The SEC's Shifting Crypto Custody Framework and Investor Risk Exposure

The U.S. Securities and Exchange Commission (SEC) has been recalibrating its approach to crypto custody in 2025, aiming to balance innovation with investor protection. Yet, as regulatory frameworks evolve, a growing tension between federal agencies and state regulators is creating a fragmented landscape. This fragmentation not only complicates compliance for market participants but also raises critical questions about digital asset security and systemic risk.

The SEC's 2025 Agenda: Clarity or Confusion?

In September 2025, the SEC outlined its Spring 2025 Unified Agenda, emphasizing modernization of crypto custody rules to support innovation while deterring regulatory arbitrage. A key development was the issuance of a no-action letter allowing state-chartered trust companies (STCs) to act as "banks" for crypto custody under the Investment Advisers Act and Investment Company Act according to regulatory developments. This relief, conditional on due diligence and asset segregation, expands institutional access to crypto custody services but introduces ambiguity about the equivalence of safeguards compared to traditional custodians as reported.

Chairman Paul Atkins' "Project Crypto" initiative further signals a shift toward tailored regulations, including a proposed token taxonomy and "Regulation Crypto" to address disclosures and exemptions for crypto distributions according to Sidley's analysis. However, these efforts remain aspirational, with formal rule proposals delayed until 2026 as noted in the same report. The gap between intent and execution leaves market participants navigating a patchwork of evolving standards.

Federal and State Regulatory Conflicts: A Patchwork of Rules

The SEC's moves contrast sharply with federal banking regulators' cautious stance. In July 2025, the Federal Reserve, OCC, and FDIC jointly issued guidance, requiring banks to apply conservative risk management to crypto custody, including strict control over cryptographic keys and segregation of client assets. Meanwhile, the OCC's Interpretive Letter 1183 permits national banks to act as validator nodes and custody crypto assets without prior approval according to DLA Piper, creating a divergence with the FDIC and Fed, which still require pre-approval for such activities as stated in the same analysis.

State regulators further complicate the landscape. For instance, the SEC's rescission of SAB 121-a rule that imposed accounting burdens on crypto custodians-was replaced with SAB 122, which allows more flexible accounting treatment. While this eases operational hurdles, it also highlights the lack of alignment between federal and state-level oversight, particularly as states like New York and Wyoming experiment with their own crypto-friendly frameworks.

Investor Risk and Systemic Implications

The regulatory fragmentation directly impacts investor protection and market stability. Traditional custodians are subject to stringent safeguards, such as asset segregation and prudential oversight, which crypto custodians may not uniformly adopt according to BPI's analysis. For example, the SEC's no-action relief for STCs does not mandate equivalent safeguards, leaving room for operational risks like misappropriation or insolvency-related asset recovery challenges as detailed in the guidance.

Systemic risks also loom large. If crypto custodians fail to meet the same safety standards as traditional institutions, a single failure could trigger cascading effects across the financial system as highlighted by federal regulators. The joint statement from federal banking agencies underscores this concern, emphasizing that crypto custody must not introduce new vulnerabilities to AML/CFT frameworks or consumer protection laws according to the FDIC.

The Path Forward: Harmonization or Chaos?

The SEC's evolving framework, while well-intentioned, risks exacerbating regulatory fragmentation unless harmonized with federal and state counterparts. Banks and financial groups have already called for the SEC to apply proven safeguards-such as asset segregation and ongoing oversight-to crypto custodians as stated by BPI. Failure to do so could erode investor confidence and destabilize markets, particularly as tokenized assets gain traction as outlined in Sidley's report.

Investors must remain vigilant. Diversifying custody strategies across regulated institutions, prioritizing custodians with robust cybersecurity frameworks, and advocating for clearer regulatory alignment are critical steps to mitigate risk according to Dechert's analysis. For policymakers, the challenge lies in balancing innovation with the need for a cohesive, risk-mitigated framework that protects both investors and the broader financial system.