With the Securities and Exchange Commission’s (“SEC”) recent release of over 80 subpoenas to issuers and others involved in token sales, and Chairman Clayton’s belief that “every Initial Coin Offering [he’s] seen is a security,”² we thought it useful to explore the general reach of the U.S. Government (the SEC and the Department of Justice) and private litigants to pursue civil and criminal claims against offshore token sales under the Securities and Exchange Act of 1934’s (the “Exchange Act”) anti-fraud provision, Rule 10b-5.³

To avoid U.S. regulators, many entrepreneurs exclude Americans from their token sales by using foreign entities to issue tokens, blocking U.S. IP addresses and only notifying U.S.-based individuals, often through small disclaimers or legalese at the bottom of an ICO launch page, that they are barred from participating in the offering. At the same time, some of these issuers advertise on Reddit, Slack and Telegram knowing full well that U.S.-based investors may see and buy into their sales using a VPN.

But do these “offshore” token sales expose issuers to potential 10b-5 civil and criminal claims from the SEC, the DOJ or private litigants? The short answer is not likely if the sale is “foreign-cubed,” meaning that it involves a foreign seller, foreign purchasers and a foreign transaction. This article discusses the recent precedent regarding 10b-5 and offshore transactions, and explains how an issuer might structure its token sale to avoid exposure to claims under that rule.

I. A Primer on Rule 10b-5 and Three Important Cases — Morrison, Absolute Activist and Vilar

The Exchange Act was a watershed moment in U.S. securities regulation that gave rise to the SEC and created one of the agency’s main tools for combating fraud in the securities market, Section 10(b). This provision makes it unlawful for a person to “use or employ any manipulative or deceptive device or contrivance in contravention of such rules and regulations as the Commission may prescribe” and grants the SEC authority to enforce the statute. (See 15 U.S.C. §78j(b); see also 15 U.S.C. §78u(a)(1).) Pursuant to that power, the SEC adopted Rule 10b-5, which provides it the ability to pursue deceptive conduct in connection with the purchase or sale of securities. The DOJ, often with the SEC’s assistance, enforces federal securities law and pursues Rule 10b-5 actions for criminal fraud.⁴ And private parties have long exercised an implied right to sue under the rule.⁵

To establish a claim under 10b-5, plaintiffs must prove that the defendant (1) made a false statement or omission of fact, (2) with the intent to deceive, manipulate, or defraud, (3) “in connection with” the purchase or sale of securities, (4) upon which plaintiff justifiably relied, and (5) which proximately caused,⁶ (6) plaintiff’s economic loss.⁷

For many years, American courts allowed parties to pursue 10b-5 claims against non-U.S.-based issuers of securities using the “conduct” and “effects” tests. This approach looked at whether 10b-5 could apply to a given purchase or sale by analyzing (1) “conduct” — whether a party’s wrongful conduct occurred in the United States or (2) “effects” — whether the harmful conduct had a substantial effect in the United States or upon U.S. citizens.⁸ The tests permitted courts to reach fraudulent securities transactions by foreign companies in foreign markets when American investors were harmed.⁹

In 2010, the U.S. Supreme Court swept away this precedent and adopted a transactional approach to regulation by restricting the right of private litigants to pursue 10b-5 claims with regard to foreign securities that trade on non-U.S. exchanges. That case, Morrison v. National Australia Bank Ltd., involved three foreign plaintiffs who sued an Australian bank for losses they suffered from purchasing the bank’s stock, which traded exclusively on an Australian exchange. See 561 U.S. 247, 251 (2010). Plaintiffs alleged that they were largely induced to invest by false statements made by American executives from the bank’s Florida-based subsidiary as well as material misrepresentations in the bank’s financial disclosures. Id.

The Court determined that Congress never intended Section 10(b) to apply outside the U.S. and held that the Exchange Act’s focus was on where the purchase of a security took place. Id. So, to avoid applying the U.S. securities laws to transactions that have little, if any, relationship to the United States, the Supreme Court restricted potential 10b-5 civil liability claims to (i) transactions in securities listed on domestic (U.S.) exchanges,¹⁰ and (ii) domestic transactions in other securities. Id. Because the foreign plaintiffs purchased the foreign bank’s stock on a foreign exchange, their claims were not sufficiently “domestic” and were dismissed.

