It's complicated and a very gray area right now. In response to this gray-ness, ICO's are now requiring investors to declare that they are not from the USA and some are geoblocking USA residents.
Obviously this means nothing, if a US citizen wants to buy they still will, but it is an interesting case of Cover Your Ass From the SEC taken by the ICO companies.