Lessons from the SEC’s Enforcement Action Against EtherDelta
On November 8, 2018, the U.S. Securities and Exchange Commission (the “SEC”) obtained a cease-and-desist order (the “Order”) charging Zachary Coburn with operating an unregistered securities exchange as a result of his activities related to “EtherDelta,” a “decentralized” digital asset exchange he founded (such exchanges commonly referred to as “DEXs”). While both the SEC and a range of U.S. state securities regulators have previously brought enforcement actions in the digital asset space, including for failure to register offers and sales of securities and failure to register as a broker-dealer, the Order represents the first enforcement action for failure to register as a securities exchange. Without admitting or denying the findings, Coburn consented to the Order and agreed to pay nearly $400,000 in fines and cooperate with the SEC in related future investigations.
A harbinger of regulatory actions to come?
Notably, the Order charges Coburn in his personal capacity only. While the Order specifically finds that “EtherDelta,” a smart contract-based trading system, violated Section 5 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), EtherDelta was not a named Respondent in the Order and the platform appears to continue operations today. It is not clear from the Order whether EtherDelta is anything more than the name used for the trading platform created by Coburn.
Coburn launched EtherDelta on July 12, 2016 and sold it to foreign buyers in December 2017, the dates bounding the timeframe covered by the Order. The SEC alleges that Coburn caused the EtherDelta “trading system” to violate certain provisions of the Exchange Act, on the basis that he: (i) founded EtherDelta; (ii) coded and deployed the EtherDelta smart contract; (iii) had exclusive control over the EtherDelta smart contract (including the ability to change the fees charged by the platform for exchanging digital assets) and (iv) served as a spokesperson for EtherDelta on Twitter and Reddit. Exchange Act liability can extend broadly to “any other person that is, was, or would be a cause of the violation, due to an act or omission the person knew or should have known would contribute to such violation, to cease and desist from committing or causing such violation and any future violation of the same provision, rule, or regulation.” Among other things, this enforcement action highlights potential exposure for individuals active in the blockchain space as a result of deemed violations by an automated “trading system” they develop, operate and promote.
In addition, the Order may preview further potential enforcement actions, including: (i) by the SEC against EtherDelta’s current owners (particularly given that the Order notes that the limited civil penalties imposed against Coburn were the result of his “agreement to testify in any related enforcement action”); (ii) by the SEC or other U.S. regulators against similar decentralized “trading systems;” (iii) by the SEC against issuers of tokens traded on EtherDelta that may deemed securities (particularly against issuers who actively sought the listing of tokens with a view to creating a secondary market in the tokens and driving token price appreciation) and (iv) by non-U.S. regulators against EtherDelta’s current owners or similar decentralized “trading systems” (since enforcement authorities in other jurisdictions with similar regulatory frameworks governing exchanges may be prompted by this Order to examine or re-examine their treatment of systems facilitating trades in digital assets among their citizens and residents).
What does the Order mean for the potential of DEXs?
We have used the term “trading system” above because the Order uses that terminology to refer to EtherDelta. Notably, while the Order sets out the definition of “exchange” in both the Exchange Act and the SEC’s related rules, “trading system” (or anything similar) does not appear within the definition an exchange. Instead, the Exchange Act refers to organizations, associations, groups of persons, etc. It is quite clear from the Order that any persons or companies that create, promote and benefit from such systems may face liability for violations resulting from the operation of those systems. However, it remains unclear whether a system — that is, a blockchain-backed software platform comprised of smart contract code — can itself fall within that definition. Unfortunately, the Order does not address this issue.
While EtherDelta was promoted as a nominally “decentralized” exchange, paragraph 16 of the Order points to open orders being maintained on a centralized server that was apparently owned and maintained by Coburn (as opposed to being maintained on the Ethereum blockchain or on a decentralized file storage platform such as IPFS and “hashed” into the Ethereum blockchain). Further, footnote 9 of the Order noted that Coburn also maintained exclusive control over the EtherDelta smart contract while he owned the platform. These findings are important to show that the EtherDelta platform was operating as an exchange — the order book available on the system had an important role in the process of bringing together buyers and sellers and facilitating trades. However, it is conceivable that a “truly” decentralized, censorship-resistant DEX may be able to escape the Exchange Act’s definition of “exchange,” particularly where no individual or group of individuals controls or benefits from the DEX’s operations.
