— Why the SEC Needs a Regulatory System Built to Iterate in the Age of AI and Crypto
In 2026, the U.S. Securities and Exchange Commission (SEC) has clearly changed its approach to crypto-asset regulation. On August 18, the SEC proposed “Regulation Crypto Assets” [1], a tailored offering framework for certain investment contracts involving crypto assets. The SEC Crypto Task Force has also continued its work on questions including asset classification, trading, custody, tokenization, and market structure [2].
That is progress. But a more basic question has not yet been discussed enough.
AI and crypto are not simply creating a few new kinds of assets. They are changing how facts are created, recorded, and proven, and they are changing how organizations and credit are formed. If we keep forcing new things back into old categories such as securities, commodities, banks, and exchanges, the categories may become more detailed without answering the most important question: when facts that once could only be backed by institutions can now be verified continuously and at much lower cost, should regulation itself change as well?
We call this question “verifiable regulation.” It is not an argument for stricter or looser regulation. It is a way of asking why regulation exists in the first place, and which parts of the existing structure remain necessary when the underlying technical conditions change.
1. Why Traditional Regulation Became So Complex
Regulation exists, of course, to prevent fraud, protect investors, preserve market integrity, and contain systemic risk. But there is another practical reason why traditional finance developed so many licenses, audits, disclosures, institutional divisions, and after-the-fact enforcement mechanisms: ordinary market participants could not independently verify many of the facts that mattered.
Depositors could not know whether a bank’s assets were really there. Investors could not independently confirm every line of a public company’s financial statements. Customers could not see whether an exchange was matching orders fairly. Regulators themselves could not continuously inspect every transaction and every internal process at every institution.
Under those conditions, society built a long chain of banks, broker-dealers, exchanges, custodians, clearing systems, auditors, regulators, and courts. Institutions checked institutions, reducing the room for any single organization to abuse its position.
Organizations are themselves sources of power. Traditional systems restrain that power mainly through institutional checks and balances, but the cost is more layers, longer supervisory chains, and substantial social overhead. Bitcoin suggests another possibility: checks do not always have to come only from formal institutional separation. Developers can propose and publish new versions; miners and nodes can choose whether to adopt them; users can express judgment through their own choices. Public rules, choice, and exit can all constrain power. Bitcoin is not a system without power; it places part of the constraint on power in rules and market choice. Where key facts can already be independently verified, it is worth asking whether regulation can rely somewhat less on organizational checks and somewhat more on rule-based and choice-based constraints.
Traditional checks and balances are not obsolete. On the contrary, they were an intelligent response to an era in which facts were difficult to verify independently. In Verifiable Thought (《可验证思想》), this idea is summarized in one sentence: regulation uses organizational cost to compensate for verification cost. Digital records, cryptographic signatures, hashes, real-time APIs, and AI are now lowering verification costs together. When the underlying cost structure changes, the institutions built on top of it deserve another look.
2. Transparency Is Not the Same as Verifiability
For years, earlier work in this project used terms such as “transparent banking,” “transparent finance,” and “transparent stablecoins.” In May 2026, those ideas increasingly converged around a more precise concept: verifiability. The change in language made several previously separate problems easier to connect.
Transparency asks: can I see it? Verifiability asks: can I independently confirm it? Those are not the same thing.
An institution can publish hundreds of pages and still leave readers dependent on its own numbers. In that case, transparency has not solved the source-of-credit problem. Conversely, a system does not need to expose every trade secret, customer record, or trading strategy. It only needs to let the appropriate parties verify the necessary facts under the appropriate permissions.
Verifiability, then, is not a demand that everything be public. It is an effort to replace “you have to trust me” with “you can check this for yourself” wherever that is feasible.
This eventually reaches the question of credit. We are not arguing that personal, sovereign, legal, institutional, or brand-based credit will disappear. The point is that society may gain another scalable source of credit: facts are verified; verification gives people reason to believe; belief accumulates into credit and, eventually, consensus. In shorthand: facts — verification — belief — credit — consensus.
