Data center ABS: the legal boundary drawn by SEC staff

Two events took place in the U.S. data center financing market on July 29, 2026.

The first took only two paragraphs. Staff at the Securities and Exchange Commission concluded that certain securities issued directly against data centers are not asset-backed securities under one specific definition in U.S. law.

The second involved $520 million. Cloud Capital announced the closing of what it called a “data center ABS,” secured by an 80 MW hyperscale facility in Northern Virginia.

On the same day, ABS therefore described a commercial category claimed for one specific transaction and a legal classification rejected for certain separately described structures. No public document establishes that Cloud Capital’s issuance falls within the staff response. The two uses of the word are not truly contradictory: the market is naming a family of financing techniques, while the law applies different tests for different purposes.

That distinction becomes tangible when the legal definition triggers risk retention, publication of a verification report or a conflict-of-interest rule. It also becomes dangerous when reduced to an overbroad claim such as “the SEC deregulated data centers.”

The SEC staff response says considerably less. Its narrow scope could still determine whether a sponsor is legally required to retain a minimum amount of risk and how much information reaches the public.

Five key points

SEC staff addressed only the Exchange Act definition of ABS in section 3(a)(79).
Its response is based on facts presented by Latham & Watkins. It does not change the law or bind the Commission.
Three regimes use that definition: certain ABS-15G filings, U.S. risk retention and Rule 192 on certain conflicts of interest.
The notes remain securities. Antifraud rules, contracts, security interests and other applicable regimes remain in place.
Cologix Canada filed an ABS-15G on July 31, but no public document yet proves that its Series 2026-1 has closed.

One acronym, four separate questions

ABS stands for asset-backed security. Its intuitive meaning looks straightforward: a vehicle issues notes, assets and their income support repayment, so the transaction resembles an ABS.

Financial law requires a more precise question. Who is using the term, under which text and for what consequence?

In market vocabulary, “data center ABS” remains a useful description. It groups notes secured by buildings, equipment, accounts, customer contracts and the operating income of data centers.

Section 3(a)(79) of the Exchange Act asks a narrower question. It defines an ABS in part as a security collateralized by a self-liquidating financial asset that allows the holder to receive payments depending primarily on that asset’s cash flow. A mortgage loan offers the classic example: the loan generates scheduled payments and disappears when it has been repaid.

Regulation AB has its own definition, used by the disclosure regime for registered ABS and focused on cash flows from a discrete pool of receivables or other financial assets that convert into cash within a finite period, with the issuer’s activities limited to passively owning the pool. The staff response did not formally address that definition.

The EU Securitisation Regulation applies another test. The credit risk of an exposure or pool of exposures must be tranched; payments depend on the performance of those exposures and subordination determines how losses are distributed. Article 2(1)(c) also excludes schemes creating exposures that possess all the characteristics of certain specialised lending exposures.

Saying that a security “is” or “is not” an ABS without naming the relevant legal regime therefore removes half the information.

Why a data center may fall outside the U.S. definition

The request submitted by Latham & Watkins on July 23 describes a direct issuance. The issuing vehicle owns the data centers directly or through asset entities. Its perimeter includes land, buildings, power systems, cooling, fiber, security, customer contracts, accounts and other rights needed to operate the facilities.

The vehicle does more than collect scheduled receivables. A manager must continue to operate the facilities, find and retain customers, negotiate contracts, maintain the sites, pay suppliers and adapt equipment.

Latham contrasts this structure with a commercial mortgage-backed security backed by one mortgage loan. In the CMBS, the issuer owns the loan. Once it is repaid, the financial asset has disappeared. In a direct data center issuance, the vehicle still owns the building after repaying the notes and can continue operating it.

On July 29, staff in the Division of Corporation Finance agreed with that reasoning for securities of the type described. Its decisive sentence is short: these securities are not ABS under section 3(a)(79).

That conclusion remains tied to Latham’s representations. The response says that different facts or conditions may require a different conclusion. It also says that it reflects the staff’s views, is not a rule, regulation or statement of the Commission, does not amend the law and has no legal force or effect.

“Exemption” is therefore an inaccurate shorthand. Staff did not remove an entire class of securities from all regulation. It accepted that one type of structure falls outside one definition.

Three possible consequences, subject to one condition

The distinction would matter little if it only changed a label. Several U.S. rules use the section 3(a)(79) definition.

The ABS-15G report

Rule 15Ga-2 requires a Form ABS-15G containing the findings and conclusions of third-party due diligence to be furnished on EDGAR for certain ABS offerings submitted for a rating. In the transactions reviewed here, the full report was attached as an exhibit. The filing exposes information that might otherwise remain in documents distributed only to investors.

The reports examined in this investigation are not credit audits. KPMG and Deloitte compare data supplied by the issuer or arranger with a sample of contracts and other documents. They do not certify collateral value, legal compliance or the probability that the notes will repay principal and interest.

