Isn't that the reason why so many ICOs are banning US residents from participating in their ICOs?  I think there's an assumption that the SEC will in fact look at and enforce rules retroactively.  Does this mean that those in the US that are skirting around US bans using VPNs actually hurt those projects in the long run?  I know that it's not hard unless their are KYC/AML rules in place, it's not a hard thing to do.