The SEC's New Crypto FAQ Is a Reference, Not a Shield

A document with zero legal force just repriced sentiment across the entire U.S. crypto complex. The SEC published a new crypto FAQ. Within hours, timelines filled with threads calling it a "regulatory thaw." Renato Mariotti — former federal prosecutor, now a white-collar defense attorney — punctured that in a single phrase: a reference, not a shield. He is correct. The market's willingness to treat a staff memo as a safe harbor is the actual event worth analyzing. I have spent two decades reading enforcement actions instead of press releases. Hype is a mask; the ledger is the face beneath it. So let me be precise about what the SEC actually issued. The SEC's crypto FAQ is staff guidance. Not a rule. Not a statute. Staff guidance does not pass through the Administrative Procedure Act's notice-and-comment process. It carries no binding legal weight. This distinction is not academic — it is the entire story. The history is unambiguous. In 2017 the SEC's DAO Report asserted that certain tokens were securities. In 2018, then-Director of Corporate Finance William Hinman gave a speech suggesting that Ether, at least, was not a security. In 2019 the agency published its Framework for "Investment Contract" Analysis of Digital Assets. None of these were rules. Courts have treated them accordingly. The Ripple litigation made this explicit. The court there held that Hinman's speech did not constitute law. It was one official's view, not a binding norm. That ruling is the template. It tells you exactly how much protection a FAQ provides: essentially none. So when Mariotti says the FAQ is a reference rather than a shield, he is not being contrarian. He is describing settled administrative law. A company can cite the FAQ as a compliance compass. It cannot cite the FAQ as a defense after the SEC sues. "I followed the guidance" is not a legal argument. It is a confession that you never got an actual opinion. This matters because the crypto market has a persistent habit: it prices regulatory vibes as if they were regulatory facts. Numbers have no emotions, only consequences. The consequence here is a gap between what the FAQ appears to promise and what it can legally deliver. Let me dissect the mechanics, because the mechanics are where the risk lives. First, the instrument hierarchy. A statute is passed by Congress. A rule is issued by the Commission through APA notice-and-comment. Staff guidance — bulletins, FAQs, frameworks — is issued by employees. It is advisory. It binds no one, including the SEC itself. When enforcement and guidance conflict, enforcement wins. Every time. Second, the defense stack that actually works. If you want legal protection, you do not collect FAQs. You collect one of three things: a formal no-action letter, where SEC staff commits not to recommend enforcement if you act as described; a formal exemptive order; or a well-reasoned legal opinion from counsel. Each of these is specific, documented, and defensible. A FAQ is none of these. I learned this lesson the hard way in a different domain. During the Compound oracle exploit in 2020, I reverse-engineered a price feed that relied on a single low-liquidity DEX pair. A $1 million attack skewed the feed 15%. The protocol had documentation claiming the oracle was "robust." Documentation is not a control. A FAQ is not a control. Both are descriptions of intent, and intent does not survive contact with an adversary. Third, the enforcement asymmetry. The SEC can publish a friendly FAQ on Monday and file a Wells Notice on Friday. Nothing in the FAQ prevents that. The agency's guidance is not a contract; it is a mood. A mood can change with a leadership transition, a political cycle, or a single high-profile case. Now connect this to the market. If traders read the FAQ as a "regulatory thaw," they are front-running a promise that was never made. The expected value of that trade is negative, because the downside — a subsequent enforcement action that ignores the FAQ — is asymmetric and sudden. Here is the piece most analysts miss. The FAQ's real function is informational, not legal. It reduces information asymmetry about how staff currently thinks. It does not reduce legal risk. Those are two different variables, and the market routinely conflates them. Reducing uncertainty about the SEC's view is not the same as reducing the probability of being sued. One is a data point. The other is a liability. The FAQ improves the former and leaves the latter untouched. I saw the same conflation in the FTX collapse. Audited financials, regulatory licenses, celebrity endorsements — all presented as shields. None were. I reconstructed the fund flows myself, tracing $1.8 billion in commingled customer assets to Alameda's offshore wallets. The paperwork looked reassuring. The ledger told the truth. Every transaction leaves a scar on the chain. The FAQ leaves no scar. That is the point. It commits to nothing, so it can be repudiated at will. But let me steelman the bulls, because they are not entirely wrong. The FAQ does represent marginal improvement. A year ago, the SEC's position on most crypto questions was pure opacity. Companies guessed. Now there is at least a published reference point. Moving from "no signal" to "a soft signal" is progress, even if the signal is non-binding. The bulls also correctly identify direction. Regulatory posture is warming. Enforcement priorities are shifting. Leadership has changed. That trajectory is real, and it is tradeable. Where the bulls err is magnitude. They treat a posture shift as a legal guarantee. They are pricing a mood as a contract. And a mood, by definition, has no enforceability. A second-order effect matters here. If the FAQ is genuinely useful, it raises the value of formal relief. Companies that want real protection will now pursue no-action letters and exemptive orders rather than leaning on a memo. That is a healthy migration — from vibes to instruments. The FAQ may accidentally push the industry toward better legal hygiene. The clearest example of a real moat is the one nobody wants to cite. After its $4.3 billion settlement, Binance did not shrink — it entrenched. Regulatory licenses became its deepest defense. New entrants cannot buy that ticket at any reasonable price. That is what durable compliance looks like: expensive, specific, and documented. Not a FAQ. So watch the instrument, not the headline. If the SEC's FAQ is later formalized through notice-and-comment, it upgrades from reference to rule, and the legal-certainty premium finally becomes real. Until then, treat every "SEC is friendly now" thread as what it is: sentiment wearing a suit. The reference card tells you how staff thinks. It does not tell you whether you will be charged. Those are different ledgers. Only one of them is audited.