SEC Mandates Direct Key Control for Crypto Custody by Brokers

The U.S. Securities and Exchange Commission (SEC) has released new guidance clarifying how broker-dealers may custody crypto asset securities under existing customer protection rules. The guidance, issued by the SEC's Division of Trading and Markets, explains that broker-dealers can consider themselves to have "physical possession" of crypto assets by maintaining exclusive control over private keys. The rules apply specifically to crypto asset securities, including tokenized versions of traditional equity and debt instruments.

According to the guidance, the statement was published on December 17, 2025, and aims to provide clarity on how the Customer Protection Rule (Rule 15c3-3) applies to digital assets. It emphasizes that broker-dealers must hold and safeguard private keys without external interference to be deemed in possession of crypto assets.

. The guidance also mandates that firms document the operational and security characteristics of the underlying blockchain network before accepting such assets for custody.

In addition, the SEC outlined specific scenarios in which a broker-dealer should not claim custody of crypto assets. These include situations involving material security or operational weaknesses in the blockchain network or risks to the firm's business model. The guidance also requires broker-dealers to have contingency plans for disruptions such as blockchain outages, hard forks, and 51% attacks, as well as procedures for handling crypto assets in the event of firm wind-downs or bankruptcies.

A Shift in Custody Standards

The SEC's guidance marks a significant shift from earlier interpretations of Rule 15c3-3, which had focused more on the concept of "control" rather than "physical possession" of assets. The December 2025 statement narrows the focus to the latter, requiring broker-dealers to demonstrate direct access and transfer capability on the associated blockchain network. This update is part of a broader effort by the SEC to integrate crypto asset securities into the existing regulatory framework for traditional securities.

Broker-dealers must now develop and enforce written policies to protect private keys from theft, loss, or unauthorized use. They are also expected to conduct regular assessments of the blockchain's governance, resilience, and security to ensure compliance. This aligns with industry best practices and aims to enhance customer confidence in crypto custody arrangements.

The guidance also highlights the importance of contingency planning. For example, firms must have protocols in place to comply with legal orders, such as asset freezes or seizures, and must ensure that customer assets remain accessible during a firm's liquidation or bankruptcy. These requirements reflect the SEC's commitment to adapting traditional securities safeguards to the evolving crypto landscape.

Implications for Market Infrastructure

The SEC's framework has significant implications for market infrastructure, particularly for traditional broker-dealers expanding into crypto services. Firms must now design systems that enable direct management of private keys rather than relying solely on external custodians. This shift increases the operational and technological burden on compliance and technology teams, who must map crypto assets to existing regulatory requirements and ensure that all systems align with the SEC's expectations.

For customers, the new rules embed crypto asset securities within the same protective framework that governs traditional securities. This approach avoids the creation of a separate, experimental regime for crypto assets and instead integrates them into the broader regulatory environment. As a result, investors may benefit from greater transparency and accountability in crypto custody practices.

Market participants have welcomed the clarity but note that implementation challenges remain. Firms must invest in infrastructure to support private key management, document blockchain network characteristics, and develop comprehensive risk mitigation strategies. These steps are critical to ensuring compliance and minimizing potential vulnerabilities in the crypto custody process.

The SEC's latest guidance is part of an ongoing regulatory effort to adapt to the growing role of crypto asset securities in the financial system. While the agency continues to evaluate broader policy issues, the December 2025 statement provides a clear roadmap for how crypto assets should be treated under existing rules. This development is expected to influence future regulatory actions and shape the evolution of crypto markets in the United States.