The SEC regulates any security issued by any company which is offered to US investors (is my understanding). If you allow US investors to buy something and the SEC deems it a security, they regulate it and you have to abide by their regulations or there can be enforcement actions. You don't get to escape jurisdiction by putting your business outside the US. For example, here is the SEC's guidance for "foreign private issuers" https://www.sec.gov/divisions/corpfin/internatl/foreign-priv...

Yes I understand that the securities law in the US has not yet evolved (and indeed has no way it could) to cope with ERC20s yet.