Yes: carrying broker-dealers can be deemed to possess crypto asset securities under Rule 15c3-3 if they meet the SEC staff’s stated conditions. Those conditions boil down to three things: verified access and transfer capability on the relevant ledger, a documented distributed ledger technology (DLT) assessment, and demonstrable private-key controls. The staff’s December 2025 statement is a “will not object” position limited to the possession requirement in Rule 15c3-3(b)(1), not a blanket safe harbor, and ongoing diligence failures can strip a firm of possession status just as fast as it was granted.
TL;DR:
- Firms must demonstrate verified access, transfer capability, private-key controls, and a documented DLT assessment to be deemed in possession of crypto securities.
- Continuous monitoring is required, with firms needing to cease custody immediately upon discovering material network issues like exploits or chain splits.
- Custody architecture should ensure control remains sole and unilateral, with regular updates to network assessments and testing of wind-down procedures.
- SIPC coverage is not automatic for all crypto assets, and legal classification affects both protection and capital treatment, requiring careful documentation.
- Building compliance over a 90-day period involves early management approval, technical setup, legal agreements, and regular testing, with firms advised to consult experienced counsel beforehand.
Table of Contents
- Understanding the Broker Dealer Crypto Rules Behind the Staff Statement
- What Counts as Possession: The Three Technical Pillars
- Possession Is Conditional: Monitoring Triggers That End Custody
- Contingency Planning for Forks, Legal Orders, and Wind-Down
- Recordkeeping, SIPC Coverage, and Net Capital Treatment
- Building a 90-Day Compliance Roadmap for Crypto Custody
- Why Firm Experience With Crypto Enforcement Matters Here
- An Examiner’s-Eye View of Where Custody Programs Fall Apart
- How Murphy’s Law Supports Broker-Dealer Custody Compliance
- Sources
- FAQ
Understanding the Broker Dealer Crypto Rules Behind the Staff Statement
The Customer Protection Rule, Rule 15c3-3(b)(1), requires a broker-dealer to maintain physical possession or control of customers’ fully paid and excess margin securities. For decades that meant a vault, a transfer agent, or a clearing bank. Crypto asset securities do not fit that model, so the SEC’s Division of Trading and Markets issued a staff statement on December 17, 2025 saying the staff will not object if a firm deems itself in possession when it meets a defined set of measures.
Those measures include verified access to the asset, the technical ability to transfer it on its native ledger, a documented network risk assessment, private-key control procedures, and a contingency plan for wind-down transfers. This builds on the May 15, 2025 FAQs, which clarified that Rule 15c3-3(b) applies only to crypto assets that are themselves securities, not to tokens the SEC treats as commodities or purely functional network assets. The FAQs also unpack what counts as a “good control location” for crypto, walking through recordkeeping duties and how SIPC protection interacts with digital asset holdings.
Two limits matter for exam preparation:
- The staff statement addresses possession under 15c3-3(b)(1) only. It does not resolve every financial responsibility question a firm might face, including certain net capital and reserve computation nuances.
- Neither the statement nor the FAQs function as a safe harbor. A firm that checks every box on day one can still lose possession status later if it fails to monitor the underlying network or ignores a documented security flaw, according to Dechert’s analysis of the guidance.
Treat this as guidance to build a program around, not a certificate to file away. Examiners will ask for the documentation trail, not just the conclusion.
What Counts as Possession: The Three Technical Pillars
Possession under the new framework rests on three testable pillars, and each one has a specific compliance signature examiners will look for.
- Access and transfer capability. The firm must be able to demonstrate, not just assert, that it can move the crypto asset security on its native ledger without third-party permission it does not control. In practice this means the broker-dealer holds signing authority over the relevant private keys or participates directly in a multi-signature or multi-party computation (MPC) scheme where its approval is required for any transfer.
- Private-key custody model. Firms generally choose among three architectures: third-party cold storage with a qualified custodian, in-house hardware security modules (HSMs), or distributed MPC arrangements that split signing authority across multiple parties. Third-party cold custody reduces internal operational burden but adds counterparty risk and requires the due diligence discussed later in this article. In-house HSMs give the firm direct control but demand serious internal security engineering and 24/7 monitoring. MPC threads the needle, letting no single party hold a complete key, though it requires more sophisticated vendor and process documentation.
- DLT and network assessment. The staff statement and Sidley’s summary of it both point to the same underlying expectation: a written assessment covering the network’s governance structure, upgrade and fork procedures, transaction finality guarantees, known attack vectors (including 51% attack risk on smaller proof-of-work chains), and a documented incident history.
Pro Tip: Build the DLT assessment as a living document with a version history, not a one-time memo. Examiners increasingly ask when a network assessment was last updated relative to the most recent protocol change, and a stale assessment reads as a compliance gap even if the underlying conclusion still holds.
Dechert’s practice guidance goes further, recommending that broker-dealers structure key custody so the firm retains sole, unilateral transfer ability when acting as custodian, with documented separation of duties and emergency key-escrow procedures that satisfy an auditor’s need for independent verification. That single design choice, sole unilateral control, resolves more exam friction than almost any other element of a custody architecture.
