The SEC Just Redrew the Line Between Data Centers and ABS. Here's What It Means for Your Money

TL;DR: On July 29, 2026, the SEC's Office of Structured Finance told Latham & Watkins that certain securities backed by data center platforms are not "asset-backed securities" under Section 3(a)(79) of the Securities Exchange Act. The reasoning: data centers are operating businesses, not a pool of receivables that pays itself off. That distinction removes several Regulation AB disclosure and risk-retention requirements for qualifying deals, and it clears a structural bottleneck for financing the AI buildout. If you hold or are considering exposure to data-center-backed debt, directly or through a fund, this changes what "asset-backed" means for that instrument and what you need to underwrite yourself.

I want to start with a confession. Most investors, including experienced ones, treat "asset-backed security" as a single bucket. Mortgage bonds, auto loan pools, credit card receivables, student loans: different collateral, same basic mental model. Money comes in from borrowers, gets passed through to you, and eventually the pool runs out because the underlying loans get paid off. That model just got a formal exception carved out of it, and the exception is the fastest-growing corner of structured finance: debt backed by data centers.

The SEC's Division of Corporation Finance, responding to a request from law firm Latham & Watkins, agreed that fixed-income securities issued in data center securitizations are not "asset-backed securities" as Congress defined that term in Section 3(a)(79) of the Exchange Act. That statute defines an ABS (asset-backed security) as a security collateralized by a "self-liquidating financial asset," meaning a loan, lease, mortgage, or receivable, where investors get paid primarily from the cash flow of that asset. The Commission has interpreted "self-liquidating" the same way since 1992: an asset that converts into cash within a set time, by its own terms, and disappears once it does. A mortgage loan is self-liquidating. Once you pay it off, the loan is gone. A data center is not. Once the notes are repaid, the building is still standing, still running servers, and probably worth more than when the deal closed if it was well run.

Why "self-liquidating" is the whole ballgame

Think about a traditional ABS deal backed by auto loans. A pool of, say, 50,000 car loans gets bundled into a trust. Every month, borrowers make payments. The trust passes that cash to bondholders in a set order, senior tranches first, then subordinated ones. As borrowers pay down principal, the pool shrinks. By the maturity date, the loans are gone and so is the trust. The collateral is the cash flow, and the cash flow has a finite, mechanical countdown built into it.

A data center securitization works differently, and the SEC's own language is useful here. In these deals, a bankruptcy-remote issuer (a special-purpose entity structured so it cannot be pulled into a sponsor's bankruptcy) owns or controls one or more data centers, directly or through wholly owned subsidiary "asset entities," along with the physical infrastructure and the customer contracts needed to run them. Many of these deals use a master-trust structure, the same basic architecture credit card ABS uses to support repeated bond issuances and refinancings off one platform over time.

Here is the part that matters for classification. The facility itself does not amortize. It does not convert to cash on a schedule. It might get expanded, refinanced, or sold as a going concern with tenants still in it. And the cash that pays bondholders is not a passive pass-through of loan payments. It is net operating cash flow: revenue from hosting and colocation contracts minus real operating costs like electricity, insurance, security, maintenance, repairs, and property taxes. Whether investors get paid in full depends on whether the operator keeps the facility full, keeps customers renewing, and keeps expenses under control. That is an operating-business risk, not a static-pool risk. The SEC agreed that this breaks the "self-liquidating" test and therefore breaks the ABS definition.

Dimension	Traditional ABS (auto loans, credit cards, RMBS)	Data-center operating-asset securitization
Collateral type	Self-liquidating financial assets: loans, leases, mortgages, receivables	Physical, appreciating operating assets: buildings, power infrastructure, customer contracts
Repayment source	Scheduled principal and interest payments from a fixed borrower pool	Net operating cash flow: hosting revenue minus operating expenses
What happens at maturity	Pool amortizes to zero; the collateral is extinguished as notes are repaid	Issuer still owns and operates the facility, which may be worth more than at issuance
Key risk drivers	Borrower credit quality, delinquency and default rates, prepayment speed	Facility quality, power availability and cost, customer concentration and renewal, operator execution, utilization, ongoing capex
Regulatory treatment	Full Exchange Act ABS regime: Regulation AB disclosure, 5% risk retention, Rule 15Ga-1/15Ga-2 reporting	Outside Section 3(a)(79) for qualifying deals; those specific requirements no longer apply by operation of ABS status

Notice what this table is not saying. It is not saying data-center debt is safer than auto-loan ABS. It is saying the risk comes from a different place, and the regulatory box built for one kind of risk does not fit the other.

