This guide is general legal information, not legal advice, and does not create an attorney–client relationship. Rules change and vary by state — verify current requirements with official sources or a licensed attorney.
When a platform says it "holds" your bitcoin, what it actually holds is a private key — and the legal consequences of that fact depend far less on the technology than on what kind of entity is doing the holding. A registered broker-dealer, a state-chartered trust company, and an unlicensed software company can all perform the same technical function and owe wildly different duties to the customer whose assets they control.
That asymmetry is the single most important thing to understand about U.S. digital asset custody. There is no unified federal custody statute for crypto. Instead, several regimes reach the activity from different directions, and large gaps remain between them. As of mid-2026 the area is unsettled, with staff positions having shifted more than once in the preceding two years.
Key takeaways
- Custody duties are entity-driven: the same technical arrangement carries different obligations for a broker-dealer, a chartered trust company, a bank, or an unregulated platform.
- Broker-dealers holding crypto asset securities must contend with the Exchange Act customer protection rule (Rule 15c3-3), and SEC staff positions on how it applies have changed repeatedly — the 2019 joint SEC–FINRA staff statement was withdrawn in May 2025 and superseded by newer staff views in December 2025.
- Several states charter limited-purpose trust companies or special depository institutions that may hold digital assets in a fiduciary capacity; requirements differ sharply and no state's regime is the national rule.
- An entity that is neither a broker-dealer nor a chartered fiduciary may still be a money transmitter under federal and state law, but it generally owes contractual rather than fiduciary safeguarding duties.
- Whether customers own the assets or merely hold a claim against the platform is usually decided by the terms of service and by property law — a question that becomes decisive in insolvency.
What "custody" actually means here
In traditional finance, custody means possession or control of a customer's securities or cash. Crypto complicates the concept because control is exercised through cryptographic keys rather than through a certificate or a book entry at a central depository. A custodian may hold the whole key, a share of a multi-party computation scheme, or a key held inside secure hardware. The technical arrangement matters for operational risk, but the legal question is narrower: who has the practical ability to move the asset, and under what duty?
Three custody models dominate. In self-custody, the customer holds keys and no intermediary duty arises. In omnibus custody, the platform pools customer assets in shared wallets and tracks entitlements on its own ledger. In segregated custody, each customer's assets sit in identifiable addresses. Omnibus arrangements are cheaper and more common; they also make the "whose property is this?" question harder to answer when something goes wrong.
Three fault lines, three sets of duties
| Custodian type | Primary oversight | Character of safeguarding duty |
|---|---|---|
| Registered broker-dealer | SEC and FINRA | Statutory possession-or-control and reserve requirements for customer securities, plus books-and-records and financial responsibility rules |
| State-chartered trust company or special depository institution | State banking regulator | Fiduciary duty under state trust law; capital, examination, and often segregation requirements set by charter |
| National bank or federal savings association | OCC | Fiduciary or non-fiduciary custody under banking law; safety-and-soundness supervision |
| Money transmitter or unregulated platform | FinCEN for AML; state money transmission regulators where applicable | Largely contractual; permissible-investment or reserve rules may apply in licensed states but fiduciary duty usually does not attach |
The table understates the messiness. A single company may hold three of these statuses through different subsidiaries, and the assets themselves may be characterized differently — some tokens may be securities, others commodities, others neither — which changes which rulebook governs the same vault.
Broker-dealer custody and the customer protection rule
Broker-dealers that hold customer securities are subject to Exchange Act Rule 15c3-3, which requires them to obtain and maintain physical possession or control of fully paid and excess margin securities and to maintain a special reserve account. Applying a rule written for certificated and book-entry securities to assets controlled by private keys has proved genuinely difficult, and the official position has moved.
- 2019 — Joint staff statement. SEC Division of Trading and Markets and FINRA staff issued a joint statement describing the problems with applying possession-or-control concepts to digital asset securities.
- 2020–2021 — Special purpose broker-dealer policy. The Commission issued a policy statement creating a time-limited framework under which a broker-dealer limiting its business to digital asset securities, adopting tailored policies, and giving customers risk disclosures would not face enforcement on possession-or-control grounds. Very few firms used it.
- May 2025 — Joint statement withdrawn. The 2019 joint staff statement was withdrawn effective immediately, removing one layer of legacy guidance.
- December 2025 — New staff views. Trading and Markets staff issued a statement on applying Rule 15c3-3 to broker-dealers custodying crypto asset securities, including tokenized equity and debt, moving away from the "special purpose" limitation.
- Mid-2026 — Still moving. Staff statements are not rules and can change. Firms should confirm the current position directly on the SEC's site and check FINRA guidance before relying on any summary.
A related accounting question also shifted. Staff Accounting Bulletin 121, issued in 2022, had told public companies safeguarding crypto for platform users to recognize a corresponding liability and asset on the balance sheet — a treatment that made custody capital-intensive for regulated institutions. It was rescinded in January 2025 by Staff Accounting Bulletin 122, which returned the question to ordinary contingency accounting.
