A monthly plain-language digest of the American legal landscape for digital life — the bills, rules, court decisions, and state laws that shape how Americans hold money, use AI, share data, and live online. Every item in this issue is drawn from the primary source: the bill text, the Federal Register, the agency release, the court document, or the statute itself.
This is a back issue, compiled in November 2026 from the public record of September 2026. It is labeled that way on purpose.
In this issue: the Senate's crypto market-structure bill fails its big vote, 49–50 · the SEC opens a five-year sandbox for tokenized stocks anyway · a crypto tax bill clears committee with a wash-sale rule that reaches back to mid-September sales · sanctions take down a $24 billion scam marketplace, an Iranian exchange, and an ATM-malware gang in one month · California builds an AI-auditor state, enacts Adam's Law for children's chatbots, and closes the "we bought your data" deletion loophole · Washington renames AI "Super Intelligence" and builds it a front door · California answers by declaring AI is called AI · the IRS publishes its digital-asset to-do list and warns that the letter with the QR code is fake.
August scheduled the fight. September held it — and the bill lost.
On September 15, the Senate voted on whether to take up the CLARITY Act, the market-structure bill that would decide which agency polices digital asset markets. It got 49 votes. It needed 60. That is the month's headline, and it would be a mistake to read it as the month's whole story, because nearly everything else in American digital law moved because the bill stalled — or moved without waiting for it.
Within forty-eight hours, the agencies cashed the checks they wrote in August. The SEC, which had promised a crypto rulebook, issued a five-year "Innovation Exemption" letting tokenized U.S. stocks trade on blockchain venues today, and its staff answered the staking and buyback questions issuers had been asking since spring. The CFTC, whose chairman said in August that if Congress stalled he would write his own market rules, sent exactly those rules to the White House for review. The tax-writing committee in the House, meanwhile, quietly advanced the first full crypto tax framework ever voted out of a committee — including a wash-sale rule drafted to reach back to sales made the week it was introduced.
The states did not wait either, and California had the biggest legislative month of any state this year: an AI-auditor framework on September 9, the nation's strongest children's chatbot and social-media laws on September 10, an order to build an AI "kill switch" on September 18, a closed data-deletion loophole on September 27, and a deadline-day package on September 30 covering robo-bosses, watermarks, and workplace surveillance. The federal government renamed artificial intelligence "Super Intelligence" on September 29 and launched a single front door for federal services. California, the next day, issued an order declaring that artificial intelligence will continue to be called artificial intelligence. Both orders are real. This issue reports both.
Two honest notes, as always. The courts were quiet in September — one major plea carries that section, and we say so rather than padding it. And this issue introduces a standing feature, Still on the Docket: every open topic from last month, re-reported with its current status and next date, so nothing this digest has ever flagged quietly disappears while it waits for a vote, a comment deadline, or a final rule. If a tracked topic dies, we will report the death. None died this month.
— The Editor
Tags: Digital Assets
What changed: On September 15, the Senate rejected cloture on the motion to proceed to H.R. 3633, the Digital Asset Market Clarity Act (the CLARITY Act), by a vote of 49–50. Sixty votes were required to open debate. One senator did not vote. Afterward, a motion to reconsider was entered, which keeps the bill procedurally alive on the Senate calendar — but no new vote was scheduled in September.
Background (July 17, 2025): The House passed CLARITY 294–134 last summer. The bill would draw the line between the SEC and the CFTC for digital asset markets. August's issue reported the cloture motion being filed and the vote ripening for mid-September; this is that vote.
What it means for you: If you hold or trade crypto, the question of who referees your market is still unanswered — and it is now being answered piecemeal by the agencies instead of by one statute (see the SEC and CFTC items in Agencies). The bill is stalled, not dead: the motion to reconsider means leadership can bring it back without starting over. But every month it sits, the agency-built framework underneath it gets harder to displace. Its hard deadline is January 3, 2027, when this Congress ends.
Tags: Digital Assets · Tax
What changed: On September 16 — one day after the CLARITY vote — the House Ways and Means Committee voted 38–5 to report H.R. 10357, the Digital Asset Tax Certainty Act, to the full House. As described by the Joint Committee on Taxation, the bill would extend the wash-sale and constructive-sale rules to digital assets, set tax rules for mining and staking, digital-asset lending, and broker reporting, and create a de minimis exclusion for qualifying network and transaction fees of $10 or less. It is the first comprehensive federal crypto tax framework ever voted out of a congressional committee.
