SEC says broker-dealers need to maintain crypto private keys to comply with customer protection rules

The U.S. Securities and Exchange Commission has published guidance for broker-dealers around the custody of “crypto asset securities,” particularly how to maintain compliance with the customer protection rule, which requires “physical possession or control” of customer assets, despite tokens living on blockchains. 

Notably, the agency defines “crypto asset securities” to include “tokenized versions of an equity or debt security,” a growing segment of the digital asset sector that is being given special attention by SEC Chair Paul Atkins. 

“The Division is providing its views in response to requests from market participants as an interim step while the Commission continues to consider issues relating to a broker-dealer’s custody of crypto asset securities and the feedback it has received,” the SEC’s Division of Trading and Markets wrote on Wednesday. 

Under the guidance, a broker-dealer can consider itself to have "physical possession or control" of a crypto asset security essentially when it maintains exclusive access to the private keys needed to transfer the token on a blockchain. It also necessitates that brokers “establish, maintain, and enforce” written policies to protect private keys from theft, loss, or unauthorized use.

“A broker-dealer does not deem itself to possess a crypto asset security if the broker-dealer is aware of any material security or operational problems or weaknesses with the distributed ledger technology and associated network … or is aware of other material risks posed to the broker-dealer’s business by custodying the crypto asset security,” the SEC wrote. 

Further, organizations must have established plans to address potential disruptions like “blockchain malfunctions,” network attacks, and hard forks, as well as the ability to comply with legal orders to freeze, burn, or seize assets. 

The guidance also seemingly suggests that custodians have to stay up-to-date with blockchain governance conversations and protocol updates that could impact customer assets and to lay out plans “to take appropriate action to reduce its exposure to such risks.”