This report presents a framework for securities regulation of cryptocurrencies—e.g. Bitcoin and derivative projects or “alt-coins.” The framework is based on the Howey test for an investment contract as well as the underlying policy goals of securities regulation. We find that several key variables within the software of a cryptocurrency and the community that runs and maintains that software are indicative of investor or user risk. These variables are explained in depth and mapped to the four prongs of the Howey test in order to create a framework for determining when a cryptocurrency resembles a security and might therefore be regulated as such. We find that larger, more decentralized cryptocurrencies—e.g. Bitcoin— pegged cryptocurrencies—i.e. sidechains—as well as distributed computing platforms—e.g. Ethereum—do not easily fit the definition of a security and also do not present the sort of consumer risk best addressed through securities regulation. We do find, however, that some smaller, questionably marketed or designed cryptocurrencies may indeed fit that definition.