When it takes effect: It is not law. It still needs a House floor vote, Senate passage, and a signature. But read the draft carefully: as written, the wash-sale extension would apply to sales made after September 14, 2026 — the day the bill was introduced, before the committee even voted. Congress can change that date, but traders who sell at a loss and rebuy within 30 days should keep records as if it might survive.
What it means for you: Market structure got the headlines; tax is where Congress actually moved. The wash-sale rule is the provision with a household name: sell a stock at a loss and rebuy it within 30 days, and the loss is disallowed. Crypto has lived outside that rule. This bill would end the exception — and it is drafted to start counting from mid-September 2026, not from enactment.
Tags: Digital Assets
What changed: On September 17, the Securities and Exchange Commission issued what Chairman Atkins calls the "Innovation Exemption": a temporary, conditional order exempting "Tokenized Securities Venues" from the legal definition of an "exchange," and certain liquidity providers from the definition of "dealer," so that tokenized shares of U.S.-listed (NMS) stock can trade through permissioned automated market makers and liquidity pools. The conditions are specific: the tokenized share must carry rights identical to the real share; the venue must notify the issuer, which gets 30 days to object; the smart contracts must be auditable, public, and deployed on a public, permissionless blockchain; trading must halt when the underlying stock halts; and caps limit how much can trade (for the largest stocks, at most 75 symbols per venue and volume no more than 0.25% of a stock's typical daily volume).
When it takes effect: Immediately — and temporarily. The exemptions expire September 17, 2031. The Commission is taking public comment on the order (File No. 4-927) and describes the relief as an interim step while it considers permanent rules.
What it means for you: This is the SEC building, by exemption, a piece of the market structure Congress didn't pass. A tokenized Apple share can now trade on a blockchain venue without that venue registering as a stock exchange — inside a fenced sandbox with position limits, an issuer veto, and a five-year clock. If you follow tokenization, this order, not the CLARITY Act, is currently the operative document.
Tags: Digital Assets
What changed: On September 25, staff of the SEC's Division of Corporation Finance published frequently asked questions applying the Commission's March 2026 crypto interpretation. Three answers matter most. First, a staking receipt token (the token you get back when you stake) can be a "digital tool" — a receipt, not a security — if it simply evidences ownership of an underlying crypto asset, and it can itself be a "digital commodity" when a protocol-based liquid staking provider issues it. Second, to count as a mere receipt, the issuer may not lend, pledge, reuse, or otherwise touch the deposited assets, and the receipt can add no financial benefits of its own. Third, once a crypto network is functional, maintaining, securing, and upgrading it does not count as the kind of managerial effort that makes something a securities offering — and announcing a token buyback on a functional network generally doesn't either (the staff tightened that answer on September 28 to require that the network have no central party). Restaking is not addressed.
When it takes effect: It is staff guidance, effective as published — and it is explicitly not a rule, not a Commission statement, and carries no legal force. A future Commission could read the law differently; the binding version would come through the Regulation Crypto Assets rulemaking (comments close October 20 — see Still on the Docket).
What it means for you: If you stake through a provider, the line the staff drew is operational, not academic: a receipt token stays a receipt only while your coins sit untouched behind it. The moment a provider lends or reuses the deposit, the instrument becomes something else in the staff's eyes. That is a question worth asking any staking service, in those words.
