoin, or initial coin offerings and tokens, this new asset class has captured the imagination of American investors. While it remains to be seen if this phenomenon has staying power, there is no doubt that these assets and their promoters have attracted the attention of the Securities and Exchange Commission. But neither Congress nor the SEC has formally elucidated which digital assets are securities and which are not. This Article seeks to provide clarity in determining which digital assets are securities. It proposes two tests that operationalize the Supreme Court’s test in SEC v. W. J. Howey Co. The first test is the Bahamas Test, which asks whether a digital asset is sufficiently decentralized such that it is not a security. The second test is the Substantial Steps Test which is used to determine whether an investment is made with an expectation of profit. This Article takes a rules-based approach to provide clarity and begin a conversation about crafting more predictable jurisprudence and regulation in this area. I. Introduction ................................................................. 444 II. A Brief Technical Aside ............................................... 451 * Michael J. Marks Professor of Law, The University of Chicago; Adjunct Professor of Law, New York University. We thank Jacob Loshin, Brent McIntosh, Peter Van Valkenburgh, Chris Dixon, Kathryn Haun, Jeremy Sklaroff, Andrew Hinkes, and Richard Epstein for their help with these ideas. We would especially like to thank the Mechanic’s Liens Steering Committee for fostering a robust research agenda. 444 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 III. SEC Stance and Existing Jurisprudence................... 454 IV. Howey for Digital Assets ............................................. 459 A. Efforts of Others Prong – the “Bahamas Test” .. 460 1. Applying the Bahamas Test ........................... 469 i. Bitcoin ........................................................ 470 ii. Ethereum ................................................... 471 iii. The DAO ..................................................... 473 iv. Summary of the Bahamas Test ................ 477 B. Expectation of Profit Prong .................................. 477 1. Current Test—Facts and Circumstances ...... 478 2. Proposal—Substantial Steps Test .................. 483 3. Summary of Our Tests .................................... 489 4. A Note on Self-Regulatory Organizations ..... 491 V. Conclusion .................................................................... 492 I. INTRODUCTION Something potentially revolutionary is going on in the capital markets. Not since the Internet Bubble of the late 1990s has there been such growth in new ways of raising money, coupled with such widespread public interest in new financial products. It began with crowdfunding.1 Entrepreneurs of all kinds realized they could use the Internet to appeal directly to investors or even their customers. This realization created a new market for funding ideas: the crowd. And while the market boomed for a bit, there were no clear and stable rules. The securities laws in place were, and still are, a product of the 1930s. Even though the laws have been continuously updated by the Securities and Exchange Commission (“SEC”) through rulemaking and guidance, this new approach to fundraising did not fit neatly into the regulatory scheme. The whole point of crowdfunding was to find a less expensive way of raising money. Forcing entrepreneurs to use existing, high- cost registration methods was incompatible with the concept. 1 Ajay Agrawal, Christian Catalini & Avi Goldfarb, Some Simple Economics of Crowdfunding, 14 INNOVATION POL’Y & ECON 63 (2014). No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 445 But a regulatory Wild West was not appealing either.2 There was a risk of fraud, and also the possibility that low-quality offerors and offers would crowd out higher quality ones. Unfortunately, Congress and the SEC addressed the regulatory lacuna with a new set of rules that may not have been passed during the New Deal, but were certainly wedded to its precepts. To avail oneself of crowds to raise money, entrepreneurs had to navigate complex rules and use investment portals registered with the government.3 Not surprisingly, corporate crowdfunding has not yet evolved into a serious alternative source of financing.4 The latest evolution in capital markets is cryptocurrency and other digital assets, which are addressed in this brief Article. Today, digital assets present both promise and peril, which makes the space similar to crowdfunding in the early 2010s. In both cases, there has been no shortage of investor demand for new classes of assets or ways to participate in capital markets. Similarly, there has been no shortage of entrepreneurs who want to provide the public with those assets. There is, however, a shortage of intelligent rules and regulations that provide a clear and predictable framework for investors, issuers, and their lawyers. This shortage of regulatory certainty is, for some, a feature of digital assets. The high costs of accessing public markets in the United States has driven capital elsewhere—going public costs millions of dollars on average, and operating a public company has significant ongoing costs.5 While the 2 But see generally TERRY L. ANDERSON & PETER J. HILL, THE NOT SO WILD, WILD WEST: PROPERTY RIGHTS ON THE FRONTIER (2004) (exploring how the Wild West was not as lawless as commonly portrayed, and had a stable institutional environment that encouraged cooperation and trade). 3 See, e.g., 15 U.S.C. § 77d(a)(6) (2012); 17 C.F.R. pt. 227 (2018). 4 See generally Joan MacLeod Heminway, How Congress Killed Investment Crowdfunding: A Tale of Political Pressure, Hasty Decisions, and Inexpert Judgments that Begs for a Happy Ending, 102 KY. L.J. 865 (2013). 5 PWC DEALS, CONSIDERING AN IPO TO FUEL YOUR COMPANY’S FUTURE?: INSIGHT INTO THE COSTS OF GOING PUBLIC AND BEING PUBLIC 14 (2017), https://www.pwc.com/us/en/deals/publications/assets/cost-of-an-ipo.pdf [https://perma.cc/MV65-MEV9] (“Two-thirds of the CFOs surveyed 446 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 government has responded with legislation aimed at promoting access to capital markets, such as the Jumpstart Our Business Startups Act (“JOBS Act”),6 there is still demand for lesser-regulated, publicly-available investment products that is not matched by supply of those products. This demand is just one of many reasons for the increase in investment in digital assets, which include cryptocurrencies, initial coin offerings (“ICOs”), and other instruments. Another driver of this market is innovation, both technological and sociological. On the technological side, innovations like blockchains have made it possible to disintermediate financial and other institutions.7 These networks and the currencies that fuel them have value. Bitcoin is the most famous example of this—it is the modern world’s first and most successful experiment in a decentralized approach to money creation. There is growing demand for a digital-age money or a private store of value, which may in turn be fueling a demand for other private services that the state has traditionally policed. Whatever the reasons, once there is a private store of value—whether it is mackerel fillets,8 cigarettes,9 or bitcoin—it is natural for individuals to use it as a means of fundraising or investing. ICOs follow from bitcoin as IPOs follow from dollars. On the sociological side, individuals are rethinking how they interact with capitalists and entrepreneurs. The success of crowdfunding prior to regulation showed that individuals estimated spending between $1 million and $1.9 million annually on the costs of being public[.]”). 6 Jumpstart Our Business Startups Act, Pub. L. No. 112–106, 126 Stat. 306 (2012); see also H.R. REP. No. 113-53 (2013) (proposing the SEC Regulatory Accountability Act). 7 See, e.g., David Yermack, Corporate Governance and Blockchains, 21 REV. FIN. 7, 10 (2017) (“Making such powerful third parties obsolete and disintermediating financial transactions was the central goal of Nakamoto’s (2008) proposal for a peer-to-peer electronic cash system.”). 8 Justin Scheck, Mackerel Economics in Prison Leads to Appreciation for Oily Fillets, WALL ST. J. (Oct. 2, 2008), https://www.wsj.com/articles/ SB122290720439096481 (on file with the Columbia Business Law Review). 9 See generally R.A. Radford, The Economic Organisation of a P.O.W. Camp, 12 ECONOMICA 189, 190–91 (1945). No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 447 are willing to participate in equity raises with mixed motives that include not only profit seeking, but also consumptive utility and charitable satisfaction. In a world in which social, environmental, political, and other attributes attach to investments, as well as an individual attachment between investors and the companies they provide capital to, there may be a need for new financial vehicles to satisfy this more nuanced demand. A final reason for the changing capital formation landscape is fraud and exuberance. As with any new technology, digital assets have opened the door for both bad and irrational actors. Vast amounts of money funneling into the space have created ripe conditions for a get-rich-quick mentality on the part of investors and cases of outright fraud on the part of promoters. There are already numerous examples of both.10 Therefore, digital assets pose two fundamental problems to securities regulators. The first is an information asymmetry problem; the second is a police power problem. Information asymmetries are the animating force behind most securities regulation. The three pillars of modern securities law— mandatory disclosure, strict anti-fraud rules, and insider trading limitations—are designed to put traders on an equal footing, regardless of whether they are inside or outside of a particular firm whose stock is being traded.11 This follows from the reality that market forces will not provide the optimal amount of information, and so the government must instead compel it. The antifraud rules in turn are designed to make any disclosures credible. The argument goes that in the absence of a way for issuers to vouch for their disclosures, the market will have a “lemons” 10 See, e.g., SEC v. Shavers, No. 4:13-CV-416, 2014 WL 4652121, at *1 (E.D. Tex. Sept. 18, 2014); Michelle Fox, People are Taking Out Mortgages to Buy Bitcoin, Says Securities Regulator, CNBC (Dec. 11, 2017), https://www.cnbc.com/2017/12/11/people-are-taking-out-mortgages-to-buy- bitcoin-says-joseph-borg.html [https://perma.cc/4Q67-L2R4]. 11 Securities Act of 1933, ch. 38, Pub. L. No. 73-22, 48 Stat. 74 (codified as amended at 15 U.S.C. §§ 77a–77aa (2012)) (“To provide full and fair disclosure of the character of securities sold in interstate and foreign commerce and through the mails, and to prevent frauds in the sale thereof, and for other purposes.”). 448 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 problem.12 After all, if fraudsters can make promises as easily as upstanding issuers, then good firms will leave the market because investors will confuse them with bad actors. If opportunities for fraud and exuberance are the primary drivers of these new digital asset markets, then the SEC has an important role in making these markets credible and efficient. The second issue is that even if investors have perfect knowledge of the assets they are purchasing, the government may still wish to prohibit purchase of these instruments. Such prohibitions can have any number of rationales, including national security, tax enforcement, or paternalism. States use their “police power” to stop gambling and a host of other activities they deem socially undesirable.13 The line between legitimate investment and illegal gambling is indeed hazy and often depends on social or moral judgments. After all, the moral difference between betting on whether the Chicago Bears will make the playoffs and betting on whether General Electric will make their earnings target for the next quarter is slight. Why the latter is universally permitted and the former only in limited circumstances is likely because of a view by government regulators that betting on stocks is “good” for society, while betting on sports and so on is “bad” for society. But, it is notable that this police power is not primarily enforced through securities laws. Gambling is banned by other laws, with the securities laws, in effect, providing a safe harbor for trading in stocks and bonds. It is still too early to tell exactly which of the drivers of digital asset excitement is dominant. This puts regulatory bodies in a tough position. Specifically, these new assets pose a problem for the SEC. More lax regulation of digital assets may give cover to bad actors, while the good actors are forced to contend with antiquated securities regulations. There has been a huge proliferation of digital assets, and both those products and the markets that trade them are changing 12 See generally George A. Akerlof, The Market for “Lemons”: Quality Uncertainty and the Market Mechanism, 84 Q.J. ECON. 488 (1970). 