SEC staff opened a custody path for broker-dealers handling crypto securities

The Securities and Exchange Commission’s Division of Trading and Markets set out a practical custody path for broker-dealers handling crypto asset securities on December 17, 2025. Staff said it would not object when a broker-dealer treated itself as having “physical possession” under Exchange Act Rule 15c3-3(b)(1), provided the firm operated within five described circumstances.

The development mattered because customer-asset protection rules were written around conventional securities infrastructure, while a blockchain asset is moved by controlling and using private keys. The statement did not rewrite that rule. It translated the staff’s view of possession into operational expectations that a broker-dealer could apply to tokenized equity or debt securities and other crypto assets that are securities.

What the custody path required

Rule 15c3-3(b)(1) requires a broker-dealer to promptly obtain and maintain physical possession or control of fully paid and excess margin securities carried for customers. The December 17 statement addressed only the physical-possession branch.

First, the broker-dealer had to have access to the crypto asset security and the ability to transfer it on the associated distributed ledger. Second, it needed written policies and procedures to assess and document the ledger, network and governance before taking custody and at reasonable intervals afterward. The SEC staff listed performance, throughput, scalability, resilience, security, complexity, extensibility and visibility among the factors that could be examined.

Third, a firm could not deem itself in possession when it knew of material security or operational weaknesses in the network, or other material custody-related risks to its business. Fourth, its controls had to protect private keys from theft, loss and unauthorized or accidental use, with no customer, affiliate or third party able to transfer the asset without the broker-dealer’s authorization.

Fifth, the firm needed disruption and recovery arrangements. The statement specifically contemplated blockchain malfunctions, 51% attacks, hard forks and airdrops; compliance with lawful seizure, freezing, burning or transfer-prevention orders; and transfer of assets if the firm entered bankruptcy, receivership, liquidation or a similar process.

Why it was institutionally significant

The statement expressly covered any broker-dealer carrying crypto asset securities, including a firm that also conducted a traditional securities business. That widened the relevance beyond the special-purpose broker-dealer framework associated with the SEC’s December 23, 2020 statement. SEC Commissioner Hester Peirce characterized the December 17 action as clarity for broker-dealers and urged the agency staff to develop formal amendments to Rule 15c3-3.

The same division also updated its crypto and distributed-ledger frequently asked questions on December 17. Those responses said federal securities laws did not categorically prohibit a national securities exchange or alternative trading system from offering a pair consisting of a security and a non-security crypto asset, provided applicable requirements were met. They also addressed ATS disclosures, customary clearing and settlement by a broker-dealer operator, and Regulation M treatment for crypto exchange-traded products. Together, the custody statement and the updated questions showed staff trying to fit blockchain market infrastructure into existing securities rules.

The boundary of the record

The action was a staff statement, not a Commission rule, regulation or formal guidance. The Commission had neither approved nor disapproved it, and the statement said it had no legal force or effect. It created no new obligation and covered neither Rule 15c3-3’s control prong nor other broker-dealer financial-responsibility duties. Obligations imposed by a broker-dealer’s designated examining authority also remained intact.

No launch, approval of a particular token, endorsement of a blockchain or immediate customer flow was established by the December 17 records. The significance was therefore regulatory and operational: the staff described a compliance route, while adoption and supervisory implementation remained open questions.

Later context

A January 27, 2026 legal analysis described the statement as a meaningful evolution that potentially lowered entry barriers, while noting that third-party “good control location” questions remained unresolved. That assessment is later interpretation, not evidence of what any firm had implemented on December 17, 2025.