SEC Regulation Crypto Assets: Reporting & Audit Guide
On August 18, 2026, the SEC proposed Regulation Crypto Assets, a new set of rules that would let token projects raise money from U.S. investors without going through a full securities registration. Most of the coverage will focus on how much you can raise. This article focuses on what happens after the raise closes: the financial statements, audits, and ongoing reports your finance team will actually have to produce.
What the SEC is Proposing
Regulation Crypto Assets is a new, self-contained section of the SEC’s rulebook that governs the sale of tokens.
Here is the part that sounds contradictory but matters: the token itself is not treated as a security. What the SEC regulates is the deal you make when you sell it… meaning the promises you make to buyers about the work you will do to build the project. That deal is what needs the exemption. Put simply, you are not registering the token; you are getting permission for the way you sell it. For measurement, one unit of the deal equals one token, so a token sale can be tested against a dollar limit.
These rules only cover a clean token sale. If you bundle the token with a share of stock, a loan, or a warrant in the same deal, you fall outside the rules entirely.
There is also an exit. Once you have finished or permanently stopped the work you promised investors, you can file a Form TR (see below) certifying so. At that point the SEC treats the deal as over, and the token is no longer tied to the security. This is the off-ramp the industry has wanted for years.
This is still a proposal, not a final rule. The public has 60 days from official publication to comment, and the details can change.
Core Requirements at a Glance
| undefined | Startup Exemption | Fundraising Exemption - Tier 1 | Fundraising Exemption - Tier 2 |
|---|---|---|---|
| Offering Cap ($) | $5M total over a four-year window (one use per token) | $20M per 12 months | $75M per 12 months |
| Offering Document | Form NOR plus website disclosure | Form 1-CRYPTO offering statement | Form 1-CRYPTO offering statement |
| Financial Statements | Not Required | Two years of U.S. GAAP | Two years of U.S. GAAP |
| Financial Audit | Not Required | Not Required | Required by an Independent Auditor |
| Ongoing Reporting | Form TR at 4 Year Mark, no periodic reports | Form 1-KC (annual), 1-SC (Semi-annual), 1-UC (Ad Hoc) | Same as Tier 1 |
| State Registration REquirements | Overridden (Rule 500) | Overridden (Rule 500) | Overridden (Rule 500) |
Key Filings, Forms, and Terms
A few terms and forms are used throughout this article. Here is what they mean:
Form NOR (Notice of Reliance) — the short notice you file before you start selling, telling the SEC you are using the Startup Exemption. It is not a disclosure document itself — its main job is to point to the public website where your required disclosures live. You file it before your first sale, every person or entity behind the project signs it, and you update it if anything material changes.
Form 1-CRYPTO — the full offering document for the Fundraising Exemption, and the heaviest filing in the regime. It brings together ten plain-language disclosures about the project — the deal terms, the token and its economics, the team and their conflicts of interest, the network and your development plan, security and source code, governance, the wider ecosystem, and risk factors — plus a written discussion of your financial condition and your financial statements (two years of U.S. GAAP, audited for Fundraising - Tier 2 Exemption). It is filed publicly on the SEC's EDGAR system before you can sell.
Form 1-KC — your annual report, due 120 days after your fiscal year end. It refreshes almost all of the disclosures from the offering document, the Form 1-Crypto (everything except the pitch for the offering itself) and includes a full, updated set of financial statements — audited if you are Tier 2. It has to be signed by the company, your CEO, CFO, and chief accounting officer, and a majority of your board.
Form 1-SC — your semiannual (twice-a-year) report, due 90 days after the mid-point of your year. It is a lighter check-in: an update on the token and your progress against the development plan, a short discussion of the period, and condensed mid-year financials that are neither audited nor reviewed. It does not require board signatures.
Form 1-UC — your current report, filed within four business days whenever something significant happens. The triggers are specific: signing or losing a contract the business depends on, a bankruptcy, a change of control, a change in token holders' rights, the departure of your CEO, CFO, or chief accountant, switching auditors, or concluding that past financial statements can no longer be relied on. When the trigger is a contract, you also have to attach the contract itself.
