Greenlight and Exam in the Same Month: SEC Puts Tokenization on the FY 2027 Examination List for the First Time
On October 23, the SEC added tokenization to high-risk clearing-agency examination areas; three days later, the innovation exemption’s “public and permissionless” standard ignited a Solana-versus-Hedera dispute, and 22 listed companies pushed back against being tokenized. Permission and oversight arrived in the same month.
A
Aurellix
October 25, 2026
6 min read
Article Overview
On October 23, 2026, the SEC’s Division of Examinations released its fiscal year 2027 examination priorities, adding “tokenization” to high-risk clearing-agency examination areas for the first time and listing it alongside superintelligence, extended trading hours, and quantum computing under Regulation SCI as emerging trends in market-systems review, covering more than 34,000 registrants. Three days later, the tokenized-securities innovation exemption introduced in September met its first wave of concentrated disputes: the Solana Policy Institute demanded a tighter “permissionless” definition, Hedera argued that permissioned-validator networks should qualify, SIFMA asked for clear eligibility criteria, and Better Markets urged the SEC to withdraw the exemption and move to formal rulemaking. Meanwhile, 22 of the 62 companies on OKXICE’s tokenization list have explicitly objected, with Wells Fargo, Arm, and Intuit joining the veto camp on October 23. Permission and oversight are arriving simultaneously; tokenization is moving from “roundtable topic” to “compliance examination.”
Tokenization Enters the SEC Examination List Through the “Infrastructure” Door
On October 23, the SEC’s Division of Examinations announced its fiscal year 2027 examination priorities (Press Release 2026-109), listing eight areas of “heightened attention”: investment advisers’ fiduciary obligations and conflicts of interest; retail investor protection, particularly regarding complex, higher-risk, and illiquid products; private funds, private credit, and other complex investment strategies; broker-dealer financial responsibility, trading practices, supervision, and anti-money laundering compliance; operational resiliency, cybersecurity, and protection of customer information; emerging technologies, including superintelligence and other advanced technologies; risks associated with evolving market infrastructure, including Treasury clearing reforms, tokenization, and related developments; and oversight of self-regulatory organizations and other critical market participants. The list covers more than 34,000 registrants and was published more than three weeks earlier in the calendar than the prior fiscal year’s report (dated November 17, 2025).
Tokenization appears in three places in the report. For clearing agencies, examiners will cover high-risk areas “including risk management of defaults, recovery and wind-down, securities lending, operations, and tokenization”; under Regulation SCI (regulating core technology systems), exams will focus on emerging trends including superintelligence, tokenization of securities, extended trading hours, and quantum computing; and transfer agents will be examined on their use of emerging technology to perform transfer agent functions. Last year’s report did not use the word at all. Notably, this year’s report does not use the words “crypto” or “digital asset” anywhere. The SEC reaches tokenization through the clearing and settlement plumbing, not through a crypto label.
“Examinations are one of the Commission’s most important tools for promoting compliance with the federal securities laws and helping protect investors. Examinations provide critical insight into emerging risks, evolving business practices, and market developments across our financial system.”
— SEC Chairman Paul S. Atkins, SEC Press Release 2026-109, October 23, 2026
Division of Examinations Director Keith Cassidy said “the markets we oversee continue to evolve rapidly, and the examination program must evolve with them.” The report also upgrades “superintelligence” from last year’s “artificial intelligence” framing: it is both a cyber threat (threat actors using SI to automate and accelerate attacks, generating phishing messages and synthetic or deepfake voice and video for social engineering) and a control to be tested (SI use in AML, Reg BI, and trading functions). On November 9, the SEC will hold a public roundtable on machine-readable data and superintelligence. The anti-money laundering section singles out omnibus accounts maintained for foreign financial institutions: when a broker-dealer cannot see the underlying customer because of nested account structures, examiners will review special due diligence and sanctions monitoring, coordinated with the SEC Cross-Border Task Force to trace pump-and-dump schemes in foreign-based companies. The report also notes an enhanced memorandum of understanding with the CFTC that allows joint or aligned examinations.