Investment advisers and the qualified custodian problem
Registered investment advisers with custody of client assets must generally maintain those assets with a "qualified custodian" — a category built around banks, registered broker-dealers, and certain futures commission merchants. Many crypto-native custodians do not fit neatly into that list, which has forced advisers into structuring exercises and, in some cases, into avoiding the asset class entirely. The SEC proposed a broader safeguarding rule in 2023 that would have extended custody obligations to a wider set of client assets; as of mid-2026 that proposal had not been adopted in final form, so the older custody rule framework remained the operative one. Advisers building crypto strategies should verify the current rule text rather than rely on secondary summaries — a discipline we describe more fully in our guide to robo-adviser registration and fiduciary duties.
State charters, licensing, and the patchwork problem
Several states have built routes for digital asset custody. Some charter limited-purpose trust companies that may hold digital assets in a fiduciary capacity; at least one state created a special depository institution charter aimed at digital assets; others apply their money transmission statutes and virtual-currency licensing regimes to custodial wallet providers. Requirements diverge on capital, permissible investments, segregation, disclosure, and examination frequency.
State variation: No state regime governs the country. A trust charter obtained in one state does not automatically authorize custody for residents of another, and a state that exempts custody-only activity from money transmission may sit next to a state that squarely covers it. Map every state where customers reside, and treat the Conference of State Bank Supervisors materials as a starting point rather than an answer.
Custodial platforms also face federal anti-money-laundering obligations. FinCEN has long taken the view that accepting and transmitting convertible virtual currency is money transmission, and a hosted-wallet provider that can move customer value generally falls inside that framework. That pulls in registration, program, and reporting duties described in our AML and Bank Secrecy Act primer, and it interacts with the state analysis covered in money transmitter licensing.
Customer property when the custodian fails
The safeguarding question that matters most to customers is rarely tested until a platform collapses. Then the issue becomes whether the assets are customer property held for the customer's benefit or part of the platform's estate, leaving customers as general unsecured creditors. Courts have looked to the plain terms of the user agreement, whether assets were segregated in fact, how the platform described the arrangement in marketing, and whether the platform used customer assets for its own account.
- Does the agreement state expressly that title remains with the customer and the platform holds only as bailee or custodian?
- Are assets segregated from the platform's own holdings, in fact and not only on paper?
- Is rehypothecation, lending, or staking of customer assets permitted, and is consent specific rather than buried?
- Do marketing statements match the legal terms? A mismatch invites unfair or deceptive practice claims on top of any contractual dispute.
- Is there an independent reserve attestation, and what exactly does it verify?
Insolvency outcomes turn on facts developed long before the filing. Companies that intend customer assets to stay outside the estate should build documentation and operational segregation to match that intent from the start; the mechanics of the proceeding itself are outlined in our overview of business bankruptcy options.
Frequently asked questions
Is a crypto exchange automatically a custodian?
Not by label, but usually in substance. If the platform controls the keys and can move assets on a customer's instruction, it is performing custody regardless of what the product is called. The consequences depend on the platform's licences and charters, and on whether the tokens involved are treated as securities, commodities, or something else.
Does "proof of reserves" prove customer assets are safe?
No. A reserve attestation typically shows that on-chain holdings at a point in time matched claimed liabilities. It usually says nothing about undisclosed liabilities, encumbrances, key management, or whether the assets are legally the customers'. Treat it as one input, not as an assurance of solvency or of title.
Can a bank custody digital assets for customers?
Federal banking regulators have issued interpretations addressing crypto custody by national banks, and the direction of that guidance has shifted with successive administrations. A bank considering the activity must still satisfy its own supervisor on risk management, capital, and operational controls. Confirm the current position with the relevant regulator before planning around it.
Do custody arrangements change if the token is not a security?
Yes. Securities-specific rules such as the customer protection rule and adviser custody requirements only reach securities. A non-security token held for customers may still trigger money transmission licensing, state trust law duties, and consumer protection statutes — a different, not lighter, set of obligations.
Building for an unsettled area
Because the rules keep moving, durable custody programmes are designed to survive changes in guidance rather than to exploit a moment in it. That means documenting a defensible legal theory for every asset type held, keeping segregation and reserve practices stronger than the minimum any single regime requires, writing user agreements that say plainly who owns what, and re-testing the analysis whenever staff positions or state statutes change. It also means treating vendor arrangements with sub-custodians as regulated relationships in their own right, with the diligence and contractual controls described in our guide to bank–fintech partnerships.
For the wider regulatory context in which custody sits, see the fintech law topic hub. This article is general information rather than legal advice, and custody structures should be confirmed with counsel against current federal guidance and the law of every state where customers are served.