Form TR (Transition Report) — the filing that ends your obligations under an exemption. For the Startup Exemption, you file it by the four-year mark to close things out. Under the Fundraising Exemption you also use it to exit — either to claim the safe harbor (certifying, with a supporting analysis, that you have finished or permanently stopped the work you promised investors, so the token is no longer tied to an investment contract) or to formally switch off your ongoing reporting.
Regulation S-X — the SEC's rulebook for how financial statements must be built and presented — which statements you include (balance sheet, income, cash flows, and changes in equity), how many years you show, how mid-year periods are handled, and the independence and reporting standards your auditor must meet. Tier 2 issuers follow it in full; Tier 1 issuers largely do not have to.
Rule 500 — the provision that lets you skip registering your offering state by state. It treats your investors as “qualified purchasers” under federal law, which puts federal rules in control and overrides the state process. It covers both exemptions — and even later trading of the token — as long as you stay current on your SEC filings.
“Blue sky” laws — the informal name for state-level securities laws (the term comes from early laws aimed at schemes backed by nothing but “so many feet of blue sky”). Historically, an offering had to clear regulators in every state where it was sold. Rule 500 overrides that for these offerings, so you deal with the SEC federally instead of with all fifty states.
The Startup Exemption: $5 Million Over Four Years
The Startup Exemption is the lighter path. You can raise up to $5 million in total over a four-year window, and you can only use it once for a given token — you and anyone affiliated with you cannot run a second Startup Exemption raise for the same or a similar token.
The paperwork is minimal. You file a Form NOR before you begin, post your required disclosures on a public website, and file a Form TR by the four-year mark to close everything out. Under this exemption there are no financial statements, no audit, and no periodic reports to file.
One thing to plan for: token giveaways count. Airdrops — free token distributions to users or validators — are treated as part of your offering. They count against the $5 million limit, they have to happen after you file, and they use up your one shot at this exemption. If you plan a small raise now and a larger incentive distribution later, model both against the cap before you file anything.
The disclosures require information you may not have organized yet: your token supply and release schedule, lockups, and holdings by people connected to the project (founders, employees, advisors, contractors, and their families). If your cap table, vesting schedule, and treasury wallets are spread across several different spreadsheets and tools, this is the point at which you will need to consolidate them into a single source you can publish and keep accurate.
The Fundraising Exemption: $20 Million (Tier 1) or $75 Million (Tier 2)
These offerings are open to the public. Both exemptions allow general solicitation, so an issuer can market the sale openly rather than quietly to a private list of insiders. Who can actually buy, and how much, depends on which exemption you use.
Under the Startup Exemption, anyone can buy, including ordinary retail investors. There is no accreditation requirement, no limit on how much any one person can invest, and the tokens are not locked up as “restricted securities.”
Under the Fundraising Exemption, both accredited and non-accredited investors can buy, but non-accredited investors are capped. In any single offering, a non-accredited person cannot invest more than 10% of the greater of their annual income or net worth (for a company, 10% of the greater of its revenue or net assets). Accredited investors — broadly, people with over $200,000 in annual income, or over $1 million in net worth excluding their home, among other ways to qualify — have no cap. The issuer can rely on the buyer’s own statement of income or net worth. This 10% limit applies to both Tier 1 and Tier 2.
The practical significance is that everyday investors can take part. Unlike a private placement, which is effectively limited to accredited investors, these offerings let the general public in — with the 10% cap as the guardrail for non-accredited buyers on the fundraising side, and no cap at all on the smaller startup side.
Once tokens are in investors’ hands, they can trade in the secondary market. While a token is still tied to its investment contract, those secondary trades are treated as securities transactions — but the proposal overrides state “blue sky” registration for trades by anyone other than the issuer, an underwriter, or a dealer, for as long as the issuer stays current on its SEC filings. Fall behind on your reports and you put that secondary-trading relief at risk.
The rules do not prohibit listing these securities on a registered national securities exchange, and they reference that possibility. But even a token listed on an exchange would still carry the 10% cap for non-accredited buyers — the proposal deliberately does not exempt exchange-listed securities from the investment limit.
The picture changes once a project reaches the finish line. When the issuer files its Form TR and meets the safe harbor — certifying that it has completed, or permanently stopped, the work it promised investors — the SEC treats the investment contract as gone and the token as no longer a security on that basis. From that point the token can trade freely, like any ordinary crypto asset that was never a security.
