Raising Capital for Crypto & Blockchain Projects Under Reg D

The Reality of Raising Crypto Capital Under Regulation D

Yes, traditional securities laws apply to blockchain and crypto capital raises. If you take passive money from investors to fund a project where you and your team do the active work, you are selling a security. That means you either register with the SEC or you use an exemption like Regulation D to sell it privately.

The technology does not change that answer. A token is just a wrapper. The question the SEC asks is the same one it asks about a share of stock or an LP interest: are people handing you money and expecting you to build something that makes them a profit?

Crypto projects are operating businesses raising private capital. The mechanics of raising business capital under Reg D work the same way whether the venture ships software, real estate, or a protocol.

The SEC’s Default Position on Digital Assets

The SEC’s starting assumption is that your capital raise is a securities offering, whatever you call the instrument.

It does not matter if you label it a digital token, a debt-based token, or plain equity. When investors provide passive capital and rely on the active work of others to generate a return, that is a security. That is the whole test in a sentence.

The delivery mechanism is irrelevant. Selling the interest through a smart contract, a wallet, or a website does not move it outside the securities laws. State securities regulators take the same position, so you are dealing with federal and state rules at the same time.

Why Regulation D is the Standard Path

Regulation D is the standard path because it lets you raise money privately without registering the offering with the SEC.

Registration is the public route. It is slow, expensive, and it puts you into ongoing public reporting obligations that no early-stage project wants. Regulation D is the exemption that lets you skip the public registration process and sell to investors under a defined set of private-market rules.

In plain English, Regulation D is a structured way to raise capital privately. You follow the conditions of the exemption, you file a Form D, and you stay out of the public reporting system. Almost every crypto raise that is done correctly runs through Rule 506(b) or Rule 506(c) under Regulation D.

What Legal Documents Actually Do in a Token Raise

Your offering documents are not marketing material. They exist to build a disclosure record, not to attract investors.

The Private Placement Memorandum, the Subscription Agreement, and the Investor Questionnaire do one core job: they create a written record that you told investors the truth and warned them about the risks. That record is what protects you later.

This matters more in crypto than almost anywhere else, because the assets are volatile. When a token drops and investors lose money, some of them will look for a way to get it back. A proper disclosure record is how you defend against rescission claims and fraud claims – you can show, in writing, exactly what the investor was told before they wired the money.

The ‘Utility Token’ Myth and the Howey Test

Calling a token a “utility token” does not get you out of securities law. The label describes what the token might eventually do. It says nothing about what you are actually selling when you take money to build the thing.

The Howey Test controls that classification, and it does not care about the label on the asset. It cares about the economic reality of the transaction. During the fundraising phase, that reality is almost always an investment contract.

How Founders Misunderstand Utility

Founders want the utility-token theory to be true because a security is expensive to sell correctly. Compliance, disclosure, verification, and legal drafting all cost money and slow the raise down. If the token is “just software access,” none of that applies, and you can sell to anyone.

That is the trap. The SEC rejects this premise aggressively at the point where it matters most, which is when you are raising capital.

The problem is timing. When you sell a token to fund the development of a network, the utility does not exist yet. You are not selling access to a working product. You are selling the promise that you will go build one, and that the token will be worth something when you do.

A token that has real, present-day utility in a live network is a different conversation. But that is not the phase most founders are asking about. They are asking about the raise, and during the raise, there is no utility to point to.

Applying the Howey Test to Pre-Launch Projects

The Howey Test asks whether someone invested money in a common enterprise with an expectation of profit derived from the efforts of others. In plain English, if investors give you money hoping to make a return based on the work you are going to do, you are selling a security.

Walk the elements against a pre-launch project. The investor sends fiat or stablecoins. That is the investment of money. They send it because they expect the token to be worth more once the network is built. That is the expectation of profit. And the network gets built by your team, not by them. That is the effort of others.

All four elements are present. The token is the wrapper. The investment contract is the substance.

If investors are funding the building of the utility, they are buying an investment contract, not a finished product. The fact that the token may someday function inside a working ecosystem does not change what you sold on the day you took their money.

The Consequence of Getting the Classification Wrong

Getting the classification wrong creates two problems, and both are severe.

The first is rescission. If you sold an unregistered security without a valid exemption, investors can demand their money back. This does not come up when the token is going up. It comes up when the token drops, the investors are underwater, and they are looking for a way out. Rescission hands them one.