13 See, e.g., UTAH CODE ANN. §§ 76-10-1101–09 (West 2012). No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 449 rapidly. It is unclear when and if this space will stabilize, but the reality is that digital assets as traded and marketed today do not fit into the regulatory dogmas of the quiet past. The SEC has entered into the fray largely through enforcement actions, consent orders, and informal guidance.14 It has not, however, announced a rule-based, operational test for determining whether a digital asset is a security (“investment contract”) under Sections 2(a)(1) and 3(a)(10) of the Securities Act of 1933 (the “Securities Act”).15 This lack of a bright-line rule maintains discretion and flexibility for regulators. To this end, on April 3, 2019, the SEC’s Strategic Hub for Innovation and Financial Technology issued its Framework for “Investment Contract” Analysis of Digital Assets (the “Framework”).16 It is not “Auer” job to determine how much weight to give the Framework.17 Instead, this Article will note the strong overlap its analysis has with the Framework.18 14 See, e.g., CarrierEQ, Inc., Securities Act Release No. 10575, 2018 WL 6017664 (Nov. 16, 2018), https://www.sec.gov/litigation/admin/2018/33- 10575.pdf [https://perma.cc/NM4X-66VV]; Paragon Coin, Inc., Securities Act Release No. 10574, 2018 WL 6017663 (Nov. 16, 2018), https://www.sec.gov/litigation/admin/2018/33-10574.pdf [https://perma.cc/ TJ3D-93DL]. 15 See Securities Act of 1933 §§ 2(a)(1), 3(a)(10). 16 Framework for “Investment Contract” Analysis of Digital Assets, U.S. SEC. & EXCHANGE COMMISSION [hereinafter Framework], https://www.sec.gov/corpfin/framework-investment-contract-analysis- digital-assets [https://perma.cc/99KD-XG4P] (last modified Apr. 3, 2019). 17 See Kisor v. Shulkin, 869 F.3d 1360 (Fed. Cir. 2017), reh’g denied, 880 F.3d 1378 (2018), cert. granted 139 S. Ct. 657 (2018) (granting certiorari to review whether the Court should overrule Auer v. Robbins, 519 U.S. 452 (1997) and Bowles v. Seminole Rock & Sand Co., 325 U.S. 410 (1945), two cases that direct courts to defer to an agency’s reasonable interpretation of its own ambiguous regulation). 18 An initial draft of this paper was published on October 17, 2018. See M. Todd Henderson & Max Raskin, A Regulatory Classification of Digital Assets: Towards an Operational Howey Test for Cryptocurrencies, ICOs, and Other Digital Assets (Oct. 17, 2018), https://papers.ssrn. com/sol3/papers.cfm?abstract_id=3265295 [https://perma.cc/L5AK-NCUW]; cf. Leibniz-Newton Calculus Controversy, WIKIPEDIA, 450 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 Where the Article primarily differs is in its proposal of a simple, rules-based test that will provide more certainty to the market.19 Such a test would not tie regulators’ hands with respect to ex post enforcement actions, preserving regulatory flexibility. This test will proceed under the existing SEC v. W.J. Howey Co. framework, which the Supreme Court and the SEC use to evaluate the jurisdictional sections of the relevant securities statutes. Howey established that: [A]n investment contract for purposes of the Securities Act means a contract, transaction or scheme whereby a person invests his money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party, it being immaterial whether the shares in the enterprise are evidenced by formal certificates or by nominal interests in the physical assets employed in the enterprise.20 Simply stated, the four prongs of the Howey test that must be met for jurisdiction are: (1) investment of money; (2) efforts of others; (3) expectation of profits, and (4) common enterprise.21 This Article’s two-step proposal offers a first cut at how digital assets of various types might be categorized within this familiar Howey framework. One part of the test will be immediately useful and operational—called the “Bahamas Test” herein. It makes a determination of whether a digital asset is sufficiently decentralized such that it does not satisfy the “efforts of others” prong of Howey and is therefore not a security. The second part of the test, determining whether an asset satisfies the “expectation of profit” prong of Howey, reveals the problems with applying the existing framework to ICOs and other digital assets. https://en.wikipedia.org/wiki/Leibniz%E2%80%93Newton_calculus_contro versy [https://perma.cc/Y339-SKWR]. 19 It is beyond the scope of this Article to defend such an approach. For such a defense, see Antonin Scalia, The Rule of Law as a Law of Rules, 56 U. CHI. L. REV. 1175 (1989). 20 SEC v. W. J. Howey Co., 328 U.S. 293, 298–99 (1946). 21 See id. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 451 Some tokens and cryptocurrencies—such as bitcoin—exist on decentralized, open source and permission-less platforms where there are no “others” to satisfy the final prong of the test, even though they may be purchased with the expectation of profit. These are not securities under the traditional Howey test, and in our view, they should not be regulated as such. The challenge comes in differentiating between digital assets and tokens that have been described as “utility” or “consumptive” tokens with those that have been described as “investment” tokens. The currently existing spectrum is between purely consumptive assets, mixed-motive assets, and purely investment assets. This has analogues in case law— one simple example is a concert venue that sells tickets to a reseller who has no intention of using them other than to sell to the final consumers. This is not treated as issuance of a security.22 This Article’s goal is to start—not end—the conversation about how to categorize crypto and other digital assets. The proposed “Substantial Steps Test”—to determine whether a purchase is made with an expectation of profit—is not without its faults and may militate towards a full rethinking of Howey. This Article begins with a brief description of the mechanics of digital assets and their limited regulatory history. It then turns to our proposed Howey test for digital assets and examines a handful of cases under the two prongs. II. A BRIEF TECHNICAL ASIDE This Section provides a brief background on digital assets. The goal here is to provide a framework that will animate the regulatory analysis, not to give an encyclopedic account of these assets. The Section begins with the concept of open source software. The hallmark of open source software is that it has little to no intellectual property protections.23 The code can be copied and modified, and no legal recourse exists to the creator. A plethora of open source licenses append to software 22 Other examples include personal seat licenses and condominiums. 23 See Jacobsen v. Katzer, 535 F.3d 1373, 1378–79 (Fed. Cir. 2008). 452 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 programs. Bitcoin uses the MIT License,24 while Ethereum uses the Free Software Foundation’s License.25 Bitcoin’s license grants permission, free of charge, “to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the [Bitcoin software.]”26 Individuals are free to run whatever versions of Bitcoin or Ethereum software they choose to run. Through network effects, however, consensus is formed and dominant versions of software emerge as a result of the free choices of network participants. For instance, the two most popular versions of Bitcoin are the original Bitcoin network and a forked version called Bitcoin Cash.27 The most important aspect of open source software is that it is predicated on voluntary choice. Decisions made on which versions of software to run are open to anyone, and no legal barriers exist to participation in a network. Additionally, the intellectual property regime is much more liberal, and there are fewer claims which prevent the creation of new competitive instruments and networks. A second technical aspect worth discussing is the number of different ways to categorize the distribution methods of 24 Bitcoin/COPYING, GITHUB, https://github.com/bitcoin/bitcoin/blob/ master/COPYING [https://perma.cc/EJD5-R34T]. 25 Licensing, GITHUB, https://github.com/ethereum/wiki/wiki/ Licensing [https://perma.cc/N7YW-AYQQ]. But see Matt Savare, John Wintermute & Shailley Singh, Coders Beware: Licensing Issues Abound for Ether Apps, COINDESK (Dec. 6, 2017), https://www.coindesk.com/coders- beware-licensing-issues-abound-ethereum-apps [https://perma.cc/T2PF- XZG4]). 26 Bitcoin/COPYING, GITHUB, https://github.com/bitcoin/bitcoin/blob/ master/COPYING [https://perma.cc/EJD5-R34T]. 27 A “fork,” when referring to digital assets, is a change in software that not all parties agree to such that two competing versions of a network are created. See, e.g., David Farmer, What is a Bitcoin Fork?, COINBASE BLOG (July 27, 2017), https://blog.coinbase.com/what-is-a-bitcoin-fork- cba07fe73ef1 (on file with the Columbia Business Law Review). No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 453 digital assets.28 This Article adopts the bifurcated typology of minting and mining discussed by Cohney et al.29 Assets that are minted are “created through an act of founder fiat.”30 The creator either uses a blockchain or some other method of issuance to create assets that are then sold to buyers, either using smart or more traditional contracts. This is an alternative to mining, in which those participating in a network receive digital assets in exchange for their involvement in the network.31 The important distinction for below is that with minting, the creator has rights and privileges with respect to the asset and network that the purchaser does not have. Finally, digital assets can be issued through a number of platforms that keep track of the asset ownership. Decentralized blockchains are one such method. No single individual or organization must hold the database that holds the asset ownership. Instead, the database exists on all of the nodes in the network running the software.32 Another, more traditional method of issuing digital assets involves centralized databases. Here, a single entity or entities that have permission maintain the database. 28 E.g., PETER VAN VALKENBURGH, COIN CENTER, FRAMEWORK FOR SECURITIES REGULATION OF CRYPTOCURRENCIES, 11–17 (2018), https://coincenter.org/files/securities-cryptocurrency-framework-v2.1.pdf [https://perma.cc/22FV-GPVZ]. 29 See Shaanan Cohsey, David A. Hoffman, Jeremy Sklaroff & David A. Wishnick, Coin-Operated Capitalism, 119 COLUM. L. REV. (forthcoming 2019) (manuscript at 29–30). 30 Id. at 30. 31 Id. at 29 n.91. 32 See Daniel Cawrey, What Are Bitcoin Nodes and Why Do We Need Them?, COINDESK (May 9, 2014), https://www.coindesk.com/bitcoin-nodes- need [https://perma.cc/YHA5-ME4X]. 454 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 III. SEC STANCE AND EXISTING JURISPRUDENCE The SEC has articulated its positions on digital assets through informal guidance,33 enforcement actions,34 and even a website that explains the perils of the ICO market and relays up-to-date information.35 Humorously,36 it also hosts a website promoting its own fake ICO called Howeycoin37 to demonstrate the problems with parts of the market.38 To date, there have been no rulemakings, either formal or informal. The SEC’s most significant policy statements on ICOs came in a speech delivered by William Hinman, director of the division of corporation finance and the Framework issued in April of 2019.39 While other commissioners spoke out about various issues in digital assets, Hinman was the first speaker to articulate a cognizable legal standard for classifying the assets. The speech sought to answer the following question: “[Whether] a digital asset that was originally offered in a securities offering [could] ever be later sold in a manner that does not constitute an offering of a security[.]”40 First, Hinman answers that when terms like “coin,” “token,” or 33 See, e.g., Framework, supra note 16; Press Release, SEC, Statement on Digital Asset Securities Issuance and Trading (Nov. 16, 2018), https://www.sec.gov/news/public-statement/digital-asset-securites- issuuance-and-trading [https://perma.cc/2EH3-AVJB]. 34 See, e.g., supra note 14. 35 See generally Spotlight on Initial Coin Offerings (ICOs), U.S. SEC. & EXCHANGE COMMISSION, https://www.sec.gov/ICO [https://perma.cc/Q2GB- 3HE4] (last modified Feb. 7, 2019). 36 This Article uses this term relatively speaking. 37 Howeycoins Pre-ICO Sale, U.S. SEC. & EXCHANGE COMMISSION, https://www.howeycoins.com/index.html [https://perma.cc/VN2X-PCWU]. 38 Press Release, SEC, The SEC Has an Opportunity You Won’t Want to Miss: Act Now! (May 16, 2018), https://www.sec.gov/news/press- release/2018-88 [https://perma.cc/M5NF-VZHW]. 39 See Framework, supra note 16; William Hinman, Dir., Div. Corp. Fin., SEC, Remarks at the Yahoo Finance All Markets Summit: Crypto (June 14, 2018) [hereinafter Hinman Speech], https://www.sec.gov/news/ speech/speech-hinman-061418 [https://perma.cc/W7N4-RN8N]. 