The Reporting Calendar
This is the part most finance teams underestimate. Once you use the Fundraising Exemption, you report on a public-company-style schedule, and you keep reporting indefinitely — until you formally suspend or exit.
There are three ongoing reports. The annual report (Form 1-KC) is due 120 days after your fiscal year end. The semiannual report (Form 1-SC) is due 90 days after the mid-point of your year. The current report (Form 1-UC) is due within four business days of a major event — things like a change of control, a bankruptcy, the departure of your CFO, or signing a contract the business depends on.
The annual report is the heavy one: it refreshes almost all of your disclosures plus a full set of financial statements. The semiannual report is lighter, with condensed mid-year numbers.
Form 1-KC (annual report) — once a year, due 120 days after fiscal year end; full financial statements, audited if Tier 2
Form 1-SC (semiannual report) — twice a year, due 90 days after your fiscal mid-point; condensed, unaudited and unreviewed
Form 1-UC (current report) — as needed, within four business days of a triggering event (change of control, bankruptcy, CFO departure, auditor change, material contract signed or lost, restatement)
Form TR (transition report) — once, when you exit: to claim the safe harbor or switch off ongoing reporting
The Financial Audit Requirements
This is where the two tiers really differ.
Fundraising - Tier 1: no audit is required. But there is a catch worth planning around. If you get an audit for any other reason — because an investor, a lender, or a foreign regulator requires it — you have to file that audited statement with the SEC anyway. So the real question is not whether to file an audit; it is whether you are going to be an audited company at all. Once the answer is yes for any reason, assume the result will be public and scope the audit accordingly.
Fundraising - Tier 2: your financial statements must be audited. You can use either U.S. auditing standards (GAAS) or PCAOB standards, and your auditor has to be independent under the SEC’s standard. The auditor does not have to be registered with the PCAOB.
A practical tip: if you might move from Tier 1 to Tier 2 later, or your voluntary audit might need to support a future raise, hold your auditor to the SEC’s independence standard from the start, so you do not discover a gap in the middle of a raise.
Who Prepares These Filings?
A Form 1-CRYPTO is not a one-person, fill-in-the-blanks form. It is a team production, and knowing who owns which piece is often the difference between a raise that stays on schedule and one that slips two quarters.
Securities counsel usually quarterbacks the offering statement. They own the legal disclosures and the judgment calls — the contract terms, the risk factors, the eligibility and bad-actor analysis, conflicts and governance, the mandatory cover-page legends, and the exhibits — and they make sure the filing complies with the rule and is submitted correctly on EDGAR.
The company supplies the substance only it has. Most of the token-specific narrative comes from the founders and the engineering team: token economics, supply, allocations and vesting, the network and its development plan, source code, and how governance works.
The finance function prepares the numbers: two years of GAAP financial statements, the written discussion of financial condition, and the crypto accounting policies that GAAP has not fully settled — how you recognize your own token, when you derecognize tokens leaving treasury, and how you treat wrapped and receipt tokens. For early-stage projects this work is often outsourced, because the books frequently have to be built from wallet exports and a general ledger no one has closed.
For a Tier 2 offering, an independent auditor then audits those financial statements. Because the auditor has to be independent, this must be a different firm from whoever builds the books — the same firm cannot both prepare the financial statements and audit them for the same issuer.
Finally, the company’s officers and board sign the filings and take legal responsibility for them. A Form 1-KC, for example, has to be signed by the CEO, CFO, chief accounting officer, and a majority of the board.
None of this is cheap, and the SEC has put numbers to it. Its own burden estimates put a first Form 1-CRYPTO at roughly $455,500, each annual report at about $381,000, and each semiannual report at about $119,400
What To Do Now
If the Startup Exemption is your likely path, the work is mostly data hygiene: get your token distribution schedule, lockups, insider holdings, and release schedule into one place you can publish and keep updated.
If the Fundraising Exemption is your likely path, start closing your books like a reporting company a full year before you plan to file. You will need two years of clean GAAP financial statements, and the most common reason a first raise slips is that those numbers have to be rebuilt from wallet exports and a general ledger no one closed. Settle your crypto accounting positions early, and decide your tier and audit approach deliberately rather than by default.
