This article was compiled and organized by BlockWeeks
For nearly a decade in the United States, crypto projects that buy back their own tokens have been shrouded under a gloomy legal cloud. Buybacks paid for with project revenue can easily be seen as a promise of "profits from the efforts of others," and under the Howey test established by the U.S. Supreme Court in 1946, this promise is precisely one of the key elements that constitutes an investment contract and therefore a security.
But on September 25, the SEC, in an FAQ on how securities laws apply to "certain types of crypto assets and related transactions," seemed to finally clear away this cloud. New guidance issued by the SEC's Division of Corporation Finance stated that when a crypto network is operating as designed, announcing a token buyback does not by itself constitute a promise of "essential managerial efforts." After the news broke, the token PUMP of meme coin issuance platform Pump.fun rose about 10% the next day, due to its buyback-and-burn mechanism.
The guidance was at one point interpreted as a major positive for revenue-generating, burn-based protocols, but it was also seen as a potential securities law nightmare. On the Monday after the FAQ was first published, SEC staff clarified that this exemption applies only when the network "has no centralized entity"—that is, when no individual or group has "operational, economic, or voting control" over it.
Applying this standard to the projects with the highest buyback spending this year, not a single one clearly passes.
Narrowed from "any usable network" to "no centralized entity"
Hyperliquid (HYPE) comes closest to qualifying, because its buybacks are executed automatically, but the validators operated by its foundation control nearly half of the network's voting power. Most other projects—including the teams behind PUMP, JUP, and LINK—are operated by companies; many of the rest, such as AAVE, SKY, and LDO, are decided by committees or token holder votes.
So for holders, the real question is: behind the token, who exactly controls this network?
This revision by SEC staff narrowed an originally broad statement aimed at "any properly functioning network" into one that applies only to truly decentralized, uncontrolled networks.
Legal skepticism and the SEC's self-correction
The SEC initially wrote that if a crypto system is "in a usable state," announcing a buyback plan does not automatically constitute a promise of "essential managerial efforts." But legal experts, including a16z crypto general counsel Miles Jennings, argued that the SEC's wording was too broad and could be misread by centralized issuers.
More specifically, the original wording could let a startup still operating its own app sell tokens to the public, promise to use app revenue for buybacks, and argue that this promise does not make the token a security.
On social media, outgoing SEC Commissioner and head of the crypto working group Hester Peirce clarified: "If you have a centralized entity, you cannot rely on this FAQ." She will leave the SEC on October 2.
On September 28, staff formally wrote this sentence into the guidance, which now reads: "when the crypto system is in a usable state and has no centralized entity." Jennings called the revision "excellent work by the SEC." MetaLeX Labs securities lawyer Gabriel Shapiro wrote: "It seems there really is a decentralization premise here."
Previously, in a March interpretive document, the SEC defined a centralized entity as "an individual, entity, or group with operational, economic, or voting control over the crypto system." Who has the power to trigger buybacks is itself evidence of such control; and an automatically running buyback may still sit on a network controlled by someone—and thus be ineligible for the SEC exemption.
Not equal to illegality, but still in a regulatory gray area
It is worth noting that the SEC did not explicitly say that buybacks on centralized, usable networks are illegal or automatically constitute securities; it only said they are excluded from the safe harbor. Projects that have a centralized entity but operate a fully usable network—such as many leading DeFi protocols—cannot cite this SEC guidance to seek legal protection, remain in regulatory limbo, and need to undergo a full, case-by-case Howey test assessment.
This year only two players support the buyback market, and only one of them is "automated"
According to Allium data, total token buybacks in the first eight months of 2026 reached $638 million. Among them, Hyperliquid's spending was more than twice that of Pump.fun, and no other project came close to these two.
In other words, the actual beneficiaries of this guidance may be far narrower than the market initially reacted—very few buyback projects truly meet the "no centralized entity" condition, and the leading players that account for the vast majority of buyback funds are precisely on the list of centralized entities.
