Yeah, that's true. They have to also be able to make a reasonable argument that they don't fit the legal definition of "security" or that they're exempt. Even then, regulators may see things differently or even contradict themselves. Sometimes I really want to leave this country...

Have you seen this one?
https://www.rootproject.co