The second is regulatory enforcement. If the SEC treats your raise as an unregistered securities offering, it can bring an action that freezes the project. That can mean disgorgement, penalties, and injunctions that stop distribution entirely. A project can be technically functional and still be legally dead.

Neither of these risks goes away because you called the asset a utility token. The cleaner path is to accept that the raise is a securities offering and structure it under an exemption from the start.

Why Web3 Marketing Pushes Most Deals into Rule 506(c)

Once you accept that your token raise is a securities offering, the next question is how you are allowed to talk about it. The answer for most crypto projects is Rule 506(c), because the way Web3 projects build community is legally indistinguishable from public advertising.

Regulation D gives you two practical paths: Rule 506(b) and Rule 506(c). The difference between them comes down to one thing – whether you can advertise. And the way founders behave online usually makes that decision for them.

The Strict Limits of Rule 506(b)

Rule 506(b) prohibits general solicitation. In plain English, you cannot publicly advertise the offering.

You can only raise from people you already have a pre-existing, substantive relationship with. That means you knew the investor, and you knew enough about their finances or sophistication, before you offered them the deal. Cold outreach to strangers does not count.

Rule 506(b) also lets you take up to 35 non-accredited investors. That sounds flexible, but it is not. The moment a non-accredited investor is in the deal, you owe them a heavy, mandatory disclosure package – effectively audited-level financials and a full Private Placement Memorandum.

For a pre-launch crypto project with no operating history, producing that disclosure package is difficult and expensive. So even sponsors who could use 506(b) usually do not want the non-accredited investors it allows.

The Discord and Twitter Problem

The bigger issue is that normal crypto community building is general solicitation. Talking about your token sale on X, Telegram, or Discord is advertising to the public.

You do not have to run a paid ad campaign to blow the exemption. A public tweet announcing the raise, a Discord channel discussing the token sale, a Telegram pinned message about the round – each one is a public offer to people you have no relationship with.

And here is the part that catches founders. Once you have generally solicited, 506(b) is gone for that offering. You cannot un-ring the bell. You cannot post about the raise for six months, then quietly switch to a “friends and family” 506(b) round and pretend the public promotion never happened.

For most Web3 founders, the community is the marketing. That behavior and Rule 506(b) cannot coexist.

Defaulting to Rule 506(c)

Rule 506(c) is the practical default for crypto sponsors because it permits general solicitation. You can advertise. You can build a public community and talk openly about the raise.

The tradeoff is strict. Under 506(c), every single investor must be accredited, and you – the sponsor – must take reasonable steps to verify it. Self-certification is not enough. A checkbox on a form does not satisfy the rule.

So the choice for most crypto projects is not really 506(b) versus 506(c). It is whether you are willing to give up public marketing entirely. Most founders are not, which pushes them into 506(c) and its verification burden.

That verification burden is where crypto gets genuinely difficult, because a lot of your investors hold their wealth on-chain, not in a brokerage account.

The Practical Challenge of Crypto Investor Verification

Under Rule 506(c), you cannot just take an investor’s word that they are accredited. You have to verify it with reasonable steps, and that gets awkward when the investor’s entire net worth is sitting in a self-custodied wallet with no brokerage statement behind it.

That is the core problem. The rule was written for a world of bank statements, tax returns, and CPA letters. Crypto wealth does not always come with any of those.

Why Traditional Verification Fails in Web3

The usual 506(c) verification path relies on third parties. You ask the investor’s CPA, attorney, or broker to write a letter confirming income or net worth, or you review their financial statements yourself.

That path breaks when the assets are held in cold storage. Many CPAs and attorneys will not sign a verification letter for a wallet they cannot tie to a custodial statement, because they have no independent source to confirm the holdings. They do not want the liability of vouching for a balance they cannot audit.

And you cannot fall back on self-certification. Letting the investor check a box that says “trust me, I’m accredited” is exactly what 506(c) prohibits. If that is your verification file, you do not have a verification file.

Handling On-Chain Asset Verification

Verifying self-custodied crypto is doable, but it takes specific steps. The point is to prove three things: the investor controls the wallet, the wallet held enough value on a given date, and that value clears the accreditation threshold in dollars.

Ownership is the first piece. The investor can prove control of a wallet by signing a message with the wallet’s private key without ever revealing that key. The signature confirms they hold the keys to that address. That ties the person to the wallet.