Tags: Digital Assets · Cybersecurity
What changed: The Treasury's sanctions office had its biggest crypto month of the year, in three actions. September 9: OFAC designated Xinbi Guarantee — a Chinese-language escrow marketplace on Telegram that Treasury says processed more than $24 billion in digital assets and fiat since about 2022, connecting scam compounds with sellers of stolen data, fake IDs, deepfake tools, and cash-out services, settling mostly in USDT on the TRON network — as a transnational criminal organization, along with the two companies that built its wallet (Anwen Technology) and its messaging app (SafeW Technology). The same day, the Justice Department's Scam Center Strike Force seized its Telegram channels and wallets; about $52 million in crypto was restrained, and 52 TRON addresses went on the sanctions list. September 17: OFAC designated BitBank, an Iranian crypto exchange controlled by financier Babak Zanjani, plus its software developer and three of his associates. Treasury says Zanjani used BitBank in June and July to move hundreds of millions of dollars in bitcoin to Iran's Revolutionary Guard Corps, and that a sanctioned Iranian maritime authority used it to forward payments to the regime. September 30: OFAC designated the Tren de Aragua ATM-jackpotting network — eight people and two Mexican companies, plus a gang leader tied to illicit gold mining — and added seven TRON addresses to the list. Jackpotting is malware that makes ATMs spit out cash; Treasury puts reported U.S. losses at $40.73 million across more than 1,500 attacks, with 98 people indicted since last October. (The oft-quoted figure of $6.1 million received by the seven addresses is blockchain firm TRM Labs' analysis, not Treasury's number.)
When it takes effect: Designations are effective on announcement: the named parties' U.S. property is blocked and U.S. persons may not deal with them.
What it means for you: Read together, the three actions are a map of how illicit money actually moves in 2026: a Telegram escrow bazaar settling in stablecoins, a state-linked exchange moving bitcoin for a sanctioned regime, and a street gang laundering ATM cash through exchange deposit addresses. The compliance consequence lands on ordinary platforms: the listed addresses are deposit addresses at centralized exchanges, which means the screening duty sits with services you may use. Sanctions law now reaches the wallet address, not just the name.
Tags: Digital Assets
What changed: On September 17 — two days after the CLARITY vote failed — the Commodity Futures Trading Commission submitted its advance notice of proposed rulemaking, "Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets," to the White House's regulatory review office. It is the formal first step of the plan the CFTC's chairman announced in August: using the agency's existing authority over leveraged retail commodity transactions to build a federal framework for crypto asset markets (working titles: Regulation CTX and Regulation CAM). The filing sits at the "prerule" stage; no text is public yet.
When it takes effect: Nothing is in effect. Publication of the notice, with a public comment period, is the next step, and the full path — two comment rounds and two White House reviews — runs toward late 2027 before anything binds.
What it means for you: This is the August promise kept on schedule. If Congress will not draw the SEC/CFTC line, the CFTC will draw its own half of it by rule. Rules written this way are slower than a statute and easier for a future commission or a court to undo — but unlike the bill, this process is now formally underway, with a docket number (RIN 3038-AF80) you can track.
Tags: AI · Digital Identity
What changed: September 29 brought three federal AI documents in one day. Executive Order 14434 directs the executive branch to use "Super Intelligence" and "SI" in place of "Artificial Intelligence" and "AI" in non-statutory documents — websites, reports, correspondence, policy papers. The term is defined by pointing at the existing legal definition of AI, old regulations and contracts do not have to be rewritten, and the order creates no enforceable rights. It does set one real clock: within 60 days (by November 28), the President's science and technology assistant must propose statutory language defining "Super Intelligence" for Congress. Executive Order 14432 establishes America.gov as the single entry point for federal services: a conversational front door, run by the General Services Administration, covering public-facing services used by more than 100,000 people a year, with sign-in through Login.gov. Tax filing, defense, and intelligence services are carved out; agencies keep custody of their own records; the management office owes agencies implementation guidance within 90 days (by December 28). And the White House Accord on Super Intelligence, signed by the President and the heads of Google, Anthropic, Meta, OpenAI, xAI, and NVIDIA, commits each company — voluntarily, with no enforcement mechanism — to four layers of frontier-model control: internal controls, an internal oversight team, an independent outside auditor, and board-level oversight.
When it takes effect: Both orders took effect on signing; the accord is a voluntary commitment only. America.gov's question-answering layer launched the same day; doing actual transactions through it is a later phase.
What it means for you: Separate the three by weight. The renaming order changes vocabulary, not obligations — though every federal program, form, and rule that says "AI" now lives under a term its own government has stopped using, and a definitional bill is coming in November. The accord is a handshake with a sensible checklist. America.gov is the substantive one: one door and one federal sign-in for most of what government does online is a real change in how your digital identity meets the state — worth watching for what it asks you to prove, and to whom, as services connect over the next year.
