The US Securities Exchange Commission (SEC) yesterday found that the “initial coin offering” last May that kickstarted the current cryptotoken gold-rush was subject to US securities laws. That means the token sale, for something called the Decentralized Autonomous Organization, was an unregistered securities offering, which is prohibited under US law.

To the relief of the cryptocurrency world, the SEC isn’t referring the DAO’s promoters, a firm called Slock.it, for criminal charges. In fact, it’s not even slapping them with a fine, because it chose not to judge that a securities law violation had taken place. This is in contrast to a 2014 case when startup founder Erik Voorhees was fined $50,000 for selling unregistered securities for bitcoin in exchange for shares in his well known SatoshiDice gambling website.

In the DAO case, the regulator simply issued a “caution” and published an investor bulletin advising the public on how ICOs work. The crypto markets responded optimistically: Ethereum and bitcoin are down 6% today, a relatively calm response to the SEC finding.

But ICO promoters are not quite off the hook. Token sales have raised over $1.2 billion in the first half of 2017, according to Autonomous Research, and there are dozens more in the pipeline, according to research firm Smith + Crown. Sid Kalla, who runs Smith + Crown, says he expects to see token sales delayed or suspended in the coming months, although none have pulled the plug yet.

Cryptocurrency boosters are lauding the SEC for its sensitive approach to token sales. The regulator has stopped short of saying all tokens are securities. Whether a token offering falls under securities law depends on its “economic realities,” the SEC’s report on the DAO (pdf, p. 17) says. That suggests some tokens, particularly those that function like a product or service rather than an investment, could lie beyond the SEC’s purview.

That doesn’t mean ICOs are going to continue unabated. For one thing, the SEC report also puts cryptocurrency exchanges that deal in tokens on notice. They’re required to register with the regulator as a national securities exchange, which could put a chilling effect on secondary market trading in tokens.

The SEC announcement is just a warning shot to the exuberant ICO market, with no charges pressed. But token promoters should understand that the legalities of their schemes are now being closely watched. As Angela Walch, an associate professor at St. Mary’s University School of Law, and a longtime analyst of the cryptocurrency industry, told Bloomberg: “The tech people coming in don’t necessarily realize they’re playing with fire.”