People expect too much from the SEC. If you look at how they are still trying to catch up on things related to the internet sector, it doesn't surprise me at all that they are taking it easy on crypto. I wouldn't even want them to "properly" regulate the market as it is right now, because they clearly lack the expertise to do so.
They're definitely capable of applying current securities laws to the low-hanging fruit. Most ICO tokens are obviously unregistered securities, particularly with how they were marketed with an emphasis on investor returns and without proper avoidance of US investors. A lot of those cases are open and shut. For what it's worth, I think their enforcement actions and general presence over the past year has deterred some of the more egregious ICO scamming from continuing.
I think it's more about resources than anything else. They're stretched far too thin to keep a handle on anything but the lowest hanging fruit. The space proliferated so fast, and they're a legacy institution that usually spends many months or even years pursuing any given case.
The SEC chairman already hinted at how they don't plan to change their rules/laws, so it might be closer to the truth than most people would like it to be.
I don't think they can change much without new legislation. They're just enforcing old laws that have been on the books for decades. If Congress redefines cryptocurrency with regard to current securities law, the SEC will have to change their rules.