The Second Circuit soon explained what “domestic transaction” meant in Absolute Activist Value Master Fund Ltd. v. Ficeto. 677 F.3d 60 (2d Cir. 2012). There, Cayman Island-based foreign hedge funds sued their investment advisors for inducing the funds into a “classic pump and dump’” from which the advisors would profit. Id. The question for the court was whether the alleged fraudulent transactions occurred “within the U.S.” and fell under the purview of 10b-5. Id. at 67.

The Second Circuit held that for a party to properly allege a “domestic transaction” in a security not listed on a domestic exchange, plaintiffs must show that a party incurred irrevocable liability or transferred title to the security while physically in the United States. Id. at 68. To meet this test, the court suggested that parties needed to show that a contract was formed, a purchase order was placed, or money was exchanged in the United States. Id. When the plaintiff hedge funds failed to allege how the defendant advisors carried out the fraudulent scheme inside U.S. borders, their claims were dismissed. Id.

Though Morrison and Absolute Activist dealt with civil liability under 10b-5, no court answered whether these decisions also restricted criminal liability under 10b-5 until the Second Circuit confronted the issue in United States v. Vilar. 729 F.3d 62 (2d Cir. 2013). There, the DOJ accused two prominent investment managers of a complicated scam whereby they materially misrepresented investments to their clients, inducing the clients to invest while lining their own pockets with fees and using the client funds to pay out other investors. See Vilar, 729 F.3d at 68–69.

The DOJ indicted and eventually convicted the investment managers for violating 10b-5. They appealed, claiming that their alleged conduct was not “domestic” and, as a result, 10b-5 could not apply. Id. at 70. Thus, two issues came before the appellate court: (i) whether Section 10(b) applied extraterritorially in criminal cases, and, if it did not, (ii) whether irrevocable liability to purchase or sell securities had been incurred by the parties in the United States.

On the first question, the Second Circuit decided that the presumption against extraterritoriality applies in criminal cases involving Section 10(b) and, accordingly, Rule 10b-5 cannot be used to pursue claims of criminal fraud related to the purchase or sale of securities in non-domestic transactions (i.e., those taking place outside the United States).¹¹

On the second question, the court looked at whether defendants or their victims had incurred irrevocable liability to carry out a securities transaction in the United States. Reviewing purchases by three investors, one by a family in Puerto Rico and two by two individuals in New York, the Second Circuit held that because these individuals, while in U.S. territory, had executed the sales contracts and sent funds to defendants, they incurred irrevocable liability in the United States and the securities transactions were domestic under Morrison and Absolute Activist. Id. Thus, Rule 10b-5 applied and defendants’ convictions were upheld. Id.

II. Morrison, Absolute Activist and Vilar: What Do They Mean for Offshore Token Sales?

Morrison, Absolute Activist and Vilar teach us that the purchase or sale of securities wholly outside the United States falls beyond the reach of 10b-5. But what does this mean for token issuers?

Some courts have ruled that placing a buy order in the United States for the purchase of securities on foreign exchanges will not create a domestic transaction.¹² Other courts have added that if the buy order for the foreign security is executed, rather than just placed, in the U.S., that will suffice for a “domestic transaction” and Rule 10b-5 may apply.¹³

Unfortunately, the analysis above, focusing on “where” a person buys or sells a security, is difficult to square in the decentralized crypto space.¹⁴ The better question for issuers, we think, is how should an offshore token sale be structured if the issuer wants it to be “foreign-cubed,” and limit exposure to Rule 10b-5?

First, the sales should hew closely to the guidance the SEC previously provided about using the internet to offer securities.¹⁵ For instance, an issuer must take “adequate measures” to prohibit a U.S.-based person from participating in your offering. What that means will depend on the facts and circumstances of a particular situation, but we think a KYC (Know-Your-Client) review, operated by a reputable third-party provider (i.e., not the issuer’s intern) will need to screen for Americans and anyone living in the United States or any of its territories. This should include requesting the potential purchaser’s name, address and a government-issued ID (driver’s license or passport), though a mature solution like Civic or uPort may also suffice. Remember, the key is to implement procedures that are “reasonably designed” to guard against the sale of tokens to persons based in the U.S.¹⁶

Second, the tokens should be sold through an offshore entity,¹⁷ from a foreign website (from a non-U.S. domain) in which a DApp blocks all U.S. IPs and potential VPNs through which a U.S.-based person may form and/or execute an agreement or order for tokens. All information released about the sale should state clearly that U.S. citizens and those residing in the U.S. cannot participate. And, in fact, a U.S.-based person should not even be able to access the screen through which potential token purchasers may be whitelisted or where the token seller places the smart contract address when the sale begins.

