-
New Guidance: The SEC’s Division of Trading and Markets issued an interim statement clarifying how broker-dealers must manage "crypto asset securities" to comply with customer protection rules.
-
Possession Defined: A broker-dealer is considered to have "physical possession" of a token only if it maintains exclusive access to the private keys required for transfers on the blockchain.
-
Risk Management: Firms must establish written policies to prevent private key theft and create contingency plans for "blockchain malfunctions," network attacks, or hard forks.
-
Governance Monitoring: Custodians are expected to actively monitor blockchain protocol updates and governance shifts that could impact customer assets.
Clarifying "Physical Possession" for Digital Assets
The U.S. Securities and Exchange Commission (SEC) has released new guidance for broker-dealers seeking to custody "crypto asset securities," including tokenized equity and debt. The statement addresses how these firms can satisfy the long-standing "customer protection rule," which requires them to maintain "physical possession or control" of customer assets—a complex task when dealing with digital tokens living on distributed ledgers.
Private Key Exclusivity is Key
Under the new 2025 guidance, the SEC specifies that a broker-dealer achieves the required level of possession by maintaining exclusive control over the associated private keys. This means the broker must ensure that no other party—including the customer or a third-party affiliate—can initiate transfers. Furthermore, the agency emphasized that firms must develop and enforce rigorous written policies to safeguard these keys against loss, unauthorized use, or cyber theft.
Operational Resilience and Compliance
Beyond simple key management, the SEC expects broker-dealers to be prepared for the technical risks inherent in blockchain technology. Firms are required to have established procedures for responding to "blockchain malfunctions," network-wide attacks, and hard forks. They must also demonstrate the ability to comply with legal orders, such as freezing or seizing assets, similar to traditional financial systems. Notably, the guidance suggests that custodians must stay informed about on-chain governance and protocol changes, taking "appropriate action" to mitigate risks posed by the underlying network’s evolution.
