The SEC's enforcement docket over the past two years reads like an obituary page for crypto's most ambitious experiments. Token delistings. Wells notices. A parade of founders learning that "decentralization" is a legal argument, not a technical feature. And yet the filing that should chill every infrastructure founder in this industry received almost no attention outside a narrow circle of Washington lawyers. The Commission walked into a federal district court and asked a judge to compel Institutional Shareholder Services — the planet's largest proxy voting advisory firm — to comply with an administrative subpoena. No token involved. No crypto exchange in the crosshairs. Just a legacy financial gatekeeper refusing to hand over documents.
That is precisely why this case matters. The crypto community hears "ISS" and switches off, assuming it belongs to a different regulatory universe. It does not. ISS sits at a structural intersection — between institutional capital, voting power, and the information supply chain that determines how trillions of dollars are deployed — that is functionally identical to the intersections occupied by crypto's data providers, indexers, oracles, and governance platforms.
The dismissal reflex is the error. Reading the SEC's move against ISS is like reading the agency's rehearsal notes for a play it intends to stage across the entire digital asset ecosystem. And the first lesson is counter-intuitive: this is not about punishing wrongdoing. It is about building the legal machinery to investigate wrongdoing before anyone knows what the wrongdoing is.
During my years analyzing regulatory filings — most recently the ETF S-1 language shifts that signaled institutional acceptance of Bitcoin as a commodity — I learned to read the SEC the way a trader reads order books: through the size and placement of quiet orders, not the loud prints. This filing is a quiet order. Its implications for every intermediary layer in crypto are outsized.
Context: The Iceberg Protocol
Let's establish what actually happened. Somewhere beneath the public radar, the SEC opened an investigation into Institutional Shareholder Services. As part of that investigation, it issued an administrative subpoena demanding documents. ISS apparently resisted, or partially complied, or raised privilege objections that went nowhere. The SEC then did what Section 21(c) of the Securities Exchange Act of 1934 empowers it to do: it filed a civil action in federal court to force judicial enforcement of that subpoena.
That is the entire public record. The underlying investigation — its targets, its scope, its theory of potential violations — remains undisclosed. This is the single most important legal fact in the case, and almost every analyst covering the story has glossed over it. The SEC does not go to court to enforce a subpoena because it is curious. It goes to court because it is building a case and needs the documents to complete it. ISS' resistance has turned a discovery dispute into a precedent-setting battleground.
Some background on the defendant. ISS is not a marginal player. It covers more than 40,000 shareholder meetings annually and, together with its rival Glass Lewis, controls roughly 97 percent of the U.S. proxy advisory market. Its recommendations on executive compensation, board composition, and ESG-related resolutions effectively determine how the largest asset managers in the world — BlackRock, Vanguard, State Street — cast votes representing trillions in assets. ISS is, in other words, a choke point.
The regulatory history here is dizzying, which is itself a signal. For years, the SEC treated proxy voting advice as outside the definition of "solicitation" under the federal proxy rules, meaning firms like ISS operated in a regulatory gray zone. That changed in 2020, when a Trump-era SEC under Jay Clayton issued rules explicitly classifying proxy voting advice as solicitation under Rule 14a-1(l) and Rule 14a-2(b), imposing disclosure requirements and forcing advisory firms to give companies a chance to review recommendations before release. The rulemaking was a direct response to years of lobbying by corporate America, which argued that ISS wielded enormous influence without accountability.
Then came the pendulum swing. In 2022, under Gary Gensler, the SEC retreated. It issued supplemental guidance clarifying that proxy voting advice is generally not solicitation when it does not seek shareholder action, and acknowledged that such advice enjoys First Amendment protection. The 2020 rules were softened. The industry breathed a sigh of relief. Glass Lewis and ISS went back to business as usual.
And now this. A subpoena enforcement action that, on its face, appears to sidestep the very rulemaking the SEC spent two years softening. Why would an agency that codified a lighter touch in 2022 turn around and investigate the industry's largest player through the back door of a subpoena? Because regulation by rulemaking is slow, legally fragile, and politically visible. Regulation by investigation is none of those things.
The crisis was the protocol all along. ISS' problem is not the subpoena. ISS' problem is the architecture of its own business model, which has always contained the fault line that the SEC is now probing.