Third, a potential token purchaser should be forced to sign any terms of sale from a non-U.S. domain and the token seller should ensure that the sole atomic operation for the “exchange of money” (sending of ETH or BTC, for instance) and transfer of token ownership occurs directly on chain rather than on a U.S.-based server.

Fourth, though we acknowledge that there is case law stating that heavily marketing a security in the U.S. and alleging general harm to U.S. investors, “while potentially [running afoul of] the defunct conduct and effects test,” fails to satisfy the domestic transaction test announced in Morrison, see Absolute Activist at 70, we believe it is unwise to tacitly market one’s token to U.S. consumers through U.S.-centric channels like Reddit or Slack.

And lastly, the most obvious point: Entrepreneurs should be truthful when discussing their technologies. It’s not hard to imagine a creative attorney from the SEC, DOJ or private practice scrutinizing one’s white paper, Twitter feed or media interviews with regard to potential investigations and lawsuits, especially if the token’s price drops precipitously or the project collapses and people lose their funds.

III. Takeaways

Of course, the efforts described above could be for naught as it may be virtually impossible to guarantee a purchaser is not in the U.S. when he or she takes part in a sale. A determined purchaser can submit false documents to the KYC reviewers or rely on VPNs to get around the IP block.¹⁸ What’s more, the technology in use evolves rapidly. Maybe a savvy investor is comfortable creating a VPN while, for now, non-sophisticated buyers cannot or will not create a VPN to participate in a sale. But what happens when these non-sophisticated buyers start using VPN browser extensions? Friction melts away, buying in the offshore token sale becomes as easy as “one-click ordering” and efforts to block U.S. IPs are rendered essentially moot.

Nonetheless, the main things to remember here are that there are hard limits to the extraterritorial application of 10b-5 under Morrison and its progeny and that if an offshore sale takes reasonable steps to completely avoid the U.S., it may sidestep exposure to 10b-5 (as the law stands today).¹⁹

Much thanks goes to Jee Kwak (Hofstra University — Maurice A. Dean School of Law) for his research and revisions; @FollowTheChain for his always valuable crypto insights; and Decentralized Legal for the ideas that gave rise to the article.

End Notes

[1] This analysis applies to tokens likely to be considered securities. For a brief review on the Howey test, see the SEC’s 21(a) Report on The DAO, available at www.sec.gov/litigation/investreport/34-81207.pdf. This post is for informational purposes only and is not legal advice in any way, shape or form. You should consult with your own securities counsel for specific guidance. Moreover, we do not endorse the roadmap described herein, but hope that it spurs useful conversation in the community around token sales and federal securities law.

[2] We hope he’s seen more than DAO or MUN tokens!

[3] Please note that Rule 10b-5 applies to public and private companies. See Dofflemyer v. W.F. Hall Printing Co., 558 F. Supp. 372 (D. Delaware 1983) (plaintiff pursued 10b-5 claims against company and its directors for alleged misrepresentations and material omissions in pre-merger disclosures); see also SEC v. Elizabeth Holmes and Theranos, Inc., 5:18-cv-01602 (N.D. C.A. 2018) (alleging that Holmes and Theranos, Inc. violated Rule 10b-5, in part, by making untrue statements of fact in the sale of Theranos securities) (filed Mar. 4, 2018).

[4] The DOJ has authority to bring 10b-5 actions pursuant to §32(a) of the Exchange Act. See 15 U.S.C. §78ff.
See Herman & MacLean v. Huddleston, 459 U.S. 375, 380 (1983) (“The existence of [a private right of action under Rule 10b-5] is simply beyond peradventure”).

[5] That is, the injury resulted from defendant’s fraudulent or deceptive acts.

