Crypto Custody and SEC Compliance.

The answer depends on both the nature of the digital asset and the type of custody services the company is offering. For example, token classification affects whether federal securities registration requirements are triggered. These requirements, then, add to a company’s custody obligations, and to its risk of facing scrutiny or enforcement from the SEC.

Why Does Digital Asset Custody Create Risks?

Crypto custody creates unique risks in terms of title, ownership, and insolvency. If it is not handled properly, custodians face liability to account holders. On the other hand, if an asset is illegally held or transferred, custodians may face liability to the rightful owners. These risks apply in all cases, though different statutory and common law provisions are relevant.

Does the SEC Handle Crypto Custody Investigations Independently?

SEC investigations are separate and distinct from DOJ criminal investigations, though it is not uncommon for the DOJ to investigate in tandem. In fact, when the DOJ gets involved, this often forces companies to engage an outside law firm to provide a proactive defense. As the SEC explains in an investigation frequently cited by the crypto industry, the Securities Exchange Act of 1934 gave Congress the ability to create federal agencies with broad enforcement authority over securities transactions.

Does Crypto Custody Involve Agencies Other than the SEC?

Yes. For digital-asset companies that are subject to CFTC jurisdiction, it is possible for SEC and CFTC scrutiny to run in tandem. However, there are other federal agencies that have roles as well. Both FinCEN and OFAC maintain jurisdiction over distinct financial-crime and sanctions requirements that apply to various aspects of the blockchain industry. Even if a digital asset business has no liability to the SEC or CFTC, it may still be liable to FinCEN or OFAC.

Which custody rules apply to my crypto business?

Does Advisers Act Rule 206(4)-2 Apply?

Advisers Act Rule 206(4)-2 addresses the requirements that apply to advisers that maintain custody over client funds and securities. Here, however, the key issue is that the rule does not apply to all digital assets that act as “investment” instruments. The rule’s applicability to crypto custody services is currently the subject of debate among lawmakers, regulators, and practitioners, and as a result, this is an area where there is significant potential for missteps.

Do Digital Assets Need to Be Custodied with Qualified Custodians?

Under Rule 206(4)-2, investment advisers with custody are generally required to maintain client funds and securities with “qualified custodians,” which include banks and registered broker-dealers. They are also required to maintain “separately identified client accounts” and other safeguards to prevent misappropriation. The rule is one of a number of important federal securities laws that pose practical challenges for digital assets that do not meet the traditional definition of “funds” or “securities” under the Securities Act of 1933 and other federal securities statutes.

Do Possession or Control Requirements Apply?

Under Exchange Act Rule 15c3-3, broker-dealers that carry customer securities are subject to possession or control requirements. This is in addition to other duties, and it is another significant provision that creates potential challenges for digital asset companies that do not meet the technical definition of a “securities” or “investment fund.” While most cryptocurrency exchanges and custodians will qualify as broker-dealers under the Securities Exchange Act, determining whether they are required to hold customer assets in possession or control depends on the applicability of specific securities registration rules.

Are There Other SEC Compliance Obligations?

Yes. As registered broker-dealers, cryptocurrency exchanges and custodians must comply with FINRA regulations as well as other federal securities laws. Registered investment advisers face a whole different set of SEC rules, including custody and advertising rules as well as recordkeeping requirements. For advisers and other entities that maintain custody of client assets via subcustodians, federal securities laws require them to ensure that their subcustodian is reliable, and that using a subcustodian does not remove their obligations under the relevant federal securities laws.

Do I Need to Register My Digital Asset Business with the SEC?

Whether registration is necessary with the SEC (and FINRA) depends on two factors, the nature of the business you operate and the nature of the instruments that you offer. The former can involve anything from offering digital asset custody services to running a cryptocurrency exchange. The latter can vary depending on whether your business offers “securities” that are subject to registration under the Securities Act of 1933. While SEC registration is not necessarily dependent on whether a company uses its registration to raise capital, it may still be necessary when registering offering instruments as securities.

How should a custodian control keys, wallets, and transfers?

How Do Custodians Manage and Store Digital Asset Keys, Wallets, and Transfers?

At its most basic level, digital asset custody means that custodians must have possession of the private keys required to authorize on-chain asset transfers. In practice, this involves a variety of technical measures and operational protocols, including some of the following measures.

Threshold-Signature Policies

Threshold-signature policies allow a custodian to implement a policy that requires multiple authorizations before transferring crypto. In turn, this allows a company to enforce its own risk limits when authorized to transfer client assets to third parties.

Transaction Allowlists

Transaction allowlists can be used to prevent fraudulent transfers to addresses not preapproved for receipt. This can be achieved through technical means, and this, in turn, helps the company to manage its exposure to fraud and theft.

Separation of Transaction Initiation and Approval

Separating the functions of transaction initiation and approval can also help to reduce the risk of any single actor being able to fraudulently transfer client assets. In turn, this provides further guardrails for protecting client assets.

Do Cryptocurrencies, Tokens, and Other Digital Assets Need Cold Storage?

