31. Law, Regulation, and Policy

the law is built to govern named people and licensed companies operating inside a country's borders. Web3 was engineered to be the opposite of all of that — global, anonymous, automatic, and fast. That mismatch, more than any single rule, is why the legal status of Web3 remains so unsettled.

"security" is a legal category for investments — things like company shares — that come with heavy rules to protect buyers. If a token counts as a security, the people who sold it had to follow those rules, and almost none did. So the whole question of whether tokens are securities is really a question of whether much of the crypto industry has been breaking the law all along.

the Howey test asks, in essence — did you put money into a shared venture expecting to get richer mainly because of work that other people would do? If yes, you bought a security, no matter what the seller called it. The original case was about orange groves; the same logic now gets applied to crypto tokens.

Howey has a loophole for crypto. If a token's network grows so spread-out that no single team is really steering it, then buyers aren't betting on anyone's efforts in particular — and the token might stop being a security. The hard part is that "sufficiently decentralized" has no precise definition, so nobody knows exactly where the line is.

the Ripple ruling said the same token could be a security or not depending on how it was sold and to whom. Sold privately to big investors under a contract promising profits from the company's work: a security. Sold blindly to ordinary people on an exchange who had no idea where their money went: not a security. Legal status attaches to the transaction, not just the token.

the EU didn't wait for courts to argue it out. It wrote a whole rulebook from scratch, invented fresh legal categories for crypto, and told companies exactly what they must do to operate legally across all 27 countries. The trade-off is the classic one between the two approaches: rules-first gives businesses clarity but can ossify or misfit a fast-moving field, while enforcement-first stays flexible but leaves everyone guessing.

a stablecoin is crypto pretending to be a dollar, and pretending convincingly enough that millions of people use it like one. Governments care intensely about anything that acts like money, because if it breaks, ordinary people lose savings and panic can spread. So both the EU and the US wrote stablecoin rules before almost anything else — demanding, above all, that every token actually be backed by real, redeemable reserves.

Web3 was built to take money out of central authorities' hands. A central bank digital currency does the reverse — it is the central bank's own money in digital form, fully under its control and fully visible to it. They use some of the same digital plumbing, but in spirit they point in opposite directions. Confusing the two is one of the most common errors in public discussion of "digital money."

the travel rule says "when money moves, the names of the sender and receiver must move with it." That works when banks are on both ends. It breaks down when someone sends crypto from their own wallet to another wallet with no company in between and only a string of characters as an identity. So there is a standing conflict: the rule needs intermediaries to enforce it, and Web3 was built to remove them.

if Web3 can run from anywhere, then a crypto business can simply set up wherever the rules are loosest, the way a ship registers under a "flag of convenience." Strict rules in one country don't stop the activity; they just push it somewhere friendlier. This is why no single nation can fully control Web3 on its own — and why some countries deliberately court the industry with light-touch regimes.

the law won't just decide whether Web3 is allowed — it will decide what Web3 is. Every legal ruling that turns a token into a security, a stablecoin into a regulated dollar, or a private wallet into a reportable account quietly puts a middleman back into a system designed to have none. Web3's biggest promise was to remove the gatekeepers; regulation's strongest tendency is to put them back. Which impulse wins is one of the central open questions of the entire project.