Introduction & Background

On December 17, 2025, the staff of the Division of Trading and Markets (the “Division”) issued a statement (the“Statement”)1 on the custody of crypto asset securities by broker-dealers under Rule 15c3-3 (the “Rule”).2 TheStatement’s views and recommendations do not constitute a rule, regulation or guidance of the U.S. Securities andExchange Commission (the “Commission”), instead it reflects the views of Division staff and is therefore not legallybinding. The Statement is significant, however, because it articulates concrete circumstances under which the staffwould not object to a broker-dealer deeming itself to have “physical possession” of crypto asset securities pursuant toparagraph (b)(1) of the Rule. 

Practically speaking, the Statement may be viewed as an inflection point for broker-dealers contemplating custodysolutions within the existing framework of the Rule for “crypto asset securities” - a term which the Division does notspecifically define but expressly states includes “tokenized versions of an equity or debt security.”3 Furthermore, theStatement is emblematic of an approach to broker-dealer custody that is evolving from narrow and specific to moreoperationally scalable. In December 2020, the Commission issued a statement that provided a narrow pathway forSpecial Purpose Broker-Dealers to engage in limited digital asset activity, which - given its constraints - led to limiteduptake.4 This new staff Statement broadens applicability by clarifying how any broker-dealer carrying crypto assetsecurities may establish “physical possession” in practice.5

The Five Measures of “Possession” of Crypto Asset Securities

Paragraph (b)(1) of the Rule states that “A broker or dealer shall promptly obtain and shall thereafter maintain thephysical possession or control of all fully-paid securities and excess margin securities carried by a broker or dealerfor the account of customers” (emphasis added). 

The Statement indicates that the staff’s non-objection pursuant to the Statement is expressly limited to the“possession” prong of Rule 15c3-3(b)(1).6 Prior Division pronouncements have addressed “control” of crypto assetsecurities.7 For crypto asset securities, the staff has identified five measures that, if taken by a broker-dealer, wouldresult in the Division not objecting to a broker-dealer deeming itself to have “physical possession”:

  • First, the broker-dealer must have direct access to the crypto asset securities and transfer capability.Possession, therefore, is framed as an operational and technological capability specifically with respect toblockchain-based crypto asset securities.
  • Second, the broker-dealer must implement written policies and procedures to assess the characteristics ofthe crypto asset security’s underlying blockchain or distributed ledger technology (“DLT”), e.g., Ethereum,and any associated network infrastructure on which transactions are validated, ordered and finalized forsuch crypto asset security. Assessments should occur prior to custody and at reasonable intervals thereafterand should generally address DLT characteristics (such as performance, speed, throughput, scalability,resiliency, security, consensus, complexity, extensibility, visibility), and governance considerations includingprotocol upgrade procedures (and other features such as forks, airdrops and staking).
  • Third, the broker-dealer must not undertake to maintain custody of, or deem itself to possess, a crypto assetsecurity if it is aware of material security or operational problems with the DLT or associated network, orother material risks to the broker-dealer from custody of that asset. The risk profile therefore centers onmaterial risk to the broker dealer’s operations arising from the possession as opposed to market orreputational risk associated with the asset.
  • Fourth, the broker-dealer must establish, maintain and enforce written policies, procedures, and controls toprotect against theft, loss, or unauthorized or accidental use of private keys. These measures should bereasonably designed to ensure that no other person, including customers or affiliates, may have the ability totransfer assets without the broker-dealer’s authorization.
  • Fifth, the broker-dealer must implement measures for ensuring the continued safekeeping and accessibilityof the crypto asset securities in the event of disruption. Specifically, the broker-dealer must:
    • Identify, in advance, the steps it will take in the wake of certain events that could affect the firm’spossession of crypto asset securities, including blockchain malfunctions, 51% attacks, hard forks,or airdrops. 
    • Ensure that it can comply with a lawful order as to seizing, freezing, burning or prevention oftransfer of the crypto asset securities.
    • Ensure that it can effectuate the transfer of the crypto asset securities held by the broker-dealer toa broker-dealer, trustee, receiver, liquidator, or person performing a similar function, or to anotherappropriate person, in the event the broker-dealer can no longer continue as a going concern andself-liquidates or is subject to a formal bankruptcy, receivership, liquidation, or similar proceeding.

Practical Recommendation

While the introduction of crypto asset securities into a broker-dealer’s business requires evaluating familiarobligations under the lens of new technological considerations, the underlying regulatory objectives remainunchanged. To align operationally with the five measures set out in the Statement, broker-dealers may considerimplementing some or all of the following non-exhaustive list of enhancements set out below. 

In addition, firms should consider whether any such expansion constitutes a material change to the businessrequiring FINRA approval, as well as the broader implications to Anti-Money Laundering (AML) and Know YourCustomer (KYC) policies, operational flows and settlements, recordkeeping and confirmations, and governanceframeworks. 

Conclusion

The Division’s Statement offers a practical pathway for broker-dealers to achieve possession of crypto assetsecurities for custody purposes within the existing framework of the Rule. The core message is continuity overchange, as the recommendations provide technology-based guidance for complying with already familiar regulatoryobligations. Targeted updates to policies and controls will allow for operationalization of the expectations set by thefive measures. As broker-dealers calibrate their programs, they should seek to design possession procedures that,notwithstanding the novelty of the technology, will integrate seamlessly into their existing compliance architecture.