Possession Is Conditional: Monitoring Triggers That End Custody
Possession under the staff statement is not a status a firm earns once and keeps forever. It is a continuous condition, and the guidance expects broker-dealers to stop custodying an asset the moment they become aware of a material security or operational problem on its underlying network.
What counts as material? Practitioner commentary points to a consistent set of triggers:
- An exploitable smart contract or protocol bug that has not yet been patched.
- A consensus mechanism failure or contested chain split with no clear resolution path.
- Sustained network downtime or validator outages that impair transfer capability.
- Credible advisories from security researchers or the protocol’s own core development team flagging active exploitation.
A defensible monitoring program needs more than a Google Alert. Firms should build telemetry that tracks validator participation and network health in real time, subscribe to vendor and custodian attestation reports on a fixed cadence, and maintain a documented incident reporting timetable that specifies who gets notified and how fast.
When a trigger fires, the operational response matters as much as the detection. A workable playbook sets escalation thresholds tied to severity (a minor governance vote does not require the same response as an active exploit), defines when custody gets temporarily suspended pending review, and lays out customer remediation and regulatory notification steps in advance rather than improvising them under pressure. Baker Tilly’s review of broker-dealer custody obligations notes that firms integrating crypto into existing accounts face meaningfully more operational burden than the lighter registration barriers might suggest, precisely because this monitoring and response infrastructure has to run continuously, not just at onboarding.
Contingency Planning for Forks, Legal Orders, and Wind-Down
Operational resilience means having an answer ready before the event happens, not scrambling once it does. Four categories of contingency deserve a pre-built playbook.
- Network events. Forks, airdrops, chain reorganizations, and 51% attack scenarios each require a mapped response: which team makes the call, how customer positions get reconciled, and how the firm communicates the change. Waiting to improvise a fork response while a chain is actively splitting is how firms end up with mismatched customer ledgers.
- Lawful orders. Freeze orders, seizure warrants, and subpoenas targeting crypto asset securities require a cooperation process built in advance, including a designated point of contact for law enforcement and a technical procedure for complying with an order without compromising other customers’ assets on the same infrastructure.
- Wind-down and insolvency. If the broker-dealer fails, a trustee or receiver needs to be able to identify and transfer customer crypto holdings cleanly. The SEC’s FAQs suggest firms consider contractual Article 8 UCC financial-asset treatment and operational segregation so customer property is identifiable and separable from the firm’s own estate.
- Custodial counterparty failure. If a third-party custodian goes dark, the service agreement needs a pre-negotiated transfer mechanism, not a renegotiation under duress.
Pro Tip: Test your wind-down transfer procedure with a tabletop exercise at least once a year, using actual custodian API credentials in a sandboxed environment. Firms that only test this on paper routinely discover during a real event that the “transfer agreement” assumed technical capabilities the custodian never actually built.
Recordkeeping, SIPC Coverage, and Net Capital Treatment
Rule 15c3-3 and the related Rule 17a recordkeeping provisions only reach crypto assets that qualify as securities. Non-security tokens, even if the firm custodies them, sit outside this framework entirely, which is exactly why the classification question comes first in any audit.
That classification distinction carries real financial consequences:
- SIPC protection is not automatic. SIPC coverage under SIPA generally extends to “securities” as statutorily defined, and many crypto assets, even some the firm treats as securities for other purposes, may not clearly qualify. Firms should not represent SIPC coverage to customers without a specific legal analysis of the asset in question.
- Net capital haircuts apply to proprietary positions. Auditors expect firms to document the haircut methodology applied to crypto asset securities held as inventory, and to be able to reconcile that treatment against the firm’s stated custody arrangement.
- Customer counts and reconciliation get more complex. Verifying a customer’s crypto position requires ledger-level confirmation, not just an internal database entry, which changes what an annual audit count actually looks like.
One structural fix worth building into custody design: mapping non-security crypto holdings to Article 8 financial-asset treatment under state commercial law, paired with strict operational segregation. That combination gives a trustee a cleaner path to identify customer property in an insolvency, even for assets that fall outside SIPC’s statutory definition of a security. Firms wrestling with concentration risk disclosures around large custodial relationships can find useful modeling in customer concentration disclosure frameworks, which apply the same logic auditors use when assessing counterparty exposure in traditional securities custody.
Building a 90-Day Compliance Roadmap for Crypto Custody
Getting audit-ready is a sequencing problem as much as a technical one. Some tasks unlock others, and doing them out of order wastes weeks.
- Weeks 1 to 2: Governance and scoping. Get board or senior management sign-off on undertaking crypto custody, engage the external auditor early to flag what evidence they will expect, and determine whether FINRA notification is required for the specific activity.
- Weeks 3 to 6: Technical architecture. Finalize the private-key custody model, stand up transaction logging and monitoring infrastructure, and complete the first documented DLT assessment for each asset the firm intends to custody.
- Weeks 7 to 10: Legal and contractual work. Draft or amend custody agreements, transfer protocols with any third-party custodian, and contract clauses covering regulatory action, insolvency, and wind-down obligations.