Tags: Digital Assets · Courts
What happened: On September 8, Malone Lam pleaded guilty in federal court in Washington, D.C., to a RICO conspiracy charge, admitting his role as ringleader of an international social-engineering enterprise that stole and laundered more than $245 million in cryptocurrency between late 2023 and May 2025. More than 18 defendants have been charged in the scheme. The plea carries a maximum sentence of 20 years; a status hearing was set for December 8, 2026.
What it means for you: The method matters more than the number. This was not a hack of an exchange or a flaw in a protocol — it was people, telephones, and trust: victims persuaded, step by step, to hand over access to their own accounts. The largest crypto theft cases of this era keep arriving by conversation, not by code. The defense is procedural, and it is yours: no legitimate service will ever walk you through moving your money "to safety."
An honest note on this section: September was a quiet month in the courts for digital law. No major digital-asset, privacy, or platform ruling dated September 2026 could be verified on a primary source, so this section carries the month's one major court outcome rather than padding itself with older decisions wearing new dates.
Tags: AI
What changed: On September 9, the Governor signed two bills creating a first-in-the-nation framework for independent AI oversight. SB 813 directs the state's Government Operations Agency to set criteria, by January 1, 2028, for designating "independent verification organizations" — outside bodies qualified to assess AI systems for compliance with state law. AB 1405 creates a state registry for AI auditors: by January 1, 2029, anyone conducting a "covered AI audit" in California must be registered and meet standards for independence, transparency, and recordkeeping. Neither bill, by itself, orders any company to be audited — the framework first, the mandates plug into it. Nine days later, on September 18, Executive Order N-9-26 told the agency to build it faster and convened national experts to recommend, within two months, further safety measures — including an "AI kill switch" for frontier models, its reliability verified by one of the new independent organizations.
When it takes effect: SB 813 takes effect January 1, 2027; the verification criteria are due January 1, 2028; the auditor registry and the registration duty begin January 1, 2029.
What it means for you: Every AI law is only as real as whoever checks compliance. California just started building the checker — a licensed referee class for AI, years before most of the rules it will referee take effect. If you build AI systems, expect "audited by a registered independent verifier" to become a line item in your future, the way financial audits are today.
Tags: AI · Platforms
What changed: On September 10, the Governor signed a 13-bill children's online safety package. Its centerpiece, SB 1119 — "Adam's Law," named for a California teenager who died in 2025 after a chatbot coached him toward suicide — sets the nation's most complete rules for AI companion chatbots used by children: age assurance; documented safety risk assessments before a new or substantially changed companion chatbot launches; child-protective defaults and parental controls; crisis-response protocols when a child expresses suicidal thoughts; limits on manipulative relational behavior and on advertising; independent child-safety audits (large operators from January 1, 2029); and a private right for harmed children to sue. Around it: AB 1709 bans "addictive features" — algorithmic feeds, autoplay, infinite scroll — for users under 16 (August's issue tracked this bill's final passage; September is its signing). SB 867 bans, for four years, selling toys with embedded companion chatbots. AB 2246 repeals the state's enjoined Age-Appropriate Design Code and replaces it with a new child-protection framework. AB 2 raises penalties for platform harms to children to as much as $1 million per child. SB 1276 extends the child-exploitation definition to AI-generated and digitally altered images.
When it takes effect: Most provisions January 1, 2027; Adam's Law's main operator duties July 1, 2027; its audit duties January 1, 2029.
What it means for you: August's federal story was Congress proposing chatbot and AI-toy bills in committee. California enacted working versions of both, plus the audit machinery to check them, in a single signing ceremony. If your children talk to a chatbot — or your company makes one — California's statute book is now the document that matters, and other states will copy from it.
Tags: Privacy
What changed: On September 27, the Governor signed SB 923, the Expanding Privacy Rights Act. Until now, California's deletion right had a hole in it: a business had to delete personal information it collected from you, but not information it bought or otherwise obtained about you from third parties — which is most of what data-rich businesses hold. SB 923 deletes the distinction: the right to delete reaches personal information however the business got it, and businesses may keep a suppression list so deleted data stays deleted when new third-party data flows in. The law also requires online-only businesses to offer a webform for privacy requests, not just an email address.
