Rule 103 — ten topics, principles-based, whitepaper-consistent

Rule 103 is the disclosure constitution of the whole regime. Both exemptions point at it. Form 1-CRYPTO Part II Items 1–10 map onto 103(b)(1)–(10) one-for-one. Form NOR does not reprint it; it points at a website that must contain it. The Commission’s bet is that principles-based narrative, rather than S-K line items, will elicit material crypto information without forcing issuers to invent answers to oil-and-gas or bank subparts.

The 103(a) method

• Tailor to the issuer, the subject crypto asset, and the associated network or application.
• Clear, concise, understandable language; do not hide behind jargon.
• Address the current stage of development; delineate forward-looking plans.
• Be consistent with public statements in established channels (website, official social) and promotional materials (whitepapers) on material aspects.
• Omit a topic if it is not applicable, or if responsive information is unknown or not reasonably available.

The ten topics

• (1) CIC — material terms; representations or promises of essential managerial efforts and progress against them; purchaser obligations; conditions. This paragraph is the measuring stick for Rule 400.
• (2) Offering — units, price or pricing method, duration, purchaser restrictions, distribution agreements, net proceeds and expenses, use of proceeds, whitepaper URL.
• (3) Subject crypto asset — name and material aspects.
• (4) Management, related persons, conflicts; and whether related persons are under any transfer or resale restriction (disclosure only).
• (5) Associated network or application, plan of development, progress.
• (6) Security of the asset/network/application; source-code URL if public. No mandate to open-source.
• (7) Economics and allocations — supply, pricing, lockups, distribution, related-person holdings, release schedules, mint/burn, methods to verify transaction history.
• (8) Governance — asset, network and smart-contract governance and permissions.
• (9) Ecosystem — onchain and offchain participants, infrastructure, other systems using the asset.
• (10) Risk factors — short, specific, no boilerplate, only factors specific to this CIC, issuer, asset and network.

Essential managerial efforts, restated for drafters

The 2026 Interpretation is imported into 103(b)(1). Promises to develop functionality, with a business plan containing milestones, a timeline, personnel, funding and an explanation of how holders will profit, likely create a reasonable expectation of profits. Vague promises with no actionable plan likely do not. After the network or application is functional, services to secure, maintain, improve or enhance it, or to facilitate network effects, are not essential managerial efforts — value is supposed to come from programmatic operation and supply/demand. That post-functionality paragraph is how a labs entity can keep shipping without re-attaching a CIC. It is also how a Form TR gets attacked if the “functional” claim is cosmetic.

103(b)(1) and (2) are more enumerated than (3)–(10). The Commission says those two paragraphs list information every investor needs; the rest stay principles-based so the rule does not have to be rewritten for the next architecture. RFC 29 asks whether to go fully prescriptive, or to add non-exclusive examples. Comparability versus tailoring is the live trade.

Where the ten topics came from

• Corp Fin, Offerings and Registrations of Securities in the Crypto Asset Markets (Apr. 10, 2025) — staff observations on how existing forms were being answered.
• Brummer / Kiviat / Massari, What Should Be Disclosed in an ICO? (2019); Brummer, Disclosure, Dapps, and DeFi (2022); Brummer, A Developer Theory of Disclosure (2025).
• LeXpunK Regulation X (2022); Paradigm (2023); comment letters from a16z, Coinbase, SIFMA, OpenZeppelin (audits and methodology), TDC, CfPA, GDCA, Anderson, Figure, CrowdCheck.
• The historical S-K pattern the Commission cites: Reg M-A, Reg AB, subpart 1200 oil and gas, 1300 mining, 1400 banks, 1600 SPACs. Crypto is being offered the same courtesy those asset classes received — a dedicated topic list — without a new S-K subpart.

On insider lockups, a16z and Coinbase asked for a limitation on development-team sales until the network is sufficiently decentralized. The Commission declined to mandate a holding period. It requires disclosure of whatever restriction exists, and it tees up RFC 35: a one-year lockup, a milestone lockup, or something else, as a condition of the exemption. Howell et al. and Davydiuk, cited in the alternatives section, find ICOs with insider vesting fail less often. That literature is the Commission’s own exhibit for a lockup comment.

• Draft a 103(b)(1) “essential managerial efforts register”: a table of each representation, the milestone, the date, the status, the evidence URL. That table is your Rule 400 file the day you start. Issuers who treat 103(b)(1) as marketing copy will not be able to file a defensible Form TR.
• RFC 35 is the highest-leverage investor-protection comment in the paper. If you want a lockup, pick one: 12 months from NOR, or until the 103(b)(1) milestones marked “functionality” are checked, with a Rule 144-style reporting of related-person sales. Do not say “decentralized enough.” The Commission already rejected that phrase.
• RFC 29: ask for non-exclusive examples, not a fully prescriptive S-K. Examples give Corp Fin a comment-letter vocabulary without freezing 2026 architecture into the rule.
• OpenZeppelin’s audit-methodology ask did not become a line item. Put it in 103(b)(6) as a requested example: name of auditor, date, standard, whether the report is public, known unpatched criticals.
• Risk-factor RFC 36: propose a page cap or a “ten factors, 80 words each” instruction. Without it, 103(b)(10) will reproduce Item 105 sludge.