SEC Issues New Mandate: Broker-Dealers Must Control Crypto Private Keys or Face Consequences

Core Viewpoint - The U.S. Securities and Exchange Commission (SEC) has clarified the custody requirements for broker-dealers handling crypto asset securities, moving from regulatory ambiguity to clear operational expectations [1][2]. Group 1: Custody Requirements - Broker-dealers must maintain exclusive possession of crypto asset securities by controlling the private keys used for access and transfer [2][4]. - A broker-dealer can only claim possession of a crypto asset security if it has direct access to the asset on the relevant blockchain and the ability to transfer it [4][5]. - Access to the private keys must not be shared with customers or third parties, including affiliates, without the broker-dealer's authorization [4][6]. Group 2: Assessment and Risk Management - Broker-dealers are required to assess the blockchains and networks of crypto asset securities before custody and to conduct regular assessments thereafter [5][6]. - Firms must evaluate various factors such as performance, security, governance, upgrade processes, and risks like hard forks and 51% attacks that could impact ownership records [5][6]. - If a broker-dealer identifies material security or operational weaknesses in a blockchain network, it should not consider itself to have possession of the asset [6]. Group 3: Historical Context - The SEC's statement comes after years of broker-dealers claiming that crypto custody was effectively impossible under previous SEC interpretations [7]. - From 2022 to 2024, the SEC's approach was heavily influenced by accounting and structural constraints that deterred traditional firms from entering the crypto space [7].