Understand these three points, and you will understand the entire chessboard of U.S. cryptocurrency regulation in the next two years.

Written by: Spinach Spinach

On the morning of May 14, 2026, the Senate Banking Committee is marking up a 309-page text—the Senate substitute amendment for the CLARITY Act. This is the most crucial step taken ten months after the bill passed the House of Representatives last July with a vote of 294 to 134.

But if you strip away all the legal shell, the real job this text is doing is actually just one thing:

- Acknowledge that crypto assets fall under the definition of "securities," and then build a separate set of rules for it that do not fall under securities law.

This sounds like a paradox. But it is precisely the spirit of this bill—neither overturning Howey, nor rewriting securities law, nor eliminating bank deposit protection, but rather chipping out a new category alongside these existing rules.

The entire text is a repetition of this "chipping" technique three times.

Strictly speaking, this is not "that" CLARITY Act anymore. The version passed by the House last July did not have the category of "ancillary asset," did not include a prohibition on interest for stablecoins, nor did it reclaim so much of SEC's jurisdiction from the CFTC.

The Senate's substitute version is the result of Tim Scott and Cynthia Lummis substantially rewriting it over the past ten months.

To understand the new CLARITY substitute version, Spinach has organized three underlying logics behind it.

If you understand these three points, you will understand the entire chessboard of U.S. cryptocurrency regulation in the next two years.

1. Do not overturn Howey, but chip a hole beside it

For the past decade, the biggest problem with U.S. cryptocurrency regulation has been the 1946 Howey test—"a reasonable expectation of profits to be derived from the efforts of others." This test is an unassailable cornerstone in case law, but it also neatly boxed almost all tokens into the category of securities.

SEC's lawsuits against Ripple, Coinbase, and Binance all stem from this.

The CLARITY substitute version did not seek to overturn Howey. It did something else:

- Create a brand new legal category called "ancillary asset."

Simply put: a token, if its value depends on the "entrepreneurial or managerial efforts" of the issuer or core team, then it is an ancillary asset.

Note this definition—it acknowledges the existence of that "dependent on the efforts of others" relationship as mentioned in Howey.

Acknowledge! Then, the bill builds a separate rule for this kind of thing:

- The act of issuance itself is legally recognized as "involving securities," but once the token is released, it is no longer a security. It is an ancillary asset, governed by disclosure rules rather than registration rules.

This is like a legal guardian saying, "I acknowledge this child is yours, but from the moment they are born, they are no longer under your care."

Isn't that a bit absurd? Yes. But this is the standard practice of American legislation to solve "wanting it all"—not overturning the cornerstone of case law (which is not overturnable and unnecessary to do so), but rather circumventing it with a new statutory category.

So what people are saying about CLARITY making tokens "no longer securities"—this is a lazy summary. The accurate statement is: CLARITY created an intermediate layer "with lower disclosure obligations than securities but higher than commodities," specifically designed to house things that are neither like stocks nor like corn.

The downstream impact of this logic is structural. The legal pathway for project teams to distribute tokens within the U.S. will become clearer, no longer needing to rely on SAFT, Reg D, or Reg S circular paths.

More importantly—America is finally going to give tokens a legal identity.

No longer will it be in a Schrödinger state of "if the SEC sues you today, you're a security, but if you settle tomorrow, you're not."

An interesting detail: there is a meticulously worded clause in the bill—one token will not be considered an ancillary asset if as of January 1, 2026, it is already the primary asset of an ETF listed on a national securities exchange in the United States.

Allow me to pause and chuckle. BTC and ETH spot ETFs are approved in January and July 2024, respectively, and by early 2026 they will already be running smoothly.

This clause effectively "grandfathers" at the legislative level: both of you are not only not securities, but you don't even fall under the ancillary asset secondary category.

The legal status is the clearest. No names mentioned, but precisely hit. An extremely American solution.

2. The compliance watershed of DeFi: Code belongs to code, operators belong to operators

This is the most potent logic in the entire bill for practitioners—and also the most often misread. On the surface, it distinguishes between "true DeFi" and "fake DeFi," but the real distinction underneath is another pair - the protocol itself and the people operating the protocol.

- Code, nodes, wallets, and pure algorithmic logic belong to the former, and are not subject to securities law;

- Those controlling, modifying, or reviewing the protocol belong to the latter, and are governed.

This sounds simple, but has not existed in the past decade.

In the SEC's arguments in the cases against Coinbase, Binance, and Uniswap, the argument has always been "the protocol is the product, the product is an extension of the issuer"—under this logic, there is no distinction between "protocol" and "operator."

The CLARITY substitute version draws this line at the legislative level for the first time.

How is it drawn specifically? Two directions.