If you are looking for a Tier 2 Fundraising Exemption, the time to start vetting and looking for auditors is now, before any potential filing and token sale.
Regulation Crypto FAQ
-
The Startup Exemption lets you raise up to $5 million over four years with no financial statements, no audit, and no ongoing reports — and you can use it only once per token. The Fundraising Exemption is the heavier regime: up to $20 million under Tier 1 or $75 million under Tier 2 in any 12-month period, with full financial statements and ongoing annual, semiannual, and current reports. Between the two fundraising tiers, the main difference in burden is the audit — Tier 1 and Tier 2 file the same forms on the same deadlines with the same two years of GAAP financials, but a Tier 2 issuer's financial statements must be audited by an independent auditor (and follow the SEC's full financial-statement rules), while a Tier 1 issuer's can be unaudited. Moving from Tier 1 to Tier 2 lifts your cap from $20 million to $75 million but adds the cost and rigor of an audit on top of an otherwise identical reporting load.
-
Yes. Under the Startup Exemption there is no limit on how much any one person can invest. Under the Fundraising Exemption, non-accredited investors are capped at 10% of the greater of their annual income or net worth per offering, while accredited investors have no cap.
-
For the Fundraising Exemption, yes — you have to be organized in the United States, run the business mainly from here, keep most of your assets here, and have a majority of your officers or directors who are U.S. citizens or residents. The Startup Exemption does not impose that U.S.-nexus requirement.
-
Yes. Under the Startup Exemption, free token distributions to users or validators are treated as covered transactions: they count toward the $5 million cap, they have to happen after you file, and they use up your one-time use of the exemption.
-
No — but if you obtain an audit for any other purpose, you have to file it with the SEC anyway.
-
No. The Startup Exemption requires no financial statements at all — and therefore no audit.
-
No. The audit can follow either U.S. auditing standards (GAAS) or PCAOB standards, and thedoes not have to be registered with the PCAOB. What matters is that the auditor is independent. The SEC has asked for comment on whether to require PCAOB registration, so this could change.
-
No. It is a proposal issued August 18, 2026, open for public comment for 60 days. The details may change.
Why This Work Needs a Crypto-Native Firm
Everything in this proposal comes down to three things a token project has to get right: specialist accounting judgment, books that are clean and defensible, and formal filings that hold up under SEC review. The hardest parts are not the forms — they are the accounting and audit requirements. How you recognize a token at a generation event, how you account for a stablecoin, and how you treat wrapped, staked, and receipt tokens are exactly the areas where GAAP is still unsettled, and a wrong call today tends to resurface later as a restatement.
This is not work for a generalist firm. A traditional accounting or audit practice can read the rules, but it has not lived through a token generation event, closed the books off on-chain wallet data, or defended a digital-asset treatment to a regulator. Whether you need your books built or a formal audit signed, you want a firm that understands digital assets at the ledger level… not one learning the space on your engagement.
That is exactly what The Network Firm does. As the largest crypto-focused CPA firm in the United States, TNF provides outsourced accounting, financial statement audits, proof-of-reserves attestations, and crypto tax advisory to digital asset companies — exchanges, custodians, stablecoin issuers, miners, and token projects — building the books and setting the accounting policies that filings like these depend on. If you are weighing a raise under Regulation Crypto Assets, or you just want to know whether your books would survive an offering statement, talk to a TNF expert.
Author Bio:
Jeremy is a founding member and audit partner at The Network Firm and co-creator of LedgerLens, a suite of digital asset-focused audit and attestation tools. Jeremy holds credentials as a Certified Public Accountant (CPA), Certified Management Accountant (CMA - inactive), and Certified Bitcoin Professional (CBP).
Over his 10-year career, including 7 years focused on digital assets, Jeremy has led audit and attest engagements across various industry niches, including exchanges, custodians, miners, token projects, wallets, payment processors, and stablecoins. Jeremy specializes in “Proof of Reserve” engagements.
Jeremy’s goal is to shape the future of the accounting profession, strengthened by verifiable, transparent, and trusted blockchain ledgers.
Connect with Jeremy Nau on LinkedIn/Twitter for more expert advice.