Well the SEC is definitely breathing down the necks of any org that sold secur… er, tokens, without properly registering with the SEC. But for the platforms that did that properly, building services on top of them is mostly permissionless.