The “Public and Permissionless” Dispute: Solana, Hedera, SIFMA, and 22 Listed Companies
Just one day before the examination list was published, the SEC’s tokenized-securities innovation exemption introduced in September was facing its first wave of concentrated disputes. This five-year exemption (in effect until September 17, 2031) allows qualifying venues to trade tokenized US stocks without registering as traditional securities exchanges, on condition that the smart contracts used for trading are auditable, publicly disclosed, and deployed on public, permissionless blockchains. The problem: the SEC never defined what counts as “public and permissionless.” The three companies that have filed operating notices chose strikingly different networks — TSV LLC plans to use Canton Network, an institutional network emphasizing privacy, while OKXICE and Kephas Corp. (Perpetuals.com) plan to use Ethereum Layer 2 networks developed by their respective corporate groups, XLayer and Kronos X Public.
| Operator |
Notice Date |
Network |
| TSV LLC |
2026-09-23 |
Canton Network (institutional privacy network) |
| OKXICE |
2026-10-04 |
XLayer (Ethereum L2) |
| Kephas Corp. (Perpetuals.com) |
2026-10-14 |
Kronos X Public (Ethereum-compatible L2) |
The standard-setting dispute was ignited on October 22 by the Solana Policy Institute. In its comment letter, the Institute urged the SEC to tighten the definition of “permissionless”: the mere fact that anyone can access a blockchain does not make it a permissionless network, and substantive decentralization should be judged by who holds authority over transaction validation or blocking and who can change network operating rules. Hedera, which filed its comment on October 9, took the opposite view: public blockchains that grant validation rights only to approved participants should not be excluded from the exemption solely because validator participation is restricted. Columbia Business School professor Omid Malekan and securities lawyer Gabriel Shapiro warned that centralized operators could retain control while enjoying the exemption’s benefits. SIFMA asked the SEC on October 19 to clarify which networks meet the standard and questioned whether issuers’ explicit consent should be obtained before tokenization, rather than requiring them to opt out. Better Markets urged the SEC to withdraw the exemption and undertake formal rulemaking.
The SEC’s stance is to let the market experiment. An SEC official said the measure is not formal rulemaking: qualifying venues can begin operations 30 days after filing a notice without separate approval, which does not mean the SEC endorses the chosen blockchain; the agency intentionally keeps a broad definition to leave room for experimentation, and may issue additional FAQs, while any substantive overhaul would require a commission vote.
Resistance from listed companies is more direct than the debate among blockchain camps. As of October 23, 22 of the 62 US-listed companies initially selected by OKXICE for tokenization have expressed opposition, more than one-third of the total; Wells Fargo, Arm, and Intuit were among six additional companies that objected on October 23, bringing the total to 22 including the 16 that had already exercised their veto rights. These companies are concerned their shares could circulate as blockchain tokens without their consent. Issuer-by-issuer objections mean “going on-chain” is no longer a unilateral decision by the platform.
Why Permission and Oversight Arrive in the Same Month
Viewed together, the two events of October reveal a “greenlight first, then tighten” structure in the SEC’s tokenization roadmap. On September 17, the innovation exemption took effect, allowing platforms to operate tokenized US stocks 30 days after filing a notice; after CLARITY Act failed in the Senate 49:50 on September 15, this administrative path became the only forward channel. On October 23, the Division of Examinations put tokenization on the clearing-agency and Regulation SCI examination lists, meaning tokenization moves from a “rulemaking topic” into “routine compliance examination.” Permission answers “can you do it,” while examination answers “are you doing it well.” While leaving room for experimentation, the regulator simultaneously builds examination and inquiry tools to accumulate material for the next round of rulemaking. Examination findings flow back into policymaking, which is exactly what the report repeatedly emphasizes as “inform Commission policy.”