The issue of whether digital assets need cold storage depends on their value and the security risk involved. Hot wallets keep signing capability online, allowing for rapid transfers of client assets. However, hot wallets are also more exposed to compromise from remote attacks. In contrast, cold storage (or an “offline” wallet) keeps the signing keys offline, meaning that they do not need to be accessible through a remote system. This helps to protect against remote attacks, and it helps to shield against the risk of an external entity stealing client assets. In turn, cold storage helps to reduce the likelihood of a custodian facing criminal liability in the event of an asset-related loss.

Does Cold Storage Create New Security Risks?

Yes. While cold storage may help shield against some risks, it introduces new risks. For example, cold storage requires that custodians maintain secure backups of their offline keys. They must also be able to retrieve these keys when necessary. In turn, this presents new concerns regarding physical security and employee risks. In order to address these concerns, custodians must have operational measures in place to secure cold-storage environments, backups, and keys.

Does Digital Asset Subcustody Create New Security Risks?

Subcustody is a practice whereby a custodian delegates the duty of protecting client assets to a third party. Subcustody presents several security and other risks, including operational, contractual, and concentration risks. While subcustodians can be helpful in some circumstances, relying on a third party to manage digital asset keys poses significant security risks that can, in turn, be relevant to SEC scrutiny.

Will Customers Recover Digital Assets That They Deposit with a Custodian if That Custodian Fails?

The answer depends on several factors, including whether customers have consented to rehypothecation and the specific terms of the relevant customer contracts. Many crypto custody contracts include provisions that permit rehypothecation. While rehypothecation serves several purposes, it also exposes customers to additional counterparty risk. As a result, contractual protections (like those that govern bankruptcy proceedings) are important in the context of digital asset custody.

When Does Deposited Crypto Become Custodian Estate Property in Bankruptcy?

A customer contract’s terms can determine whether deposited crypto becomes part of the custodian’s bankruptcy estate in the event of insolvency. In the case of Celsius Network, the bankruptcy court noted that the terms of the customer contracts for Celsius “Earn” accounts transferred ownership of deposited crypto to Celsius, and thus a number of other factors did not prevent the court from ruling that deposited assets became Celsius’s bankruptcy estate property. In turn, this means that customers will need to assert claims against the custodian’s bankruptcy estate, which is a risky and time-intensive process that is subject to deferral and denial by a bankruptcy trustee.

Does SIPC Protection Apply to Crypto Deposits?

While many crypto companies market themselves as regulated or compliant, this does not necessarily mean that their customers are entitled to SIPC protection. In order to be eligible for SIPC protection, a customer generally must have entrusted qualifying assets to a SIPC-member broker-dealer. In addition, the customer must be an “investor” (i.e., SIPC must recognize the crypto assets as being SIPA securities). As a result, customers that have deposited crypto assets with un-SIPC-registered companies, or those who have deposited digital assets not recognized as SIPA securities, will not be entitled to SIPC protection.

Does Proof-of-Reserves Help Protect Customers?

Proof-of-reserves (PoR) is a method of confirming that a custodian has sufficient assets to cover customer deposits. PoR attempts to resolve issues involving rehypothecation and asset-level security. However, PoR also has several limitations. For example, a snapshot that shows reserves is not evidence that the company does not have customer liabilities. Similarly, PoR is not conclusive evidence that customers own the digital assets they have deposited with the company in bankruptcy.

Do SOC Reports Provide Assurance?

SOC reports are often cited as evidence of a company’s operational compliance. However, a SOC report’s opinion is subject to limitations, both regarding the scope of its examination and the specific period of time that it covers. In turn, this means that SOC reports generally do not establish operational compliance in the area of digital asset custody.

Can Customers Recover Their Digital Assets via Insurance?

Insurance may be an option in some cases, but recovery is subject to several conditions. This includes (i) the amount of the insurance company’s coverage limits, (ii) any policy exclusions that apply, and (iii) whether the customer has a covered custody arrangement. In turn, insurance may not always serve as an effective means of recovering customer assets in the event of custody-related losses.

If any of this describes your situation, it is worth talking it through with counsel. Spodek Law Group can be reached at 212-300-5196.

Which SEC Crypto Custody Guidance is Still in Effect?

The SEC recently withdrew the guidance that it had previously issued to broker-dealers and investment advisers regarding crypto custody. For broker-dealers, the SEC issued new Frequently Asked Questions (FAQs) that clarify how existing financial regulations apply to custody of crypto and other digital assets. For investment advisers, however, the SEC withdrew its proposed safeguarding rule in June 2025. The SEC subsequently announced its 2026 examination priorities on November 17, 2025, noting that it would examine digital assets, but not custody specifically. Meanwhile, the CLARITY Act remained pending in Congress as of July 22, 2026.

Is SEC Staff Accounting Bulletin (SAB) 121 Still in Effect?

No. The SEC staff issued SAB 122 in January 2025, which rescinded SAB 121. SAB 121 had previously established requirements for the financial reporting of safeguarded digital asset transactions. This was in addition to requiring public companies to report the transaction on the company’s balance sheet.

What Happens After the SEC Examines a Digital Asset Company’s Custody Program?