Core: Anatomy of an Enforcement Prelude
The subpoena enforcement standard is deceptively simple — and brutally stacked in the SEC's favor. Since the Supreme Court's decision in United States v. Morton Salt Co. in 1950, courts have held that agency subpoenas are enforceable if they satisfy three conditions: the investigation serves a legitimate legislative or enforcement purpose; the information sought is relevant to that purpose; and the demand is not unreasonably broad or burdensome. That's it. The SEC does not need probable cause. It does not need to articulate a specific theory of liability. It needs only to demonstrate that the documents it seeks "might throw light upon" a potential violation.
The practical effect is that ISS carries the burden of proving the subpoena is illegitimate — an uphill fight that very few companies win. The leading cases, from SEC v. Brigadoon Scotch Distilling Co. in 1981 through the modern enforcement docket, uniformly grant the SEC wide latitude at the investigative stage. A company cannot resist a subpoena merely by arguing that it has done nothing wrong, or that the investigation is a fishing expedition. The whole point of the investigative stage is to determine whether wrongdoing occurred.
The hidden vulnerability is not procedural — it's structural. During my time modeling institutional behavior around regulatory actions, I developed an analytical framework for assessing which companies become enforcement targets. The pattern is consistent: the SEC does not investigate isolated mistakes. It investigates structural features that make mistakes inevitable. For ISS, that structural feature is the dual-revenue model.
Consider the geometry. ISS earns subscription fees from institutional investors who rely on its voting recommendations. Simultaneously, through its separately branded corporate solutions division, ISS sells governance consulting, ESG ratings, and advisory services to the very companies that are subjects of those votes. It is paid by both sides of the ballot box. The company maintains an internal firewall between these units, but firewalls are procedural constructs. They are only as strong as the documentation that proves they are enforced. And documentation is exactly what a subpoena demands.
If the underlying investigation is examining whether ISS adequately disclosed conflicts of interest to its investor clients, or whether its voting recommendations were influenced by its consulting relationships, the internal emails and decision logs sought by the subpoena become the central evidence. This would be a classic Rule 14a-9 analysis — whether ISS made misleading statements in its proxy voting advice. The legal theory writes itself: if ISS rated a company's governance poorly while simultaneously pitching that company on consulting services to improve its score, the potential for undisclosed bias is manifest.
The deeper insight is that this enforcement action functions as a workaround for failed rulemaking. The 2022 safe harbor created First Amendment space for proxy advisory firms, making it harder for the SEC to impose new obligations through regulation. Aggressive constitutional challenges, including the Supreme Court's Jarkesy v. SEC decision limiting the SEC's use of administrative proceedings, further constrained the agency's toolkit. When rulemaking is blocked, enforcement becomes the alternative pathway. By investigating ISS as an individual entity, the SEC can establish facts that effectively create new industry-wide obligations without ever going through the Administrative Procedure Act. This is a playbook crypto knows intimately. For years, the SEC denied clarity on which tokens constitute securities, preferring to bring case-by-case enforcement actions that cumulatively defined the boundaries. Coinbase, Ripple, and a dozen others were the tuition payments for that education. ISS is now paying the same tuition in the proxy advisory industry.
The exposure geometry extends far beyond ISS. Let's map the cascade.
First layer: the procedural violation. ISS has already lost on the narrow question of compliance — the fact of resistance is now public. If the court orders enforcement, ISS faces potential contempt sanctions for continued non-compliance. Under Section 21(c), a court can impose daily fines. In extreme cases, officers can face detention. This is not the existential threat. It is the prelude.
Second layer: the substantive investigation. Once the SEC obtains ISS' internal documents, it will look for evidence of undisclosed conflicts or misleading recommendations. The probability of finding something is not trivial. I explained this to an institutional client in 2023 as the "toothbrush problem" — you can find unauthorized use of a toothbrush in any large organization if you inspect hard enough. Large companies produce millions of documents annually. Somewhere in that corpus, an executive will have written something impolitic, or a firewall will have been breached, or a consulting relationship will have created the appearance of impropriety. The SEC knows this. It is why prosecutors prefer document review over witness interviews.