- Weeks 11 to 13: Testing and documentation. Run a continuity and wind-down tabletop exercise, finalize written supervisory procedures, and assemble the exam evidence package.
| Task Category | Quick Win (1 to 4 weeks) | Long-Lead Item (2+ months) |
|---|---|---|
| Governance | Board resolution approving custody scope | Full written supervisory procedures manual |
| Technical | Enable transaction logging on existing systems | Build or migrate to MPC key architecture |
| Legal | Draft lawful-order cooperation memo | Negotiate custodial wind-down transfer agreement |
| Documentation | Initial DLT assessment for one asset | Ongoing quarterly reassessment program |
The general counsel’s office and the compliance officer’s team need to run these tracks in parallel, since the legal work on custody agreements depends on knowing the final technical architecture, and the technical build depends on knowing what the contracts will require of the custodian.
Why Firm Experience With Crypto Enforcement Matters Here
The law firm was founded by an attorney with significant experience in litigating notable matters in the crypto space, including proceedings tied to Celsius, Terraform Labs, and BitMEX. That litigation background matters for custody compliance specifically: the firms that end up in enforcement or class action proceedings are almost always the ones whose custody documentation could not survive scrutiny after the fact.
Murphy’s Law works with broker-dealers and crypto businesses on compliance program design, vendor and custody arrangement audits, blockchain forensic tracing, and regulatory response. The right time to call counsel is before an exam, not during one, and certainly before an incident forces the question.
An Examiner’s-Eye View of Where Custody Programs Fall Apart
Three failure patterns show up over and over in this space. The first is a DLT assessment written once at launch and never updated, which collapses the moment a protocol upgrade happens and nobody revisits the document. The second is key control architecture that looks solid on paper but relies on a single employee’s access without documented separation of duties or escalation coverage. The third, and the most expensive to fix retroactively, is a wind-down or custodial transfer agreement that was drafted by people who never confirmed the custodian’s API or operational capability actually matched the contract’s promises.
Firms that fix these before an exam almost always do it the same way: they rebuild the DLT assessment on a quarterly cycle, they run a real technical test of their key escrow procedure rather than trusting the org chart, and they tabletop the wind-down scenario with the actual custodian rather than assuming the paperwork will hold. None of these fixes are expensive. All three get skipped constantly because they feel unlikely to matter until they suddenly do.
— Mark
How Murphy’s Law Supports Broker-Dealer Custody Compliance
Broker-dealers building or auditing a crypto custody program face a narrower path than most consulting shops or generic compliance vendors can walk with real courtroom credibility behind it. Murphy’s Law is a licensed crypto law firm, not a compliance-in-a-box vendor, which means the same team reviewing your DLT assessments and key control architecture has also litigated the enforcement and recovery matters that show up when those controls fail.
The firm’s crypto compliance consulting work typically starts with a scoping call to identify gaps against the current staff guidance, followed by a readiness assessment covering key custody architecture, DLT documentation, and wind-down contracts, and ends with a prioritized remediation plan your operations and engineering teams can execute directly. If your firm is preparing for an exam, onboarding a new custodian, or simply trying to determine whether your current possession claims would survive scrutiny, request a compliance audit with Murphy’s Law before the question gets forced on you by a regulator.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- Statement on the Custody of Crypto Asset Securities by Broker-Dealers | SEC (Dec 17, 2025)
- Broker-dealer obligations and risks in crypto asset custody and crypto-related activities | Baker Tilly (Mar 30, 2026)
- SEC Staff clarifies broker‑dealer custody and trading of crypto assets | Dechert (Jan 2026)
- SEC Issues Further Crypto Asset Security Guidance, Addresses Broker‑Dealer Physical Possession and Asset Pairs Trading | Sidley (Dec 23, 2025)
FAQ
What Are the Current Broker-Dealer Crypto Custody Rules?
Carrying broker-dealers can be deemed in possession of crypto asset securities under Rule 15c3-3(b)(1) if they demonstrate transfer capability, a documented DLT assessment, and private-key controls, per the SEC staff’s December 2025 statement.
Does SIPC Cover Crypto Assets Held by a Broker-Dealer?
Not automatically. SIPC protection generally applies to assets meeting SIPA’s statutory definition of a security, and many crypto assets fall outside that definition even when custodied by a registered broker-dealer.
Do the New Crypto Broker Regulations Apply to All Digital Assets?
No. Rule 15c3-3(b) and the related possession guidance apply only to crypto assets that qualify as securities under the SEC’s May 2025 FAQs, not to tokens treated as commodities or purely functional network assets.
Is the SEC Staff Statement a Safe Harbor for Custody?
No. Law firm analysis is clear that the staff statement is a “will not object” position, not a safe harbor, and firms must continuously monitor network conditions to keep their possession status valid.
What Happens if a Broker-Dealer Discovers a Network Security Flaw?
The firm is expected to cease custody of the affected asset once it becomes aware of a material security or operational deficiency, escalate internally under its written procedures, and notify regulators and affected customers as appropriate.