What this actually unlocks

Since the first deal of this kind priced in 2018, the market has grown to more than $50 billion in cumulative issuance, according to Latham's own letter to the SEC, and it did so under a cloud of uncertainty. Because Section 3(a)(79) lists "a lease" as an example of a self-liquidating asset, and data center deals often include customer leases as part of the collateral pool, sponsors complied with ABS rules anyway, out of caution, even though they doubted the label fit. That voluntary compliance was not free. It meant Regulation AB-style pool disclosure, ongoing Form 10-D and 10-K reporting, Form ABS-EE filings, 5% credit risk retention under Regulation RR, and Rule 15Ga-1/15Ga-2 reporting on repurchase demands and third-party due diligence. That is a full compliance stack built for passive receivables pools, bolted onto deals that never behaved like passive receivables pools.

The July 29 guidance removes that stack for qualifying transactions. Sponsors can still use the securitization tools that make these deals work: bankruptcy remoteness, senior and subordinate tranching, cash reserves, anticipated repayment dates, and master-trust issuance capacity that lets them add new data centers or refinance without standing up a new legal entity every time. They just do not have to force those tools into a disclosure regime designed around amortizing pools. Law firm coverage from Alston &. Bird and Seward &. Kissel both describe this as removing execution friction rather than removing risk. The deals get easier and cheaper to bring to market, and offering documents can now focus disclosure on what actually drives repayment instead of static-pool concepts borrowed from auto and mortgage ABS.

Zoom out and the timing tells you why this matters. Industry estimates cited by the Structured Finance Association put data-center ABS and CMBS issuance at roughly $61 billion outstanding as of mid-2026, up from about $4 billion in 2020, and project it could approach $180 billion by the end of 2028. That is a small slice of the trillions in projected data-center capital spending tied to the AI buildout, but it is the slice growing fastest, and the slice that ordinary yield-seeking capital, including insurers and pension allocators, can actually buy into. Reducing the compliance drag on that pipeline means more infrastructure spending can get financed through securitization rather than through more expensive corporate bonds or private credit. Reuters put it plainly: the SEC just made it easier for data-center owners to raise capital as the AI boom pushes deeper into financing markets.

The credit-risk framework you actually need

Here is my honest take, the kind I would give a friend with a CFA over coffee. "Not ABS" is a classification outcome, not a safety rating. It tells you which disclosure rules apply. It tells you nothing about whether you will get your money back. If anything, the SEC's own reasoning hands you the risk checklist. Payments depend on net operating cash flow and on the operator's ability to keep winning and retaining customers, not on a fixed, amortizing pool of receivables. If you are evaluating exposure to this asset class, whether through a direct purchase, a structured-credit fund, or a REIT with data-center-backed debt on its balance sheet, underwrite it like commercial real estate with a technology tenant base, not like a bond backed by 50,000 anonymous car loans. A few things I would insist on knowing before I put a dollar in.

Facility quality and location. Is this a purpose-built, well-powered facility in a market with room to grow, or an older shell being retrofitted? Age, redundancy, and cooling capacity drive both operating cost and how easily the operator can re-lease space if a tenant leaves.

Power availability and cost. Electricity is the single biggest recurring operating expense and, increasingly, the binding constraint on whether a facility can even add capacity. A facility in a power-constrained grid region carries a different risk profile than one with a locked-in, low-cost power contract.

Customer concentration and renewal. If one or two hyperscale tenants make up most of the revenue, your credit risk is really a bet on that tenant's continued willingness to renew at that facility, on those terms. Ask what the contract terms look like, how long they run, and what happens to occupancy if a major customer does not renew.

Operator performance. Someone has to keep signing new contracts, negotiating renewals, controlling electricity and maintenance costs, and running the facility competently. That is an active management function baked into your credit risk in a way it simply is not for a static loan pool. A weak operator can turn a good building into a bad investment.

Utilization and ongoing capex. A half-empty data center generates a fraction of the promised cash flow. These facilities also need continuing capital investment to stay competitive as chip generations and cooling requirements change, and that capex competes with debt service for the same operating cash flow.