What can we learn from the Order regarding the applicability of securities laws to tokens?
The obligation to register as an exchange or fall within an exemption from registration is triggered by directly or indirectly effecting any transaction in a security in interstate commerce. A key question then is which securities were being traded on EtherDelta? The Order does not specifically identify which of the tokens traded on EtherDelta were deemed to be securities. Rather, the Order indicates any ERC-20 token could be traded on EtherDelta and that some unspecified number of the tokens that were traded were securities within the definition of Exchange Act Section 3(a)(10). Further, the SEC’s press release accompanying the Order notes that the “SEC has previously brought enforcement actions relating to… unregistered ICOs, including some of the tokens traded on EtherDelta.” A cursory analysis of EtherDelta shows how it allowed for the trading of tokens that had been the subject of prior enforcement actions, including the CTR Tokens offered by Centra Tech Inc.
It is important to keep the context of this Order in mind. Coburn agreed to the entry of the Order, but not necessarily to the SEC’s specific findings. As a result, the findings were not challenged and it was not necessary for the SEC to set out in detail which tokens or token transactions, in their view, involved securities.
What does the Order tell us about the SEC’s enforcement priorities?
The Order may signal the SEC’s enforcement priorities when it comes to utilization of resources. The fact that the first enforcement action against a digital asset exchange targeted a DEX may indicate that the SEC is particularly concerned about the prospect of these systems, specifically as it relates to relative level of anonymity of DEX participants and the greater likelihood that such an exchange might facilitate money laundering. As noted above, the Order represents the SEC’s first enforcement action with respect to any digital asset exchanges for potential Exchange Act violations, despite various centralized exchanges also operating in apparent violation of registration requirements. It may be that the SEC has determined to use their enforcement resources to first address the Exchange Act violations that have a greater potential to contribute to other unlawful conduct (such as money laundering) before turning their attention to centralized exchanges, where, at least theoretically, exchange participants can be more easily identified.
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
For more information, or to speak with the team at DLx Law, please email: email@example.com.
Thank you for reading!
 The Order can be found here: https://www.sec.gov/litigation/admin/2018/34-84553.pdf. The SEC’s press release announcing its enforcement action can be found here: https://www.sec.gov/news/press-release/2018-258.
 See the SEC’s Cyber Enforcement Actions here: https://www.sec.gov/spotlight/cybersecurity-enforcement-actions. See also the MoCo Cryptocurrency Litigation Tracker for a list of enforcement actions by other U.S. regulators, available here: https://www.morrisoncohen.com/news-page?itemid=471.
 On July 25, 2017, the SEC issued the DAO Report where it stated that platforms that offer trading of digital assets that are securities and operates as an “exchange” must register with the Commission or be exempt from registration. See here: https://www.sec.gov/litigation/investreport/34-81207.pdf.
Further, on March 7, 2018, the SEC again warned that certain “online trading platforms” for digital assets were subject to registration requirements. See here: https://www.sec.gov/news/public-statement/enforcement-tm-statement-potentially-unlawful-online-platforms-trading.
 Securities Act, §8A
 The introduction of Know-Your-Customer policies and procedures by other decentralized exchanges may signal that regulators have been in discussions with various actors in this space. See, e.g., September 4, 2018 announcement by ShapeShift available here: https://info.shapeshift.io/blog/2018/09/04/introducing-shapeshift-membership/.
 “The term ‘exchange’ means any organization, association, or group of persons, whether incorporated or unincorporated, which constitutes, maintains, or provides a market place or facilities for bringing together purchasers and sellers of securities or for otherwise performing with respect to securities the functions commonly performed by a stock exchange as that term is generally understood, and includes the market place and the market facilities maintained by such exchange.” Exchange Act, §78c(a)(1)