On November 2, 2026, the SEC's Division of Corporation Finance added new answers to its crypto assets FAQ, addressing when a network's governance counts as decentralized rather than merely functional — confirmed by the SEC's own CorpFin Crypto Assets page, which lists a FAQ document dated November 2, 2026. The FAQ was first issued September 25, 2026, building on a March 17, 2026 interpretive release that defined a "central party" as a person, entity, or group with operational, economic, or voting control over a crypto system, per Lowenstein's client alert on the original release. The new, governance-specific answers — numbered 1.4 to 1.6 in crypto.news's read of the update, corroborated by CoinGabbar — hold that ordinary participation in a token vote does not, by itself, turn unrelated holders into a controlling group, and that a network can be functional (usable as intended) without being decentralized, because operational, economic, or voting power can stay concentrated regardless of how the product works day to day. The inquiry turns on who can admit or exclude users, change upgrade rules, control validators, or modify code — a token vote is one input, not the answer — and on where voting power actually sits once holders delegate it, which raw token distribution alone doesn't show. As with the rest of the FAQ, this is staff guidance only: crypto.news describes it as carrying "no legal force and no new obligations," and the Commission has neither approved nor disapproved its contents.

This FAQ answers a securities-law question — does the asset's governance structure invite hard gate 7, the unregistered-security / regulatory-kill profile — and that question is binary: the gate is tripped or it isn't. Security, Decentralization & Durability, one of the six weighted dimensions, asks a related but different question on a 0–18 scale: how concentrated is operational, economic, and voting control, measured through node count, client diversity, governance structure, and audit history. Both tests look at the same underlying fact pattern — who actually controls access, code, and validators — but they don't collapse into each other. A network could clear the SEC's facts test for "no central party" and still score poorly on this dimension, if the reason no single entity controls it is that control is split among a handful of entities rather than genuinely distributed. Clearing a legal test isn't a framework input; only the underlying facts are, and the facts the SEC wants now are close to the ones this dimension already has to chase down asset by asset.

The delegation point is the sharper half of this update. Most of what circulates as decentralization evidence — snapshot token distribution, a Gini coefficient (a standard measure of how unequally something is spread across holders) on wallet addresses — measures who owns a governance token, not who votes it. Once holders delegate voting weight, which most governance systems now allow by default, ownership concentration and voting concentration can diverge in either direction: a widely held token can still have its votes routed through a small number of delegates, while a concentrated token can have its votes genuinely diffused through delegation. The SEC's answer makes that distinction part of a securities-law facts inquiry; it's independently the harder half of measuring decentralization for any purpose, including this one — and it's evidence this dimension mostly can't get today, because most protocols don't publish delegate-level voting data the way they publish token distribution at mint.

There's a connection worth naming to the August 18 proposal covered here: proposed Rule 400's safe harbor turns on an issuer certifying it has permanently ceased "essential managerial efforts." That read concluded a Form TR certification is a claim, not a measurement. This FAQ doesn't change that verdict — it's a staff view with no legal force, two steps removed from an adopted rule — but it sharpens what a certification would need to show to be checkable at all: not just "we stopped managing," but who, specifically, still holds the keys to access, code, and validators, and where delegated voting power actually sits. A clearer question isn't the same as an answered one.