For founders and counsel, labels such as “DAO-governed” or “permissionless” remain insufficient. Governance documents, delegation arrangements, validator admission, upgrade keys, emergency powers, and reward distribution should be mapped against the staff’s control factors. The FAQs are staff views, not a Commission rule, and expressly create no new legal obligations, but they provide a useful diligence checklist for token launches, listings, disclosures, and restructuring.
SEC Staff Gives Canton Coin a Fact-Specific No-Action Position
On November 3, the Division of Corporation Finance issued a no-action response concerning Canton Coin. Relying on counsel’s representations, the Division viewed the token as a “digital commodity” under the Commission’s March 2026 interpretation. The staff highlighted two points: Canton Coin’s value was represented as arising from the network’s programmatic operation and supply-and-demand dynamics, rather than essential managerial efforts, and the Canton Network was represented as having no central party.
The Division said it would not recommend enforcement if Canton Coin is minted programmatically by Super Validators, Validators, and application providers as described, without Securities Act Section 5 or Exchange Act Section 12(g) registration. This is not a ruling that every utility or governance token is a non-security. The response states that different facts could produce a different conclusion and expresses an enforcement position, not a legal conclusion.
The practical lesson is that design evidence matters. Projects seeking similar treatment should expect scrutiny of minting mechanics, control rights, value drivers, and whether managerial promises—not merely present utility—create a reasonable expectation of profit.
CFTC Directs DCMs to Remove Domestic Geographic Barriers
On November 5, the CFTC issued an interpretation of designated contract markets’ impartial-access obligations. It said DCMs generally may not bar an otherwise eligible participant solely because that person is located in a particular U.S. state or region. DCMs were directed to cease noncompliant domestic geographic restrictions within 30 days, or explain to the Division of Market Oversight why compliance is not feasible. They should also address restrictions imposed through intermediaries.
This is a material new step in a dispute covered last week. The earlier development concerned the CFTC’s lawsuit challenging Utah’s attempt to apply state gambling law to federally regulated event contracts. This week, the Commission articulated a nationwide access position under Core Principle 2 and Regulation 38.151, rather than relying only on litigation against one state.
The interpretation is immediately relevant to prediction-market DCMs, but its reasoning reaches any DCM offering crypto derivatives or other products through state-sensitive onboarding. Platforms and intermediaries should review geofencing, residency exclusions, account terms, and position-management controls. At the same time, the document is interpretive guidance—not a statute—and the CFTC said any enforcement decision would depend on the particular facts and circumstances.
OFAC Targets Eight Canadian MSBs Using Digital-Asset Rails
On November 6, OFAC designated eight Canada-based money services businesses under Executive Order 13902 for operating in Iran’s digital-asset sector. Treasury alleged that the businesses converted Iranian rials and other currencies into digital assets and that several transacted with sanctioned Iranian exchanges or addresses associated with the Islamic Revolutionary Guard Corps, terrorism, or sanctioned drug trafficker Ryan Wedding. The action was coordinated with FinCEN, Canada’s FINTRAC, and the DEA.
The designations block property and interests in property in the United States or held by U.S. persons, extend to entities owned 50 percent or more by blocked persons, and generally prohibit U.S.-nexus transactions involving the targets absent authorization or exemption. Treasury also reiterated that OFAC may impose civil penalties on a strict-liability basis.
For exchanges, stablecoin businesses, OTC desks, and MSBs, this action shows why sanctions controls cannot stop at a customer-name screen. Effective compliance should combine ownership analysis, wallet and counterparty screening, transactional monitoring, geographic and service-risk review, and escalation procedures for indirect exposure to designated exchanges or addresses.
Former FBI Agent Pleads Guilty to Cryptocurrency Theft
On November 5, former FBI agent Patrick Steven Yaroch pleaded guilty to wire fraud and money laundering arising from his misuse of cryptocurrency credentials held in FBI systems. According to the agreed facts described by the Justice Department, Yaroch made about 100 unauthorized transfers involving credentials connected to 35 investigations, including at least one FBI operational wallet, and obtained approximately $2.47 million. He then exchanged and moved the assets to obscure their source and ownership. Sentencing is scheduled for March 4, 2027; the court has not yet imposed a sentence.
The case is a sharp reminder that private keys and recovery credentials remain bearer-like assets even inside sophisticated institutions. Exchanges, custodians, receivers, bankruptcy estates, law firms, and investigators handling recovered crypto should use split knowledge or multi-party approval, role-based access, immutable audit logs, rapid credential rotation, and independent reconciliation. Asset-recovery planning should address insider compromise as well as external hacking, because attribution and tracing do not themselves prevent a person with valid credentials from moving funds.
These developments reward careful architecture and documented controls. Businesses evaluating token status, DCM access, sanctions exposure, custody, or a digital-asset loss can contact Kelman PLLC to discuss the facts and available legal options.
Attorney Advertising. This article is for general informational purposes and does not constitute legal advice.