40 Id. http://www.sec.gov/ICO No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 455 “ICOs” are used in an attempt to evade registration requirements, the SEC will treat them simply as securities with a straightforward Howey analysis.41 There are numerous examples of these types of assets.42 The second half of the speech, however, deals with instruments that may not be securities: If the network on which the token or coin is to function is sufficiently decentralized – where purchasers would no longer reasonably expect a person or group to carry out essential managerial or entrepreneurial efforts – the assets may not represent an investment contract. Moreover, when the efforts of the third party are no longer a key factor for determining the enterprise’s success, material information asymmetries recede. As a network becomes truly decentralized, the ability to identify an issuer or promoter to make the requisite disclosures becomes difficult, and less meaningful.43 The most notable asset to meet this definition is bitcoin. Recognizing that such “sufficiently decentralized” digital assets may not be securities is an important foundational principle. But this raises a second question: how can the investment community know what Hinman and the SEC mean by “sufficiently decentralized”? No operational test has been offered, which is why this Article proposes the Bahamas Test. The Framework focuses on the reasonable expectation of profits and efforts of others prongs of the Howey inquiry.44 Instead of this Article's more rigid rules-based approach, the Framework lists a number of characteristics for determining whether a purchaser had a reasonable expectation of profit 41 See id. 42 See, e.g., CarrierEQ, Inc., Securities Act Release No. 10575, 2018 WL 6017664 (Nov. 16, 2018), https://www.sec.gov/litigation/admin/2018/33- 10575.pdf [https://perma.cc/NM4X-66VV]; Paragon Coin, Inc., Securities Act Release No. 10574, 2018 WL 6017663 (Nov. 16, 2018), https://www.sec.gov/litigation/admin/2018/33-10574.pdf [https://perma.cc/ TJ3D-93DL]. 43 Hinman Speech, supra note 39. 44 See Framework, supra note 16. 456 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 derived from the efforts of others.45 In this standards-based approach, "no one of the . . . characteristics is necessarily determinative" but the "stronger their presence" the more likely the instrument is a security.46 The Framework then goes on to provide a long list of such characteristics. Some examples of them are: • An active participant (“AP)47 is responsible for the development, improvement (or enhancement), operation, or promotion of the network, particularly if purchasers of the digital asset expect an AP to be performing or overseeing tasks that are necessary for the network or digital asset to achieve or retain its intended purpose or functionality. • There are essential tasks or responsibilities performed and expected to be performed by an AP, rather than an unaffiliated, dispersed community of network users (commonly known as a "decentralized" network). • The digital asset gives the holder rights to share in the enterprise's income or profits or to realize gain from capital appreciation of the digital asset. • The digital asset is transferable or traded on or through a secondary market or platform, or is expected to be in the future. • There is little apparent correlation between the purchase/offering price of the digital asset and the market price of the particular goods or services that can be acquired in exchange for the digital asset.48 The above is not an exhaustive retelling of the Framework's list and the Framework's list is not exhaustive 45 Id. 46 Id. 47 The Framework defines this as “a promoter, sponsor, or other third party (or affiliated group of third parties).” Id. 48 Id. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 457 of all things considered. But this should give a sense of the flexible standard reflected in the Framework. Beyond the speech and the Framework, federal courts have opined on whether digital assets are securities. One federal district court, for instance, found no reason why Howey cannot be applied to digital assets and said that this was a factual question.49 The three most significant SEC actions thus far are the so- called “DAO Report”, an early cease-and-desist order against a company called Munchee, and a no-action letter issued following the release of the Framework to TurnKey Jet, Inc. (“TKJ”).50 The Decentralized Autonomous Organization (“DAO”) Report, discussed in greater detail below, declared the sale of shares in a company run by computer code a security offering, even though there were no employees or human issuers of the security other than the code that created the autonomous corporation.51 The Munchee order, relying on the DAO Report, found that the company’s selling of digital tokens to help fund a food 49 United States v. Zaslavskiy, No. 17 CR 647, 2018 WL 4346339, at *5 (E.D.N.Y. Sept. 11, 2018) (“For present purposes, we conclude that [REcoins] are [investment contracts]. However, the ultimate fact-finder will be required to conduct an independent Howey analysis based on the evidence presented at trial.”) (citation omitted). 50 Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO, Securities Exchange Act Release No. 81207 (Jul. 25, 2017) [hereinafter The DAO Report], https://www.sec.gov/ litigation/investreport/34-81207.pdf [https://perma.cc/L5M7-ZXV8]; Munchee Inc., Securities Act Release No. 10445 (Dec. 11, 2017) [hereinafter Munchee Order], https://www.sec.gov/litigation/admin/2017/ 33-10445.pdf [https://perma.cc/Q4JY-RD2Q]; TurnKey Jet, Inc., SEC No- Action Letter (Apr. 3, 2019) [hereinafter TurnKey Jet No-Action Letter], https://www.sec.gov/divisions/corpfin/cf-noaction/2019/turnkey-jet-040219- 2a1.htm [https://perma.cc/8SZ4-MWWH]. There have also been a number of other enforcement actions. See e.g., Press Release, SEC, SEC Charges ICO Superstore and Owners with Operating as Unregistered Broker- Dealers (Sept. 11, 2018), https://www.sec.gov/news/press-release/2018-185 [https://perma.cc/395P-37KR] (detailing the first action against an unregistered broker dealer). 51 See The DAO Report, supra note 50; see also infra Part IV.A.1.iii. 458 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 review app was an unregistered security offering.52 This was in spite of the fact that users would be paid in “MUN token[s]” for writing food reviews and that there was an ecosystem promised that would allow individuals to spend their MUN tokens, potentially even at restaurants.53 The SEC’s reasoning focused on (i) the reasonable expectation of profits by purchasers and (ii) the entrepreneurial and managerial efforts of Munchee.54 For purposes below, the following observation is important: “At the time of the offering and sale of MUN tokens, no other person could make changes to the Munchee App or was working to create an ‘ecosystem’ to create demand for MUN tokens.”55 Finally, on the same day the Framework was released, the SEC issued a no-action letter to TKJ.56 The letter says that the company’s tokens as presented to the SEC are not securities and therefore are exempt from registration under the Securities and the Securities Exchange Act of 1934.57 In making this determination the SEC relied on a number of factors including: • TKJ will not use any funds from Token sales to develop the TKJ Platform, Network, or App, and each of these will be fully developed and operational at the time any Tokens are sold; • The Tokens will be immediately usable for their intended functionality (purchasing air charter services) at the time they are sold; • TKJ will restrict transfers of Tokens to TKJ Wallets only, and not to wallets external to the Platform; • TKJ will sell Tokens at a price of one USD per Token throughout the life of the Program, and each Token will represent a TKJ obligation to supply air charter 52 Munchee Order, supra note 50, at 9–10. 53 See id. at 7. 54 See id. at 5–7. 55 Id. at 9. 56 TurnKey Jet No-Action Letter, supra note 50. 57 Id. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 459 services at a value of one USD per Token; • If TKJ offers to repurchase Tokens, it will only do so at a discount to the face value of the Tokens (one USD per Token) that the holder seeks to resell to TKJ, unless a court within the United States orders TKJ to liquidate the Tokens; and • The Token is marketed in a manner that emphasizes the functionality of the Token, and not the potential for the increase in the market value of the Token.58 As will be shown below, the tests proposed by this Article would reach the same conclusion in a more straightforward manner. IV. HOWEY FOR DIGITAL ASSETS In applying the Howey test to digital assets, this Article sets forth a decision tree that will be helpful for determining whether a particular digital asset is an “investment contract” under Howey. When an instrument is presented and alleged to be a security, a court asks if the four Howey factors are met. This Article deals with two of those factors and proposes an operational test for helping a court answer whether the factors have been met. These tests are part of the Howey decision tree. This Article assumes that there has been a payment of value in a collective venture. In most cases of digital asset purchases, this is the case; thus, the first two prongs of the test under Howey—an investment of money in a common enterprise—are presumed satisfied. The first step of the decision tree is to determine whether the asset is “sufficiently decentralized”59 such that it does not satisfy the “efforts of others” prong of the Howey test. This standard was set forth by SEC Director William Hinman in the June 2018 speech discussed above.60 58 Id. 59 Hinman Speech, supra note 39. 60 See supra note 43 and accompanying text. 460 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 Thus, if the purchasers never expected a person or group to carry out such efforts, then the assets are “sufficiently decentralized” and may not represent an investment contract. Below we propose what we call the “Bahamas Test” for determining sufficient decentralization. Figure 1: A Decision Tree for Digital Assets The second step of the decision tree applies if the asset is not sufficiently decentralized. This step determines whether the investment is made with an expectation of profit. If it is not made with expectation of profit, then the asset is not a security. To make this determination, we consider a “Substantial Steps Test.” This test has its benefits, but because of the inherent problems in determining an expectation of profit, we are willing to entertain a full rethinking of Howey as opposed to the imprecise fit attempted here. Generally, the first step asks a more straightforward question than the second. Expectation of profit will necessarily involve casuistic determinations of borderline cases. A. Efforts of Others Prong – the “Bahamas Test” The first step toward determining whether a digital asset is a security is determining whether it is sufficiently decentralized such that there is no “other” to satisfy the “. . . with profits to come solely from the efforts of others . . .” prong No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 461 of the Howey test.61 To operationally answer this question, this Article proposes a “Bahamas Test.” At a high level, the test holds that if the instrument is a decentralized one that is not controlled by a single entity, then it is not a security. This comports with the truism that, for an investment contract to exist, there must be a contract of some sort, whether implicit or explicit. If there is no other party to the contract or any expectation of performance, then there is no contract. The Bahamas Test asks: If there is a minting and selling of an instrument, as opposed to open mining of it, is there either an explicit or implicit contract to build and manage software such that if there were a breach of that contract, the project would fail? If there is no such sale or if there is no such obligation, then the “efforts of others” prong of the test is not satisfied and the instrument is not a security. Said differently: if the sellers fled to the Bahamas or ceased to show up to work—like Satoshi Nakamoto—would the project still be capable of existing?62 If the answer is “yes,” then the risk of fraud is sufficiently reduced such that the instrument is not a security. The Bahamas Test comports with lower courts’ jurisprudence regarding the “efforts of others” prong of the Howey test. A literal reading of Howey’s stipulation that the expectation of profit must come “solely through the efforts of the promoter or of someone other than themselves,”63 would suggest that any minor participation by the purchaser could render the asset not a security. Instead, lower courts have interpreted the language more broadly. For instance, in a widely-adopted explication, the Ninth Circuit articulated the standard as “whether the efforts made by those other than the investor are the undeniably significant ones, those essential 61 SEC v. W. J. Howey Co., 328 U.S. 293, 301 (1946). 62 See infra Section IV.A.1.i (discussing the background of Satoshi Nakamoto). 63 Howey, 328 U.S. at 298 (emphasis added). 462 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 managerial efforts which affect the failure or success of the enterprise.”64 If read too literally, this text conflicts with both common sense and Hinman’s articulation that sufficiently decentralized assets are not securities. So long as there are significant efforts made by others, for example, individuals other than the investor who coded the protocol, then every non-autarkic network would satisfy the “efforts of others” prong.65 A more natural reading, however, would be to focus on the concept of managerial efforts. Indeed, the Supreme Court in United Housing Foundation v. Forman stated that the efforts must be “entrepreneurial or managerial.”66 “Managerial” implies a kind of special position, either as a fiduciary or simply one with additional privileges, responsibilities, and abilities. In a sufficiently decentralized network, none of those managerial or entrepreneurial efforts are present because there are no managers or entrepreneurs.67 There are simply co-equals exerting effort, but none under a requirement to do 64 SEC v. Glenn W. Turner Enters., Inc., 474 F.2d 476, 482 (9th Cir. 1973). 