Digital Commodity or Security: How the CLARITY Act Actually Sorts Tokens
Under the CLARITY Act, a token is a digital commodity, a security, or in transit between them. The three tests, the hard exclusions, and four worked examples.
On 15 September the Senate took a procedural vote on the CLARITY Act. Sixty votes are needed to open debate; Republicans hold 53 seats, so at least seven Democrats have to come along. Pass it, and the United States finally has a market structure for digital assets. Miss it, and the calendar pushes the whole question into another Congress.
While the deal-making drags on, two myths circle the bill. Read the critics back to back and something strange happens. One side says the law will set crypto loose and feed investors to scammers. The other says the same law will drag half the market into securities rules and choke it in red tape. Both camps cannot be right. Both are loud.
The loudest voices sit at the extremes. The coalition Americans for Financial Reform calls the bill "a gift to crypto grifters masquerading as reform." Its author, House committee chairman French Hill, says it brings "long-overdue clarity to the digital asset ecosystem." The truth is not in the slogans. It is in the text, and the text answers a question every founder with a token is already asking: which side of the line am I on?
Myth 1: the bill blows up investor protection
The face of the first panic is Senator Elizabeth Warren, who argued at committee markup that the bill guts protections standing since 1929 and opens the door to fraud. Strong words that hide two very different arguments glued together.
The bank fear. The first argument comes from the people Warren usually attacks. Stablecoins paying a yield could pull deposits out of the banking system, and a coalition led by the American Bankers Association warned that lending to families and small businesses could fall by a fifth or more. Jamie Dimon put it plainly: crypto firms could end up paying rewards that look like bank interest without carrying bank safeguards.
That fight already has an ending. Senators Thom Tillis and Angela Alsobrooks negotiated language barring interest or yield on stablecoin balances where it is economically or functionally equivalent to a bank deposit, while preserving rewards tied to real activity such as payments, transfers and trading. Regulators get twelve months after enactment to define which reward programmes qualify. Passive yield on an idle balance is out. Paying users for doing something is in.
The token fear. The second argument is more serious, and it is about how tokens get sorted.
Start with why a brand-new token is treated as a security at all. Not because a regulator is being difficult. At launch a network does not run on its own. A team runs it, and the token's value rides on that team's work, which is a textbook investment contract under Howey. Money is raised on a promise of future effort, and the law has treated that as a security since 1946.
To spare every startup a full IPO, the bill offers a lighter road. The issuer sells without full registration but files an offering statement: the business, the finances, the source code, the token supply, the risk factors. Updates follow every six months until the network is certified mature. The ceiling is 75 million dollars in any twelve-month period, and no single buyer may take more than ten percent of supply.
Consumer groups attack precisely this road, arguing the disclosures sit below what current law demands. Banking Committee chairman Tim Scott answers with the same text and calls the bill an investor-protection measure built to stop the next FTX. The mechanics support him more than the slogans do. Once a network grows up, the issuer certifies maturity; absent an objection within sixty days, the token drops its securities label and trades as a commodity. If the network never decentralises, full securities law lands on it and stays. That is the price of failing to decentralise, not a sentence handed down at birth.
The transition is not a cliff. It is a corridor. Weak projects will get pushed off US venues, but "pushes out the weak" and "blows up the market" are not the same sentence.
Myth 2: everything becomes a security
The second myth is the mirror image of the first, and Warren voices this one too from the other side: firms will simply opt out of the SEC by going onchain. Lawyers call it regulatory arbitrage, the worry that issuers repackage ICO tokens as commodities under a thin coat of decentralisation. From the same fear grows the opposite complaint, that the bar for commodity status sits so high ordinary tokens cannot clear it and the whole mid-market lands under the SEC.
The bar is high, and that part is true. To be a digital commodity the network has to work, run on open code, follow rules set in advance, and answer to nobody holding twenty percent or more. A venture token where funds and founders sit on a controlling stake will not clear that on day one.
It sounds convincing until you read the rule on the secondary market. Once a token is resold by anyone other than the issuer or its agents, it stops being part of the original investment contract and trades as a plain digital commodity. Securities duties attach to the issuer at the moment of raising money and fall away once the token changes hands freely. In plain terms: "security" is a label on the sale, not a lifelong brand on the token. Critics read the first page of the bill and present it as the last.
