Regulatory Risks in Crypto Treasury Management: How TradFi Enforcement Actions Signal Systemic Vulnerabilities

The U.S. Securities and Exchange Commission (SEC) and Financial Industry Regulatory Authority (FINRA) have undergone a dramatic regulatory pivot in 2025, shifting from enforcement-heavy approaches to structured rulemaking in crypto asset custody. This evolution, however, underscores systemic vulnerabilities in how crypto treasuries are managed, particularly in light of past enforcement actions that exposed gaps in custody frameworks and governance models.

From Enforcement to Structured Rulemaking: A Regulatory Shift

In September 2025, the SEC issued a no-action letter affirming that registered investment advisers and funds could treat state-chartered trust companies as qualified custodians for crypto assets. This marked a departure from the 2019 joint statement with FINRA, which had restricted broker-dealers from custodying digital assets. By replacing restrictive enforcement with FAQs and clarifications, the SEC signaled a broader intent to foster innovation while maintaining investor protections, as discussed in SEC Crypto Regulation 2025. For instance, the FAQs clarified that Rule 15c3-3 (Customer Protection Rule) does not apply to non-security crypto assets, allowing broker-dealers to use qualifying custodians like banks or state trusts without adhering to the 2020 Special Purpose Broker-Dealer (SPBD) Statement, according to the SEC FAQs.

This shift reflects a recognition of systemic risks identified in earlier enforcement actions. For example, the 2019 restrictions had inadvertently limited custodial options, pushing some market participants toward less secure or unregulated solutions, as noted in a Money Laundering News analysis. By expanding the universe of custodians, the SEC aims to mitigate such risks, but the transition period remains fraught with ambiguity.

Legislative Momentum and Persistent Gaps

Legislative efforts like the CLARITY Act and GENIUS Act further illustrate the push for clarity. The CLARITY Act seeks to categorize crypto assets into digital commodities and investment contracts, assigning oversight between the SEC and Commodity Futures Trading Commission (CFTC), as summarized in a KPMG alert. Meanwhile, the GENIUS Act addresses stablecoin regulation, adding structure to a sector previously plagued by governance failures (KPMG).

Yet, critical vulnerabilities persist. The FAQs explicitly acknowledge unresolved issues, such as how to interpret control in decentralized systems and the risks of self-custody for crypto asset securities, as described in an SEC staff withdrawal. For example, the SEC's August 2025 enforcement action against MyConstant-a crypto-backed investment scheme-highlighted the agency's continued focus on fraud, as described in a MoFo enforcement roundup. Similarly, the agency's dismissal of enforcement actions against platforms like Robinhood and Coinbase under the Trump administration suggests a strategic pivot toward reducing regulatory friction, even as it leaves certain risks unaddressed, according to the Harvard Law Forum.

Systemic Risks in Crypto Treasury Management

The evolving regulatory landscape exposes three key vulnerabilities in crypto treasury management:

1. Custody Fragmentation: While the SEC's no-action letter expands custodial options, the reliance on state-chartered trusts introduces fragmentation. Unlike federally insured banks, these entities may lack uniform standards, creating operational and liquidity risks for treasuries (CoinDesk).

2. Decentralized Governance Challenges: The FAQs acknowledge that decentralized systems complicate the definition of "control," a cornerstone of custody regulations (Fintech and Digital Assets). This ambiguity leaves treasuries exposed to governance failures, as seen in the collapse of Terra/LUNA in 2022.

3. Enforcement Inconsistencies: The SEC's closure of high-profile cases and its declaration that meme coins are not securities signal a reduced enforcement appetite in certain areas (Harvard Law Forum). While this may encourage innovation, it also creates a regulatory gray zone where bad actors could exploit loopholes.

The Path Forward: Balancing Innovation and Risk Mitigation

The SEC's Spring 2025 regulatory agenda emphasizes structured rulemaking, including formal frameworks for custody, issuance, and trading, as outlined in the Spring 2025 agenda. However, until these rules materialize, investors must navigate a landscape where regulatory clarity is uneven. For example, the SEC's FAQs allow broker-dealers to treat non-security crypto assets as financial assets under the Uniform Commercial Code, but this approach may not hold in insolvency scenarios (Morgan Lewis).

Investors and treasury managers should prioritize due diligence on custodial partners, favoring entities with clear regulatory alignment and robust governance. Additionally, the SEC's Project Crypto and Crypto Task Force initiatives suggest that more formal rules are on the horizon, potentially reshaping custody requirements in 2026, as suggested in the SEC's keynote address.

Conclusion

The SEC's 2025 regulatory shifts reflect a strategic move toward structured rulemaking, but they also expose systemic vulnerabilities in crypto treasury management. While expanded custodial options and legislative clarity are positive developments, unresolved issues in decentralized governance and enforcement inconsistencies remain significant risks. As the industry awaits formal rules, investors must remain vigilant, balancing innovation with prudent risk management.