On Immutability & Control

Who controls the assets? Who makes the investment decisions? Who can change the rules? Is a design immutable?

These are natural questions to ask when evaluating how the federal securities laws apply to a new financial arrangement. The authority to act on behalf of others can create conflicts of interest, information asymmetries, and opportunities for misuse of investor assets. Securities regulation has long sought to address these risks.

As blockchain technology increasingly allows financial activity to occur through shared infrastructure, automated processes, and distributed decision-making, control has become an attractive organizing principle for regulatory analysis. It offers a seemingly intuitive way to distinguish arrangements that depend on human discretion from those governed by predetermined rules.

Control undoubtedly matters in securities law analysis. But making it the dividing line for regulation risks replacing distinct statutory requirements with a single, overly broad inquiry. It can also obscure the legal and economic relationships that Congress chose to regulate.

This was precisely the shortcut we sought to avoid in Veda’s recent submission with our industry partners to the SEC.

The economic rationale is not the legal test

The concept of control, also known as the principal-agent problem in law, offers a useful way to understand many of the protections established by the federal securities laws. When someone entrusts capital to another who possesses superior information or discretion over its deployment, the resulting relationship can create risks that warrant regulatory oversight.

But an economic explanation for why regulation may be desirable cannot substitute for the precise statutory requirements that determine when it applies. Consider the different inquiries under the federal securities laws:

Under Howey, reliance on another person’s essential managerial efforts is relevant to whether an investment contract exists. But the investor must also have invested in a common enterprise such as an underlying business venture. The existence of managerial discretion, standing alone, does not establish that element.

Under Reves, the threshold question is whether an instrument constitutes a note and, if so, whether it is properly characterized as a security under the relevant factors. The degree of control exercised over the underlying assets does not resolve that inquiry.

The Investment Company Act requires identifying an issuer and determining whether its activities or assets satisfy the relevant statutory definitions. The Investment Advisers Act illustrates a different distinction: a person may exercise investment discretion without possessing custody of client assets.

These distinctions exist for good reasons. Each statute addresses particular relationships and risks through different legal requirements. A framework organized primarily around control risks collapsing those separate inquiries into a single question that Congress did not establish as the governing test.

Control is not always a single power

The difficulty is compounded by the fact that control can mean very different things in decentralized, blockchain-based arrangements.

A person may have authority to select investments without being able to withdraw assets. Another may possess administrative powers over software while lacking the ability to redirect funds. Investors may retain enforceable redemption rights while delegating investment decisions to a third party. And control can be exercised in constrained ways, such as through decentralized governance or subject to notice and an opportunity to exit.

Think of an investment adviser who exercises discretion over a client’s securities portfolio held in an independently custodied, separately managed account. The adviser may be regulated under the Advisers Act, but it does not necessarily follow that the arrangement involves an investment contract under Howey, creates an investment company, or gives the adviser custody of client assets.

Conversely, an investment company may issue securities representing interests in a portfolio governed entirely by a predetermined, fixed investment strategy. That doesn't mean the arrangement falls outside of the securities laws.

The presence of control does not necessarily establish that the securities laws apply, just as its absence does not automatically establish otherwise. Treating control as the dividing line can therefore prove too little or too much. 

The risk of creating perverse incentives

There is also a practical consequence worth considering. If discretionary control or immutability becomes the principal determinant of securities law coverage, developers may have incentives to eliminate meaningful human oversight or constrain it as much as possible to obtain a more favorable regulatory classification.

Consider a curator responsible for managing a vault’s investment strategies. The curator might have authority to replace a compromised strategy, respond to an emerging exploit, or adjust allocations within predetermined limits. Those powers could be valuable safeguards for users, even where the curator cannot withdraw user assets, redirect them for its own benefit, or override programmatically enforced restrictions.

Similar considerations arise with decentralized lending protocols. Protocol governance may retain limited authority to adjust collateral parameters, respond to oracle failures, or pause certain functions during a security incident. Such powers can introduce risks of their own, depending on who exercises them and how they are constrained. But eliminating those powers entirely may also leave users exposed to vulnerabilities that could otherwise have been addressed.

A framework that treats the absence of discretionary control as a prerequisite for avoiding securities regulation could encourage developers to eliminate useful safeguards, even where carefully constrained intervention would better protect users.

Immutability can protect users from arbitrary changes and misuse of authority. But removing the ability to respond to unforeseen risks can create vulnerabilities of its own.

The converse problem also exists. An arrangement may involve little ongoing human discretion while still creating the legal and economic relationships that securities regulation is designed to address. Automation alone does not eliminate the existence of an issuer, an investment contract, or an investment company.

The objective should be to encourage structures that appropriately protect investors while applying the law faithfully to the relationships they create. A control-centered approach risks distorting product design around regulatory classification rather than the goal of investor protection.

Start with the law

This concern informed the approach we took in Veda’s recent SEC submission examining how the federal securities laws apply to decentralized lending protocols and vaults.

We began with the elements of each statutory test, then examined the rights, obligations, economic exposures, and effective powers of the relevant participants. Control was an important part of that analysis because it helped establish what each participant could do and what risks those powers created. But its legal significance depended on the requirements of the particular statute, and it had to be considered alongside other required elements of the laws.

The desire for clear and administrable regulatory standards is understandable, particularly as financial technology evolves. Regulators and market participants alike benefit from frameworks that can be applied consistently across new arrangements. And the industry as a whole benefits when advocates preserve the least restrictive arguments possible that are grounded in the law, especially in areas where the technology is rapidly evolving, business models are diverse, and the law is unsettled.

The challenge is to develop those frameworks while preserving the distinctions that make the law coherent. As technology increasingly separates functions once performed by a single intermediary, these distinctions will become more consequential. Arrangements involving similar financial activities may create fundamentally different legal relationships, while arrangements with different allocations of control may nevertheless satisfy the same statutory requirements.

Control matters. But understanding what someone can do is only part of the legal inquiry. The question is what rights, obligations, and relationships the arrangement creates, and what the law requires of them.