Their public value lies elsewhere. They reveal a proposed transaction, identify some of its participants, count sites or contracts and list the attributes tested. A future issuance that genuinely falls outside section 3(a)(79) might no longer trigger the filing. Any loss of public information remains to be observed: an issuer could still publish voluntarily or distribute the report privately to investors.

The 5% risk-retention rule

The general rule in Part 246 requires a securitization sponsor to retain at least 5% of the credit risk in an eligible vertical, horizontal or combined form, absent an exception. It aligns part of the sponsor’s exposure with that of investors.

Part 246 uses the section 3(a)(79) definition of ABS. If an issuance genuinely fits within the factual perimeter accepted by staff, the regulatory trigger may be missing. This does not prove that the sponsor retains no risk. Equity, subordinated notes, guarantees or contractual commitments can keep the sponsor exposed.

The conflict-of-interest rule

Rule 192 prohibits certain securitization participants, for a defined period, from entering into certain transactions that create a material conflict of interest with ABS investors. It also uses the section 3(a)(79) definition, while extending coverage to certain synthetic and hybrid instruments.

A note outside that definition may therefore sit outside this particular Rule 192 trigger. Antifraud rules and other duties remain in force.

These three consequences are readings of the governing texts, not an operation-by-operation list endorsed by the SEC. The July 29 response names none of Rule 15Ga-2, Part 246 or Rule 192. Each issuance still turns on its actual structure and complete documentation.

What remains in force

The Latham vehicle still issues securities. Their offer must be registered under the Securities Act or qualify for an exemption. Prohibitions on fraud and misleading statements remain. Security interests, covenants, payment waterfalls, reserve accounts and bankruptcy law still matter to investors.

The response does not automatically change Regulation AB. It decides nothing under accounting, prudential, state or foreign definitions. Rating agencies can continue classifying the instruments as data center ABS because they are naming an analytical method, not necessarily the result under section 3(a)(79).

The accurate formulation is narrow: some direct data center issuances may not be ABS under section 3(a)(79). The claim that “these notes are no longer regulated” would be false.

Cologix Canada: two days that prove no causal link

Cologix Canada’s Series 2026-1 is the chronology’s most intriguing document.

The Deloitte report published on EDGAR concerns a proposed offering of Secured Data Center Revenue Term Notes, Series 2026-1. Its site file covers 21 data centers as of March 31, 2026. Its commercial file contains 10,631 service contracts as of December 31, 2025.

Deloitte tested one contract for each of the 50 organizations producing the highest operational monthly recurring revenue, then 50 contracts drawn from the remaining 10,581. RBC Capital Markets provided the files on Cologix’s behalf. The report is dated July 21, eight days before the staff response.

The Cologix Form ABS-15G was signed on July 30; the complete submission file records EDGAR acceptance at 8:04:44 a.m. Eastern Time on July 31. The SEC page carrying the July 29 response currently says “Last Reviewed or Updated: July 31, 2026,” without identifying its initial publication time.

The documents establish that the transaction was already in preparation before the response and that Cologix still used the ABS-15G channel after the date printed on it. They do not establish whether the response was public at filing time, whether Cologix knew of it or whether the transaction fits the facts presented by Latham.

They also disclose no amount, currency, coupons, classes, security identifiers, ratings, closing date or list of the 21 sites. As of August 12, 2026, no public evidence found establishes that Series 2026-1 has closed.

This Canadian transaction is separate from the $525 million of notes backed by COL4 in the United States in 2025. The three primary announcements reviewed separately describe that issuance, the NVIDIA HGX B200 clusters deployed by Lambda at COL4 and Nvidia’s newly announced program to mobilize more than $500 billion. None legally connects the three.

Lohrasp and Compass test two extremes

Two other transactions prepared before the response show why each security still requires its own analysis.

Lohrasp 2026-1: one building, one tenant

On July 29, Cloud Capital announced the closing of $520 million in notes. The issuance consists of a single A-2-I class rated AAA by Fitch, Morningstar DBRS and KBRA, according to the company’s release.

KBRA describes an 80 MW Virginia facility fully leased to a single hyperscale customer with investment-grade credit characteristics. The triple-net lease had about 13.8 years remaining as of May 1. The tenant pays base rent, operating expenses and electricity. The site generated about $65.1 million in annualized adjusted base rent.

The ABS-15G had been filed on July 2, well before Latham’s request. Concentration in one lease and one tenant does not establish whether Lohrasp is covered by the response. It makes one question decisive: do payments depend primarily on a financial asset and predetermined cash flows, or on the ownership and continued operation of the facility? The public documents do not resolve that test on their own.

Compass 2026-2: seven sites and 26 leases

The S&P presale report contemplated a $413 million issuance split among three classes. The pool included seven facilities, six in Phoenix and one in Toronto, approximately 234.2 MW of leased capacity and an appraised value of about $4.4 billion. Closing was expected on July 30.

The KPMG report published on July 16 covered 26 lease agreements intended for the collateral. S&P listed security interests in real property, equipment, leases, accounts, reserves and equity interests in the asset entities.

The multi-site structure visually resembles the Latham transaction. Resemblance is not a legal classification. The S&P document was a presale report and proves neither a final July 30 closing, final ratings nor the legal position taken by Compass.

