Who Regulates What: The Architecture of Investor Protection
7 steps · one page
In short
The useful thing to understand first is that there is no single regulator, and the divisions between the ones that exist are drawn according to what the instrument is rather than what the investor is doing with it.
Scope. This article describes the structure — which bodies exist, what each covers, and how the boundaries between them are drawn. The conduct standards that apply to broker-dealers and investment advisers are established in Broker-Dealers, Investment Advisers and the Standards That Apply and are not restated. No officeholder is named. Individuals in these posts change, and an article that named them would begin decaying immediately. United States architecture, verified 17 August 2026; other jurisdictions are organised differently and the closing section says how.
One person, in one afternoon, buying shares and then a futures contract and then a token, moves across three regulatory regimes — and the boundary of the third is genuinely unsettled.
Four layers
| Layer | What it is | What it covers |
|---|---|---|
| Federal securities agency | A government agency created by statute in 1934 | Securities issuance, trading and disclosure; broker-dealers, investment advisers, funds, exchanges |
| Federal derivatives agency | A separate government agency | Derivatives markets under the Commodity Exchange Act — but not spot markets |
| Self-regulatory organisations | Private corporations exercising delegated authority | Member firms: licensing, examination, rulemaking and enforcement within the federal framework |
| State securities regulators | State-level authorities | Registration and enforcement within each state, alongside the federal layer |
The layer most readers have never thought about
A self-regulatory organisation is a private corporation.
The body that supervises brokerage firms in this market is not a government agency. It is a private American corporation, successor to a predecessor body that operated from 1939 until 2007, which performs licensing, routine examination, rulemaking and enforcement over its member firms — and it is funded by the industry it regulates. It operated on a budget of roughly $1.5 billion with about 4,400 employees in 2025.
Its rules are subject to approval by the federal securities agency, which is the mechanism connecting a private body to public authority. The Pillar 29 article on the day-trading margin regime is an illustration of that process working: the self-regulatory organisation proposed amendments to its own margin rule and the federal agency approved them, after which they took effect.
Worked example
Why this is worth stating rather than glossing. The argument in Reading Financial Media Critically — that an organisation is shaped by what pays for it — is a general one, and it applies here as much as to a publication. A regulator funded by its member firms has a structural characteristic worth knowing about, and this portal states it as a fact rather than a complaint. It does not follow that the arrangement fails. Industry funding also buys expertise, proximity and a scale of examination that a government agency covering the same ground would need appropriations to match, and the approval requirement above is the designed check. What follows is only that a reader should know which of the bodies protecting them is a government agency and which is a private corporation — because almost nobody does, and the two are routinely described in the same breath.
How the agencies are insulated, structurally
The federal securities agency is led by five commissioners appointed by the president with staggered five-year terms, one designated as chairman. By law, no more than three may belong to the same political party. The derivatives agency is similarly constituted with five commissioners.
That party-composition limit is a deliberate design feature rather than a convention — an attempt to make the body's composition resistant to a single election, in the way staggered terms make it resistant to a single appointment round.
The boundary that is currently unresolved
Which agency covers digital assets depends on whether a given instrument is a security or a commodity, and as of 2026 that question is not settled.
The two agencies issued a joint memorandum of understanding, and on 17 March 2026 a joint interpretation addressing how the federal securities laws apply to crypto and crypto-related transactions. Legislative work has clarified some aspects, particularly around stablecoins and market structure. The underlying classification question remains open, with the securities agency continuing to maintain that many tokens fall within its jurisdiction.
A structural constraint compounds this: the derivatives agency cannot oversee spot markets, and has asked Congress for that authority. So there are instruments traded in venues where the applicable regime is a matter of ongoing dispute rather than settled law.
What that means for a reader, stated carefully and without a view on how it should be resolved. Protection is not a property of a market or a platform. It is a property of the legal characterisation of the specific instrument being bought, and of the registration status of the party selling it. Two things that look similar on a screen can sit under different regimes, one regime, or a regime nobody has yet agreed on. Which is why the practical question is never "is this regulated" but "by whom, under which statute, and is the party I am dealing with actually registered with them". The registration question is checkable and the last article in this pillar sets out where. This portal takes no position on how the classification dispute ought to be resolved.
Other jurisdictions
The four-layer structure described above is specific to the United States. Other jurisdictions divide the same functions differently — some place market conduct and prudential supervision in separate authorities, some combine them, and in the European Union a central authority coordinates while national competent authorities supervise firms in each member state. No cross-jurisdictional equivalence should be assumed: a body with a similar name may have a materially different remit.
Frequently asked
8 questions
Is there a single regulator of investing?
No. Several bodies exist, and the divisions between them are drawn according to what the instrument is rather than what the investor is doing — so buying shares, then a futures contract, then a token moves a person across three regimes.
What are the four layers?
A federal securities agency created by statute in 1934; a separate federal derivatives agency operating under the Commodity Exchange Act but not covering spot markets; self-regulatory organisations exercising delegated authority over member firms; and state securities regulators alongside the federal layer.
Is the body that supervises brokerage firms a government agency?
No. It is a private American corporation, successor to a body that operated from 1939 to 2007, performing licensing, examination, rulemaking and enforcement over member firms — and funded by the industry it regulates, on a budget of roughly $1.5 billion with about 4,400 employees in 2025.
Does that mean it does not work?
That does not follow. Industry funding also buys expertise, proximity and examination scale, and its rules require approval by the federal securities agency, which is the designed check. What matters is that a reader knows which protector is a government agency and which is a private corporation, since the two are routinely described in the same breath.
How are the agencies insulated?
Five commissioners with staggered five-year terms, one designated chairman, and a statutory limit of no more than three from the same political party — a deliberate design feature intended to make composition resistant to a single election.
Who regulates digital assets?
It depends on whether a given instrument is a security or a commodity, and as of 2026 that is unsettled. The two agencies issued a joint memorandum of understanding and, on 17 March 2026, a joint interpretation on crypto and crypto-related transactions; the classification question remains open, with the securities agency maintaining that many tokens fall within its jurisdiction.
What is the practical takeaway?
That protection is a property of the legal characterisation of the specific instrument and the registration status of the seller — not of a market or a platform. So the question is never "is this regulated" but "by whom, under which statute, and is the party I am dealing with actually registered with them".
Does this describe other countries?
No. Other jurisdictions divide the same functions differently, and in the European Union a central authority coordinates while national competent authorities supervise firms in each member state. A body with a similar name may have a materially different remit.
References
- SEC — Mission and organisation (commission structure, staggered terms, party limit) —
- SEC — Division of Trading and Markets, scope of oversight including self-regulatory organisations —
- CFTC — About the Commission (derivatives remit under the Commodity Exchange Act) —
- FINRA — About FINRA (private, not-for-profit self-regulatory organisation; funding; annual reports with budget and headcount) —
- North American Securities Administrators Association — the state and provincial regulators —
- SEC Division of Examinations — Examination Priorities, Fiscal Year 2026 —
Educational and informational only — not investment advice, a recommendation, or an offer to buy or sell any security. Investing involves risk, including the possible loss of principal. Worked examples use fictional companies and figures.