Another detail worth noting is the report’s language: it never uses “crypto” or “digital asset,” reaching tokenization through the clearing and settlement pipeline. This means that for clearing agencies and transfer agents operating tokenized platforms, examiners will apply the same standards used to assess legacy systems (operational risk, wind-down planning, vendor dependence) to their distributed ledgers, rather than imposing a new crypto-specific framework. For practitioners, compliance costs and narrative heat will both rise in fiscal year 2027.
Implications for Practitioners
1
The definition of “permissionless” will decide which chains can enter the exemption channel
Solana argues for judging decentralization by actual control, Hedera argues that permissioned-validator networks should qualify, and the three operators’ choices — Canton plus two enterprise L2s — all carry permissioned characteristics. If the SEC adopts a tighter reading, the eligibility of enterprise L2s and institutional privacy networks will face direct impact; if the broad definition is kept, there is more room for experimentation but higher compliance uncertainty. Practitioners should track the comment summary and subsequent FAQs, and prioritize control and audit transparency when selecting chains.
2
Issuer opposition is the most realistic on-chain adoption risk
22 of OKXICE’s 62 targets have objected, more than one-third, and the opposition list grows every week. Although the innovation exemption includes an issuer veto mechanism, SIFMA has already questioned whether “tokenize by default, opt out later” is the right default. Platforms should front-load issuer consent before advancing tokenization, rather than treating vetoes as acceptable friction costs.
3
Tokenization entering routine examinations means a steeper compliance cost curve
Clearing agencies and transfer agents will face high-risk examinations covering default risk management, recovery and wind-down, securities lending, operations, and tokenization, while Regulation SCI-covered systems add superintelligence, quantum computing, and other new trends. Distributed-ledger programs will need to prepare the same operational risk and wind-down planning arguments as legacy systems, and vendor dependence will be a focus of inquiry.
4
Superintelligence enters regulatory discourse, reframing technology risk
The SEC treats superintelligence simultaneously as a source of cyber threats (deepfakes, phishing) and as a compliance tool (in AML, Reg BI, and trading), requiring automated systems to meet the same technology-neutral standards. Financial institutions deploying AI trading and compliance monitoring should retain explainable records of model decisions to withstand examination inquiries; the November 9 roundtable and subsequent FAQs are worth following.
5
The administrative “greenlight-examine-re-rule” loop is taking shape
After CLARITY’s legislative failure, the SEC uses the innovation exemption to greenlight, uses examination lists to gather evidence, then adjusts rules through commission action, forming a closed loop. The report is explicit that examination findings flow back into policymaking. For practitioners, the short term is the exemption channel, the medium term is examination inquiry, and the long term is the formal rules driven by both — the operational traces left during the experimentation window will become inputs to the next round of rulemaking.
Sources
- 1. SEC Announces Fiscal Year 2027 Examination Priorities — SEC, October 23, 2026
- 2. SEC’s 2027 Exam Priorities for 34,000 Firms Add Tokenisation Checks — TSN, October 23, 2026
- 3. Solana Policy Institute Urges SEC to Tighten Blockchain Test for Tokenized Stocks — TokenPost, October 2026
- 4. US SEC Tokenization Exemption Sparks Debate Over ‘Public, Permissionless’ Criteria; 22 Listed Companies Also Push Back — BigGo Finance, October 24, 2026
- 5. SEC Tokenization ‘Innovation Exemption’ Sparks Debate in US — TradingView/Bloomingbit, October 24, 2026
- 6. US SEC Tokenization Exemption Sparks Debate Over ‘Public, Permissionless’ Criteria — BlockBeats, October 24, 2026
- 7. SEC Announces FY 2027 Examination Priorities Focusing on Tokenization, Cybersecurity and Advanced Technology — BlockBeats, October 23, 2026
- 8. SEC Targets Private Markets, AI and Fiduciary Risks Among 2027 Exam Priorities — 401(k) Specialist, October 2026