65 For instance, the open source Bitcoin network has over 600 contributors who have written code for the software. See Bitcoin Core Integration/Staging Tree, GITHUB, https://github.com/bitcoin/bitcoin [https://perma.cc/EG58-N8BF]. These contributors are by no means united in any coherent manner. The vast majority of them have no connection to Satoshi Nakamoto and probably would not recognize each other while walking down the street. 66 United Hous. Found., Inc. v. Forman, 421 U.S. 837, 852 (1975). 67 Entrepreneur is a term of art. According to economist Ludwig von Mises, it implies acting in the face of uncertainty to allocate resources in more productive manners. 1 LUDWIG VON MISES, HUMAN ACTION: A TREATISE ON ECONOMICS 290–91 (Bettina Bien Greaves ed., 4th ed. 2007). The entrepreneur is not the capitalist, but instead has some kind of contractual arrangement with the capitalist who is risking her capital. In a sufficiently decentralized network where there are no implied or explicit contracts, those risking their money do not give it to entrepreneurs or managers with an expectation of performance. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 463 so, and with the success of the enterprise not hinging on any one individual.68 There are two further issues to explain with respect to the “efforts of others” prong—the difference between minting and mining and the issue of contractual privity. First, there should be a fundamental difference between how the securities laws view minting and mining. When a token is minted, the minter is in a special position compared with the purchaser. He has the unilateral ability to change the economic nature of the asset. This could include changing the supply or some other characteristic of the asset. On the other hand, when a token is openly mined, then there is no technical distinction between promoter and participator as both are on even footing.69 They are interacting with code that can only be changed through consensus.70 If the investor is in the exact same position as the promoter, then the stated information asymmetry rationale falls away.71 68 It could be said that decentralization of ownership of the asset is enough to establish decentralization. This is incorrect because most publicly traded companies have ownership that is decentralized throughout the public. Indeed, that is one of the points of public market capital formation. Instead, in determining decentralization, one should look towards the centralization of the organizational entity. 69 This is not to say that minted digital assets are categorically “bad” and mined digital assets are categorically “good.” There can certainly be bad actors that establish a mined digital asset to make a quick buck and there can certainly be good actors who mint digital assets, creating a healthy and vibrant community. What is relevant, however, is the reach of the securities laws. A diamond miner who sells fake diamonds is not selling securities simply because he is defrauding purchasers who may be investing money with an expectation of profit. 70 Viz. consensus is the mechanism for making changes to the characteristics of the token, not unilateral action. Satoshi could have unilaterally changed the supply to forty-two million by pushing to the Github, but people could choose not to run this version of the code. This is different from a situation where individuals own tokens and more are minted in a closed-source environment without a choice not to run the code. Although ERC-20 is not closed source—anyone could create another version of a token with less supply—but the promoter can say that that token can no longer interact with her infrastructure. 71 Pre-mining rights at first blush may appear to pose a wrinkle to this articulation. In such a situation, there is open mining of the asset, but ab 464 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 That is why this Article proposes two distinct conclusions. First, assets that are mined in an open process where anyone can participate should be considered prima facie sufficiently decentralized. In such a case, there is an exchange not of money, but of computing resources for the digital asset. This fails the first element of the Howey test—that there must be an investment of money.72 Presales, ICOs, and their ilk, on the other hand, should presumptively fail the “efforts of others” prong of the test because there is an exchange of money not for an asset, but for a promise to create an asset or network that will make such an asset valuable.73 This has analogues in extant case law.74 initio the protocol included already-allocated coins that were reserved by the promoter for the ownership of pre-mine purchasers. On the one hand, a privileged group is going to have certain rights that others do not have, which would abut the open source nature of mining. This would be covered by the first part of the Bahamas Test, requiring open mining. On the other hand, if the privileges are openly known then that would qualify as open, or at least transparent, mining. It is unlikely that the SEC would view this as anything other than a workaround to the securities laws, and thus the Bahamas Test would not likely allow the sale of pre-mining rights to fall outside of the SEC’s jurisdiction. 72 See, e.g., SEC v. Blockvest, LLC, No 18-CV-2287, 2019 WL 625163, at *7 (S.D. Cal. Feb. 14, 2019) (finding that a company’s offer to exchange its own tokens for potential investors’ digital currencies satisfied the first prong of the Howey test). 73 See COINBASE, A SECURITIES LAW FRAMEWORK FOR BLOCKCHAIN TOKENS 16 (2016), https://www.coinbase.com/legal/securities-law- framework.pdf [https://perma.cc/HN7C-BN3V] (“This may similarly apply in the case of a presale made prior to the launch of the system. For example, one court has found that a purchase agreement that was entered into prior to the construction of a resort community demonstrated a common enterprise. This was in part because the construction company was pooling presale purchase commitments in order to obtain financing to fund the project, and thus the completion of the project was dependent on generating sufficient investor interest.”); see also Wooldridge Homes, Inc. v. Bronze Tree, Inc., 558 F. Supp. 1085 (D. Colo. 1983). 74 See Silver Hills Country Club v. Sobieski, 55 Cal. 2d 811 (1961); All Seasons Resorts, Inc. v. Abrams, 68 N.Y.2d 81 (1986); see also VAN VALKENBURGH, supra note 28, at 49 (“The information asymmetries inherent in a token pre-sale agreement are by-necessity more pronounced than a sale of a token powered by a running decentralized network.”). No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 465 The second issue is that of privity and disclaiming liability. Many ICOs include warranty disclaimers or promises to actually build the project to completion. However, this kind of disclaimer cannot be the final word when a court or regulator determines whether there is an explicit or implicit promise to build. That is because implicit promises exist even if they are disclaimed; it is a settled principle of law that disclaimers are not the final word on whether liability exists.75 Suppose for instance that the promoters of a project called Colacoin76 promote that their coins will be used to interact with Colacoin vending machines. Were the promoters to abscond before creating any such machines—even though they might attempt to disclaim any responsibility with respect to actually building and stocking the vending machines—a court would quickly look past such disclaimer. Looking past this would not be based on a subjective expectation of the purchaser of the security, but rather on the objective actions of the seller in marketing the coin. The central point of this inquiry into the seller’s objective actions is whether there was a product or service implied in marketing the coin that would necessarily require actions of the promoter to complete. One key factor in the above analysis is whether there are technical barriers to entry to participation in the project- network. The SEC weighed the existence of such barriers in the Munchee order above when they found it relevant that “no other person could make changes to the Munchee App[.]”77 If there are no technical barriers, however, and anyone can make changes to the project-application or network, then there is much less of a reason to think the instrument is centralized. There can be both formal and economic barriers to entry in any market.78 A formal barrier to entry would be ex ante 75 For example, a defendant manufacturer cannot disclaim product liability, and a merchant cannot simply disclaim implied warranty of merchantability. 76 See Cohsey et al., supra note 29, at 10–11. 77 Munchee Order, supra note 50, at 9. 78 See generally JOE S. BAIN, BARRIERS TO NEW COMPETITION: THEIR CHARACTER AND CONSEQUENCES IN MANUFACTURING INDUSTRIES (1956). 466 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 regulation or grants of exclusivity by the government. An economic barrier to entry, on the other hand, is something like imposing high upfront capital requirements in an industry with economies of scale, which makes it costlier for a newcomer to enter the market. Economic barriers can be efficient barriers but are not by any means necessarily pernicious or welfare-decreasing. The formal definition of barriers, however, is the one that the SEC adopted in Munchee—it referred to investors’ reliance on the promoters’ stated ability to create an ecosystem that only the company itself would be able to create.79 Others were not allowed to run the Munchee software or contribute to the project. This is not the case with the decentralized Bitcoin network, where there are no formal barriers to entry, but solely economic ones. Even though mining bitcoin today is a much more expensive proposition than it was when it was still possible to do on central processing units (CPUs), there are still no formal barriers to mining, nor other formal barriers to enter the network.80 The promoter is not in any privileged position relative to investors, except perhaps that she has earlier knowledge of the project and thus could have mined without others having heard about it.81 This contrast between the accessibility of Munchee and Bitcoin illustrates a central point: Formal barriers to entry are what authorities should look at when evaluating sufficient decentralization. 79 Munchee Order, supra note 50, at 8–9. 80 Cade Metz, Why A.I. and Cryptocurrency Are Making One Type of Computer Chip Scarce, N.Y. TIMES (May 8, 2018), https://www.nytimes. com/2018/05/08/technology/gpu-chip-shortage.html [https://perma.cc/VY R9-YQPT]. 81 If the promoter tries to hide her intentions and mine such that it becomes functionally the same as minting, this case seems like a concert promoter who does not tell anyone who the concert is so that she can buy the tickets ahead of time. However, if the network is open, then the future participants would have knowledge of the activity before their buy-in. To analogize to the concert promoter—there would be a ledger showing that tickets were already owned by the promoter herself. The decision to then participate is on the purchaser and the fact that an individual owns a high proportion of the outstanding issue is something that the participant can weigh. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 467 A counterargument is that economic barriers to entry can be as powerful as formal ones, and should also factor into the decentralization analysis. This suggests a more expansive definition of monopoly and centralization than the formal barriers definition. Such arguments are premised on a weak conception of voluntariness—the thought being that an individual no more “chooses” to use a popular social network like Facebook than she chooses to eat every day. Similarly, the critic would say that participation in the most popular cryptocurrency network at the time, like Bitcoin, is not voluntary because economic and social pressures have made it the dominant, unavoidable, player. The response first is that the history of American business—and especially the history of the software industry with its low barriers to entry—has shown that so long as free entry is possible, there is rarely an entity that maintains its dominance for long, particularly if it is harming the market or behaving badly more generally.82 In other words, robust market forces provide a powerful check on supposed centralized monopolies. If, for instance, Satoshi Nakamoto were to have suggested new code early on that would have increased his share of bitcoins, it is hard to imagine the community approving. There are examples where miners and others have resisted forks even though influential groups supported them.83 This behavior is akin to the market’s reaction to an industry leader’s misstep. Economic barriers to entry can be efficient if they are the result of natural benefits of bigness, such as economies of scale or network effects. These 82 See, e.g., Jeffrey Dorfman, What Antitrust Should Look Like in a World of Low Entry Barriers, FORBES (Oct. 24, 2016), https://www.forbes.com/sites/jeffreydorfman/2016/10/24/what-should- antitrust-look-like-in-a-world-of-low-entry-barriers/#195a5da11b46 [https://perma.cc/7HMZ-KASL]. 