The SEC has finally opened the door to tokenized securities custody

Photographer: Michael Nagle/Bloomberg

For years, the securities industry has watched the SEC treat tokenized assets like a zookeeper eyeing an unfamiliar creature — curious, vaguely threatened, unsure whether to feed it or call animal control. That era of regulatory paralysis ended in December, when the Division of Trading and Markets released a staff statement explaining, with the air of someone announcing that water is wet, that tokenized stocks and bonds are still stocks and bonds and may be custodied under the same rules that have governed securities since the Nixon administration.

The statement addresses Rule 15c3-3, the Customer Protection Rule that has required broker-dealers to maintain "physical possession or control" of customer securities since 1972. For half a century, this posed no interpretive challenge: Certificates sat in vaults, entries populated ledgers and possession meant what it had always meant. Then someone invented the blockchain, and suddenly an entire regulatory apparatus built around physical safekeeping confronted assets that exist as cryptographic abstractions on distributed networks. The SEC's response, for the better part of a decade, was to treat this conceptual mismatch as an insurmountable obstacle rather than a drafting problem.

The December guidance corrects course with notable pragmatism. Broker-dealers may now deem themselves in "physical possession" of crypto asset securities — the SEC's preferred terminology for tokenized equities and debt — provided they satisfy a series of operational and security conditions. The firm must maintain exclusive control over the private keys that authorize transactions on the relevant blockchain. No customer, affiliate or third party may access those keys without authorization. The broker-dealer must implement written policies and procedures consistent with industry best practices, a standard that invites future refinement as the custodial infrastructure matures.

The guidance imposes additional requirements that reflect the technical idiosyncrasies of distributed ledger systems. Before custodying any tokenized security, a broker-dealer must assess the blockchain's operational integrity and document that assessment. If the firm identifies material security vulnerabilities — susceptibility to 51% attacks, consensus mechanism weaknesses, unresolved hard fork disputes — it cannot claim possession. The statement also requires contingency planning for scenarios that traditional custody rarely contemplates: chain reorganizations, protocol-level emergencies, and the logistical challenge of executing asset freezes or seizures when the underlying infrastructure was designed to resist precisely those interventions.

This last requirement deserves attention. The SEC expects tokenized securities infrastructure to accommodate lawful court orders, regulatory mandates and bankruptcy proceedings with the same facility as conventional systems. Crypto-native participants may find this expectation incongruous with the architectural philosophy of public blockchains, but the commission's position is clear: If you want institutional capital, you accept institutional constraints. The guidance does not prescribe how broker-dealers should engineer compliance with judicial orders on immutable ledgers; it simply assumes they will figure it out.

Commissioner Hester Peirce released a companion statement titled "No Longer Special," a wry acknowledgment that the guidance finally abandons the SEC's prior tendency to treat blockchain-based securities as exotic instruments requiring bespoke regulatory frameworks. Peirce applauded the clarity while urging the division to accelerate formal rulemaking. Staff statements, she noted, provide interpretive comfort but lack legal force; broker-dealers operating under their shelter remain exposed to shifts in enforcement philosophy. The December guidance is interim relief, not permanent architecture.

Wealth management

Exclusive: Senate bill would loosen SEC definition of small business

A bipartisan bill offered Monday by Senate Banking Committee member Katie Britt, R-Ala., and Andy Kim, D-N.J., would force the Securities and Exchange Commission to update a 25-year-old threshold that holds small financial firms to higher regulatory standards.

By Claire Williams

September 29

The timing reflects a broader repositioning under Chair Paul Atkins, whose "Project Crypto" initiative has prioritized regulatory clarity over enforcement theatrics. The previous administration's approach — exemplified by the stalled Safeguarding Proposal of 2023 and the Galois enforcement action — treated technological innovation as presumptively suspect. Atkins has signaled a preference for accommodation within existing frameworks, a posture that the December guidance embodies. Tokenized securities are not a new asset class requiring new rules; they are familiar instruments recorded on unfamiliar infrastructure, and the regulatory task is translation rather than invention.

The practical implications extend beyond compliance departments. The guidance arrives alongside a Dec. 11 no-action letter authorizing the Depository Trust Company to pilot tokenization services for Russell 1000 equities, Treasury securities and major ETFs. DTCC, which custodies over $100 trillion in assets and processes quadrillions in annual transactions, will operate the pilot on approved blockchains beginning in late 2026. The convergence of these announcements signals that institutional tokenization is no longer speculative; the plumbing is being installed.

Market data supports the trajectory. Tokenized real-world assets reached $36 billion in value by late November 2025, a figure that would have seemed fanciful two years prior. Ethereum hosts roughly two-thirds of this market, though DTCC has not yet disclosed which networks its pilot will employ. The SEC's willingness to grant temporary exemptions from certain Rule 17Ad-22 provisions — governing infrastructure reliability — suggests a recognition that blockchain-based settlement systems require iterative development rather than immediate perfection.

None of this resolves the deeper tensions between programmable assets and legacy compliance frameworks. The guidance applies exclusively to crypto asset securities; bitcoin and other instruments treated as commodities remain outside its scope. The question of which tokens qualify as securities — the classification dispute that has animated enforcement actions against Ripple, Coinbase and others — receives no new clarity. The December statement assumes the asset in question is already a security and addresses only how to custody it, leaving the antecedent determination to the Howey test and its accumulated judicial glosses.

Still, the guidance represents a genuine inflection. For broker-dealers seeking to offer tokenized securities custody, the path forward is now visible, even if not yet paved. The SEC has acknowledged that distributed ledger technology does not nullify decades of investor protection law but merely requires its sensible adaptation. The industry has waited years for this concession.

Regulation, like blockchain itself, advances one block at a time — though the SEC's blocks have considerably longer confirmation times.