This did not become a general institutional model in the past because verification was expensive, slow, and difficult to perform continuously. That condition is now changing.
3. Bitcoin’s Lesson for Regulation Is Not Just “Decentralization”
The most useful lesson Bitcoin offers regulators is not that it created a world without trust. What Satoshi Nakamoto achieved was more specific: some things that once had to be confirmed by trusted third parties could instead be checked against public rules and cryptographic proofs.
The crypto world later developed terms such as “Don’t trust, verify,” trust minimization, public verifiability, zero-knowledge proofs, proof of reserves, and verifiable computation. The labels differ, but they all circle the same problem: how can something that once had to be trusted become something that can be checked?
This is also where misunderstanding begins. Proof of reserves can establish some facts about assets, but it does not automatically prove that liabilities are complete, that an exchange is matching orders fairly, that rules have not been changed quietly, or that customer assets have not been misused. Proving one number is a long way from making an entire system verifiable.
Assets, liabilities, authorization, transactions, clearing, rule changes, and responsibility need to enter a structure that can be reviewed over time. Otherwise, we have simply replaced an old black box with a few sophisticated-looking proofs.
The world is already moving in parts of this direction. The OECD has developed work on regulatory experimentation and ex post evaluation [3]. The UK Financial Conduct Authority (FCA) and the Bank of England have tested machine-readable and machine-executable regulation through Digital Regulatory Reporting [4]. FINRA has built a machine-readable rulebook and rulebook API [5]. The EU Artificial Intelligence Act permits real-world testing of high-risk AI systems under defined safeguards [6]. The OECD is also advancing Law as Code, including questions of authorization, conditions, exceptions, legal hierarchy, time, responsibility, and discretion [7].
These efforts are usually discussed under separate labels: regulatory sandboxes, RegTech, SupTech, Rules as Code, Law as Code, continuous audit, and compliance by design. They look like different projects, but they share a deeper direction: facts that once depended heavily on institutional trust are beginning to move into verifiable structures.
4. The SEC Can Start by Changing the Order of Its Questions
When a new token appears, regulation naturally tends to begin with a familiar question: is it a security? Does it satisfy the Howey Test [9]? If so, the securities-law framework follows.
Howey remains important, and we are not proposing to bypass securities law. But in the age of AI and crypto, the order of the questions may need a small adjustment. Before applying a label, first look at what the thing actually is. Where does its value come from? What rights does the holder actually have? Who has effective control? Do investors depend on the continuing managerial efforts of others? Which critical facts can already be verified independently? Which powers and risks remain invisible or unverifiable?
Once those questions are reasonably clear, entering a securities, commodities, or other legal framework may produce a more stable legal judgment.
Verifiable Thought (《可验证思想》) reduces crypto assets to five basic factual questions: source of value, structure of rights, managerial dependence, degree of verifiability, and traceability of responsibility. These are not new legal labels; they are a factual checklist. Understanding the factual structure before legal classification is more suitable for today’s technology than beginning with a dispute over what something should be called. That is exactly why factual structure should come before the label: new forms of value keep pushing beyond old conceptual boundaries. Native network assets such as Bitcoin and Ether are difficult to describe completely through the single concept of a traditional stock or security, and they cannot simply be valued as stocks.
5. Regulation Should Be Able to Experiment, Fail, and Keep Versions
New technologies, new financial structures, and new AI systems often lack long historical records. When regulators write rules under those conditions, the rules inevitably contain judgment. Judgment is probabilistic, and probabilistic judgment can be wrong.
We therefore favor a smaller-step approach: state the principle, design the smallest workable rule, test it in a limited real-world setting, define the objective, assumptions, observation metrics, risk boundaries, time limit, suspension triggers, and failure conditions in advance, and then compare the results with the original expectations. If it works, expand it. If the assumptions fail, revise it. Some regulatory debates last for years; by the time the rule takes effect, the technical environment may already have changed.
We call this Minimum Viable Regulation. “Experiment” does not mean deregulation. Precisely because experimentation is allowed, the boundaries before the test and the review after it should be clearer than under ordinary rulemaking.