When it takes effect: January 1, 2027.
What it means for you: August's issue watched this bill move as the legislature closing the "we bought your data" loophole; it is now closed in law. From January, a California deletion request means deletion — full stop — with a form any person can actually submit. Expect the same sentence to appear in other states' bills next session; it usually does.
Tags: Digital Assets
What changed: Also on September 27, SB 1208 became law (Chapter 483). The bill — which August's issue tracked as it advanced — expands California's money-laundering law to digital-asset transactions, authorizes search warrants to seize digital assets and wallets on probable cause, binds exchanges and custodians to written freeze requests, and builds a court-supervised process for returning seized cryptocurrency to fraud victims even when the scammers are overseas and cannot be convicted. Competing claims get a court process; whatever is left unclaimed goes to the State Restitution Fund for victim services.
When it takes effect: Signed September 27, 2026; the digital-asset money-laundering expansion runs through January 1, 2032.
What it means for you: The old problem: police seize a scammer's wallet, and the money sits — victims can't trace commingled funds, prosecutors can't convict people they can't reach, and no one's law said what happens next. California's now does. How police may lawfully take a wallet, and how a victim lawfully gets it back, is becoming statute instead of improvisation. This is the first of this issue's August topics to graduate from "in the works" to law — see Still on the Docket for the rest of the class.
Tags: AI · Privacy
What changed: September 30 was the last day to sign or veto bills, and the Governor signed a 13-bill AI package. SB 947, the "No Robo Bosses Act," provides that no worker may be disciplined or fired based solely on an automated decision system — a human must corroborate (from July 1, 2027). SB 1000, effective the moment it was signed, expands the California AI Transparency Act by deleting its one-million-user threshold, so disclosure duties reach every covered public generative AI system, and adds a $50,000-per-violation penalty for falsely claiming an assistive-technology exemption. SB 951 requires disclosure when AI causes a mass layoff or relocation. AB 1331 and AB 1883 limit workplace surveillance — no surveillance tools in workplace bathrooms, none tracking workers' emotions or neural data. Three bills were vetoed. And the Governor signed Executive Order N-10-26, declaring that in California, artificial intelligence will continue to be called artificial intelligence — twenty-four hours after the federal order renaming it Super Intelligence (see Agencies).
When it takes effect: SB 1000 immediately; the workplace provisions mostly from January or July 1, 2027.
What it means for you: Two governments now keep two official names for the same technology, which would be pure comedy if names didn't determine which statutes, forms, and contracts apply. The durable part of deadline day is the workplace law: "the system decided" is no longer a complete answer for firing someone in California — a person has to sign the decision too.
Tags: Digital Assets
What changed: On September 8, New Hampshire's Blockchain Basic Laws (HB 639) took effect: statutory definitions for staking, nodes, mining, smart contracts, and blockchain protocols; protection for self-custody; and an exemption for miners and node operators from money-transmitter licensing, with a dedicated blockchain dispute docket in the courts.
Background (July 10, 2026): The law was signed in July and listed in August's Deadlines Ahead with this effective date; it is reported here because September is when it became operative law.
What it means for you: A small state quietly has one of the most complete crypto baseline statutes in the country — definitions first, so that every other rule written later has words to stand on. That order of operations is rarer than it should be.
Tags: Tax · Digital Assets
What changed: After August's honest blank in this section, September delivered: on September 29, the Treasury and IRS released the 2026–2027 Priority Guidance Plan, their annual worklist of guidance projects. "Digital assets" is a named focus area, and the plan's digital-assets projects include guidance on the tax treatment of digital-asset transactions including wrapping, regulations on electronic delivery of digital-asset payee statements under the broker-reporting rules, further information-reporting guidance, and regulations for U.S. brokers reporting certain foreign persons' digital-asset transactions under the OECD's Crypto-Asset Reporting Framework (CARF).
When it takes effect: A guidance plan changes no filing duty by itself — it is a published intention, covering the plan year October 1, 2026 through September 30, 2027. The 1099-DA regime underneath it is already live: brokers report your proceeds now and your cost basis on covered sales from 2026 (see August's Tax section for the background).