Value is the second piece. You take a point-in-time snapshot of the wallet’s balances on a public block explorer as of the verification date. That fixes the holdings to a specific moment instead of a floating number that changes by the block.

Then you convert. You price the tokens in USD as of that same date and add it up. If the net worth clears $1 million excluding the primary residence, or the numbers otherwise meet an accredited category, you document how you got there and keep the file.

None of this replaces standard verification for investors who do hold assets in traditional accounts. It just handles the piece that traditional verification cannot reach.

The Danger of Outsourcing Blindly

Plenty of sponsors hand verification to an automated third-party service and assume the problem is solved. Using a verification provider is fine. Assuming the provider understands crypto is where sponsors get hurt.

Many of these tools were built for W-2s and brokerage statements. Drop a self-custodied wallet into that workflow and the tool may not actually confirm ownership or price the assets correctly. You end up with a green checkmark that does not prove what you need it to prove.

The liability does not sit with the software. It sits with you, the sponsor and issuer. If the verification was inadequate, you are the one who took the reasonable steps that were not reasonable.

And the stakes are not marginal. If your verification fails, you lose the 506(c) exemption for that offering. Once you have generally solicited, you cannot quietly fall back to 506(b), because the public marketing already closed that door. A broken verification file can unwind the entire raise.

So if you outsource, confirm the provider can actually verify on-chain, self-custodied assets, and keep your own copy of the ownership proof, the balance snapshot, and the dollar conversion. The file is your defense. Build it like you will have to show it to someone later, because you might.

The Anti-Fraud Imperative: Why a Crypto PPM Is Never Optional

Rule 506(c) does not strictly require a Private Placement Memorandum if every investor is accredited. That is the technical answer. The practical answer is that raising crypto capital without one leaves you standing in front of an anti-fraud lawsuit with nothing to point to.

The exemption and the anti-fraud rules are two separate problems. Solving one does not solve the other.

The Gap Between Exemption Rules and Anti-Fraud Rules

Rule 506 answers one question: can you sell this security without registering it with the SEC? If you follow the rule, the answer is yes. That is all the exemption does.

Rule 10b-5 is a different rule with a different job. It says you cannot make a material misstatement or leave out a material fact that makes what you did say misleading.

The two rules do not overlap. You can be perfectly compliant with Rule 506(c) and still lose a Rule 10b-5 case because you failed to disclose something material.

That is the trap. Sponsors think that because the offering is exempt, the disclosure is optional. Exempt from registration is not exempt from fraud liability. Nobody is ever exempt from fraud liability.

The PPM is where you make your disclosures. It is the document that shows what you told the investor and what risks you put in front of them before they wired the money.

Volatility and the Shift of Risk

Crypto assets can lose most of their value in a matter of days. That is not a rare event in this space. It is a normal Tuesday.

When investors lose money, some of them sue. And when they sue, the question is not whether the token dropped. The question is whether you warned them it could.

This is what the PPM does. It is the record that says the investor was told, in writing, that this token could go to zero, that the smart contract could fail, that the regulatory treatment could change. When the plaintiff says “nobody told me this was risky,” the PPM is your answer.

Without it, you are arguing about what was said in a Discord channel or a Zoom call. With it, you have a signed acknowledgment that the investor read the risk factors and understood them.

The PPM does not make the deal safer. It moves the risk of loss back onto the investor who accepted it, which is where the law says it belongs.

The Accredited Investor Discovery Trap

Here is the part sponsors miss, and it applies even to a 506(b) deal you built for accredited investors only.

When a lawsuit starts, plaintiffs’ counsel goes through discovery. They pull the financials of the investors. They are looking for one thing: an investor who was not actually accredited when they came in.

Accreditation is a facts-and-circumstances test, and financials are messy. If even one investor is later deemed non-accredited, and you had no PPM because you assumed everyone qualified, that gap becomes a serious liability. In a 506(b) deal, non-accredited investors trigger mandatory disclosure requirements you never met.

So the “we only took accredited investors, we don’t need a PPM” logic breaks the moment discovery finds one person who does not hold up. You do not control that outcome. The plaintiff’s accountant does.

Depending on your investor mix and the facts, a PPM may be legally required. Even when it is not, it is usually the center of your disclosure record. In a crypto raise, where volatility guarantees somebody loses money and somebody sues, going without one is not a shortcut. It is exposure you do not need.