A regulator should also be able to say publicly: “The original assumption was not supported.” A system that can only demonstrate that it was always right will find it difficult to iterate. OECD work on ex post evaluation shows that systematic regulatory review remains far from universal [8].
Experimentation should be paired with versioning. Software does not pretend that v1 will be correct forever, and regulation does not need to pretend that its first version will never change. What matters is that every change leaves a record: why the earlier rule was adopted, what facts were known at the time, what outcome was expected, what actually happened, which judgment failed, and why the next version was different.
This also has a practical legal implication. Later rules and later knowledge should not be projected backward as though people in the past already had them. A reliable regulatory knowledge system must be able to reconstruct the rule in force at the time, the facts then available, the information the regulator could then access, and the formal judgment then given. Knowledge acquired later should not be written back into the past.
6. More Important Than a “Regulatory Operating System” Is Compliance That Can Be Queried and Explained
Today, a company facing a regulatory question often reads rules, hires lawyers, tries to infer the regulator’s view, submits materials, waits, and may only much later learn whether its interpretation was right.
Technology makes another experience imaginable. A company could submit or connect facts about itself that can already be verified. An AI-enabled system could then compare those facts with the rules currently in force and tell the company what appears clearly compliant, what is conditionally compliant, what presents a clear problem, and what cannot be decided by a machine.
If the system identifies non-compliance, it should continue: which fact creates the problem? Which rule, and which version of that rule, applies? What information is missing? If the issue requires legal discretion, the system should say “judgment required” instead of manufacturing a definite answer merely to maximize automation.
The FCA’s Digital Regulatory Reporting work shows that, as an engineering matter, machine rules can be connected directly with firm data [4]. The OECD’s Law as Code initiative similarly treats machine-executable law as an emerging form of public digital infrastructure [7].
Earlier work called this direction a “regulatory operating system.” The name matters less than the change in experience. Regulation could add a layer between rulemaking and enforcement: before something goes wrong, the system tells you where the problem is, why it is a problem, and what can be changed. That would alter the relationship between regulators and market participants.
But this cannot mean dumping every legal document into a large language model. Statutes, regulations, SEC interpretations, court decisions, exemptions, no-action letters, and administrative decisions have different levels of authority and different dates of effectiveness, supersession, conflict, and interpretive status. If an AI system does not know those distinctions, more knowledge can simply make it more confidently wrong.
A regulatory knowledge base should therefore record at least the source, authority level, jurisdiction, effective date, superseding date, rule version, conflict status, and interpretive status. Users should be able to ask: why did you cite this case? Why not another one? Which rule has higher authority? Otherwise, an opaque human regulatory process has merely become an opaque AI knowledge base.
7. Before AI Enters Regulation, Four Boundaries Need to Be Clear
The first boundary is responsibility.
Suppose an official SEC AI tells a company, “This complies with the rules.” The company acts on that answer. A year later, the agency says, “The AI was wrong; you violated the law.” Who bears responsibility? That question cannot be postponed until after the system is deployed.
FINRA’s Rulebook Search Tool (FIRST) expressly states that it is for informational purposes, does not provide regulatory or compliance advice, and cannot be relied upon as a defense to non-compliance [5]. That illustrates the real difficulty in moving from a search tool to a regulatory AI that influences behavior: the main obstacle is no longer only model capability, but legal effect, responsibility, and reasonable reliance.
The second boundary is privacy and regulatory power. Verifiability does not mean regulators should have unlimited access to data. Trade secrets, personal information, trading strategies, and security keys should not lose protection simply because regulation becomes digital. A better principle is to verify the facts that must be verified and avoid collecting information unrelated to the regulatory purpose. As regulators gain stronger verification powers, those powers should also have limits and audit trails.
The third boundary is the verification mechanism itself. Verifiable infrastructure can become a new center of power. Who defines the verification interface? Who controls the underlying data? Who certifies machine-readable rules? Who is responsible when verification is wrong? None of these questions should be buried in a new black box. Verifiable regulation must therefore make not only the regulated entity, but also the source, permissions, versions, and responsibilities of the verification mechanism itself open to review.
