Notice-and-Comment Rulemaking (US)

Notice-and-comment rulemaking is the primary mechanism by which US federal administrative agencies create binding legal rules. Established under the Administrative Procedure Act (APA) of 1946, the process requires agencies to provide public notice of proposed rules and an opportunity for public comment before finalising them. Its application to crypto regulation — and, notably, the SEC’s decision under Chair Gensler to bypass it in favour of enforcement — is a central controversy in US crypto policy.

The Process

The notice-and-comment process follows a defined sequence. The agency publishes a Notice of Proposed Rulemaking (NPRM) in the Federal Register, setting out the proposed rule text, the agency’s legal authority for the rule, an explanation of its purpose and expected effects, and an invitation for public comment. The comment period, typically 30 to 90 days but sometimes extended for complex rules, allows any member of the public — firms, trade associations, individuals, academic researchers, consumer advocates — to submit written comments. After the comment period closes, the agency reviews the submissions, revises the proposed rule if warranted, and publishes a final rule in the Federal Register accompanied by a “preamble” responding to the significant issues raised in comments. The final rule generally takes effect 30 days after publication. Failure to follow APA procedures renders rules vulnerable to judicial invalidation.

The Congressional Review Act Layer

Above APA rulemaking sits the Congressional Review Act (CRA), which allows Congress to pass a joint resolution of disapproval nullifying a major final rule within 60 legislative days of its publication. The CRA has been invoked to strike down crypto-related regulations: in 2025, Congress used the CRA to overturn the IRS broker reporting rule that would have applied to DeFi platforms, with President Trump signing the resolution. This represents the full APA-to-CRA cycle operating on crypto regulation.

The Gensler Enforcement Approach

Under SEC Chair Gary Gensler (2021-2025), the SEC pursued crypto regulation primarily through enforcement actions rather than rulemaking. The theory was that existing securities laws already applied to most crypto assets under the Howey test, and that enforcement of existing law did not require new rulemaking — the SEC was simply applying rules already on the books. This approach had strategic advantages for the SEC: enforcement is faster than rulemaking (which can take years), and the SEC did not need to go through the notice-and-comment process to bring charges.

Critics, including crypto industry participants and some legal academics, argued that the enforcement approach amounted to “regulation by enforcement” — creating de facto rules about what is and is not permissible through the choice of targets and legal theories, without the transparency and accountability of the notice-and-comment process. Affected parties had no opportunity to comment on the interpretive positions the SEC was advancing before facing enforcement consequences.

Ripple’s Partial Win

The court’s ruling in SEC v. Ripple Labs (2023-2024) was significant for this debate. Judge Torres’s partial ruling that programmatic secondary market XRP sales to retail buyers did not satisfy the Howey test demonstrated that enforcement-based regulation is legally contestable in ways that properly promulgated rules would not be. Had the SEC defined through rulemaking which token sales constitute securities offerings, the legal landscape would have been clearer (and more difficult to contest). The enforcement-first approach created uncertainty that the courts, not the agency, ultimately resolved.

The Atkins Era: Return to Rulemaking

SEC Chair Paul Atkins has signalled a preference for rulemaking over enforcement as the mechanism for establishing the legal framework for crypto. This would mean publishing NPRMs setting out proposed rules for crypto asset custody, exchange registration, and disclosure requirements, going through public comment, and issuing final rules that establish clear legal obligations. The advantage of this approach for industry is predictability: firms know what is required before committing capital to compliance infrastructure. The disadvantage from a public interest perspective is speed: proper rulemaking for a comprehensive crypto framework could take three to five years.

Proper Rulemaking Requirements

If the SEC were to establish a crypto regulatory framework through proper APA rulemaking, it would need to define which crypto assets are securities (a legal question that may require legislative resolution first), specify registration requirements for crypto exchanges and custodians, set disclosure requirements for token issuers, and establish market manipulation and insider trading rules adapted for crypto markets. Each of these would require a separate rulemaking proceeding with notice and comment. The complexity of the undertaking is one reason why the enforcement approach, despite its legal vulnerability, was attractive to the Gensler SEC.