Third layer: secondary enforcement. If the SEC's investigation reveals systematic deficiencies, ISS faces a cease-and-desist proceeding, civil penalties, and a potential disgorgement order. The SEC historically demands that settling parties retain independent compliance consultants at their own expense — a cost that runs for years and effectively converts the company into a permanent regulatory audit subject. The reputational damage alone can trigger what I call the "algorithmic trust collapse": institutional investors do not manually evaluate every voting recommendation; they delegate stewardship to ISS as a trusted oracle. Once that oracle is publicly tainted, the delegation logic fractures.
Fourth layer: downstream liability. This is the piece most analysts miss. The SEC's new Form N-PX requirements compel asset managers to disclose how they vote. Those managers rely on ISS data. If the SEC determines that ISS voting recommendations were misleading, every asset manager who relied on them faces a difficult question: did they adequately discharge their fiduciary duty of independent judgment, or did they blindly outsource voting to a conflicted intermediary? The potential for aider-and-abettor liability under Section 20(e) of the Exchange Act creates a legal hydraulic pressure. It is entirely possible that the ultimate financial consequence of this case falls not on ISS but on its clients — through increased compliance costs, through the need to independently verify every recommendation, and through a wave of litigation if shareholder losses can be traced to improperly influenced votes.
This is the exact structural relationship that exists between crypto exchanges and their market makers, or between DeFi protocols and their governance token holders. When a centralized authority provides decision-making recommendations to decentralized or semi-decentralized actors, it creates a concentration of information risk. The SEC's playbook against ISS is a direct template for how it will eventually treat crypto infrastructure providers who package and sell contextual information to asset managers.
The FOIA shadow is the quietest risk of all. If ISS is compelled to produce its proprietary voting methodologies, analytical models, and client communications, those documents enter the SEC's investigative file. Under the Freedom of Information Act, third parties — corporate adversaries, activist shareholders, media organizations, competitors — can request disclosure of SEC enforcement records. Exemption 4 protects trade secrets and confidential commercial information, but the burden of proving that exemption applies falls on the party resisting disclosure. ISS will almost certainly negotiate for a protective order limiting who at the SEC can view the documents and for what purpose. But protective orders in enforcement context have limits. If the investigation ripens into a public enforcement action, the documents may become part of the judicial record, at which point the confidentiality calculus shifts dramatically. The competitive value of ISS's proprietary methodologies — accumulated over decades — could be compromised wholesale.
When I wrote about the BlackRock ETF filings in 2024, I noted that regulators communicate through document architecture as much as through explicit statements. The same principle applies here. The SEC's choice to pursue enforcement rather than rulemaking tells you something about its estimation of congressional and judicial headwinds. This case is a canary in a coal mine that runs directly beneath the foundations of the crypto regulatory landscape. Speculation is the fuel, narrative is the engine — and the narrative the SEC is building here is that gatekeepers who influence financial decision-making are subject to expansive investigative authority, regardless of whether their legal status has been clarified by formal rulemaking.
There is also an international dimension that deserves scrutiny. ISS operates across Europe and Asia through subsidiaries. Documents stored abroad may be captured by the subpoena's reach. The Supreme Court's decision in Société Nationale Industrielle Aérospatiale v. U.S. District Court established a comity analysis for cross-border discovery: courts weigh the U.S. investigative interest against foreign sovereign interests, considering the good faith of the party resisting discovery and the hardship of compliance. If ISS maintains data in jurisdictions with strict data protection laws — particularly the EU's GDPR regime — it may face genuinely conflicting legal obligations. But here's the practical reality: courts rarely accept the mere existence of a foreign data protection law as a defense to a U.S. enforcement subpoena. ISS would need to demonstrate active good-faith efforts to obtain permission from foreign authorities, and even then, the court may still order production.
As an analyst, I've learned to assign probabilities to regulatory pathways. My probability distribution on this case looks like this: roughly 70 percent that the court orders enforcement of the subpoena in substantially its current form; roughly 20 percent that there is significant narrowing of scope through negotiation; and roughly 10 percent that ISS succeeds in defeating the subpoena entirely, probably on a narrow procedural or privilege ground. Within the 70 percent scenario, there is a high conditional probability — approaching 80 percent — that the SEC's review of the obtained documents leads to formal enforcement action against ISS within 12 to 24 months. Those are not comforting odds for any intermediary operating in the SEC's jurisdiction.
