Federal exemptions from registration, whether Reg D or Reg A+, handle the federal side of a securities offering. They do not preempt state securities law. Every state maintains its own "blue sky" statutes, and for a digital securities issuer selling to investors across multiple states, understanding how those state laws interact with your federal exemption is one of the more friction-heavy parts of running a compliant offering.
This overview explains the basic structure of blue sky compliance for digital securities, how the rules differ between Reg D and Reg A+ offerings, and where the specific high-friction states tend to cause problems. We are not providing legal advice here, and specific state requirements change; use this as orientation, not as your compliance checklist.
The Federal-State Layer Interaction
The National Securities Markets Improvement Act of 1996 (NSMIA) preempted state registration requirements for "covered securities," which includes securities sold in Reg D Rule 506 offerings and Reg A+ Tier 2 offerings. That preemption, however, does not mean states have no role. States retained the right to require notice filings and to collect fees, and they retained full anti-fraud jurisdiction over all securities transactions in their state.
For Rule 506 offerings, Section 18(b)(4)(D) of the Securities Act confirms federal preemption of state registration, but states may still require a Form D notice filing within 15 days after the first sale in that state. Most states have adopted this notice requirement, and failure to file on time, while not typically a deal-killer, is a compliance gap that can surface in later examinations.
For Reg A+ Tier 1 offerings, the situation is more complex. Tier 1 offerings are not federally preempted, meaning states can and do require registration or qualification of the offering before you sell to their residents. The SEC's coordinated review process through the North American Securities Administrators Association (NASAA) exists specifically to reduce the burden of multi-state Tier 1 registration, but it does not eliminate it. Tier 2 offerings under Reg A+ are preempted for state registration purposes, though notice filings may still apply.
Reg D 506(b) and 506(c): The Notice Filing Requirement
For most digital securities issuers using Rule 506(b) or 506(c), the primary blue sky obligation is the state notice filing. You file with the SEC on Form D, and many states require a separate state notice filing, sometimes with a filing fee, sometimes accompanied by a consent to service of process, and often with their own deadline rules that differ from the federal 15-day window.
New York requires that issuers file a Form 99 (Uniform Investment Adviser Notice Filing) in addition to the federal Form D. California requires a Form D notice filing with the Department of Financial Protection and Innovation, with fees based on the amount sold in the state. Texas requires a Form D notice and imposes its own eligibility conditions on certain types of offerings, including some restrictions on how general solicitation is conducted under 506(c) that go beyond the federal minimum requirements.
Florida, notably, requires a notice filing within 30 days of the first sale to a Florida resident, a deadline that differs from the 15-day federal window, and requires payment of a filing fee. Missing this window exposes you to a deficiency that can complicate later transfers of the same security within Florida.
The practical upshot: you need a state-by-state filing calendar that maps to your actual investor roster. When you close a subscription from an investor in a new state, the state notice filing deadline clock starts, and different states start counting differently.
Transfer Restrictions and the Blue Sky Resale Problem
The blue sky issue that most directly affects tokenized securities is not the initial offering notice filing. It is the secondary transfer problem. When an investor who purchased under Rule 506 wants to sell or transfer their digital security to another investor, that resale transaction is subject to its own state-level analysis.
The federal resale rule under Rule 144 provides safe harbors for resales of restricted securities, including a one-year holding period for non-reporting companies. But Rule 144 does not preempt state resale restrictions. The state where the selling investor is located, and in some analyses the state where the buying investor is located, may require a separate registration or exemption for the secondary transfer.
Most states have adopted resale exemptions that cover secondary transfers of federally preempted securities, but the coverage is not uniform. Some states have limited resale exemptions that apply only if the original sale was made to an in-state resident, or that impose conditions on the nature of the buyer (accredited status, holding period requirements, or a cap on the number of purchasers in a rolling 12-month period).
For tokenized securities specifically, this creates a transfer restriction mapping challenge that does not exist in the same form for traditional private placement interests. Traditional restricted securities are not easily transferred, so the secondary market is thin and the friction of state-by-state analysis is acceptable. Tokenized securities are technically easy to transfer, which means the compliance infrastructure needs to actively enforce what the paper-based world achieved through illiquidity.
High-Friction States for Digital Securities
Not all 50 states carry equal compliance weight. Based on the regulatory posture of state securities administrators, the states that require the most attention in a multi-state digital securities program are, in rough order of compliance friction: California, New York, Texas, Massachusetts, and Illinois.
California's Department of Financial Protection and Innovation has been active in examining digital asset offerings and has published guidance on how existing blue sky statutes apply to tokenized securities. California's non-preempted review authority over secondary transfers is particularly relevant for tokenized securities programs with California-resident investors.
Massachusetts has historically taken an aggressive stance on private placements through its securities enforcement program. The state has used anti-fraud authority and its own merit review provisions to scrutinize offerings that, while federally preempted from registration, still fall within the state's anti-fraud jurisdiction.
New York's Martin Act provides the state's attorney general with broad jurisdiction over securities fraud, without a requirement to prove scienter. For digital securities issuers, this means that even a technically compliant federal exemption does not insulate you from a New York enforcement action if your offering materials contain misleading statements under New York law.
Reg A+ Tier 1 Versus Tier 2: Where Blue Sky Really Bites
The choice between Reg A+ Tier 1 and Tier 2 is, for many issuers, effectively a blue sky compliance decision. Tier 2 caps the offering at $75 million per 12-month period (as of the current rules) and preempts state registration. Tier 1 is capped at $20 million, carries no individual investor limits, and requires state qualification or a state exemption in each state where you sell.
For digital securities issuers targeting a broad retail base, Tier 2 is usually the better path precisely because state-by-state qualification would be prohibitively expensive. A Tier 1 offering to investors in 20 states requires compliance with the registration or exemption rules of all 20 states, plus the NASAA coordinated review process, which itself takes several months and involves responding to comments from multiple states simultaneously.
The tradeoff is investor limits: Tier 2 non-accredited investors face a 10% limit (of the greater of annual income or net worth) on the amount they can invest in any 12-month period across all Tier 2 offerings. Enforcing that limit at the issuer level requires tracking investor-level investment amounts, which adds its own compliance overhead.
Practical Compliance Approach
What we have found, building state restriction monitoring for Bluprynt, is that the useful unit of analysis is not "which states require notice filings" but rather "which compliance actions need to happen, in which sequence, for each investor state." The question is not a lookup table. It is a workflow that combines the investor's state of residence, the offering type (506(b), 506(c), Reg A+ Tier 2), the timing of the investment, and the specific state's current notice requirements and fees.
For secondary transfers, the relevant inputs expand: selling investor's state, buying investor's state, the date of original purchase, whether any holding period conditions have been met, and whether the transfer falls within any applicable resale exemption in both states.
The states that require the most active monitoring are not always the states with the highest filing fees. They are the states whose exemptions have conditions that can expire or that require periodic renewal, or whose administrators have demonstrated a willingness to use anti-fraud jurisdiction to reach back into apparently compliant offerings. Knowing which states those are, and building that into your transfer restriction monitoring, is where compliance exposure is actually managed.