SEC Staff Clarifies ‘Possession and Control’ in Custody Rules for Crypto Assets

The statement, released alongside updated FAQs on crypto trading and a related request for information (RFI) from Commissioner Hester Peirce, reflects the agencies increasing focused on integrating crypto assets into existing securities market infrastructure rather than treating them as regulatory outlier, according to an analysis by Dechert.  It comes as the fate of legislation to define a distinct market structure for crypto assets remains uncertain amid ongoing debate over the measure in the Senate.

At the core of the December statement is Rule 15c3-3, the Exchange Act’s Customer Protection Rule, which requires carrying broker-dealers to maintain “physical possession or control” of fully paid and excess margin securities. For traditional securities, those concepts have long been tied to certificates, transfer agents, and recognized “good control locations” such as clearing agencies and banks. Crypto assets, by contrast, lack physical form and rely on distributed ledger technology, forcing the staff to reinterpret what possession means in a digital context.

The statement does so by anchoring physical possession to functional control over the cryptographic keys that enable transfer of a crypto asset security. According to the staff, a broker-dealer can establish physical possession by maintaining access to the asset on the relevant blockchain and the ability to transfer it, which in practice requires control of the associated private keys.

Related: CFTC Certifies First Crypto-Native Exchange as a Designated Contract Market

Per Dechert, the statement goes further by conditioning physical possession on a robust compliance infrastructure. Broker-dealers must adopt and enforce written policies to safeguard private keys, evaluate the underlying distributed ledger and network both initially and on an ongoing basis, and prepare in advance for contingencies such as forks, airdrops, network attacks, or operational failures. They must also have procedures to comply with court orders and to ensure orderly transfer of customer assets in the event of insolvency. In effect, the staff treats custody of crypto asset securities as a risk-managed operational function, not merely a legal designation.

The staff also draws a clear line around operational risk, according to Dechert.A broker-dealer cannot be deemed to have physical possession of a crypto asset security if it is aware of material security or operational weaknesses in the blockchain or network on which the asset resides. This limitation underscores the staff’s view that custody is inseparable from technological integrity. At the same time, the guidance suggests reputational or market risks alone do not negate possession, reinforcing the idea that the analysis is grounded in custody-specific concerns rather than broader skepticism toward crypto markets.

Equally important is what the statement implies about non-security crypto assets. The staff reiterates that Rule 15c3-3 does not apply to assets such as bitcoin or ether, meaning broker-dealers are not subject to the Customer Protection Rule when custodying those assets. Yet the document stops short of endorsing unrestricted custody of non-security crypto assets by all broker-dealers. The cautious tone suggests the SEC remains concerned about spillover risks to regulated securities businesses, even where its direct statutory authority is limited.

Taken together, the December statement and related guidance mark a decisive evolution in the SEC’s posture. The new framework opens custody to any carrying broker-dealer willing to meet defined operational and compliance standards. More broadly, the staff’s emphasis on functional control, technological resilience, and integration with existing market rules indicates a regulatory philosophy that treats crypto asset securities less as an exception and more as a new asset class to be absorbed into the federal securities regime.