Translating Digital Asset Risks into Legal Disclosures

A standard business PPM does not protect you in a crypto raise. The risk factors that cover an operating company or a real estate deal say nothing about the things that actually go wrong with digital assets. If you drop your token project into a generic template, you have a disclosure record with a hole in it.

The whole point of the PPM is to tell the investor what can go wrong before they wire money. So the risk section has to name the specific ways a digital asset can lose value or disappear entirely. If it does not, the document is not doing its job.

Smart Contract and Code Vulnerabilities

The PPM must warn investors that the code itself can fail. Smart contracts get hacked. They contain bugs. They get exploited by someone who finds a flaw before you do.

This is not theoretical, and investors need to see it stated plainly. The protocol can be drained, the logic can break, and a single overlooked line of code can wipe out the value the investors funded.

The part that surprises people is irreversibility. When a transaction executes on-chain and the code did what it was told, there is usually no undo button. No bank reverses it. No court claws it back easily. The disclosure has to say that when the code fails, the loss can be permanent.

Custody and Loss of Access

The PPM must also disclose that the assets can be lost through custody failure, not just market failure. This is a risk category traditional deals do not have.

If the sponsor holds the private keys and loses them, the assets are gone. There is no password reset for a self-custodied wallet. The same is true on the investor’s side if they take delivery of tokens and mishandle their own keys.

The other side of custody is third-party reliance. If you use a custodian or route assets through a centralized exchange, you have taken on that entity’s solvency and security risk. Exchanges freeze withdrawals. Custodians fail. Investors have watched it happen, and the PPM should tell them the project depends on parties who may not survive.

The Regulatory Horizon

The PPM must disclose that the legal ground can shift under the project. What is permitted today may be classified differently tomorrow.

The SEC or another agency can change how it treats a digital asset. A token that trades freely now can be reclassified in a way that freezes the project or makes it functionally illegal in certain jurisdictions. That is a live risk, and investors should be told the classification is not settled.

Tax treatment carries the same uncertainty. How digital assets are taxed keeps moving, and neither the sponsor nor the investor can promise how it lands. The honest disclosure is that the rules are unsettled and could change in ways that hurt the investor’s return. Say that, rather than pretending there is more certainty than there is.

The Mechanics of the Raise: SAFTs, Equity, and Entity Structure

Once you accept that the raise is a securities offering, the next question is what you are actually selling. In practice, sponsors do one of two things: they sell equity in an operating entity, or they use a SAFT to bind the investment now and deliver tokens later. Either way, the investor is buying a security governed by the documents you sign.

The Role of the Operating Entity

Crypto is decentralized. The capital raise is not. Somebody has to accept the money, and that somebody is a legal entity.

You form an LLC or similar entity to act as the issuer. That entity is what signs the documents, holds the funds, and does the work of building the project.

The Operating Agreement controls how you run it. It defines your authority as the manager, how you deploy the capital, and how the economics flow. In plain English, it is the document that says what you are allowed to do with the money after it comes in.

Do not skip this and try to raise into a wallet or a foundation you have not properly papered. The issuer needs to be a real entity with a real governing document, because that is who is on the hook to the investor.

Structuring with a SAFT

A SAFT is a Simple Agreement for Future Tokens. The investor gives you fiat or stablecoins now, and in exchange gets a contractual right to receive tokens later, once the network or protocol actually exists.

The point of the SAFT is to separate two things that people tend to blur together. The capital raise is a security, full stop. The token delivered down the road is something you hope will function as a usable asset by the time it exists.

The SAFT is the security. It is the investment contract you are actually selling under Regulation D. The token is what gets delivered on the back end.

I would not treat a SAFT as a way to dodge securities law. It is not. It is a way to structure the security honestly while you build the thing the token is supposed to do.

Finalizing the Subscription Process

The execution steps are the same as any other Reg D offering, with a crypto-specific verification layer on top.

The investor reviews the offering documents, including the PPM where you have one. They complete KYC and AML checks. They sign the Subscription Agreement, which is the document that actually admits them into the offering and confirms their representations, including accreditation.

Under Rule 506(c), verification happens here too. You confirm the investor is accredited through reasonable steps before you let them in, not after.

Capital moves last. Only after the documents are signed and verification is complete does the investor transfer funds into the entity. Do it in that order. Taking money before the paperwork and verification are done creates a problem you do not need.