The SEC's Buyback Guidance Is Narrower Than It Looks. Does Yours Pass the Test?

Well… easy come, easy go. SEC staff handed token buybacks a pass on Friday and took some of it back on Monday. This reminds me of Bill Hinman's 2018 speech calling Ethereum "sufficiently decentralized," a phrase projects leaned on for years afterward. I suspect this week's fine print gets the same treatment, though with Hester Peirce already one foot out the door, I'd check who's actually in charge before counting on it.

— Jeff

Crypto projects that buy back their own tokens have operated under a dour legal cloud within the US for nearly a decade. A buyback paid for with a project's revenue can look like a promise of profits from someone else's work, and that promise is part of what makes a token a security according to the Howey test, the Supreme Court's 1946 standard for an investment contract.

On Sept. 25, however, the Securities and Exchange Commission appeared to lift the cloud at last in an FAQ about how securities law applies to "certain types of crypto assets and certain transactions involving crypto assets." New guidance from the agency's corporate finance division said that once a crypto network works as designed, announcing a token buyback would not, by itself, constitute a promise of essential managerial efforts. PUMP, the token of the memecoin launchpad Pump.fun, rose about 10% the next day, given its buy-and-burn program.

The guidance was interpreted as a huge boon to revenue-generating protocols that burn their tokens, but also as a potential securities law nightmare. On the Monday after it initially published its FAQ, the SEC staff clarified that its relief only applies where the network "has no central party," defined as any person or group with "operational, economic, or voting control" of it.

Run the programs that spent the most on buybacks this year through that test, and none of them clearly passes.

Hyperliquid (HYPE) comes closest, because its buybacks execute automatically, but the validators run by its foundation hold nearly half of the network's votes. Most of the other programs in the chart below — including those behind PUMP, JUP and LINK — are run by companies, and many of the rest, like AAVE, SKY and LDO, by committees or token-holder votes.

So the question for a holder is: who controls the network behind the token?

Our Sept. 2 issue sorted buyback programs into encoded and automatically enforced "rules" and "pens," which a human at a foundation or company controls. SEC staff have now made a version of that split a legal question. In some sense, they're asking who is writing the program — automatic code, or a team that can write and rewrite the buyback plan.

What SEC Staff Changed

Monday's edit by SEC staff transformed a broad statement about any working network into a narrow one about truly decentralized networks no one controls.

The SEC initially wrote that if a crypto system is "functional," announcing a buyback program does not automatically constitute a promise of "essential managerial efforts." However, legal experts, including a16z crypto General Counsel Miles Jennings, argued that the SEC's wording was too broad and could be misinterpreted by centralized issuers.

In particular, the original language could have let a startup that still runs its app sell tokens to the public, promise to buy them back with the app's revenue, and argue that the promise did not make the token a security.

On social media, outgoing SEC Commissioner and Crypto Task Force lead Hester Peirce clarified that "if you have a central party, you can't rely on this FAQ."

On Sept. 28, the staff wrote that into the guidance, which now reads, "Where a crypto system is functional and has no central party." Jennings called the change "great work by the SEC." Gabriel Shapiro, a securities lawyer at MetaLeX Labs, wrote that "it seems there is a decentralization premise here after all."

This comes after an interpretive release from the SEC in March defining a central party as "a person, entity, or group of persons or entities having operational, economic, or voting control of a crypto system." Who pulls the trigger on a buyback is evidence of that control, and a buyback that runs itself can still sit on a network someone controls — making it ineligible for SEC relief.

Notably, the SEC did not explicitly say that buybacks on centralized, functional networks are illegal or automatically securities, just that they're excluded from the safe harbor. Projects with a central party that operate fully functional networks — e.g., many major DeFi protocols — cannot point to this SEC guidance for legal protection and remain in regulatory limbo, subject to a full, case-by-case Howey test evaluation.

Where the Buyback Money Went

Two programs account for most of this year's token buyback spending, and only one of them runs itself.

Token buybacks reached $638 million in the first eight months of 2026, according to Allium data. Hyperliquid spent more than twice as much as Pump.fun, and no other program came close to either.

In the rest of the issue, subscribers get:

• Which of the buyback programs that spent the most this year, from Hyperliquid's to Aave's paused one, have a plausible claim to pass the "no central party" test, and why most don't

• Why Hyperliquid's automatic buyback may not be enough once you count who holds the validator votes

• How PUMP and HYPE traded around both versions, and what their prices say about paying for a company-run buyback

• What the guidance is worth once Hester Peirce leaves the SEC on Oct. 2

• Bull, base and bear ranges for HYPE and PUMP, and the dates that decide between them

Already a subscriber? Keep reading.

Subscribe for just $1.25