An SEC examination that concludes with a finding of shortcomings may present an opportunity for companies to address these shortcomings before the SEC takes enforcement action. While SEC examinations generally provide companies with an opportunity to remediate any issues that arise, it is important to remember that the agency also has the authority to refer exam findings to the SEC’s Enforcement Division for further investigation and possible enforcement action.

Does an SEC Deficiency Letter Mean Enforcement Action?

No, and it is important to understand the difference between the SEC’s examinations and its enforcement actions. A deficiency letter is issued by the SEC examination staff. On the other hand, enforcement actions are handled by the SEC Enforcement Division. While the referral of unresolved deficiencies for further investigation is common, the referral of an examination to the SEC Enforcement Division does not automatically result in enforcement action.

How Do SEC Enforcement Investigations Work?

SEC enforcement investigations involve the discovery of information, the evaluation of this information, and the development of a case for prosecution. Investigations can involve, among other things:

• Subpoenas to third parties;
• Testimony from company officials under oath; and,
• Wells submissions.

What Remedies Can the SEC Seek in Digital Asset Custody Cases?

In successful enforcement cases, the SEC can seek a range of remedies. Along with remedies similar to those available in public company securities fraud cases, such as penalties, disgorgement, and bars from serving as officers and directors of public companies, the SEC can also seek and obtain industry bars, contempt orders, disgorgement of “ill-gotten gains,” and other penalties. In each case, the legal remedies will depend on the specific enforcement action taken.

How Long Do SEC Examinations and Investigations Take?

There is no universal resolution deadline for SEC examinations or investigations, and these inquiries can last for any amount of time. However, the SEC Enforcement Manual generally limits the window for Wells submissions to two weeks. In turn, a company’s ability to meet its reporting and public relations obligations can be restricted in SEC enforcement investigations.

How Much Does a Crypto Custody Lawyer Cost?

As mentioned above, the cost of a crypto custody lawyer or firm will depend on a variety of factors. However, there are some important considerations as well.

Do I Receive Attorney-Client Privilege Protection When Working With Compliance Consultants?

Consulting services provide a lot of value to companies that need compliance advice, but consulting agreements generally do not afford attorney-client privilege protection. Attorney-client privilege protects communications made in confidence to an attorney for the purpose of obtaining legal advice. Consultants, on the other hand, do not possess the license required to represent a client’s interests in court, which means that they also cannot represent a client’s interests in enforcement litigation.

How Do I Know the Basis or Rate of My Lawyer’s Fees?

Under ABA Model Rule 1.5, lawyers are required to communicate the basis or rate of their legal fees to clients as soon as it is reasonably practicable under the circumstances. The ABA also notes that in some cases, the basis for a fee may be “implicit,” but, in all cases, a lawyer’s fee must not be “unreasonable.” In turn, these considerations mean that the cost of legal representation should be communicated to a client in an engagement letter.

Do I Need to Sign an Engagement Letter?

Yes. While an engagement letter is not required under the ABA Model Rules, it is highly recommended in all cases. An engagement letter can establish the staffing and rates that a client should expect to pay. The engagement letter can also define retainers and expenses, the scope of the relevant legal matter, and other terms of the engagement. Similarly, informed consent is required under ABA Model Rule 1.7 in certain cases involving concurrent representation and conflict waiver, and informed consent can also serve as a crucial part of a lawyer’s engagement process.

Which Crypto Litigation Firm Should I Hire?

The DOJ vs the SEC

While the DOJ is responsible for criminal securities fraud prosecution, the SEC handles civil and administrative securities fraud enforcement. As a result, when choosing a crypto litigation firm, it is important that companies select an attorney that has the ability and experience to defend SEC and DOJ matters.

Which Crypto Litigation Firms are the Best?

Which firms are the best? Some rank among the best for digital assets. For example, the legal rankings publication Chambers FinTech ranks Skadden in “Band 1” for its national crypto-asset disputes practice. However, what makes the difference for many companies and individuals is a clear and notable track record that includes winning against the SEC and other regulators.

How can I judge whether a Law Firm is any good?

Similar to selecting other firms, judge their ability to deliver on their representations. For example, a federal court recently dismissed the SEC’s action against Richard Heart. This case has highlighted the importance of choosing a legal team that can make good on their claims by securing a favorable result.

What about “SEC Attorneys” or the “Most-Feared” Crypto Litigation Firm?

What about lawyers who are regarded as “SEC attorneys” or the most-feared crypto litigation firm? While these are phrases that are frequently used, in truth, they are not meaningful descriptors. No separate bar license designates a lawyer as an SEC attorney, and no court, regulator, or professional association has the authority to officially designate a most-feared litigation firm.

How do I select a lawyer or law firm to represent my digital asset business?

As a result, choosing a lawyer for SEC enforcement depends on the information at hand, and that may depend on the nature and scope of your SEC enforcement matter as well.

Speak With a Federal Defense Lawyer

If you are dealing with any part of what this article describes, the next step is a conversation with a lawyer who handles these cases. Spodek Law Group is a second generation criminal defense firm practicing since 1976, representing clients nationwide from offices in New York, Brooklyn, Queens and Los Angeles. Call 212-300-5196 to speak with our team.