[6] See, e.g., Dura Pharm., Inc. v. Broudo, 544 U.S. 366, 341 (2005). Note that the pleading standards for liability under 10b-5 differ slightly based on whether a private party or the SEC is bringing the claim. The standard described here only applies to private parties, and the SEC need not prove that it purchased the security based on defendant’s misrepresentations (standing and reliance) or was damaged due to the defendant’s acts (loss causation and damages) in order to bring a 10b-5 claim.

[7] Traditionally, the conduct test and effects test were applied separately. See generally, Leasco Data Processing Equip. Corp., v. Maxwell, 468 F.2d 1326 (2d Cir. 1972); Schoenbaum v. Firstbrook, 405 F.2d 200 (2d Cir. 1968). However, courts began to merge the tests in the mid-1990’s. See Itoba Ltd. v. LEP Group PLC, 54 F.3d 118, 121–122 (noting that there is no “requirement that the [two] tests be applied separately and distinctly from each other”); SEC v. Berger, 322 F.3d 187, 192–194 (2d Cir. 2003) (stating that the tests were two factors to be analyzed when deciding whether the Exchange Act could be applied to predominantly foreign transactions).

[8] See John Koury, Extraterritoriality for Securities Fraud Post-Morrison, 1 Emory Corp. Gov. and Account. Rev. 1 (2015).

[9] We have foregone analysis of the first Morrison prong — “securities in transactions listed on national exchanges” —  because to date no token sales have taken place through any organized U.S. securities exchange.

[10] There is a body of case law that allows criminal statutes punishing crimes against the United States to be applied outside the U.S. See U.S. v. Bowman, 260 U.S. 94 (1922) (where two U.S. sailors planned to defraud the U.S. Government during a sailing trip to Rio de Janeiro, U.S. criminal law could apply regardless of where the offending conduct took place). However, the legal presumption against extraterritoriality applies to “[c]rimes against private individuals or their property” and not to statutes where the law protects the “right of the [U.S.] government to defend itself.” Id.

[11] See, e.g., City of Pontiac Policemen’s & Firemen’s Retirement System v. UBS AG, 752 F.3d 173, 181 (2d Cir. 2014); see also Plumbers’ Union Local No. 12 Pension Fund v. Swiss Reinsurance Co., 753 F. Supp. 2d 166, 178 (S.D.N.Y. 2010) (holding that “a purchase order in the United States for a security that is sold on a foreign exchange is insufficient to subject the purchase to the coverage of section 10(b) of the Exchange Act.”).

[12] See In re Petrobras Secs. Litig., 150 F. Supp. 3d 337, 340 (S.D.N.Y. 2015) (North Carolina-based pension fund incurred irrevocable liability to purchase a foreign security when its Raleigh, N.C.-based traders executed a buy order for a Brazilian debt security from New York-based underwriters).

[13] For example, even the basic question about where a party incurs irrevocable liability to purchase is difficult to answer. When a party confirms a transaction on My Ether Wallet? When the transaction is mined (in a proof-of-work system) or, in the future, validated (in a proof-of-stake system)?

[14] See, generally, Statement of the Commission Regarding Use of Internet Web Sites to Offer Securities, Solicit Securities Transactions or Advertise Investment Services Offshore, International Series Release №1125 (effective Mar. 23, 1998).

[15] So, if a determined U.S.-based token purchaser submits a false passport or driver’s license and gets around the third-party KYC review, at least the issuer can argue that it took (very) reasonable efforts to block U.S. buyers.

[16] Even though courts have noted that “a party’s residency or citizenship is irrelevant to the location of a transaction,” we understand that most sellers prefer to issue their tokens from more tax beneficial jurisdictions (such as the Cayman Islands). See Absolute Activist, 677 F.3d at 70.

[17] Some streaming platforms, like Netflix, even employ advanced VPN blockers to ban users based on the source of traffic.

[18] The United States District Court for the District of Utah recently found Section 929(b) of the Dodd-Frank Wall Street Reform and Consumer Protection Act to supersede Morrison and applied the “cause and effects” test with regard to the extraterritorial application of Rule 10b-5. See SEC v. Traffic Monsoon, 2:16-cv-00832-JNP (D. Utah 2018). Oral argument on the appeal was held before the 10th Circuit on March 21, 2018, and a decision is expected in the coming months.