The first direction, towards "fake DeFi"—drawing a warning line for operators.

The bill provides a textbook-like definition of DeFi protocols: participants execute financial transactions based on predefined, non-discretionary algorithms, with no one but the users themselves holding or controlling the assets.

Then it defines what "fake DeFi" is—anyone who meets any of the following is considered:

- There exists a person or group that can control or significantly change the functionality, operations, or consensus rules of the protocol;

- The protocol does not operate solely based on preset, transparent rules in the source code;

- There exists someone or a group that can audit, restrict, or prohibit the use of the protocol through its operations.

Once you are identified as "fake DeFi," and your activities fall under the category of securities, you will have to register, disclose, and comply with regulation under the 1934 Act, and be subject to anti-money laundering obligations.

Ask yourself: your so-called DAO-governed DEX, is the admin key part of the multisig? Are most of the multisig members from the core team? Is the protocol parameter upgrade something the core team can propose, and the core team votes to pass? Is the frontend operated by the core team?

If any of the above answers is "yes," then according to the standards of this bill, you are likely categorized as "fake DeFi."

The bill left a very clever safe harbor—a provision for emergency safety committees.

You can retain an emergency pause mechanism to protect users against hacking attacks, as long as this power is publicly disclosed in advance, regulated, only used to respond to specific cybersecurity incidents, the scope and duration are strictly limited, and no single individual has unilateral control.

However, you cannot use this pause to upgrade protocols, change economic parameters, or make governance decisions. This provision is drawn very nicely, almost custom-tailored for protocols like Compound, Aave, and Uniswap that have security councils.

The second direction, toward "the protocol itself"—drawing a protective circle around the code.

The bill exempts several of the most nerve-wracking items for developers from the past few years at once:

- Compiling, relaying, verifying network transactions; operating nodes or oracles;

- Developing distributed ledger systems;

- Developing wallet software allowing users to hold their own private keys.

Simply acting on these behaviors will not constitute jurisdiction under securities law. Those who have gone through the Tornado Cash incident in 2018, the sanctioning of code in 2022, or the prosecution of Samourai Wallet developers in 2023 should feel the weight of this provision.

It directly twists the long-advocated notion in legal academia that "writing code is free speech"—though the DOJ does not acknowledge it—into legislative language.

But note the detail: the bill retains the SEC's enforcement powers against fraud and manipulation. In other words—writing code is no longer a crime, but using code to deceive still is.

These two directions together form the complete second logic:

- The protocol itself is legislatively protected, but the people operating the protocol are regulated according to their actual control.

- Truly decentralized protocols receive decent legal status, but "semi-DeFi" will be adapted.

Numerous platforms claiming decentralization, but still holding admin keys within the team—DEXs, lending protocols, derivative platforms will face painful choices in the next two years—either truly delegate power or register as a broker-dealer or exchange.

The highest cost of capital and compliance lies in that gray area.

3. Stablecoins cannot act like banks, but DeFi can— a carefully maintained narrow boundary

If there is one most dramatic chapter in this entire bill, it is the prohibition on stablecoin interest.

In one sentence: it prohibits digital asset service providers from paying interest or returns on stablecoins to U.S. users.

However—the devil is in the list of "allowed returns."

Allowed returns that do not constitute "functional bank interest equivalents" include:

- Rebates related to transaction settlement;

- Returns gained from liquidity provision, collateralization, or otherwise placing assets at credit or investment risk;

- Participation in governance, validation, staking, loyalty programs, etc.

Moreover—these returns can be calculated based on balance, duration, and tenure.

When I read "placing assets at credit or investment risk," I laughed out loud.

What is this? It is a compliance pathway specifically designed for the entire DeFi lending market.

"Depositing USDC into protocols like Morpho, Aave, or Compound to earn returns, as long as the return comes from the exposure to credit or investment risk of the asset, rather than the balance interest of stablecoins themselves, is not within the scope of the ban."

Of course, the banking industry sees through this. On May 9, the three major U.S. banking associations (ICBA, BPI, ABA) jointly sent a letter rejecting this compromise, specifically stating that this is a "loophole."

On May 11, Mother's Day, Rob Nichols, CEO of the American Bankers Association, wrote to CEOs of all banks in the U.S., calling for "immediate action" to lobby senators.

Their core argument is straightforward: about 80% of the loan funds for U.S. banks come from customer deposits; if stablecoins can give users a reason to keep their money in a USDC wallet rather than a checking account through "activity-based rewards," then banks lose their cheap source of funding.

Tillis's response translated means: "If it's a loophole, it's a loophole—agree to disagree."

The logic behind this game is the most important part worth understanding.

