What We Told the SEC and CFTC About Proving Eligibility at the Moment It Matters

This month the SEC took up how a firm should confirm that an investor or a wallet is allowed to act, and the CFTC turned to AI agents in finance and to records kept on blockchains. We filed four letters with them. This post explains what we said, why, and what it may mean for your business.

What happened this month

On September 17 the SEC granted an exemption that lets new venues trade tokenized stocks. Each venue must set standards for who may trade, and the order describes allow-listing approved wallet addresses as one way to enforce them.

On September 23 Commissioner Hester Peirce, speaking for herself in one of her last speeches before leaving the Commission, argued for moving "away from prescriptive collection requirements and toward attribute-based verification": confirming only the specific fact a firm needs. As one example, she said a zero-knowledge proof can tell a counterparty "Yes, this person meets your requirement" without revealing a name, income, or address.

At the CFTC, the Innovation Task Force announced on September 21 a series of public forums, the first of them on artificial intelligence and agentic finance, set for October 28. On September 24 CFTC staff said they would not object to firms keeping required records on a blockchain, as long as the firms still meet the recordkeeping rules.

Why we wrote in

The question running through all of this is how a firm shows that someone, or something, was allowed to act at the moment it acted, and shows it again years later when an examiner asks. Our service answers a narrow version of that question for blockchain wallets, so we put our view on the record while the agencies are still asking. We wrote to both, through their own formal channels.

What we said

Check when it matters, not only at signup. Eligibility is judged at a point in time. The SEC's definition of an accredited investor looks at status "at the time of the sale." A professional's written confirmation of that status qualifies as one of Rule 506(c)'s listed verification methods only if the check was done within the prior three months. A customer can narrow or withdraw an AI agent's permission at any time, and sanctions lists change. A check made at onboarding shows who qualified that day. We argued that the check should also be made when the trade, sale, or action happens. Others have raised the timing point too: Octet, in materials for an April meeting with the SEC's Crypto Task Force about where a user is located when they transact, said KYC "verifies identity once, at account creation, and the system treats that check as permanent."

Ask for the answer, not the data. For a particular access decision, a venue may need to know only that the wallet meets the stated criterion. On a tokenized venue the wallet address is usually known anyway, because the shares settle to it. The determination itself need not expose the owner's name, income, other holdings, or the data used to establish the fact. It does not replace any separate identity, sanctions, or recordkeeping obligations the venue has.

Keep a record that lasts. A record's signature should stay secure for as long as the rules require the record to be kept. Firms must keep records for years. A broker-dealer keeps a customer's identifying information for five years after the account closes. Most CFTC records are kept at least five years, and swap records for five years after the swap ends. ECDSA, a widely used digital signature, is listed in NIST's draft transition plan as disallowed after 2035, because quantum computers could break it. A record signed now may need to be trusted after that date. One way to keep it trustworthy today is to add a signature under the post-quantum standard NIST has already published.

In every letter, the firm relying on the check sets the criteria and makes the decision. The check reports whether the criteria were met at that moment, and leaves a record of it.

Where zero-knowledge proofs fit

Zero-knowledge proofs let someone prove a fact without revealing the data behind it, and Commissioner Peirce used them as an example of where verification could go. We see them as complementary to what we argued for. A proof can be designed to check an expiry date. Whether it catches a credential revoked after it was issued depends on whether the check made at the moment of use looks that up. Our letters are about that moment and about the record of it, whatever method produced the answer.

What it may mean for you

If you run a trading venue. A venue using the SEC's exemption must publish its access criteria in plain English. Our suggestion: decide whether your check runs once at signup or at each trade, and keep a signed record of each decision.

If you are raising money. Under the SEC's proposed rules for crypto offerings, an issuer checking the 10 percent investment limit for buyers who are not accredited may rely on the buyer's own statement. We asked the SEC to confirm that an issuer may also rely on a professional's confirmation that a buyer is accredited, including one tied to the buyer's wallet, and that an issuer that checks it at the moment of sale and finds it current should be in no worse position than one that did not check.

If you build software that acts for people. Expect to be asked whether your software's permission was still in force when it acted, not only when it was granted. Where that permission is a signed delegation on a blockchain, its status can be checked at the time of each action. Keep a record of that check.

For anyone keeping records for years. Plan the signature you use now for the whole retention period.

The four letters

1. SEC, September 17: the tokenized stock exemption (File No. 4-927). How a venue decides which wallets may trade: check at the trade and keep a signed record. Read it on sec.gov.
2. SEC Crypto Task Force, September 25: attribute-based verification. What a firm's record should show when it accepts a proof in place of collected data: current, minimal, and verifiable for as long as it must be kept. Read it on sec.gov.
3. SEC, September 25: proposed Regulation Crypto Assets (File No. S7-2026-27). Relying on a professional's confirmation of accredited status, checked at the time of sale. Read it on sec.gov.
4. CFTC Innovation Task Force, September 25: software acting for customers. Showing that software's authority was in force when it acted, and keeping a signed record of that check. The CFTC posts written input on its Innovation Task Force page and had not posted this letter when we published; read our copy in the meantime.

Each letter states our interest, and so should this post. We operate InsumerAPI, which checks whether a wallet meets a condition and returns a signed yes or no. We sell that service. The agencies received these letters as public comments and written input; that is all they are.