Greenlight and Exam in the Same Month: SEC Puts Tokenization on the FY 2027 Examination List for the First Time

On October 23, the SEC added tokenization to high-risk clearing-agency examination areas; three days later, the innovation exemption’s “public and permissionless” standard ignited a Solana-versus-Hedera dispute, and 22 listed companies pushed back against being tokenized. Permission and oversight arrived in the same month.

Tokenization Enters the SEC Examination List Through the “Infrastructure” Door

On October 23, the SEC’s Division of Examinations announced its fiscal year 2027 examination priorities (Press Release 2026-109), listing eight areas of “heightened attention”: investment advisers’ fiduciary obligations and conflicts of interest; retail investor protection, particularly regarding complex, higher-risk, and illiquid products; private funds, private credit, and other complex investment strategies; broker-dealer financial responsibility, trading practices, supervision, and anti-money laundering compliance; operational resiliency, cybersecurity, and protection of customer information; emerging technologies, including superintelligence and other advanced technologies; risks associated with evolving market infrastructure, including Treasury clearing reforms, tokenization, and related developments; and oversight of self-regulatory organizations and other critical market participants. The list covers more than 34,000 registrants and was published more than three weeks earlier in the calendar than the prior fiscal year’s report (dated November 17, 2025).

Tokenization appears in three places in the report. For clearing agencies, examiners will cover high-risk areas “including risk management of defaults, recovery and wind-down, securities lending, operations, and tokenization”; under Regulation SCI (regulating core technology systems), exams will focus on emerging trends including superintelligence, tokenization of securities, extended trading hours, and quantum computing; and transfer agents will be examined on their use of emerging technology to perform transfer agent functions. Last year’s report did not use the word at all. Notably, this year’s report does not use the words “crypto” or “digital asset” anywhere. The SEC reaches tokenization through the clearing and settlement plumbing, not through a crypto label.

Division of Examinations Director Keith Cassidy said “the markets we oversee continue to evolve rapidly, and the examination program must evolve with them.” The report also upgrades “superintelligence” from last year’s “artificial intelligence” framing: it is both a cyber threat (threat actors using SI to automate and accelerate attacks, generating phishing messages and synthetic or deepfake voice and video for social engineering) and a control to be tested (SI use in AML, Reg BI, and trading functions). On November 9, the SEC will hold a public roundtable on machine-readable data and superintelligence. The anti-money laundering section singles out omnibus accounts maintained for foreign financial institutions: when a broker-dealer cannot see the underlying customer because of nested account structures, examiners will review special due diligence and sanctions monitoring, coordinated with the SEC Cross-Border Task Force to trace pump-and-dump schemes in foreign-based companies. The report also notes an enhanced memorandum of understanding with the CFTC that allows joint or aligned examinations.

The “Public and Permissionless” Dispute: Solana, Hedera, SIFMA, and 22 Listed Companies

Just one day before the examination list was published, the SEC’s tokenized-securities innovation exemption introduced in September was facing its first wave of concentrated disputes. This five-year exemption (in effect until September 17, 2031) allows qualifying venues to trade tokenized US stocks without registering as traditional securities exchanges, on condition that the smart contracts used for trading are auditable, publicly disclosed, and deployed on public, permissionless blockchains. The problem: the SEC never defined what counts as “public and permissionless.” The three companies that have filed operating notices chose strikingly different networks — TSV LLC plans to use Canton Network, an institutional network emphasizing privacy, while OKXICE and Kephas Corp. (Perpetuals.com) plan to use Ethereum Layer 2 networks developed by their respective corporate groups, XLayer and Kronos X Public.

The standard-setting dispute was ignited on October 22 by the Solana Policy Institute. In its comment letter, the Institute urged the SEC to tighten the definition of “permissionless”: the mere fact that anyone can access a blockchain does not make it a permissionless network, and substantive decentralization should be judged by who holds authority over transaction validation or blocking and who can change network operating rules. Hedera, which filed its comment on October 9, took the opposite view: public blockchains that grant validation rights only to approved participants should not be excluded from the exemption solely because validator participation is restricted. Columbia Business School professor Omid Malekan and securities lawyer Gabriel Shapiro warned that centralized operators could retain control while enjoying the exemption’s benefits. SIFMA asked the SEC on October 19 to clarify which networks meet the standard and questioned whether issuers’ explicit consent should be obtained before tokenization, rather than requiring them to opt out. Better Markets urged the SEC to withdraw the exemption and undertake formal rulemaking.

The SEC’s stance is to let the market experiment. An SEC official said the measure is not formal rulemaking: qualifying venues can begin operations 30 days after filing a notice without separate approval, which does not mean the SEC endorses the chosen blockchain; the agency intentionally keeps a broad definition to leave room for experimentation, and may issue additional FAQs, while any substantive overhaul would require a commission vote.

Resistance from listed companies is more direct than the debate among blockchain camps. As of October 23, 22 of the 62 US-listed companies initially selected by OKXICE for tokenization have expressed opposition, more than one-third of the total; Wells Fargo, Arm, and Intuit were among six additional companies that objected on October 23, bringing the total to 22 including the 16 that had already exercised their veto rights. These companies are concerned their shares could circulate as blockchain tokens without their consent. Issuer-by-issuer objections mean “going on-chain” is no longer a unilateral decision by the platform.

Why Permission and Oversight Arrive in the Same Month

Viewed together, the two events of October reveal a “greenlight first, then tighten” structure in the SEC’s tokenization roadmap. On September 17, the innovation exemption took effect, allowing platforms to operate tokenized US stocks 30 days after filing a notice; after CLARITY Act failed in the Senate 49:50 on September 15, this administrative path became the only forward channel. On October 23, the Division of Examinations put tokenization on the clearing-agency and Regulation SCI examination lists, meaning tokenization moves from a “rulemaking topic” into “routine compliance examination.” Permission answers “can you do it,” while examination answers “are you doing it well.” While leaving room for experimentation, the regulator simultaneously builds examination and inquiry tools to accumulate material for the next round of rulemaking. Examination findings flow back into policymaking, which is exactly what the report repeatedly emphasizes as “inform Commission policy.”

Another detail worth noting is the report’s language: it never uses “crypto” or “digital asset,” reaching tokenization through the clearing and settlement pipeline. This means that for clearing agencies and transfer agents operating tokenized platforms, examiners will apply the same standards used to assess legacy systems (operational risk, wind-down planning, vendor dependence) to their distributed ledgers, rather than imposing a new crypto-specific framework. For practitioners, compliance costs and narrative heat will both rise in fiscal year 2027.

Implications for Practitioners