New SEC rules lets Morgan Stanley, Goldman Sach legally “control” your private keys without the safety net you assume exists

The SEC has refreshed its crypto asset FAQs, clarifying how broker-dealers like Morgan Stanley, Goldman Sachs, and others can satisfy custody and capital requirements for crypto asset securities, and addressing how the framework applies to Bitcoin and Ethereum ETF activity.

The update appears on the Trading and Markets FAQ index as “Frequently Asked Questions Relating to Crypto Asset Activities and Distributed Ledger Technology (May 15, 2025) – UPDATED December 17, 2025.”

It gives firms a current staff-posted reference as custody design becomes a gating item for tokenized securities distribution and ETP market-making.

How the SEC’s updated custody guidance reshapes broker control of crypto assets

In the FAQ text, staff reiterates that Rule 15c3-3(b) “possession or control” does not apply to non-security crypto held by broker-dealers, keeping non-security crypto outside the Customer Protection Rule mechanics that apply to securities custody.

For crypto asset securities, staff says a broker-dealer can establish “control” under Rule 15c3-3(c), even where the instrument is not certificated, by using qualifying control locations.

Staff also says this approach reduces reliance on the special-purpose broker-dealer (SPBD) safe harbor as the primary route for demonstrating control over these securities.

The staff also says it would not object if broker-dealers facilitating in-kind creations and redemptions treat proprietary positions in bitcoin or ether as “readily marketable” for net capital purposes.

That would apply the 20% commodity haircut under Rule 15c3-1 Appendix B when calculating deductions.

Those staff positions now sit alongside a formal cleanup of prior messaging.

How the SEC’s withdrawal reframes “control” in crypto asset custody

The 2019 SEC and FINRA joint staff statement on broker-dealer custody of digital asset securities is marked withdrawn on the SEC withdrawal page, with a parallel notice posted by FINRA.

The withdrawal narrows the broker-dealer custody “north star” to the FAQ framework and its stated use of existing control-location concepts for crypto asset securities.

The most operationally sensitive issue is what it takes, in practice, to satisfy the Rule 15c3-3(c) concept of “control” when securities are recorded on a blockchain.

The FAQ does not say a broker-dealer must hold private keys, but 15c3-3(c) control is tied to safeguarding and directing the movement of customer securities at a recognized control location.

For on-chain instruments, that often maps to who can sign or compel signing through the custody stack.

Examples include broker-dealer-held key material in an HSM, a bank control location where the broker-dealer has documented directive rights, or a multisignature arrangement where the broker-dealer’s signatory authority and procedures are designed to meet control-location expectations.

Law-firm summaries have emphasized that the staff’s approach expands the path for regular broker-dealers to evidence control without leaning on SPBD status as the default posture.

That shift increases focus on contract language, key governance, and the audit trail that demonstrates control over time, according to Sullivan & Cromwell and Sidley Austin.

On ETP rails, the “readily marketable” posture for proprietary bitcoin and ether positions links directly to intraday inventory economics for authorized participants and market makers that support in-kind baskets.

A capital-efficiency sketch shows the direction: If an affiliated broker-dealer carries an average intraday inventory of $50 million in BTC or ETH to facilitate creations and redemptions, a 20% commodity haircut implies a net capital deduction of about $10 million tied to that inventory.

That arithmetic is not a full net capital model, but it explains why some desks prefer cash workflows and why staff treatment can make in-kind operations more workable for firms operating on thin spreads.

Bank partnerships may also face fewer procedural tripwires than in prior cycles

The Federal Reserve withdrew earlier supervisory letters on April 24, 2025, that had set advance-notice expectations for certain crypto-asset and dollar token activities, moving bank engagement toward more routine supervisory channels.

For broker-dealers relying on bank sub-custody as a control-location pathway, that shift matters because it can shorten the path from concept to a supervisory conversation on the bank side.

Broker-dealers still have to evidence 15c3-3(c) control and records in a manner exam teams can test.

Over the next 12–18 months, the custody market may cluster around which structures produce repeatable evidence of control while containing cyber and operational exposure.

In broad terms, the decision is often whether the broker-dealer directly controls key material or proves directive control through a qualifying third-party control location.

Each option trades off governance burden, incident-response design, and examiner comfort.

The Dec. 17 refresh also keeps a line clear for retail-facing firms: Non-security crypto held at a broker-dealer remains outside Rule 15c3-3(b).

Firms still need clear disclosures on which protections apply and which do not.

Commissioner Hester Peirce has framed the staff FAQs as incremental, while pointing to how the guidance can lower friction for market participants trying to fit on-chain activity into existing rule sets.

For compliance teams, the near-term tells are concrete: whether the SEC FAQ index receives further edits.

Another key signal is whether FINRA interpretations evolve toward standardized examiner checklists for on-chain control evidence and books and records.