Crypto Law Brief: The SEC’s Five-Year Tokenized Stock Window, a CFTC Pass for Wallet Front-Ends, and Sanctions on Iran’s BitBank

Thursday, September 17, produced four separate developments in U.S. crypto policy: a new SEC trading-venue category, a CFTC reprieve for wallet developers, Treasury sanctions on an Iranian exchange moving bitcoin to the IRGC, and S&P Global's purchase of a smart contract auditor. Here is what each does and where the legal exposure sits.

The SEC Opens a Five-Year Window for Tokenized Stocks

The SEC issued Order 34-106402, granting temporary conditional relief from the Exchange Act's definition of "exchange" to a new category it calls a Tokenized Securities Venue. A TSV may match buyers and sellers of tokenized National Market System stock through permissioned automated market maker liquidity pools without registering as an exchange. The relief expires five years after publication, and the Commission opened a comment file.

The conditions do the work. Each tokenized share must carry the same rights as the underlying stock, including dividends and voting. Smart contracts must be public, auditable, and on a permissionless ledger. Symbol counts and volume are capped, trading halts when the listing exchange halts the underlying, and issuers get notice and a chance to object when a third party tokenizes their stock. One omission matters: the order does not reach synthetic price-tracking tokens, which is what much offshore "tokenized equity" is.

The CFTC Extends a Narrow Pass to Wallet Front-Ends

The CFTC's Market Participants Division issued Staff Letter 26-25, extending to all "passive software providers" the relief granted to Phantom Technologies in Letter 26-09 in March. Qualifying self-custodial wallet developers that route users into regulated derivatives will not be recommended for enforcement over failure to register as introducing brokers.

Ten conditions attach, and they are not cosmetic: risk and conflict disclosures, onboarding users directly with registered intermediaries reachable independent of the software, joint and several liability undertakings with each registrant, and a filed consent to CFTC jurisdiction. Relief covers only a custodial model, and the provider may not hold funds, generate trading signals, or exercise discretion over routing. This is staff policy, not a Commission rule, and it lapses whenever the Commission acts.

Treasury Sanctions BitBank Over Bitcoin Sent to the IRGC

OFAC designated BitBank, an Iranian exchange Treasury says is controlled by previously sanctioned financier Babak Zanjani, as part of Operation Economic Outcast. Treasury alleges Zanjani used BitBank in June and July to move hundreds of millions in bitcoin to the Islamic Revolutionary Guard Corps, and that the Hormuz Safe Marine Services Authority has used it since June to pass collected payments to the Iranian government under a bitcoin-settled scheme covering vessels transiting the Strait of Hormuz. Its developer and three Zanjani associates were designated too.

The designations come under Executive Order 13902, which carries secondary sanctions exposure, so non-U.S. institutions that keep dealing with these parties risk losing access to the U.S. financial system themselves. Sanctions screening is strict liability. Good faith is not a defense.

S&P Global Buys OpenZeppelin

S&P Global agreed to acquire OpenZeppelin, terms undisclosed. Its open-source contract library underpins much of deployed onchain code, and its audit practice has run 900+ security engagements. When a ratings company owns audit infrastructure, "we were audited" stops being marketing and becomes a baseline that counterparties, insurers, and courts weighing negligence claims can point to.

What This Means for You

For trading venues, the SEC order is an invitation with a clock on it: five years of relief, conditions you must evidence continuously, and a comment window that shapes whatever replaces it. If you build wallet software, read Letter 26-25 before assuming it covers you, because the liability undertaking and the ban on routing discretion disqualify plenty of products that look passive from outside. If you hold assets near Iranian counterparties, screen now rather than after a freeze.

All three federal actions are temporary, conditional, and revocable. Exemptive orders and staff letters are not statutes, relief vanishes the moment compliance lapses, and none of it binds private plaintiffs or state regulators.

At Coin Counsel, we work with individuals and businesses navigating the legal fallout of crypto fraud — whether you're a victim seeking recovery, a company facing regulatory scrutiny, or a project working to stay compliant in an increasingly complex legal landscape. The rules are evolving fast, and the cost of getting it wrong has never been higher. Contact us at coin-counsel.com to speak with a crypto-focused attorney today.

Disclaimer

This blog post is for informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship between you and Coin Counsel or Franco Law PLLC. The legal landscape surrounding cryptocurrency is rapidly evolving and varies by jurisdiction. Do not act or refrain from acting based on information in this post without first consulting a qualified attorney. If you believe you have been the victim of crypto fraud, contact us at coin-counsel.com for a consultation.