16. Safe Harbor/pp. 161–169/17 CFR 228.400
Rule 400 — the CIC ends when the promises end
If the issuer has completed or permanently ceased all essential managerial efforts it represented or promised, is not making and does not intend to make new ones, and files Form TR, the covered investment contract is deemed ceased for the Commission’s administration of the “investment contract” definitions. Self-executing. Challengeable. Not binding on private litigants. Not a decentralization test.
II.D Investment Contract Safe Harbor (Subpart D, Rule 400)
Time limit
None
Decentralization test
None
Private-litigant bind
No
PRA TRs / year
475
RFCs
124–135
Analysis
What the text does
Rule 400 is the evolution mechanism the introduction promised. It is not Peirce’s Token Safe Harbor 2.0. It is not a three-year registration holiday. It is a definitional safe harbor: for purposes of the Securities Act and Exchange Act definitions of “security,” a crypto asset is deemed not subject to an investment contract if two things are true.
- 400(a): the issuer has completed or otherwise permanently ceased all essential managerial efforts that it represented or promised it would engage in under the CIC, and is not making and does not intend to make any new representations or promises to engage in essential managerial efforts with respect to the crypto asset.
- 400(b): the issuer files Form TR — issuer identity, a brief description of the CIC and the asset, a certification, and a supporting analysis.
The measuring stick is the issuer’s own Rule 103(b)(1) disclosure, not a market conception of decentralization. If you promised a mainnet with specified modules, a token distribution, and a handover of a multisig, those are the efforts. Post-functionality maintenance, security hardening, grants programs and network-effects work are, on the Commission’s 2026 Interpretation as restated in this paper, not essential managerial efforts. File against the promises you made, not against a Twitter poll about whether the chain is “decentralized.”
Legal effects, tightly
- Self-executing on filing, for the Commission’s administration. The Division does not have to bless the TR for the harbor to attach.
- The Commission may challenge the filing if it believes the certification or the analysis is a misrepresentation. Challenge is a facts case against 400(a), not a discretionary denial of a benefit.
- The harbor does not bind private litigants. A purchaser can still plead Howey. Form TR is evidence; it is not a judgment.
- Non-exclusive. A crypto asset can leave the securities laws under the 2026 Interpretation without anyone filing a TR. The TR is a safe harbor, not a gate.
- Available to any issuer, not only those who used Rule 200 or 300. Legacy ICO issuers can file. That is the transition path.
- Form TR is the “public announcement” contemplated by 2026 Interpretation n.98.
Research
Comparables and the record
- PRA: 475 safe-harbor Form TR filers a year, being 15% of the 3,165 crypto projects launched in 2024, at 30 hours each.
- Alternatives (pp. 274–276): impose a time limit (like Rule 200’s four years); replace 400(a) with a functionality-plus-decentralization test with specified criteria. The Commission rejected both, in the draft, because a deadline forces rushed efforts and a decentralization test is the continuum problem flagged by Ripple, L. Cohen and Goody Guillén.
- G. Shapiro’s Task Force letter distinguished a utility path from a decentralization path. Rule 400 is the utility path.
Ideation
What to file
- Without-prejudice language on Form TR is the legacy-issuer comment. Propose exact caption text.
- If you wanted a decentralization test, you must beat pp. 274–276 on cost and administrability. “Nakamoto coefficient > X” will be treated as a toy unless you also propose who measures it and what happens when it drops the next week.
- Private-litigant non-bind is the plaintiffs’ bar comment and the defense-bar comment. Defense: ask the Commission to make the harbor presumptive in private actions. Plaintiffs: keep it as is, and ask for a 103(b)(1) archive so the measuring stick cannot be rewritten.
- New promises after a TR: one tweet from a founder “we’re going to build X” can re-attach a CIC under the 2026 Interpretation even if the TR stays on file. Draft a post-TR communications policy as a 400(a) “does not intend” control, and describe it in the comment.
Analysis
What the text does
Rule 400 is the evolution mechanism the introduction promised. It is not Peirce’s Token Safe Harbor 2.0. It is not a three-year registration holiday. It is a definitional safe harbor: for purposes of the Securities Act and Exchange Act definitions of “security,” a crypto asset is deemed not subject to an investment contract if two things are true.
- 400(a): the issuer has completed or otherwise permanently ceased all essential managerial efforts that it represented or promised it would engage in under the CIC, and is not making and does not intend to make any new representations or promises to engage in essential managerial efforts with respect to the crypto asset.
- 400(b): the issuer files Form TR — issuer identity, a brief description of the CIC and the asset, a certification, and a supporting analysis.
The measuring stick is the issuer’s own Rule 103(b)(1) disclosure, not a market conception of decentralization. If you promised a mainnet with specified modules, a token distribution, and a handover of a multisig, those are the efforts. Post-functionality maintenance, security hardening, grants programs and network-effects work are, on the Commission’s 2026 Interpretation as restated in this paper, not essential managerial efforts. File against the promises you made, not against a Twitter poll about whether the chain is “decentralized.”
Legal effects, tightly
- Self-executing on filing, for the Commission’s administration. The Division does not have to bless the TR for the harbor to attach.
- The Commission may challenge the filing if it believes the certification or the analysis is a misrepresentation. Challenge is a facts case against 400(a), not a discretionary denial of a benefit.
- The harbor does not bind private litigants. A purchaser can still plead Howey. Form TR is evidence; it is not a judgment.
- Non-exclusive. A crypto asset can leave the securities laws under the 2026 Interpretation without anyone filing a TR. The TR is a safe harbor, not a gate.
- Available to any issuer, not only those who used Rule 200 or 300. Legacy ICO issuers can file. That is the transition path.
- Form TR is the “public announcement” contemplated by 2026 Interpretation n.98.
Requests for comment
Numbered questions on this page
- RFC 124
Adopt Rule 400 as proposed?
Desk State whether you would file a TR, and on what fact pattern.
- RFC 128
Should the harbor include a time limit?
Desk The Commission’s own alternative. Rushing development is the cost.
- RFC 130
Should functionality and decentralization be specified criteria?
Desk Only with an administrable test. The paper thinks you do not have one.
- RFC 134
Will issuers decline to file because filing admits a prior CIC?
Desk Yes. Propose without-prejudice text.
Related sections
10. Disclosure
Rule 103 — ten topics, principles-based, whitepaper-consistent
12. Startup $5M
Rule 200 — $5 million, four years, a website, and a one-time ticket
15. Reporting
Rule 305–307 — staying current, getting out, getting suspended
2. Intro
Why the Commission says existing rules are not fit-for-purpose
RCA publishes source-linked intelligence for professionals. Nothing here is a token-buying call, a legal opinion, or an “approved / safe / regulated” badge. Every material claim is dated. Incomplete files stay incomplete.