SEC Mandates Broker-Dealers Control Private Keys for Custody

• The SEC said broker-dealers must control crypto private keys to meet customer protection rules.
• Tokenized stocks and debt fall under the SEC’s definition of crypto asset securities.
• Firms must assess blockchain risks and avoid custody if major security flaws exist.

The US Securities and Exchange Commission (SEC) released new guidance that explains how broker-dealers must handle the custody of crypto asset securities

The guidance focuses on how firms can meet the long standing customer protection rule that requires physical possession or control of customer assets. While crypto tokens exist on blockchains rather than in paper form, the SEC states that the rule still applies in full.

SEC’s Division of Trading and Markets said the statement responds to repeated requests from market participants and serves as an interim step while broader policy work continues.

Related: Unicoin Charged, Binance Cleared: The New Rules of SEC’s ‘Selective Enforcement’

SEC’s Crypto Definition

The SEC uses the term “crypto asset securities” to describe digital tokens that qualify as securities under US law. This includes tokenized versions of traditional equity or debt securities.

The guidance applies to any broker-dealer that carries crypto asset securities for customers. This includes firms that already run a traditional securities business and later add crypto products.

The SEC said that the focus of this statement is limited to paragraph (b)(1) of Rule 15c3-3, which deals only with possession or control of customer securities.

Private Keys As Proof Of Possession

According to the SEC, a broker-dealer can treat itself as having physical possession or control of a crypto asset security when it has exclusive access to the private keys needed to move that asset on a blockchain.

If another party can access those keys, the broker-dealer cannot claim possession under the rule. The agency said firms must create and enforce written policies to protect private keys from theft, loss, or unauthorized use.

These controls must ensure that no customer, affiliate, or third party can transfer the asset without the broker-dealer’s approval. If a firm knows about major security or operational weaknesses in the blockchain network, it cannot claim possession of that crypto asset security.

Broker-dealers must also prepare for major disruptions. The SEC expects firms to maintain plans for events such as blockchain failures, network attacks, hard forks, or similar events that could affect customer assets. 

These plans must also allow firms to follow lawful orders to freeze, seize, or burn crypto assets when required.

Also, the guidance states that firms must plan for scenarios where they can no longer operate. In such cases, crypto asset securities must remain accessible so they can move to another broker-dealer, trustee, or similar party during liquidation or bankruptcy.

Related: Crypto VC Shima Capital Shutting Down Following SEC Charges Against Founder