Contrarian: The Blind Spot Points Downstream
The consensus narrative will frame this as an ISS problem. ISS is under investigation. ISS will suffer reputational damage. Its competitors, Glass Lewis and any emerging proxy advisory startups, will capture market share. In the short term, that narrative has some validity. Compliance uncertainty drives client migration. But look at the problem from the perspective of the institutional asset managers who form ISS's client base.
They cannot simply defect to another provider without inheriting the same structural exposure. Any proxy advisory firm faces the same dual-revenue temptation. The question the SEC is implicitly raising — whether voting recommendations can be trusted when the recommender also sells consulting services to the vote targets — applies to Glass Lewis as much as to ISS. Asset managers that flee to Glass Lewis are not solving the conflict-of-interest problem. They are merely deferring it.
Shadows in the shard, light in the ape. The darkest outcome of this case is not that ISS gets destroyed. It is that ISS's clients discover their entire stewardship apparatus was resting on information systems they did not control and methodologies they did not verify. The SEC investigation could easily broaden into a review of how asset managers discharge their proxy voting duties. If institutional clients are forced to independently audit every voting recommendation they previously rubber-stamped, the economics of asset management change. The cost of independent verification would exceed any penalty the SEC could levy against ISS by an order of magnitude. The real "victim" of this enforcement action may be an entire industry of institutional intermediaries who believed that outsourcing stewardship was the same thing as exercising it.
Liquidity is just social consensus in code. Proxy voting is just social consensus in paperwork. When the mechanism of consensus formation comes under regulatory scrutiny, the underlying legitimacy of every vote cast through that mechanism becomes questionable. That is a systemic risk that reaches far beyond one company.
The counter-intuitive contrarian play here is to recognize that the SEC's enforcement strategy has a vulnerability — and that ISS might exploit it. If ISS can demonstrate that the SEC is using investigative authority to accomplish what Congress declined to authorize through legislation, or that the investigation is a "bad-faith" attempt to circumvent the First Amendment protections acknowledged in the 2022 guidance, it could win significant concessions on scope. And for the crypto industry, an ISS victory would provide something priceless: judicial language limiting the SEC's subpoena power as applied to unregulated or ambiguously regulated intermediaries. That kind of precedent resonates far beyond proxy voting advice.
Takeaway: Reading the Regulatory Tea Leaves
Decoding the narrative before the fork happens. We are at a fork in the road for how the United States regulates financial information intermediaries. One path leads to expanded administrative oversight through enforcement, with each case establishing new obligations without formal rulemaking. The other path leads through legislative intervention — Congress restricting the SEC's authority over proxy advisory firms through legislation that has been introduced but never passed — and through judicial constraint in the form of Jarkesy-era skepticism about agency power.
For crypto founders and infrastructure operators, the ISS case offers a cost-free education in what the next enforcement cycle looks like. The pattern is unmistakable: first a quiet investigation, then a subpoena, then litigation over compliance, then document production, and finally an enforcement action built on documents nobody knew existed. Companies that assumed their regulatory ambiguity protected them from scrutiny will learn the same lesson that ISS is learning now: ambiguity is not a shield. It is an invitation.
The SEC's quiet war with ISS is not really about proxy voting advice. It is about establishing the principle that anyone who influences financial decision-making through the synthesis and distribution of information is subject to investigative oversight. In the age of AI-driven credit scoring, token rating agencies, on-chain analytics firms, governance consultancies, and algorithmic recommendation engines, that principle has staggering scope. If the SEC can compel ISS to expose the inner workings of its proprietary methodology through a simple subpoena enforcement action, it can do the same to every intermediary layer in the crypto ecosystem.
What will the next twelve months reveal? Will ISS stand firm and become a martyr for the principle that the SEC's investigative reach has limits? Or will it capitulate, signalling to every regulated intermediary that resistance is futile? I am watching the docket in the same way I watched the ETF filings — looking for the quiet tells, the timing decisions, the language choices. The answer will tell us whether the enforcement era in American finance is about to expand exponentially, and whether crypto's middle layer is prepared for what arrives. The question is not whether the SEC will come for your documents. It is whether you have been documenting your decisions as if the SEC will one day read them. Based on a decade of observing how these investigations unfold, I can tell you this: most of you have not.