Sidley Austin: SEC CUI Statement Leaves MEV Antifraud Liability Explicitly Unaddressed

SEC's CUI Statement Leaves MEV Antifraud Liability Open — What Infrastructure Teams Must Know

On April 13, 2026, the SEC issued a staff statement creating a no-action framework for Crypto User Interface (CUI) Providers, effectively carving out a broker-dealer registration exception under Section 15(a) of the Exchange Act. One week later, on April 21, 2026, Sidley Austin published a client alert making something explicit that the SEC left implicit: the CUI statement says nothing about antifraud liability. Satisfying all 11 conditions of the no-action framework does not insulate a CUI Provider — or its connected infrastructure — from exposure under Section 10(b) and Rule 10b-5. For MEV-adjacent infrastructure operators, that gap is not a footnote. It is the entire risk surface.

What the SEC Statement Actually Covers — and What It Doesn't

The April 13 SEC staff statement is narrow by design. It addresses one question: whether a CUI Provider operating within defined parameters must register as a broker-dealer under Section 15(a) of the Exchange Act. The answer, under the 11 enumerated conditions, is no.

What it does not address is equally significant. Sidley Austin's alert identifies three live exposure categories the statement leaves untouched: national securities exchange registration obligations, other potential statutory obligations under the Exchange Act, and — most critically — antifraud liability under the federal securities laws.

Sidley specifically flags that MEV and "connected trading venues and trading systems" represent an unresolved legal exposure. The language matters. A CUI Provider that routes order flow through an external venue — a block builder, an auction system, a private mempool — does not shed liability for what happens to users inside that routing chain simply by satisfying the registration safe harbor. The SEC has not said it will look away from execution-layer harm. It has said nothing at all.

That silence is the exposure. Under Rule 10b-5, antifraud liability attaches to any "device, scheme, or artifice to defraud" in connection with the purchase or sale of a security. MEV extraction — front-running, sandwich attacks, and related strategies applied to on-chain order flow — fits that description in straightforward terms. The SEC has not needed to make that argument yet. Sidley's alert is a signal that sophisticated legal counsel believes it will.

Implications for DeFi Protocols and Execution Infrastructure

The two-tiered risk profile Sidley describes has direct operational consequences for protocol teams and infrastructure operators. Registration risk is substantially reduced for CUI Providers operating within the 11-condition framework. Fraud liability risk for MEV-connected infrastructure is not diminished at all.

Any entity that sits between user intent and on-chain execution — block builders, private order flow auctions, MEV relays, RPC providers with routing logic — now occupies a legally ambiguous position. The SEC has not blessed these systems. It has simply not yet moved against them on registration grounds. That is not equivalent to clearance.

Protocol teams integrating third-party execution venues need to ask a harder question than "does this venue meet the 11 CUI conditions?" The operative question is: if a user suffers measurable execution harm attributable to MEV activity routed through this venue, can we document that we took reasonable steps to prevent it? Without that documentation, secondary liability under Section 10(b) is a real and near-term exposure, not a theoretical one.

Compliance teams should begin building the evidentiary record now. That means cataloguing every execution venue in the routing stack, documenting auction mechanics and fairness properties, preserving records of searcher competition and bid transparency, and establishing internal policies for detecting and flagging MEV-related harm to users. The enforcement action that makes this mandatory has not arrived yet. The time to prepare is before it does.

Where Birdai's Infrastructure Fits This Legal Framework

Birdai Auction is, in the precise language Sidley Austin uses, a "connected trading venue." That classification is not a liability admission — it is a compliance starting point. Birdai's MEV Observatory has decoded millions of transactions and identified hundreds of searchers operating across the execution layer. That corpus of verified, structured data is directly relevant to demonstrating the kind of good-faith architecture that antifraud defenses require.

The MEV Observatory's ability to classify extraction strategies, quantify user-level harm, and attribute activity to specific searcher profiles is not just a product feature. In a Section 10(b) enforcement context, it is documentation. It shows that the system was designed with visibility into MEV dynamics, not designed to obscure them.

BirdSearch extends that capability to CUI Providers building on top of Birdai Auction. Protocol teams that need to demonstrate they understood the MEV environment their users were operating in — and took steps to mitigate harm — have access to the search and audit infrastructure to make that case. Execution transparency is the compliance asset the SEC's silence makes necessary.

What to Watch Next

The SEC's next move in this space will likely come through enforcement, not rulemaking. Watch for investigative inquiries directed at CUI Providers whose user interfaces route to private execution venues with documented MEV activity. The Sidley alert is a leading indicator that outside counsel is already advising clients to treat MEV antifraud exposure as active, not speculative. Protocol teams that have not mapped their execution routing stack against a Rule 10b-5 framework should do so before that inquiry arrives at their door. The registration question is settled — for now. The fraud question is not.

Source: Sidley Austin, Data Matters Blog, April 21, 2026 — U.S. SEC Clears Path for Decentralized Crypto Asset Security Trading with Broker Registration Exception for User Interfaces