The public issue: which documents will remain visible

S&P said that, as of March 31, 2026, it rated 15 U.S. data center ABS issuers representing more than $23 billion outstanding. This does not measure the entire global market. It is enough to show that transparency extends beyond a few experimental deals.

The most observable change may not be the name printed on the notes. It may be the presence or absence of documents in EDGAR.

Filings by CloudHQ, Lohrasp, Compass and Cologix made before or around the response made it possible to count contracts, date the data examined and identify the accounting firms performing agreed-upon procedures. If future issuances no longer trigger Rule 15Ga-2, the public will need to see what replaces them: voluntary publication, a rating report, a memorandum available only to investors or no accessible information at all.

The first series designed, structured and placed after the response will provide a better test than the July transactions, all of which were already under way. Four elements will matter: whether an ABS-15G is filed, how much risk is retained, whether Rule 192 is referenced and how much information is made public.

Europe may reach a different answer

The EU regulation does not simply adopt the U.S. label. Article 2(1) requires the credit risk associated with an exposure or pool of exposures to be tranched, payments to depend on the performance of the exposures and subordination of the tranches to determine how losses are distributed.

A third condition is decisive here. Article 2(1)(c) says the transaction must not create exposures possessing all the characteristics in Article 147(8) of Regulation 575/2013: the exposure is to an entity created specifically to finance or operate physical assets, or is economically comparable; contractual arrangements give the lender substantial control over the assets and their income; and that income, rather than the independent capacity of a broader commercial enterprise, is the primary source of repayment. These are the specialised-lending characteristics cross-referenced by the Securitisation Regulation.

Recital 6 illuminates that cross-reference: an exposure creating a direct payment obligation for a transaction used to finance or operate physical assets should not be treated as an exposure to a securitisation, even when the structure has payment obligations of different seniority. The recital guides interpretation; the operative test remains Article 2(1)(c) and its cross-reference. The European analysis therefore comes closer to the distinction accepted by SEC staff without becoming identical.

If all three Article 147(8) characteristics are present, Article 2(1)(c)’s negative condition is not met. If they are not all present, the other elements of the definition must still be tested, including whether credit risk is tranched and how subordination allocates losses. When a transaction ultimately meets the EU definition of securitisation, Article 5 imposes checks on institutional investors and Article 6 generally requires at least 5% risk retention. Falling outside section 3(a)(79) is therefore insufficient to disapply the EU regime.

Lohrasp illustrates the difficulty. Only one class of notes was publicly announced. Complete documentation would be needed to test, in sequence, the entity’s purpose, the lenders’ contractual control, the primary repayment source and then, if Article 2(1)(c) does not exclude the scheme, the existence of tranches and how subordination allocates losses. Equity and any subordinated interests may then become relevant. The closing release does not provide those elements.

The questions that remain open

The response moved a legal boundary without documenting every consequence. The parties able to clarify the remaining unknowns are identifiable.

The SEC can clarify whether Rule 15Ga-2 and Rule 192 cease to be triggered for a structure matching the Latham facts exactly. The SEC and the other federal regulators that jointly adopted the risk-retention rule can clarify treatment under Part 246. The SEC can also identify which structural changes would bring an issuance back within section 3(a)(79), and when the response dated July 29 was first published.

Cologix and RBC Capital Markets can establish the status of Canadian Series 2026-1: whether it closed, its amount, currency, classes, ratings, economic risk retention, final collateral and analysis of the staff response.

Cloud Capital and Guggenheim Securities can state whether they consider Lohrasp 2026-1 to fall within Latham’s facts and whether future series from its master trust will continue filing an ABS-15G and an agreed-upon procedures report.

Compass and Guggenheim Securities can confirm the final outcome of Series 2026-2, its risk-retention regime and the classification applied after the staff response.

Rating agencies can explain whether “data center ABS” will remain their public category when an issuer falls outside section 3(a)(79), and what information will replace reports previously available through EDGAR.

European institutional investors, their advisers and the relevant authorities can clarify how they test these notes under Article 2(1)(c), its cross-reference to Article 147(8) of Regulation 575/2013 and recital 6 of Regulation 2017/2402 independently of the U.S. classification.

A boundary, not a legal vacuum

July 29 did not make the law surrounding data centers disappear. It exposed a difference between the structured-finance meaning of ABS and its content under one U.S. statute.

The Latham structure has a dual nature. Economically, it turns a group of assets and contracts into notes distributed to investors. Under the reasoning accepted by staff, the issuer legally resembles an operating real-estate business more than a passive vehicle holding self-liquidating receivables.

For structures that actually match the Latham facts, this boundary could leave three ABS-specific triggers unsatisfied while leaving the rest of securities law intact. Its importance will be measured through the next issuances: the risk actually retained, the information actually published and the treatment actually applied on both sides of the Atlantic.

The first number to watch will therefore not be the volume of new notes. It will be the number of documents that remain public.

The ABS That Is Not One: A New Legal Boundary for Data Centers