83 See Nathaniel Popper, Some Bitcoin Backers Are Defecting to Create a Rival Currency, N.Y. TIMES (July 25, 2017), https://www.nytimes.com/ 2017/07/25/business/dealbook/bitcoin-cash-split.html [https://perma. cc/793Q-U35M]. 468 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 effects are not enough to overcome either corporate sins of commission84 or omission.85 A second response to this critique of the definition of centralization is that viewing consent in terms of legal and technical terms is a clearer line that better comports with society’s general notions of consent. Individuals may think using Facebook is not a free choice because they are forced into doing it as a result of the network effects (i.e. “all my friends are using it”), but legally speaking, this is at worst damnum absque injuria—a loss without a legally cognizable injury. Too broad a definition of involuntary action could lead to a legal regime where every contract and agreement is open to rescission, injecting uncertainty and chaos into society. One potential objection to this test is that the binary nature of this Bahamas inquiry is inferior to evaluating a promoter shirking his managerial activity on a sliding scale. For instance, a sliding scale would treat differently a promoter who flees when there is a ninety percent chance of the project’s success than one who flees when there is a ten percent chance of success. In the latter, the intuition would be that the promoter does not “deserve” a big chunk of the investment if he dramatically reduces the probability of the project’s success. The trouble with this argument is that it fails to appreciate the fundamental difference between open source projects and traditional companies. The nature of open source software projects is that there is no inherent ownership over the codebase, and it is one of the norms of the open source software community that there is a decentralized ownership 84 Joe Nocera, Opinion, The Inside History of the ‘New Coke’ Debacle, BLOOMBERG (Nov. 3, 2017), https://www.bloomberg.com/opinion/articles/ 2017-11-03/the-inside-history-of-the-new-coke-debacle (on file with the Columbia Business Law Review). 85 JLuo, The Rise and Fall (and Rise Again?) of BlackBerry, HARV. BUS. SCH. (Feb. 1, 2018), https://digit.hbs.org/submission/the-rise-and-fall-and- rise-again-of-blackberry/ [https://perma.cc/D3E6-ZWJX]. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 469 structure.86 In a traditional company, there are both duties of care and loyalty that are legally cognizable; no similar norms or duties are legally, or even morally, assumed in the very libertarian ethos of open source projects.87 The Bahamas Test is therefore well-tailored to the realities of open source digital assets because it incorporates a workable definition of consent and emphasizes only technical barriers to entry. 1. Applying the Bahamas Test This Section considers the decentralized status of three networks under the Bahamas Test: Bitcoin,88 Ethereum,89 86 Certain aspects of an open source project may be closed source. If it is possible to sever those aspects from the project itself, then they should be analyzed under a different rubric than the open source parts. 87 But see Angela Walch, In Code(rs) We Trust: Software Developers as Fiduciaries in Public Blockchains, in THE BLOCKCHAIN REVOLUTION: LEGAL & POLICY CHALLENGES (Georgios Dimitropoulos et al. eds.) (forthcoming 2019), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3203198 [https://perma.cc/84UF-Z9FL]. Walch argues that a fiduciary duty can exist in open source projects. Id. at 3. One of the criteria she uses to determine if there is a fiduciary duty is whether there is an entrustment of either property or power. See id. at 10. She claims that a duty exists in certain open source projects because certain core developers can have significant power and control over the property of the network. Id. at 3. The trouble with this argument is that mere exercise of power does not create a fiduciary. It is the entrustment of that power. For example, individuals who agreed to participate in an open source project or the network it forms did not have any powers they entrusted to the network. They chose to participate, which gave the developers power by virtue of their participation. This is no different from attending a speech—the speaker has not been granted a fiduciary duty simply because he is more powerful because he has a platform. In other words, the power is created by the network participant—neither it nor property is entrusted to the developers. 88 For a general background of Bitcoin, see Max I Raskin, Realm of the Coin: Bitcoin and Civil Procedure, 20 FORDHAM J. CORP. & FIN. L., 969, 971– 72 (2015). 89 For a general background of Ethereum, see Bernard Marr, Blockchain: A Very Short History of Ethereum Everyone Should Read, FORBES (Feb. 2, 2018), https://www.forbes.com/sites/bernardmarr/ 2018/02/02/blockchain-a-very-short-history-of-ethereum-everyone-should- read/#549791d01e89 [https://perma.cc/3DUN-Z2DA]. 470 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 and The DAO.90 This is to show that the test works not only prospectively but retrospectively—it ensures that the test is not simply our normative view of what the law should be, but what the law is. i. Bitcoin The Bitcoin project was originally created by a person or group called Satoshi Nakamoto. Nakamoto wrote a white paper in which he91 presented the idea of the Bitcoin network and then worked with a group of new individuals to release the first version of the software.92 The Bitcoin White Paper (the “White Paper”) made no investment claims, nor did Nakamoto make any promises regarding seeing the project to fruition.93 This closely adheres to how open source communities work. In fact, only a few years after launching the Bitcoin network, Nakamoto disappeared and no longer wrote code for the project or contributed in any meaningful way. He still retained the huge amount of bitcoin that he initially mined, having an estimated 980,000 bitcoin.94 Yet the 90 For a general background of The DAO, see Nathaniel Popper, A Hacking of More Than $50 Million Dashes Hopes in the World of Virtual Currency, N.Y. TIMES (June 17, 2016), https://www.nytimes.com/2016/06/18/ business/dealbook/hacker-may-have-removed-more-than-50-million-from- experimental-cybercurrency-project.html [https://perma.cc/J2J6-V3HK]. A corollary to the Bahamas Test is a Capitalization Test—if the first letter of the network is capitalized, then it is not sufficiently decentralized. 91 Some will object to using “he” as the personal pronoun for Nakamoto when it is not known if Nakamoto is a male, let alone an individual. This article uses “he” for brevity’s sake, fully aware that this footnote defeats this purpose. 92 See Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System, BITCOIN.ORG, https://bitcoin.org/bitcoin.pdf [https://perma.cc/N55D- LTXA]. 93 Even if the White Paper did make investment claims, it is unlikely that bitcoin would be classified as a security any more than baseball cards are classified as a security even though they can be sold by dealers promising an increase in value. This is precisely because there is no satisfaction of the “others” prong of Howey. 94 See Evelyn Cheng, There Are Now 17 Million Bitcoins in Existence – Only 4 Million Left to ‘Mine,’ CNBC (Apr. 26, 2018), https://www.cnbc.com/ No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 471 SEC, as heard through Hinman, believes bitcoin is not a security.95 This determination did not hinge on the effort Nakamoto contributed. Had Nakamoto left the project a month or even a year earlier, he could do so because he was under no obligation; he made no promises—implicit or explicit—to those involved with the project. The real analysis was whether he was an “other” at all.96 He clearly was not. The law ought to encourage innovators in the open source field to create decentralized projects and not calculate the exact time they can jump ship—at least in these kinds of projects, it is better that the ship has no captain. This is an easy case. As Director Hinman said in his speech, “when I look at Bitcoin today, I do not see a central third party whose efforts are a key determining factor in the enterprise.”97 Thus, bitcoin appears sufficiently decentralized to pass the Bahamas Test and should not be regulated as a security under Howey. ii. Ethereum The Ethereum Network is a more difficult case. Vitalik Buterin conceived and promoted the network, and Buterin held a presale and made promises to build software.98 In Buterin’s words, “You are trusting us to take the bitcoin and 2018/04/26/there-are-now-17-million-bitcoins-in-existence--only-4-million- left-to-mine.html [https://perma.cc/XN49-CW72]. Given the considerable volatility in bitcoin price, we leave it to the reader to calculate the current value in U.S. dollars. See Bitcoin Price (BTC), COINDESK, https://www.coin desk.com/price/bitcoin (on file with the Columbia Business Law Review). 95 See generally Hinman Speech, supra note 39. 96 There is also an issue of whether there was a sale directly from Nakamoto—this, however, is a proxy for determining whether there was any promise made. The existence of consideration is a good indication that there was something exchanged on the other side. In the case of a presale, as opposed to mining, this promise is often to build or maintain a network. 97 Hinman Speech, supra note 39. 98 Victoria van Eyk, Ethereum Launches Own ‘Ether’ Coin, with Millions Already Sold, COINDESK (July 23, 2014), https://www.coindesk.com/ethereum-launches-ether-coin-millions-already- sold [https://perma.cc/H7J4-T7FM]. 472 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 use it to develop Ethereum.”99 If, following the presale, Buterin and his team had absconded to the Bahamas, his proposed project almost certainly would have collapsed. Thus, Ether would fail the Bahamas Test. This alone, however, does not mean that Ether is a security. There is still the second step of the test.100 Furthermore, as Director Hinman pointed out, an asset that was once issued as a security—and even an unregistered security—can later lose its security characteristics.101 Peter Van Valkenburgh gives a particularly useful analogy: [T]ake the facts of the Howey case itself, and make a small change. As before, Mr. Howey convinces people to give him money for land in Florida; he says they own the land and he says he’ll maintain the orange trees that grow on the land. But, instead of promising to pay investors profits from selling the oranges at market, he promises to give them the oranges. This fact does not change the outcome in Howey—the [sic] court would still have found that investment contracts for an orange grove in Florida had been sold—but, of course, the oranges themselves would never have been found to be securities. If one of the resultant oranges ends up in a grocery store, you don’t need a broker dealer to buy it for you. People know this intuitively with oranges and other scarce physical things (of course this inert object I hold in my hand isn’t a security—it’s just a thing), but many haven’t yet internalized that scarce digital things now exist and the same reasoning applies.102 On the other end of the spectrum is an ICO like REcoin, for which the issuers made specific promises about backing tokens with real estate.103 This is a contractual statement, 99 Id. 100 See infra Section IV.B (discussing the “expectation of profit” analysis of Ethereum, which concludes Ether could pass the Substantial Steps Test). 101 Hinman Speech, supra note 39. 102 VAN VALKENBURGH, supra note 28, at 61. 103 Cali Haan, RECoin and Diamond Reserve Coin ICO Issuer Pleads Guilty to Fraud, CROWDFUND INSIDER (Nov. 16, 2018), No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 473 and were the promoters to flee, the project would cease to exist because it would not fulfill its primary claim of economic value. REcoin would thus fail the Bahamas Test because it is not decentralized. This easy case provides a meaningful contrast to Ether’s more ambiguous status. iii. The DAO An even more difficult case than Ether is The DAO. The DAO was meant to operate as an investment fund, in which investors would fund an entity that would later make distributions to fund business ventures.104 The DAO would not be like other venture capital funds in a key way—there would be no general partner making decisions on behalf of the limited partners. Instead, using an open-source code, members of the Ethereum community would use a coding framework—Slock.it—to build a smart contract on the Ethereum blockchain. The smart contract would be self- executing, meaning once it was built and deployed, the smart contract would make investment-funding decisions. Anyone with a project could pitch an idea to The DAO community— which raised 12.7 million Ether (valued at about $150 million at that time). Individuals with tokens could vote on the plan, and if the projects were profitable, they would receive distributions. Things fell apart.105 A hacker found a weakness in the code, which allowed him to steal nearly $55 million, about a https://www.crowdfundinsider.com/2018/11/141403-recoin-and-diamond- reserve-coin-ico-issuer-pleads-guilty-to-fraud/ [https://perma.cc/362G- SEB9]. 