SEC Says Brokers Must Hold Crypto Keys to Meet Custody Rules
- SEC says broker-dealers must control private keys to claim possession of crypto securities.
- Guidance applies to tokenized equities and debt held by broker-dealers for customers.
- Firms must plan for forks, attacks, court orders, and asset transfer during failure.
The U.S. Securities and Exchange Commission issued new guidance explaining how broker-dealers must custody crypto asset securities. The SEC’s Division of Trading and Markets said firms must control private keys to meet customer protection rules under federal law. The statement responds to market requests and outlines how physical possession applies to blockchain-based securities.
Crypto Asset Securities and Scope of Guidance
The guidance focuses on paragraph (b)(1) of Rule 15c3-3 under the Securities Exchange Act of 1934. Notably, the SEC defines crypto asset securities as digital tokens that qualify as securities. These include tokenized versions of equity or debt securities recorded on blockchains.
The Division of Trading and Markets said the statement applies to any broker-dealer carrying crypto asset securities for customers. This includes firms running traditional securities businesses alongside digital asset services. However, the SEC stressed that the guidance addresses possession only, not broader custody or control obligations.
According to the SEC, the statement carries no legal force and creates no new rules. Instead, it reflects staff views issued as an interim step. The Commission continues reviewing broker-dealer custody issues and feedback from market participants.
SEC Chair Paul Atkins has given attention to tokenized securities, a growing segment within digital markets. The guidance reflects that focus by clarifying how existing rules apply. However, the SEC limited the statement strictly to physical possession requirements.
Private Key Control as Proof of Physical Possession
Under these rules, broker-dealers can be considered to have “physical possession” of crypto assets if they fully control the private keys. This means they must be the only ones with access to the keys needed to move tokens on the blockchain. If anyone else can access those keys, the firm cannot claim custody.
The SEC also requires firms to have clear written rules for protecting private keys. These rules must prevent theft, loss, or misuse. Customers, partners, or third parties are not allowed to move assets without the broker-dealer’s permission.
In addition, broker-dealers must carefully review the blockchains that support each crypto asset. This review has to be done before taking custody and repeated at reasonable intervals afterward. The SEC said assessments should examine security, reliability, governance, and operational risks.
Governance processes also matter under the guidance. Broker-dealers must monitor protocol upgrades, changes, hard forks, airdrops, and token exchanges. According to the SEC, these factors could affect possession and require prompt action.
However, the SEC drew clear limits. A broker-dealer cannot claim possession if it knows of material security or operational weaknesses. The focus remains on custody-related risks, not market or reputational concerns.
Related: SEC Opens Public Consultation on Crypto Trading Rules
Planning for Disruptions, Legal Orders, and Firm Failure
Beyond controlling private keys, the SEC expects broker-dealers to be ready for custody problems. They must have written plans for issues like blockchain failures, cyberattacks, or even 51% attacks. These plans also need to address events such as hard forks.
Broker-dealers must also be able to follow legal orders. This includes court instructions to seize, freeze, destroy, or limit the movement of crypto-based securities. The SEC said custody arrangements must allow such actions when required.
The guidance also addresses firm failure scenarios. Broker-dealers must ensure crypto asset securities remain accessible during liquidation or bankruptcy. Assets should be transferable to another broker-dealer, trustee, or receiver if operations cease.
The SEC emphasized that these measures aim to protect customer assets during stress events. According to the Division of Trading and Markets, advance planning provides reasonable assurance of continued safekeeping.
SEC Commissioner Hester M. Peirce welcomed the guidance in a separate statement. She praised the clarity around private key protection and custody expectations. Peirce also urged the Division to propose amendments to Rule 15c3-3 to better accommodate crypto custody.
Meanwhile, the guidance explains how broker-dealers can meet long-standing customer protection rules while holding blockchain-based securities. The SEC said the statement answers repeated industry questions. Further policy work, however, remains ongoing.