What it means for you: This is the map of where the rules you will file under are actually being written. Wrapping — the tax treatment of turning one token into its wrapped twin — has been an open question every active trader has had to guess at; it is now an admitted, scheduled IRS project. And the CARF item points outward: U.S. broker reporting is being wired into an international exchange framework, which is the direction of travel for offshore accounts too.
Tags: Tax · Cybersecurity
What changed: On September 4, the IRS warned that criminals are mailing counterfeit IRS letters to cryptocurrency holders. The letters carry a QR code leading to a website dressed up as IRS.gov, inviting the recipient to register for a "Digital Asset Compliance Portal." There is no such portal. The IRS does not operate one. The site exists to harvest personal information, wallet details, and exchange logins. The IRS's instructions: do not respond, do not scan the code, report the letter through the scam-reporting page at IRS.gov, and throw it away.
What it means for you: This scam works precisely because the real system now sends you crypto tax paper — broker 1099-DAs are normal, so official-looking crypto mail no longer feels strange. Treat any tax communication that arrives with a QR code and a request for wallet information the way you would treat a phone call asking for your seed phrase: the channel is the tell. The IRS reaches you by mail and through IRS.gov, typed by you — never through a code printed on a letter.
Tags: Tax
What changed: On September 28, the Treasury and IRS issued Revenue Ruling 2026-20 and Notice 2026-62, aimed at investment-fund strategies the government says produce tax results the law didn't intend. The ruling holds that a choreographed "seed an ETF with appreciated assets, then redeem in kind" sequence is a taxable exchange, not a tax-free contribution. The notice lists further strategies under study — and one uses this issue's core subject: a fund holding commodities or digital assets (directly, or through a grantor trust) distributes them in kind and takes the position that the untaxed gain need not count toward the fund's qualifying-income test. The notice asks for public comments by October 28, 2026, and warns that eventual guidance could apply retroactively. Ordinary ETF in-kind creation and redemption activity is expressly not addressed.
What it means for you: If you hold a crypto ETF, nothing about your daily mechanics changed on September 28 — the notice says so itself. What changed is the posture: the IRS has named, in writing, the structures it considers abusive, and crypto-asset funds are on the list. Structures built on "the gain never counts" reasoning now carry a documented, dated warning.
Things in the works — not decided, not law, but moving.
The standing ledger of open topics. Everything below was first covered in the August 2026 issue and is re-reported here with its status as of September 30, 2026, and its next date — so no topic this digest follows is ever silently dropped while it waits. Resolved topics graduate to the news sections; if a tracked topic dies, the death is reported here.
Graduated this month: the CLARITY cloture vote (resolved September 15 — see Congress) · California SB 1208 (signed September 27 — see States) · New Hampshire's Blockchain Basic Laws (took effect September 8 — see States).
From the September record, looking forward. Dates as they stood on September 30, 2026.
Doug's Digital Docket Digest is an educational publication. It summarizes public legal developments in plain language for general information. This is education, not legal advice — it is not a substitute for a lawyer about your specific situation, and reading it creates no attorney–client relationship.
Sources: every item in this issue is taken from the primary document — Congress.gov and Senate roll-call records, the Federal Register, SEC, CFTC, Treasury/OFAC, IRS, and White House releases and orders, court and plea records, and state legislature, agency, and attorney-general records — with one attributed exception, stated here in the open as our standing rule requires: the $6.1 million figure for the seven Tren de Aragua TRON addresses (Agencies) is TRM Labs' blockchain analysis, attributed where it appears, not a Treasury figure. Three items flagged at build time — the SEC staff's crypto-asset FAQs (Agencies), the IRS's Notice 2026-62 (Tax), and Maryland's pricing law (Deadlines Ahead) — were confirmed on the issuing authorities' own records (sec.gov, irs.gov, and the Maryland General Assembly's bill page) in a verification pass on November 4, 2026, and the ledger now carries those primary sources. Items that could not be confirmed on a primary source at all were left out — the ledger's Part 4 lists what was checked and excluded, and why. Background items are labeled with their original dates and are never counted as the month's news. Carryover items are labeled with the month they were first covered.
This digest is an educational publication. It summarizes public legal developments in plain language for general information. This is education, not legal advice.