The three checks, and where your token lands
Strip away the slogans and the law comes down to one question. Where does the token's value come from? From a working network, it is a commodity. From a promise of someone else's profit, it is a security.
The first check is the source of value. A digital commodity draws its worth from the network being used: transactions settled, services accessed, validators paid, governance exercised. A security draws its worth from somewhere else, either a business generating profit or a team still doing the work that makes the token worth holding. The same token can sit on the same chain in both cases. What separates them is whether anyone has to keep working for the price to mean anything.
The second check is the state of the network and who controls it. To count as mature, the system has to actually function, run on open-source code, and operate under rules fixed in advance rather than rewritten at will. On top of that sits the concentration limit: no person and no affiliated or coordinated group may hold twenty percent or more of the units or of the voting power. A pre-launch project fails this by definition, and so does a venture token where funds and founders sit on a controlling stake. That twenty percent is not a guideline, it is a number that either clears or does not, and vesting schedules, treasury reserves, foundation allocations and affiliate wallets all count toward it.
The third check is what the holder actually receives. Access to the network, the right to validate, a vote on protocol parameters: none of that turns a token into a security. Equity, debt, dividends, or a share of revenue or assets does, immediately and permanently. This is the check that catches most real-world asset projects, because the entitlement written into the contract is the entitlement the law reads, whatever the marketing calls it.
Those three checks decide the category. Two practical consequences follow. On trading, a token sold by the issuer to raise capital carries securities duties, while the same token resold by anyone other than the issuer or its agents trades as a plain digital commodity. On paperwork, a commodity needs a maturity certification that takes effect absent objection within sixty days, while a security sold under the exemption needs an offering statement, semiannual updates and a ceiling of seventy-five million dollars in any twelve-month period. The category is the question. Everything else is the consequence of the answer.
Everything between the poles is an early-stage network token. The House text calls it an investment contract asset, the Senate draft calls it an ancillary asset, and the idea is the same: technically a commodity, carrying disclosure duties until the team proves the network has grown up. Not a third category. A waiting room between the two.
If you are mapping this against the older commercial taxonomy of utility, payment, governance and security tokens, note that the two do not line up neatly. A token marketed as a utility can still be a security here, and the label on your whitepaper carries no weight in the analysis.
The lines that do not move
Two exclusions are absolute, and no amount of decentralisation theatre works around them.
A cut of someone's income is never a commodity. The digital commodity definition in Title I throws out any asset representing an ownership or other interest in the revenues, profits, obligations or debts of an issuer or a related person. This is not "while the team runs it" or "until decentralisation." It is a flat no. Hand that token to a million wallets and its status does not change. The narrow carve-out: where the entitlement runs through a decentralised governance system, the exclusion does not apply.
A wrapped security is still a security. The same definition excludes securities, derivatives and stablecoins outright. Tokenise a share, a bond or a fund interest and the wrapper changes how the asset is recorded, not what it is. Our note on securities tokenization walks through what that means for the issuing structure.
What the maturity test actually requires
The certification route sits in Section 205 of the House bill, and four conditions have to hold at once.
- The network functions. Real transactions, access to services, validation or governance, not a testnet and a roadmap.
- The code is open source.
- The rules are set in advance and transparent, with no unilateral power to rewrite the protocol.
- Nobody controls it. No person or coordinated group, affiliates included, holds twenty percent or more of the units or of voting power.
On top of that, value has to come mainly from the network itself. Where all of it holds, the issuer files a certification and it takes effect automatically unless the regulator objects within sixty days. The burden sits on the regulator to rebut, which is a meaningful shift from the enforcement-first era.
The practical consequence for founders is a cap table problem, not a drafting problem. Twenty percent is a number you either meet or do not, and vesting schedules, treasury holdings, foundation allocations and affiliate wallets all count toward it. Projects that intend to certify need to model that threshold before the token generation event, not two years after it.
Four tokens, four answers
Bitcoin. No issuer, no controlling group, value drawn from the network's own work and security. It passes every maturity condition. A pure digital commodity under the CFTC, with no disclosures and no SEC.
Ethereum. Almost the same case with one formal catch. It turns on the maturity test: does any group hold twenty percent or more, and does value genuinely come from the network. The market expects it to pass, but the check is not automatic.
