SEC issues new regulations on crypto asset custody: brokers must meet 5 major compliance requirements

[ChainWen] The U.S. Securities and Exchange Commission’s Division of Trading and Markets recently published guidance on broker-dealer custody of crypto asset securities. The core of this document is to clarify how Section 15c3-3(b)(1) of the Securities Exchange Act applies specifically to crypto asset securities, especially for brokers holding such assets for clients.

The document emphasizes a key concept: what constitutes “physical possession or control.” Simply put, if a broker can do the following, regulators recognize that they hold the rights to the crypto asset securities in client accounts.

First is technical capability. They must be able to directly access the crypto assets and perform transfer operations on the relevant blockchain networks. This is fundamental—without it, everything else is meaningless.

Second is a risk assessment system. A comprehensive written policy and operational procedures must be established to evaluate the inherent characteristics and potential risks of blockchain technology itself. Blind custody is not acceptable; the underlying technology must be thoroughly understood first.

The third requirement is more stringent: risk mitigation principles. If significant security vulnerabilities, operational issues in the relevant blockchain, or other major risks to the broker’s own business arise from custody of the asset, they cannot claim control over the asset. In other words, issues must be addressed immediately to prevent losses.

Private key protection is of utmost importance. Policies, procedures, and internal controls aligned with industry best practices must be established to ensure that private keys needed for access and transfer are not stolen, lost, or illegally used. Most critically, beyond the broker’s own authorization, no one—including clients and third parties—should have access to private keys or be able to transfer assets.

Finally, an emergency contingency plan must be designed. A complete written policy, procedures, and arrangements should be in place to ensure that even in the event of blockchain failures, 51% attacks, hard forks, or extreme situations like liquidation or bankruptcy of the broker, clients’ crypto asset securities remain securely stored and can be transferred smoothly.

While these requirements may seem complex, they reflect regulators’ genuine concern for custody security. As more institutions participate in the crypto asset market, such standardized norms are becoming increasingly necessary.