GAO Says SEC Crypto Custody Bulletin Must Face Congressional Review

The U.S. Government Accountability Office concluded on October 31, 2023 that the Securities and Exchange Commission’s Staff Accounting Bulletin No. 121 was a rule for purposes of the Congressional Review Act and therefore had to be submitted to Congress.

The decision placed a contested piece of crypto-custody accounting guidance inside a formal congressional-review framework. GAO said the SEC had not submitted the required report to either chamber of Congress or to the comptroller general before the bulletin took effect. The finding did not erase SAB 121 on October 31, however, and the SEC told CoinDesk that GAO’s opinion did not otherwise change the bulletin’s status.

What SAB 121 required

SEC staff issued SAB 121 on March 31, 2022, with an effective date of April 11, 2022. It addressed specified SEC-reporting entities responsible for safeguarding crypto assets held for platform users, including arrangements in which an entity or its agent maintained the cryptographic keys needed to access those assets.

The bulletin said a covered entity should recognize a safeguarding liability on its balance sheet, measured at the fair value of the crypto assets it was responsible for holding at initial recognition and each reporting date. It also called for a corresponding asset measured on the same basis, subject to evaluation for potential loss events. Expected disclosures included the nature and amount of safeguarded crypto assets, concentrations, responsibility for key management, and vulnerabilities involving loss, theft, litigation or bankruptcy.

SEC staff described the treatment as a response to technological, legal and regulatory risks it considered distinct from conventional custody. The agency’s own publication also said staff accounting bulletins were staff interpretations and practices—not Commission rules or interpretations carrying official Commission approval. That characterization became the center of the October 31 dispute.

Why GAO called the bulletin a rule

The Congressional Review Act uses the Administrative Procedure Act’s broad definition of a rule. GAO found that SAB 121 was an agency statement because SEC staff published it on the agency’s official website; that it had future effect because it directed covered entities to consider specified accounting and disclosure practices; and that it interpreted or prescribed policy.

GAO also rejected all three statutory exclusions. The bulletin was generally applicable rather than directed to a named entity, did not concern only internal agency management or personnel, and had what GAO considered a substantial effect on non-agency parties. GAO reasoned that covered companies could reasonably change operations and policies to align with practices SEC staff would consider when reviewing filings.

That conclusion was narrower than declaring SAB 121 invalid under every body of administrative law. GAO explicitly examined whether the bulletin was a rule under the Congressional Review Act; it did not decide that the document required notice-and-comment procedures under the Administrative Procedure Act.

Why the decision mattered for crypto custody

SAB 121 had become an institutional fault line because its balance-sheet treatment applied to firms safeguarding customer crypto assets. Critics, including SEC Commissioner Hester Peirce and crypto-industry participants, argued that the staff bulletin used guidance to impose a consequential accounting position. Industry critics further claimed that adding a safeguarding liability and corresponding asset could interact with bank capital requirements and make crypto custody uneconomic for regulated banks.

Those were contemporaneous policy claims, not quantified findings in GAO’s decision. The October 31 record did not measure the bulletin’s effect on any particular bank, identify foregone custody capacity, or establish a cryptocurrency price reaction.

The immediate development was procedural but consequential: Congress had an authoritative basis to review a policy that the SEC had treated as staff guidance. At the close of October 31, 2023, no resolution of disapproval had passed, SAB 121 remained in place, and its longer-term fate was unresolved.