None of this makes data-center securitizations a bad investment. I think it is a legitimately interesting diversification tool for investors who understand what they are buying, and the added capital-markets efficiency here should, over time, mean more deals and tighter execution. But swap "amortizing receivables pool" for "actively managed operating business" and you have swapped one risk framework for a materially different one, closer to real estate credit than to the auto-loan or credit-card ABS most people picture when they hear "asset-backed."

The caveats that matter

I would be doing you a disservice if I let this guidance sound bigger than it is.

First, this is Division of Corporation Finance staff guidance, not a Commission rule. The letter itself says as much. It is not a rule or regulation, the Commission has neither approved nor disapproved it, and it creates no binding legal obligations. Different facts could produce a different answer for a differently structured deal.

Second, it answers exactly one question: whether these securities meet the Section 3(a)(79) definition of an "asset-backed security" under the Exchange Act. It says nothing about Securities Act registration questions, other Exchange Act reporting obligations, the Trust Indenture Act, or Regulation AB more broadly. Those all still require their own separate analysis, deal by deal.

Third, the conclusion is fact-specific and narrower than "all data-center debt is exempt." Single-asset, single-borrower commercial mortgage-backed securities on a data center, where a loan gets extinguished as it is repaid, are unmistakably still Exchange Act ABS under this same reasoning, because a mortgage loan genuinely is self-liquidating. Deals leaning more on passive lease collection, a limited-role operator, or debt tenor that tracks an asset's remaining useful life could land back inside the ABS definition. Each new master-trust issuance or structural tweak has to be retested against the same framework, not assumed to inherit this letter's answer automatically.

Finally, this connects to something bigger the SEC has already signaled it is thinking about. In September 2025, the Commission published a concept release asking whether Regulation AB's own definition of "asset-backed security" should be revised to align with, incorporate, or be replaced by the Section 3(a)(79) Exchange Act definition. This July 29 letter does not amend Regulation AB. But it hands the Commission a concrete, real-world example of a maturing, multibillion-dollar securitization market operating successfully outside the traditional ABS box, which is exactly the kind of evidence that shapes how a rulemaking eventually gets written.

For more on this, see our coverage of CRE CLO Securitization: The $26B Market Reshaping Commercial Real Estate, Data Centers as Alternative Investments: AI-Driven Demand and Accredited Investor Access in 2026, Aligned Data Centers $40B: How Accredited Investors Access AI Infrastructure, and Fidelis Just Sold $191.5 Million in House-Flipping Debt.

Frequently Asked Questions

Does this SEC guidance mean data-center securitizations are now unregulated?

No. It removes specific Exchange Act ABS requirements, including Regulation AB disclosure, Regulation RR risk retention, and certain repurchase and due-diligence reporting rules, for qualifying deals. Securities Act registration questions, other Exchange Act reporting, the Trust Indenture Act, and general antifraud rules still apply, and sponsors still need separate legal analysis for those.

Is a data-center-backed security riskier than a traditional asset-backed security?

Not necessarily riskier, but differently risky. Traditional ABS risk centers on borrower credit quality and default rates in a fixed pool. Data-center securitization risk centers on facility quality, power costs, customer concentration, operator execution, and ongoing capital spending, which is closer to commercial real estate or infrastructure credit than to a car-loan pool.

Does this guidance apply to all data-center financing, including mortgage-style deals?

No. It applies to the specific structure described in the interpretive request: a bankruptcy-remote issuer that owns or controls the data centers and related infrastructure directly, often through a master trust. Single-asset, single-borrower commercial mortgage-backed securities on data centers remain squarely within the Exchange Act ABS definition, because a mortgage loan is a self-liquidating asset in a way an operating facility is not.

How should an accredited investor evaluate a fund with data-center securitization exposure?

Ask what the fund actually holds and how it gets paid, since a facility-owning securitization tranche behaves differently than a mortgage loan on a data center. Then push on the operating fundamentals: tenant concentration, contract renewal terms, power contracts and costs, the operator's track record, and how much ongoing capex the facilities need. Regulatory classification tells you which disclosure rules applied at issuance. It does not tell you whether the facility will stay full or whether the operator will execute.

Author Disclosure: Jeff Barnes, MBA has no personal position in any company, fund, or platform named in this article. Angel Investors Network has no current commercial relationship with any party mentioned. AIN provides marketing and education services, not investment advice. Past performance does not guarantee future results. All investments involve risk, including loss of principal.