104 Christoph Jentzsch, Decentralized Autonomous Organization to Automate Governance Final Draft – Under Review (unpublished manuscript), https://download.slock.it/public/DAO/WhitePaper.pdf [https://perma.cc/YNS3-Q23G]. 105 See Osman Gazi Güçlütürk, The DAO Hack Explained: Unfortunate Take-off of Smart Contracts, MEDIUM (Aug. 1, 2018), https://medium.com/@ogucluturk/the-dao-hack-explained-unfortunate- take-off-of-smart-contracts-2bd8c8db3562 [https://perma.cc/A8WV-D9DD]. 474 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 third of the fund.106 The hacker was not the person who set up The DAO, since no single individual set up The DAO. Instead, the hacker simply observed the weakness—which had to do with the timing of how the smart contracts and token balances were updated—and exploited it. At first blush, it would seem The DAO was sufficiently decentralized. The founders of the project could have left the project, and it would not fail because others could and did participate in the network.107 Furthermore, Slock.it had denied implicit or explicit obligations to those participating in the project. Thus, under the Bahamas Test, The DAO would appear to not satisfy the definition of an investment contract, and could not be regulated as a security. The SEC, however, disagreed.108 It declared The DAO was, in fact, offering unregistered securities.109 The SEC focused on the “Curators”—a group of individuals chosen by Slock.it to manage aspects of The DAO.110 Though the SEC decided not to pursue any enforcement action,111 the pronouncement still stands. The answer to reconcile this outcome with the Bahamas Test, however, is that our initial intuition from the Bahamas Test was wrong and that The DAO was not sufficiently decentralized. There are two reasons for this. The first is the simple explanation that the Curators had specific responsibilities and obligations to the DAO project. Most importantly, they whitelisted Ethereum addresses that could receive Ether from 106 See Matthew Leising, The Ether Thief, BLOOMBERG (June 13, 2017), https://www.bloomberg.com/features/2017-the-ether-thief/ (on file with the Columbia Business Law Review). 107 See Michael del Castillo, The DAO: Or How a Leaderless Ethereum Project Raised $50 Million, COINDESK (May 12, 2016), https://www.coin desk.com/the-dao-just-raised-50-million-but-what-is-it [https://perma. cc/26DG-DRCN]. 108 See The DAO Report, supra note 50. 109 Id. at 11–16. 110 Id. at 7. 111 Id. at 1. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 475 The DAO. This certainly fails the Bahamas Test, and therefore, The DAO was not sufficiently decentralized.112 Had there been no Curators, the case would be closer, so it is worth discussing the second reason the initial intuition is wrong: a conflation of decentralized networks and decentralized corporations. Decentralized networks generally do not make promises to their participants other than to abide by certain protocols.113 They do not use computer code to place obligations on third parties to manage the effort. A decentralized corporation, on the other hand, can still make promises to investors—and in the case of The DAO, did make promises to investors. The promises were not about performance, but about distributions. The DAO codified these promises, albeit in smart contracts. The DAO entity itself was the offeror of the security and the SEC’s reasoning was that those behind The DAO were the coders and the Curators. Contrast this with Bitcoin, where there was no promise made to a certain share of profits or any obligation on any third party. An additional reason for finding insufficient decentralization is that the Curators of The DAO had special rights and powers that average users did not have.114 This was baked into the code and created obligations. For instance, they had the power to change the governance of the DAO such that they could lower the threshold for voting on proposals.115 This is a special power that can be characterized as a privilege or contractual arrangement. This whitelisting of proposals fails the Bahamas Test because if the users were to walk away, they would be in breach. 112 For purposes of argument, this Article accepts the Howey framework of the expectation of profit and assumes that this was present in this case. 113 Were a decentralized network to encode certain promises to investors that put obligations on others, this would change the analysis. Admittedly, the line between promises to investors and encoded protocols is blurry. 114 See id. at 7–8. 115 Id. at 8. 476 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 The SEC’s reasoning, however, muddies the waters by focusing on users’ reliance on Slock.it, instead of their reliance on The DAO. The SEC in its opinion stated, “The DAO’s investors relied on the managerial and entrepreneurial efforts of Slock.it and its co-founders, and The DAO’s Curators, to manage The DAO and put forth project proposals that could generate profits for The DAO’s investors.”116 The SEC then goes on to list a number of technical ways in which investors relied on Slock.it.117 This is unnecessary because the smart contracts that encoded the DAO made certain promises. That itself is enough to fail the Bahamas Test because if the decentralized DAO was to abscond, the project would necessarily fail. Imagine, for a moment, that Apple’s board of directors and managers were replaced by computer code. This computer could either execute the wishes of decentralized shareholders or be artificially intelligent and autonomous, but otherwise behaved and invested like any other board. Now suppose the computer code was “hacked”118 and money was transferred from Apple’s coffers to the hacker. Whether this “hack” is fraud or a clever use of code does not change the fact that the decentralized shareholders still hold, albeit now less valuable, securities. This is because there were promises, either implicit or explicit, that the offeror (Apple) was going to do something for the purchaser. Whether it was a computer or group of humans who were doing the promising, there was still a promise. In this case, the promises were not explicit, but rather implicit because the purchaser of DAO tokens had an expectation. That being said, there is an intractable problem of who is making the promises, and by extension, who is selling those securities. Slock.it was promoting here—it is not that they were involved with the DAO. The question for the SEC was whether they were involved in the promotion of selling the securities, 116 Id. at 12. 117 Id. at 12–13. 118 This is a loaded term in The DAO context because the “hack” involved someone taking advantage of a loophole but not stealing any information—such as a password—to gain unauthorized access. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 477 made the promises to the purchasers, and were expected by the purchasers to promote and manage the venture. An individual who owns no equity in a company can still be liable for selling securities—the Howey test looks at the instrument itself.119 That the SEC did not bring any kind of case against Slock.it is telling. This was clearly more of an example of experimentation than investment defrauding. The “bad actor” here was not anyone related to The DAO, but rather a hacker.120 The SEC’s non-enforcement was the right outcome—The DAO hack is not a situation that the Securities Act was meant to cover. iv. Summary of the Bahamas Test The virtue of the Bahamas Test is that it gets at what the securities laws aim to prevent: individuals being taken advantage of based on information asymmetry.121 It does this in a manner that it easy to operationalize because it is not difficult to distinguish open from closed networks or instances where promises have been made from those where promises have not. This is a fairly simple determination and one that courts make regularly. B. Expectation of Profit Prong The second node of the decision tree shown in Figure 1, and thus the second step in our analysis, is whether the instrument is primarily about investment or about consumption—this is the “expectation of profit” prong from Howey. If an instrument fails the Bahamas Test, i.e., it is not sufficiently decentralized, and passes the expectation of profit 119 See, e.g., SEC v. Chinese Consol. Benevolent Ass’n, 120 F.2d 738 (2d Cir. 1941) (holding intermediary in bond sales that was not even earning a commission sold unregistered securities in violation of securities laws by arranging sale). 120 There is an open question of whether the hacker even was a bad actor. 121 Whether one accepts that the state needs to play this role is beyond the scope of this Article. 478 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 prong—as evaluated under the two standards described below—it should be regulated as a security. This prong is, frankly, a more difficult one to analyze than the first discussed. The structure of this Section hopefully reflects this difficulty by posing more theoretical concerns. This Section begins with a recap of the current test for expectation of profits, and includes a discussion on the amount of resale in the secondary market. Then, it proposes the “Substantial Steps Test.” 1. Current Test—Facts and Circumstances With respect to the “expectation of profit” prong of the Howey test in the digital asset context, there is a temptation to use a multi-factor test or employ a “I know it when I see it” analysis.122 The SEC relied on this in Munchee.123 Among other things, the trouble with multi-factor analyses is that they create legal uncertainty—their virtue is flexibility to the regulator. That is why this multi-factor analysis—“facts and circumstances”—is largely the approach chosen by the SEC in its enforcement actions and articulated in its Framework.124 One of the factors that could be relevant for determining whether there is an expectation of profit is the ratio of individual buyers who consume the instrument versus resell the instrument—that is, the velocity of the secondary market. Certainly, in the vast and overwhelming number of ICOs, the purchasers are profit-seeking because in many instances there is no useable product, nor will there ever be a useable product.125 This latter result could be because of fraud or 122 See Jacobellis v. Ohio, 378 U.S. 184, 197 (1964) (Stewart, J., concurring). 123 “Determining whether a transaction involves a security does not turn on labeling – such as characterizing an ICO as involving a ‘utility token’ – but instead requires an assessment of ‘the economic realities underlying a transaction.’” Munchee Order, supra note 50, at 9. 124 See Framework, supra note 16 (“Whether a particular digital asset at the time of its offer or sale satisfies the Howey test depends on the specific facts and circumstances.”). 125 See Cohsey et al., supra note 29 (noting a number of important features of smart contract ICOs—including scarcity, lock-in, and No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 479 because the business simply failed. But this factor is not dispositive because there are certainly instances where a low ratio of consumers-to-sellers does not deem an instrument an “investment contract.” For instance, a concert promoter may sell 50,000 Lady Gaga concert tickets to various dealers knowing that these dealers (and many of their customers) may turn around and resell them for a profit depending on how the supply and demand change over time. No one believes, and the SEC has never taken the position, that the intent of the initial buyers in such a case would turn a concert ticket into a security. This is in large part because it is the market as a whole that determines the price, not the effort of the individual promoters. Courts have consistently held that markets where supply and demand, and not the managerial efforts of others, determines the market price are not securities markets.126 One could complicate the concert ticket case by imagining the concert promoter does not yet have Lady Gaga signed up yet but rather offers the following deal: the promoter will sell 50,000 tickets for a venue and an act to be determined, based in part on how much money the promoter is able to raise through the sale. This is a more difficult case for reasons that have little to do with the expected velocity of the secondary market. Instead, the concern is that the promoter might abscond with the money or, perhaps, not exert the effort or expend the resources that the buyers expect. The latter concern—low promoter effort—seems to prove too much, since this is present in every exchange of money for value, whether it is going to the movies or eating out or buying any product. modifiability). These features are often not encoded in the actual software, leading them to conclude that there is something inherently fraudulent in the ICO market. See id. The trouble with this analysis is that it implies that sticking to the smart contract is what the purchasers value, where it may be the case that the low cost of non-SEC issuance is the real value in these markets. 