Washington is making a bet—a narrow boundary, meticulously maintained by legal language, lies between stablecoins and bank deposits: stablecoins cannot directly pay interest like banks (protecting the deposit base), but stablecoins can serve as an entry point to DeFi returns (allowing capital market pricing).

It pretends to protect banks, but in reality, it opens up a product space for the cryptocurrency industry that is more flexible than banks.

The most important takeaway from this provision is that the law draws a line between "deposit" and "credit risk exposure," and this line is drawn right at the boundary of DeFi lending protocols.

The legitimacy of the USDC lending market is further solidified—not because stablecoins pay interest, but because users place stablecoins into a vehicle "at credit or investment risk."

The downstream impact of this logic: compliant issuers like Circle and Paxos cannot pay interest directly, but users can place stablecoins into DeFi protocols, on-chain lending markets, tokenized money market funds, these "credit risk exposure" vehicles to earn returns.

The legal foundation for RWA lending markets and on-chain credit markets is further solidified.

The three logics reflect the same legislative philosophy

When you look at these three underlying logics together, you will find a hidden common structure—each one is "the law does not overturn X, but rather chips out a new path beside X":

The first point, does not overturn Howey, chips out ancillary asset.

The second point, does not overturn securities intermediary regulation, chips out the distinction between "protocol vs. operator."

The third point, does not overturn bank deposit protection, chips out the "credit risk exposure" pathway.

Combined, these three points are the spirit of the bill: it is not about overturning existing rules but rather chiseling out new categories within the seams of existing rules.

The cornerstone of case law remains intact, securities law is not abolished, and bank deposit protection is not removed, but cryptocurrency assets, DeFi protocols, stablecoin activities, and on-chain lending returns are all specifically, separately, and incorporated into the law using a new logic.

This represents a very American legislative philosophy—it dislikes revolutions but is skilled at patching new patches on old frameworks, and after enough patches, the world has become different.

Also, recognize the costs

Having discussed this, portraying this bill as too rosy would seem dishonest. Each of the three logics has its opposite, and professionals ought to see clearly:

The cost of the first point is that the nature of the disclosure obligations for ancillary assets will ultimately be determined entirely by the SEC through rulemaking.

If the disclosure forms are made excessively burdensome—such as requiring project teams to update token economic models quarterly, disclose all holders with holdings over 4% during unlockings and changes, and provide continuous "entrepreneurial progress" reports—then this set of disclosure obligations could practically approach the cost of a full securities registration.

The law gives you a new pathway, but how wide the path is will depend on how regulatory agencies interpret it.

The cost of the second point is that the test for "true DeFi" is stringent, but the enforcement power lies with the SEC.

"The functionality to control or significantly change the protocol," "the ability to revise, limit or prohibit the use of protocols"—the boundaries of these terms will need to be defined by the SEC through cases and rules.

Should the next SEC chair be unfriendly to DeFi, they could easily interpret these standards very narrowly.

The legislation provides a safe harbor but who will draw the boundaries of that safe harbor remains an open question.

The cost of the third point is most straightforward—will the wide "credit risk exposure" pathway encourage a new wave of Celsius/BlockFi-type gray yield products?

The line between "activity-based rewards" allowed by law and essentially "interest" is clear in the text but can easily become blurred in product design. Regulatory authorities will likely face a slew of products that walk the boundary—they may seem like "placing assets at credit or investment risk," but in user experience, they are not different from time deposits.

This game has only just begun.

The real battleground in the next phase is not in Congress but in regulatory agencies.

The phrase "the Commission shall adopt rules…not later than 1 year" has appeared dozens of times in the bill.

Who becomes SEC Chair, who becomes CFTC Chair, and how they respond to industry opinions during the notice-and-comment phase will determine the final texture of these provisions. What we see today is the skeleton; the muscles will take 12 to 18 months to develop.

Conclusion

Returning to the markup this morning.

Even if it passes the committee smoothly, this bill must still go through the Senate floor vote, merge with the agriculture committee version, coordinate with the House version, return for votes in both chambers, and finally be sent for the president's signature—any one of these steps could alter the text's form.

Polymarket has recently fluctuated the probability of "CLARITY being signed into law in 2026" between 60-70%.

But even if the final legal text differs from today's draft, this 309-page document has already done its most important work:

It has changed the language system of the national cryptocurrency policy debate from "Is this a security?" to "At what level to disclose, who regulates, and what standards to comply with."

Ten years ago, regulation in this industry relied on "regulation by enforcement," five years ago on "regulation by ambiguity," and now finally moving towards "regulation by statute."

What practitioners should focus on is not which specific exemptions are in place but rather that the language of the game has changed. As for where this game ultimately leads, no one can give an answer now—that's precisely what makes it truly interesting.