The fourth boundary is judgment. Whether an asset exists can be verified. How a rule was changed can be replayed. But whether control amounts to legal “effective control,” whether managerial effort is sufficient to create an investment contract, or whether a penalty is appropriate still involves legal interpretation and value judgment.
Verifiable Thought (《可验证思想》) separates these into three categories: deterministic facts are checked; process facts are replayed; cognitive judgments are reviewed. AI can clarify facts and narrow disagreement, but where discretion cannot be eliminated, the decision should return explicitly to people, and the reasons should remain on the record. Final judgment and responsibility do not disappear because AI exists.
8. Why We Increasingly Believe in Experiment — Review — Revision
We do not treat these ideas as purely institutional speculation. We are testing a similar division of labor in our own AI monitoring system.
One AI mainly handles programming and engineering execution. Another mainly checks rules, evidence, logic, and acceptance results. We deliberately avoid allowing the same AI to execute a task, interpret what it did, and then prove itself correct.
On the human side, the model does not depend on someone reading every line of code. We retain the authority to set the objective, define risk boundaries, stop the process when necessary, and give final authorization. AI can execute and check, but it cannot replace final human responsibility.
Once the system actually runs, the problems look very different from theoretical discussions. Data sources go down. Timestamps are wrong. Permissions are insufficient. Different AIs interpret the same fact differently. Sometimes a model turns “we do not know why” into a plausible-sounding explanation.
These are not problems that can all be discovered at a desk. They emerge in real operation and force changes to the rules. That is why we believe regulation needs limited experimentation. If verifiable thinking asks others to accept factual testing, the theory itself must accept the same discipline.
9. Ten SEC Predictions We Can Check Later
When we previously examined remarks by Federal Reserve Chair Kevin Warsh, we wrote down ten predictions about future behavior. The purpose was not to prove that we were clever. It was to come back years later and ask whether we had actually understood the decision function behind his words.
We can do the same with the SEC. The ten statements below are not facts. They are predictions we are making today through the lens of verifiable thinking. If many of them fail, then this regulatory model should be revised.
| Today’s prediction | What to watch | What would make us revise it |
| 1. The SEC will move further from single asset labels toward economic structure, sources of value, and managerial dependence. | Formal rules or interpretations begin to use structural variables systematically. | Regulation still turns mainly on the “security/commodity” label. |
| 2. Experimental exemptions and limited-scope regimes will increase before final rules are complete. | More sandboxes, conditional exemptions, and pilots. | Innovation must still fully fit old rules before it can operate. |
| 3. Some regulatory rules will become machine-readable and gradually machine-executable. | Official APIs, structured rules, and automated compliance interfaces appear. | Regulation remains mainly PDF-based and dependent on manual legal interpretation. |
| 4. Regulatory reporting will move toward factual interfaces and continuous verification. | Continuous data interfaces appear for custody, reserves, assets, and related facts. | Reporting remains mainly quarterly or annual. |
| 5. The SEC will build a more complete AI regulatory knowledge system. | Firms can automatically query applicable rules, cases, and remediation requirements. | Official AI remains only search and FAQ. |
| 6. Automated regulatory systems will distinguish factual determinations from legal discretion. | Formal boundaries such as “verified” and “judgment required” appear. | AI presents legal judgments as if they were deterministic facts. |
| 7. AI-assisted regulatory conclusions will gain formal review and appeal mechanisms. | Clear escalation, appeal, and correction channels are created. | AI affects rights in practice but cannot be challenged. |
| 8. Experimental rules will increasingly require ex ante metrics and ex post review. | Rules include time limits, evaluation metrics, and review clauses. | Rules are implemented with little systematic evaluation afterward. |
| 9. As protocol governance and responsibility chains become more verifiable, DAOs and protocol governance will develop a more distinct legal status. | Rules begin assigning responsibility based on verifiable governance conduct, control, and responsibility chains across DAOs, foundations, and protocols. | The law still forces a binary choice between “company” and “nobody responsible,” without using governance facts. |
| 10. The SEC’s own organizational structure will change because of AI. | More roles in AI audit, rule strategy, and dispute review; fewer repetitive manual fact-checking tasks. | AI only improves efficiency inside the existing organization, while the organizational logic remains unchanged. |
Conclusion
Industrial-era regulation was built around a practical reality: many critical facts could not be directly verified. Society therefore developed licenses, audits, institutional credit, checks and balances, and after-the-fact enforcement. Those institutions still have value.