126 See, e.g., SEC v. Belmont Reid & Co., Inc., 794 F.2d 1388 (9th Cir. 1986) (dealing with a sale of gold coins); Noa v. Key Futures, Inc., 638 F.2d 77 (9th Cir. 1980) (involving a forward contract for silver); Sinva, Inc. v. Merrill, Lynch, Pierce, Fenner & Smith, Inc., 253 F. Supp. 359 (S.D.N.Y. 1966) (addressing a futures contract for sugar). 480 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 It might be worth less than expected. In general, one expects markets and general anti-fraud rules, enforced by both private actions and the government, to take the edge off this concern. The former concern—fully absconding—is significant, and this Article addresses it below. But it is doubtful that if a concert promoter offered this contract the SEC would intervene. The case of tokens can be similarly difficult. A token that is redeemable for a product or service might not be considered a security, but what if an entity bought most or all of the tokens with the goal of reselling them to consumers? This might look like a distribution, with the initial seller engaged in a scheme to avoid the securities laws. But, if the initial buyer were purchasing bananas to resell, the initial seller of bananas would not be engaged in a securities transaction. Other problems arise. When considering resales, how should one weigh the tokens—by number of tokens or individual person? Tokens are also mixed-use—unlike concert seats, they can be used for multiple things. How does one compare the utility of one individual who is consuming the token with the utility of another purely speculating?127 Ether used to power smart contracts may have tremendous value to a small number of individuals actually running smart contracts and building their applications on them—but the vast majority of Ether owners are likely owning for profit- seeking reasons. The fundamental problem is that an investment contract for one individual may not be an investment contract for another, but as the SEC cannot make these individual determinations, it must necessarily draw a line, which creates imprecision. Other tests could be used. One might look at the intent of the buyer. If the buyer intends to resell, or perhaps enough buyers intend to resell, then the expectation of profit prong 127 This challenge for utilitarian theory formed the basis of Robert Nozick’s “Utility Monster” thought experiment. See generally ROBERT NOZICK, ANARCHY, STATE, AND UTOPIA (1974). This theory is accepted in contemporary analyses. See, e.g., Jeffrey L. Harrison, Happiness, Efficiency, and the Promise of Decisional Equity: From Outcome to Process, 36 PEPP. L. REV. 935 (2009). No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 481 might be satisfied. This raises significant line-drawing problems, as noted above. How many buyers motivated by resale would be enough to turn something into a security? But, more problematically, it would create significant uncertainty for issuers, who would have to guess as to the motivation of buyers, which they cannot control. This would effectively kill any exemption along these lines. It is for perhaps this reason that the SEC and courts have eschewed the motive of buyers, focusing instead on the intent of the issuer regarding what the issuer is offering, as reflected through the marketing of the offering. This approach is illustrated by the SEC’s consideration of these issues in the context of condominiums. After all, a real estate developer might build a condo building and sell the initial condos to individuals who intend only to resell them. One can easily see how the situation could look much like the concert promoter examples above. Another option would be for the developer to sell interests in condos to individuals who would continue to own them but had no intention to live in them, preferring to rent them out. A few tweaks could make this into an investment scheme that looked just like the facts of Howey. Individuals might invest money in a condo development motivated entirely or primarily by the money that the investment would generate, instead of a desire to live in the condo. The SEC addressed this problem through the issuance of an informal lawmaking known as a “release.” Release 5347, issued on January 4, 1973, set forth the conditions under which an investment condo would be considered a security.128 The goal was to reduce the uncertainty for real estate developers and buyers and sellers of condos. The release provided: . . . condominiums, coupled with a rental arrangement, will be deemed to be securities if they 128 Guidelines as to the Applicability of the Federal Securities Laws to Offers and Sales of Condominiums or Units in a Real Estate Development, Securities Act Release No. 5347 (Jan. 4, 1973) [hereinafter “SEC Release No. 5347”], https://www.sec.gov/rules/interp/1973/33-5347.pdf [perma.cc/U9M4-ZNA9]. 482 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 are offered and sold through advertising, sales literature, promotional schemes or oral representations which emphasize the economic benefits to the purchaser to be derived from the managerial efforts of the promoter . . . in renting the units.129 This test is designed to draw a jurisdictional line, putting the scarce resources of the SEC to work in cases in which there is a greater risk of fraud or irrational behavior that might implicate the capital markets. By focusing on marketing materials, the test may risk being both under-inclusive and over-inclusive, but it in turn gives some certainty to buyers and sellers. And, at least in the condo case, it avoids the more complicated inquiries into buyers’ intents, the nature of the resale markets, and so on. One could imagine deploying a similar test for digital assets—if they are sold through materials emphasizing “the economic benefits to the purchaser” from reselling them, then they would be securities, while if they are pitched as opportunities for consumption of goods or services, they would not be. Although potentially useful, there is a problem with this approach. In a context in which the public has an expectation about ICOs that is already formulated—perhaps, that they are a way to get rich quick—then the marketing materials may not matter very much. Of course, such a concern might also have been true during the condo craze during the recent run up in housing prices before the financial crisis, but it was not enough to move the SEC to regulate condos. Compounding the problems of the expectations of profit test is the approach of the SEC. The SEC’s analysis thus far has not been static, which has reduced the certainty of any regulatory action. As the SEC has recently pointed out, Ether may have begun as a security—because there was an expectation of profit stemming from a centralized promoter— but is now no longer a security.130 Even the advertisements 129 Id. at 3. 130 See Hinman Speech, supra note 39. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 483 and presale by the Ethereum Foundation were not enough to counteract what the Ethereum network had become. Thus, any new test must incorporate the facts that: (a) an instrument that did carry with it an expectation of profit can morph into one that does not; and (b) expectation of profit with respect to utility is a nebulous concept, especially when involving multiple buyers and sellers131 of an instrument. 2. Proposal—Substantial Steps Test This Article proposes a Substantial Steps Test for determining whether a token is purchased with an expectation of profit. The focus of this test is not on how the object of the token or coin is marketed, but on whether someone is actually producing it. The purpose of this shift in the inquiry is to reflect concerns over the fact that the marketing test may be under-inclusive on fraud protection in the current chaotic environment for digital assets. The possibility that the test could evolve as conditions change remains open. The Substantial Steps Test is as follows: Are the promoters taking good faith, substantial steps towards completion of a project that they believe will have use to some users of the token beyond resale value or economic income? If so, then the instrument is not sold with an expectation of profit and thus is not classified as an investment contract. So long as the issuer of a token is in fact engaged in a good faith effort to build the underlying product or service for which the token will be redeemable, then the token is not an investment, but rather purchased for consumption. This is true even if there is a robust secondary market for tokens. After all, there is a robust secondary market for condos, homes, cars, boats, and practically all other real and personal property. 131 Some of the sellers may have an intent to build a network, while others may be snake oil salesmen. 484 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 Return to the concert promoter hypothetical discussed above.132 The Substantial Steps Test applied to the case of the Lady Gaga concert yields an easy answer—it is not a security because obtaining a venue and a performer would clearly constitute substantial steps. This result is in accord with how the SEC views the case, since concert promoters do not even feel the need to request a no-action letter. After all, concert tickets are not marketed as an investment opportunity, as dictated by Release 5347.133 But what about the tougher case of the concert promoter without a venue or a performer who pitches the offer as a way of raising money to afford a top venue and performer in the first place? Under the marketing test, one would simply look to how the promoter packaged the opportunity—if it were sold as a way of getting in early so as to profit from the efforts of the promoter, then it would be a security; if it were instead sold as a concert lottery ticket of sorts (instead of an economic one), then it would not. But, as noted above in the exploration of the facts and circumstances test, for digital assets, this might not paint a full picture. Instead, the Substantial Steps Test asks whether the promoter is in fact taking concrete steps to put on a concert, or is merely trying to create a frenzy in which the whole game is the secondary market. The virtue of this test to a federal regulator is that it encourages the development of useful projects and it discourages the sale of unregulated securities that are solely designed to enrich the promoter and its affiliates through creating a secondary market. It essentially says that when a seller of an instrument uses those proceeds to build a product in some way connected to the instrument, then the seller does not have to register the sale. Importantly, the test has a requirement of continuousness—as soon as the promoters cease trying to create an actual, functional software project, the consumers can no longer have a reasonable expectation of some 132 See supra Section IV.B.1. 133 See SEC Release No. 5347, supra note 128. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 485 consumptive utility and any sales are likely done with an expectation of profit. The challenge of this test, beyond determining the subjective intent of the promoters, is that it creates the possibility of a non-security becoming a security. This poses two problems: monitoring and creating proper incentives. After discussing both these problems, this Article lays out a solution for regulators to adopt. On the monitoring side, the regulator must ensure that the promoter is compliant by continuing to take those substantial steps towards the creation of a useful project.134 One can imagine lots of ways in which ongoing compliance with these regulatory expectations could be measured. Regulators could require periodic updates, involving affidavits from promoters filed on a periodic basis, for example. This could be done whether the regulator is the government or, in a likely better approach, a self-regulatory body that acts as a first-line regulator, such as the Financial Industry Regulatory Authority (FINRA). Such affidavits, under penalty of felony, could provide a basis for ex post enforcement, including a loss of membership fees and bans in the case of a self-regulatory organization (SRO) or civil and criminal sanctions in the case of the government regulator. On the incentives side, entrepreneurs are in a difficult position. Put simply, fraud is not the only reason projects fail. For example, an entrepreneur acting in good faith may have raised money through a coin offering to build a service she cannot complete. At some point, she will need to stop taking substantial steps to establish the business as a useful creation as it winds down. This potential ex post security label would disincentivize entrepreneurs from the outset. The flip side of this disincentive, however, is deterring the bad faith entrepreneur who initially takes substantial steps toward her 134 It may not be the SEC itself that has jurisdiction to engage in this monitoring, but rather the Commodity Futures Trading Commission or some other entity. 