Tokenised rent or mining royalties. The holder receives a slice of rent or mining revenue, which is a direct claim on someone else's profit. Security, locked in. Trading it on a DEX and dressing governance up as a DAO changes nothing, because the economics are a payout from a business. This is the classic trap for RWA projects: technically a token on a blockchain, legally an investment contract. It is also why the structure underneath a tokenised real estate deal decides its regulatory outcome long before the token exists.
A fresh L2 startup token. Team and funds hold more than twenty percent, the roadmap sits with the founders, value rides on their work. At launch it is an investment contract: offering statement, semiannual disclosures, a 75 million dollar annual ceiling. Then the fork in the road. Decentralise, drop control below twenty percent, certify, and it becomes a commodity under the CFTC. Stay parked on the team's endless "work" and it stays under the SEC. This is the type that feeds the "everything becomes a security" myth, because its starting state gets sold as its final one.
What to do before the vote
Whichever way 15 September goes, the classification logic is not going away. It has been converging across the House bill, the Senate draft and last year's joint agency guidance, and the same questions already decide listings, banking and audits today.
- Model the twenty percent line. Founders, treasury, foundation, funds and affiliates, fully diluted, on a vesting timeline. Most cap tables built for a normal venture raise do not clear it, and fixing it later means renegotiating with people who have no reason to agree.
- Read your own token's economics honestly. If a holder receives anything resembling revenue, profit or a claim on assets, no jurisdiction shopping saves it. Redesign the entitlement or accept securities treatment.
- Get the disclosure file built now. The offering statement wants the business, the financials, the code, the supply schedule and the risk factors. Projects that already keep a defensible token legal opinion are most of the way there.
- Check the instruments you raised on. SAFTs, SAFEs and token warrants written before this framework often assume a classification the new text will not grant.
- Line it up against Europe. A token that clears the US commodity test can still be a financial instrument under MiCA. Firms selling into both markets need one structure that survives both readings.
The bottom line
Both myths run on the same trick. Critics take the starting point, a token born as a security and a project under the SEC, and sell it as the finish. The law describes a route, not a verdict: disclosures at the entrance, reclassification on the secondary market, and an exit to commodity as the network decentralises.
There are real things to argue about. Whether the CFTC is ready for retail. Whether small investors are protected enough. Whether the gates are wide enough to invite arbitrage. Those are fair questions, asked by serious people. But "it will blow up the market" and "everything becomes a security" are not conclusions drawn from the text. They are a fear of its cover, and a cover always gets read faster than the law.
FAQ
Is my token a security or a commodity under the CLARITY Act?
It depends on where the value comes from and who controls the network. A token whose value grows from network use, on a functional open-source system with no holder above twenty percent, is a digital commodity under the CFTC. A token whose value rides on a team's continuing work or on a business's profit is a security under the SEC.
Does a token stay a security forever once it is sold as one?
No. Securities duties attach to the issuer's capital-raising sale. Once the token is resold by someone other than the issuer or its agents, it trades as a digital commodity.
What is a mature blockchain system?
A network that functions for real transactions, validation or governance, runs on open-source code, follows rules set in advance, and is not controlled by any person or affiliated group holding twenty percent or more.
Who decides whether a network is mature?
The issuer or another qualified party files a certification. It takes effect automatically unless the regulator objects within sixty days.
What is the twenty percent threshold?
The concentration limit in the maturity test. If an issuer, its affiliates or any coordinated group beneficially hold twenty percent or more of the units or of voting power, the network is not mature and the token cannot be a digital commodity.
How much can a project raise under the exemption?
Up to 75 million dollars over any twelve-month period, with no single purchaser taking more than ten percent of supply, against an offering statement and semiannual updates until maturity is certified.
Are tokenised real-world assets covered?
Only some. A token conveying a share of rent, revenue or profit is excluded from digital commodity status outright, and a tokenised share or bond is excluded as a security. The blockchain changes the record, not the asset.
What is the difference between an investment contract asset and an ancillary asset?
Drafting, not substance. The House text uses investment contract asset and the Senate draft uses ancillary asset for the same idea: an early-stage network token treated as a commodity but carrying disclosure duties until the network is certified mature.
When does the Senate vote?
A procedural vote on the motion to proceed is set for 15 September 2026. Sixty votes are required to open debate, and passage would still need floor consideration and reconciliation with the House text.
Token structures rarely fail on the token. They fail on the cap table, the entitlement written into the smart contract, or an instrument signed two years before anyone read the bill. If any of those sound familiar, bring the documents.