Creator, yes. If you're an issuer and sell to US persons, you have to register the issue as a security. The SEC brings the hammer down on about two issuers a month. They're still working through the ICO boom of 2017-2019, and just getting started on the NFT boom of 2020-2021.[1]

The SEC is basically reactive. They usually take action after people complain that their money disappeared. So they're always behind.

[1] https://www.sec.gov/spotlight/cybersecurity-enforcement-acti...