486 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 business’s development and subsequently spends the rest of the business funds on Lamborghinis and alpaca socks.135 A registration system discussed below, whether it is with the government or an SRO would help address this problem. Affidavits regarding substantial steps could be withdrawn based on changes in business facts. When that happens, the tokens would become unregistered securities, and therefore could not be resold without registration. Those who initially sold instruments that later became unregistered securities would not be liable under securities laws unless they sold the instruments after they were deemed unregistered securities. This solution, however, presents some problems under current law because a security cannot currently arise from a non-security in this fashion. Accordingly, if something is deemed to be a security, and it were sold or resold without registration or an exemption therefrom, it would subject the seller of the security to liability. Under the Substantial Steps Test, this would turn business risk into legal risk—any good faith effort to create a product or service that failed would subject the promoter to legal liability for selling unregistered securities. The market would therefore need a safe harbor for token issuers who would otherwise be subjected to liability through this quirk of adding the test to current law. To solve the above problems and operationalize the Substantial Steps Test, this Article endorses a safe harbor similar to one previously offered.136 The proposal is as follows: A developer, seller, or token exchange shall be free from civil and criminal liability for violations of securities laws if they: 135 It is worth mentioning that a perfect subjective test would take care of this second challenge by allowing reviewers to read the mind of the entrepreneurs to separate the good from the bad actors. But this side of Eden, there are only proxies for intent. 136 See VAN VALKENBURGH, supra note 28; see also Peter van Valkenburgh, Principles for Clarifying SEC Jurisdiction over Cryptocurrencies and ICOs, COIN CENTER (May 24, 2018), https://coincenter.org/entry/principles-for-clarifying-sec-jurisdiction-over- cryptocurrencies-and-icos [https://perma.cc/U8L7-EQNK]. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 487 1. Register as a developer, seller, or token exchange with the SEC or approved self-regulatory organization, providing [name, contact information, and a brief description of the token related activities in which they intend to engage or have previously engaged], and 2. Have a reasonable and good faith belief that the tokens they are developing, selling, or exchanging are not either: a. Tokens that represent a promise by a developer or seller to deliver a future open blockchain token if the developer or seller accepted money from purchasers and advertised that said future token will be a valuable investment; or b. Tokens that represent specific contracted-for rights to profits derived from the efforts of the developer or seller beyond mere appreciation of the token’s value if the developer or seller has accepted money from purchasers; and 3. Take reasonably prompt and effective action to cease development, sale, or exchange of a token that is identified as a security by the SEC or otherwise ceases to meet the criteria described in (2)(a)–(b) above.137 This lighter registration requirement goes beyond the anti- fraud rationale by helping to bridge the information asymmetry between the seller and purchaser. The prospective purchaser would see a clear statement about the asset, given the ease of articulating the value of a product in a short simple statement. For instance, a token could allow an individual to watch television over the Internet or could be used to backup files. Such statements could also provide a basis for future civil or criminal actions against the seller. One possible concern, however, is that such a light registration requirement would quickly come to resemble the current regulatory regime in which there is a risk of too much regulatory discretion. Having a link to a tangible product mitigates this risk. On the front end, the Substantial Steps Test encourages entrepreneurs to take substantial steps towards building a 137 Id. 488 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 useful product. On the back end, the safe harbor discourages them from stopping because what was once not a security can ex post attain the status of a security.138 This is the mirror image of Ethereum, which was once possibly a security, but now is no longer. As a coda to this Section, the SEC’s no-action letter issued to TKJ confirms the validity of the Substantial Steps Test. Clearly the tokens issued by TKJ would fail the Bahamas Test as there were rights, privileges, and obligations the promoters had that would doom the project were they to abscond to the Bahamas. On the Substantial Steps Test, it is clear that the promoters here are taking good faith, substantial steps towards completion of a project that they believe will have use to some users of the token beyond resale value or economic income. Specifically, they are building and maintaining a platform for purchasing air charter services that has value beyond secondary trading of the tokens.139 Merely marketing a digital asset as a “utility token” does not allow a promoter to evade a determination that the asset is, in fact, a security. But in applying the Substantial Steps Test, certain utility tokens are certainly not securities and the SEC’s TKJ no-action letter confirms this. 138 See Samuel Issacharoff, Regulating After the Fact, 56 DEPAUL L. REV. 375, 377 (2007). 139 TurnKey Jet No-Action Letter, supra note 50. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 489 3. Summary of Our Tests Figure 2: A Summary of New Tests for Digital Assets Issue Howey Element Proposed Test Examples Agency Costs v. Decentralization (2) “Solely through the efforts of others” Bahamas Test Currency, bitcoin, Ethereum, Real Estate, Personal Property Investment v. Consumption (3) “Expectation of profits” Substantial Steps Test Tokens, Real Estate, Personal Property There are two primary issues that motivate securities regulation: “agency costs” and “investment versus consumption.” The first issue goes to the possibility that promoters will take advantage of investors, whether this amounts to fraud or something short of fraud. This is the “other peoples’ money” problem—when anyone turns over money to someone else, the possibility exists that the recipient will abuse the trust of the investor. Economists and lawyers call this possibility an agency problem, and the costs associated with it—costs of monitoring agents, bonding by agents, and the inevitable wedge between interests of the principal and the agent—“agency costs.”140 This issue is addressed in the Howey test by the prong that triggers securities regulation in cases when agency costs may be high. When investors turn over their money to strangers with only 140 See, e.g., Michael C. Jensen & William H. Meckling, Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure, 3 J. FIN. ECON. 305 (1976). 490 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 a promise in return, securities laws will generally apply. When, however, investors are not held to the whim of the promises of other individuals, the securities laws will generally not apply. In such cases, the decentralization of the system cuts strongly against treating investments as securities. The other issue is whether the thing being purchased for value is for consumption purposes (as one buys a house or a car) or for investment purposes (as one buys a stock or bond). Although there are robust secondary markets for houses and cars, these things do not become securities, and thus subject to the jurisdiction of the SEC, simply because an individual buys one with the sole intent of reselling it quickly for a profit. The SEC has tried to draw the line instead based on whether a piece of property, like a condo, is marketed for consumption or rather as an alternative investment to the stock market. The concern is that if investment opportunities are not regulated, money will flow out of the stock market and into real estate or other markets. While marketing materials may be probative of whether a digital asset is a security, those materials alone are insufficient to make a determination, especially in the current environment for digital assets.141 Therefore, this Article proposes a “Substantial Steps Test.” It focuses on whether the digital asset is linked to an actual physical product or service, such as computing power, consulting services, or the like. If it is, then it follows that the digital asset looks more like a car or a house, rather than a stock or bond. To avoid the empty promise problem, this Article proposes that issuers of coins be required to register their products or services with either the SEC or an approved self-regulatory organization, and then certify on an ongoing basis that they continue to take substantial steps to develop the product or service. 141 See Chris Brummer, Trevor I. Kiviat & Jai Massari, What Should Be Disclosed in an Initial Coin Offering?, in CRYPTOASSETS: LEGAL AND MONETARY PERSPECTIVES (forthcoming 2019) (manuscript at 13, 22), https://ssrn.com/abstract=3293311 [https://perma.cc/V4ZR-3VW9] (discussing disclosure generally). No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 491 If the product or service failed or started to fail for business reasons—that is, it was not a fraud related failure—the issuer of the coin would not file an affidavit certifying the Substantial Steps Test. This would likely have two impacts. First, the coin would transition from being a simple piece of property to being a security. This would mean any sale of it by any person could not take place without registering the security or having an exemption from registration, such as a private placement pursuant to Regulation D. Second, the trading value of the coin could fall to zero, since the underlying business would no longer be viable as a means of assessing the coin’s fundamental value. 4. A Note on Self-Regulatory Organizations In several instances above, this Article has made reference to a self-regulatory organization as a means of regulating digital assets. As one of the authors has written elsewhere, self-regulatory organizations—such as FINRA for stockbrokers—are a potentially elegant solution to the shortcomings of government regulation.142 A discussion of the advantages and disadvantages of SROs are beyond the scope of this Article, but we believe an SRO would be a welcome entity as a means of providing best practices or certification of traders in this market. Additionally, in accordance with the proposed solution, a SRO could act as a mechanism for registration and certification of compliance with the Substantial Steps Test. We expect that the SEC or other government regulators would lurk in the background, supervising any such SRO, as well as bringing civil or criminal charges against fraudsters in digital asset markets, just as in other markets. As of this writing, there are discussions underway among many major digital asset players to create a new self- regulatory organization for digital asset markets.143 Known 142 See William A. Birdthistle & M. Todd Henderson, Becoming a Fifth Branch, 99 CORNELL L. REV. 1 (2013). 143 See, e.g., Nikhilesh De, CFTC Meeting Hears Renewed Calls for Crypto Self-Regulation, COINDESK (Oct. 5, 2018), https://www.coindesk.com 492 COLUMBIA BUSINESS LAW REVIEW [Vol. 2019 as ADAM (Association for Digital Asset Markets), it would promulgate a voluntary code of conduct, with the possibility of evolving into a FINRA-like entity, or perhaps merely a platform to inform government regulators. V. CONCLUSION The rise of digital assets, made possible by innovations such as the distributed ledger and blockchains, poses a significant challenge to government regulators. Digital assets herald undeniable potential and risk. Because digital assets as a category do not fit neatly into existing regulatory buckets—currency, personal property, securities—but rather span all of them, most jurisdictions have yet to develop thoughtful regulation to create a fair and orderly market. This regulatory lacuna perpetuates fraud and a market that is not yet safe for institutional investors to enter with confidence. If the potential of digital assets is to be realized, a trustworthy infrastructure is needed. A centerpiece of such a reliable infrastructure is a characterization of digital assets that will enable both private and public regulators, as well as entrepreneurs, investors, and market makers, to know what they are dealing with. This Article has attempted a very rough sketch of the types of digital assets and how they fit into the existing legal tests for what qualifies as a security. Different digital assets can be analogized to currency, gold, or stock, to give just three examples. Being able to differentiate among different types of digital assets is vital for securities regulators, as well as other government entities. The implications of these characterizations are far reaching—for instance, tax treatment varies across asset classes in important ways. For our purposes, we offer two tests—the Bahamas Test and the Substantial Steps Test—as means of categorizing digital assets as securities or not. With this stake in the ground, we hope to encourage others to offer alternative tests /cftc-meeting-hears-renewed-calls-for-crypto-self-regulation [https://perma .cc/KGP2-V7FN]. No. 2:443] A REGULATORY CLASSIFICATION OF DIGITAL ASSETS 493 so the market can move towards a workable definition that accounts for the unique promise and peril of digital assets.