On March 5, 2024, the U.S. Securities and Exchange Commission (“SEC”) announced charges and a corresponding cease-and-desist order (the “Order”) with ShapeShift AG, a cryptocurrency exchange registered in Switzerland that previously operated out of Colorado.  The Order notes that ShapeShift allowed its users to buy and sell certain crypto assets that are considered securities as defined in Section3(a)(10) if the Securities Exchange Act of 1934.  Further, ShapeShift’s operations met the criteria of a “dealer” under Section3(a)(5)(A) of the Exchange Act and, as such, the company was required to register with the SEC though failed to do so.  As part of the Order, ShapeShift does not admit nor deny any of the findings. 

ShapeShift is a prominent cryptocurrency exchange founded by crypto-pioneer Erik Vorhees.  ShapeShift was somewhat unique as an exchange as it operated as a market maker and served as the counterparty for every transaction.  Rather than matching buyers and sellers, its customers simply traded against ShapeShift’s own reserves.  Due to this, the company marketed itself as a “crypto vending machine.”  The company generated revenue by making these exchanges at rates favorable to itself, similar to how a foreign exchange currency converter operates.  At its peak, the exchange offered 79 crypto assets and handled approximately 20,000 transactions per day. 

The settlement is relatively cut and dry, but it’s caused some commotion within the industry.  The biggest issue with it? There’s nothing really useful to take away from it from a compliance perspective.  The SEC has constantly been criticized for failing to offer any concrete guidance for the crypto industry and this Order is much of the same.  Many companies want to comply with secutiries laws, but the SEC has not offered any clarity as to the application of its regulations towards these new digital assets. 

This is not necessarily uncommon, as we have seen other areas of law suffer from the same deficiency at times, though those regulators continue working to provide guidance as the laws evolve.  This has been common with sanctions law, for one example.  These laws are sometimes ambiguous and often opaque.  However, the Office of Foreign Assets Control (“OFAC”) does put a lot of effort in creating FAQs and other guidance to help its constituents comply.  Furthermore, subsequent enforcement actions help flesh things out so the public can see what mistakes the defendant(s) made, what OFAC considers aggravating and/or mitigating circumstances, and sometimes even include guidance as to practical compliance solutions and remediation efforts.   

The SEC has not done any of that.  This latest Order is a perfect example.  It is, unfortunately, bereft of any significant takeaways that the industry can use to help guide their own compliance efforts.  For example, the Order simply notes that “[t]he crypto assets bought and sold by ShapeShift include crypto assets that were offered and sold as securities as defined by Section 3(a)(10) of the Exchange Act.”  That’s great and all, but which ones were securities?  The Order notes that, at its peak, ShapeShift allowed its users to exchange at least 79 different crypto assets.  The language of the order certainly indicates that not all of those assets were considered securities.  Yet that Order does not list the offending assets, nor does it provide any guidance on how to determine which assets constitute a security.  There are now thousands upon thousands of different cryptocurrency projects with a myriad of mechanics and economics and still no reasonable guidance as to what constitutes a security.  If the SEC has its own internal review standards, it has done little to publicize those to the public.

The SEC is at the point where its drawing deep criticism from its own staff.  Commissioner Hester Pierce and Commissioner Mark Uyeda released a highly critical joint statement regarding the ShapeShift action.  They highlight the clear absurdity of the SEC’s stance in a mock conversation between an early ShapeShift and the SEC:

Future ShapeShift (“FSS”): Hello, I would like to register as a dealer.
SEC:  Why?
FSS:  Because I think some of the assets that I plan to deal might be deemed at some point by the SEC to be securities.
SEC:  Which ones?
FSS:   I’m not sure because I can’t really understand what criteria you use to decide whether a token offering is a securities transaction and, if it is, whether the token that was the subject of the investment contract remains a security in secondary market transactions.
SEC:  Well, if you don’t know whether you’re dealing in securities, you can’t register.  And by the way, if some of the assets you’re dealing in are not securities, you also can’t register.
FSS:  So can you help us think through which assets are securities?
SEC:  No.  We suggest that you read the 2017 DAO report, and it will all be clear to you.  You can also look at our enforcement actions if you want.
FSS:  I read it, and I’ve read about your enforcement actions.  I still have questions.
SEC: Hire a lawyer.
FSS:  I did, and the lawyer has even more questions.
SEC: Sorry, we cannot help any more than we already have. We don’t give legal advice.
END SCENE

Ultimately, the SEC needs to do much more to help the industry with its compliance efforts.  While specific guidance documents will be helpful, the Commission must at least use these Orders as a conduit to provide clarity on its evaluation criteria and other important elements.  There will certainly be more enforcement actions in the coming months, which means there will be many opportunities to offer more insight.