But technology is gradually changing the underlying condition. Crypto has shown that some public facts can be continuously verified without relying on a single institution, while AI is lowering the cost of checking facts, replaying processes, organizing rules, and reviewing judgments.
This does not mean regulation disappears, and it does not mean machines take over law. It means we should ask questions that previously were less practical: which facts can now be verified? Which risks are reduced because of that? Which powers remain invisible and therefore still require separation of responsibility and institutional checks? After a rule is implemented, does anyone return to see whether it actually achieved its purpose? Can regulators’ own judgments be replayed? Can the verification mechanism itself be verified?
If these questions gradually become part of ordinary regulation, the change may run deeper than simply “digitizing regulation.”
What we hope to see is not a regulatory system that claims to be permanently correct, but one that can verify facts, discover mistakes, acknowledge failure, keep revising itself, and remain open to review.
References / 参考文献
Chinese titles in brackets are editorial translations provided for the bilingual edition; official English legal texts control. / 方括号内中文标题为本双语版本译法，法律文件以官方英文原文为准。
[1] U.S. Securities and Exchange Commission (SEC). Regulation Crypto Assets [《加密资产监管规则》]. Proposed Rule, Release Nos. 33-11434; 34-106150, File No. S7-2026-27, Aug. 18, 2026. https://www.sec.gov/rules-regulations/2026/08/s7-2026-27
[2] U.S. Securities and Exchange Commission (SEC). Crypto Task Force Roundtables [《SEC加密资产工作组圆桌会议》]. Updated Jan. 16, 2026. https://www.sec.gov/featured-topics/crypto-task-force/crypto-task-force-roundtables
[3] OECD. Regulatory experimentation: Moving ahead on the agile regulatory governance agenda [《监管实验：推进敏捷监管治理议程》]. OECD Public Governance Policy Papers, No. 47, Apr. 5, 2024. https://doi.org/10.1787/f193910c-en
[4] Financial Conduct Authority (FCA). Digital Regulatory Reporting [《数字化监管报送》]. Joint initiative with the Bank of England; project page first published Nov. 1, 2017, updated Feb. 10, 2023. https://www.fca.org.uk/innovation/regtech/digital-regulatory-reporting
[5] Financial Industry Regulatory Authority (FINRA). FINRA Rulebook Search Tool™ (FIRST™) Overview [《FINRA规则手册搜索工具（FIRST）概览》]. Accessed Sept. 8, 2026. https://www.finra.org/rules-guidance/rulebooks/finra-rulebook-search-tool-first
[6] European Union. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 60, Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes [《欧盟人工智能法案》第60条：监管沙箱外高风险AI系统的真实环境测试]. OJ L, July 12, 2024; consolidated text updated July 27, 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
[7] OECD. Consultation on the digital provision of law: Towards a shared reference framework for Law as Code [《法律数字化提供咨询：迈向“法律即代码”共同参考框架》]. Public consultation, July 29, 2026–Apr. 30, 2027. https://www.oecd.org/en/events/public-consultations/2026/07/consultation-on-the-digital-provision-of-law-towards-a-shared-reference-framework-for-law-as-code.html
[8] OECD. Government at a Glance 2025, §8.3 Ex post evaluation [《政府概览2025》第8.3节“事后评价”]. June 19, 2025. https://doi.org/10.1787/0efd0bcd-en
[9] SEC v. W.J. Howey Co., 328 U.S. 293 (1946) [美国最高法院“豪威案”，Howey Test（豪威测试）来源].
