SEC Clarifies “Crypto” Custody for Broker-Dealers:

In the last few hours a signal has arrived from the United States which, for those who follow the evolution of on-chain finance, is worth more than many promises: the staff of the Division of Trading and Markets of the SEC has published a position that brings order to a thorny and often paralyzing topic for traditional operators, i.e. how a broker-dealer can "safeguard" crypto assets which are securities (including tokenized versions of shares or bonds) while remaining within the confines of the rules of responsibility and protection of the customer.

The central point is technical but decisive: rule 15c3-3 requires the broker-dealer to maintain "physical possession or control" of client securities. In practice, the world of certificates and custodians does not match the world of private keys and distributed ledgers. The SEC, with this intervention, is trying to build a bridge: it essentially says that, under certain conditions, the staff will not object if a broker-dealer considers the "physical possession" requirement for a crypto asset security to be satisfied.

What conditions? Here we can see the direction: it is not enough to "have a wallet", you need a mature, documented and verifiable operational system. In particular, the orientation insists on five blocks:

1. Access and transfer capacity: the broker-dealer must be able to directly access the asset and transfer it to the reference network, without opaque dependencies.
2. Preventive evaluation of the blockchain and governance: before taking into custody (and then periodically), there must be a written evaluation of the ledger and the network: performance, security, resilience, protocol updates, how changes are decided and applied.
3. Automatic stop if material risks emerge: if there are significant operational or security weaknesses, or concrete risks that could undermine custody, the operator should not "give himself possession" of the asset. Translation: no shortcuts when the technology does not meet the required standards.
4. Private key protection: The SEC is very clear here. We need policies and controls in line with best practices to prevent theft, loss and unauthorized use. And above all: the system must be designed to prevent other parties (customers, third parties, even affiliates) from moving the asset without the authorization of the broker-dealer.
5. Plans for “on-chain” contingencies: not just IT incidents. Scenarios such as blockchain malfunctions, 51% attacks, hard forks and airdrops are explicitly discussed. In addition, the broker-dealer must foresee how to execute legal orders (seize, freeze, burn or block transfers) and how to guarantee transferability and continuity even in the event of a corporate crisis or liquidation.

The most important detail for the sector is the implicit message: the SEC is defining the minimum contours of an "institutional" infrastructure for the custody of tokenized assets. It is an assist to those who want to build regulated services, but it is also a filter: access passes through procedures, controls, auditability and risk management, not marketing.

In parallel, the FAQs updated by the staff add pieces that closely concern markets and products: they clarify that the rule concerns crypto assets which are securities, and that a broker-dealer can also establish "control" using certain "control locations" provided for by the legislation; reiterate that old “temporary” settings were not an obligation; and touch on practical aspects that touch on the world of spot ETPs and regulatory capital management.

What changes, in concrete terms, for the ecosystem? If this orientation is received and consolidated, we can expect more experiments on tokenization of financial instruments, more traditional players willing to enter into custody (without having to invent creative interpretations), and a push towards infrastructures in which on-chain finance presents itself with standards comparable to those of regulated markets. But there is also a red line: the document reminds, in fact, that not all crypto assets are the same and that the protections "from traditional finance" do not automatically extend to everything that lives on blockchain.

It is a maturation step: it does not resolve every ambiguity, but it indicates the route. And in a sector where those who run fastest often win, today those who manage to run without losing control win.