New 3 rules allow large brokers to manage private keys of crypto assets with less supervision

SEC’s regulatory changes in digital asset custody open a new operational reality for firms like Morgan Stanley and Goldman Sachs. Through their updated guidelines on December 17, 2025, the commission establishes a framework where broker-dealers can demonstrate “control” over tokenized crypto assets without needing to adhere to certain protection mechanisms that have traditionally been considered essential.

The shift in the definition of control: rules of 3 in practice

Rule 15c3-3© now allows broker-dealers to establish control over crypto asset securities through qualified control locations, even without physical possession of certificates. This change represents a departure from the 3-point rule that characterized previous cycles, where reliance on specialized brokers (SPBD) was practically mandatory.

Under the new framework, a broker-dealer can demonstrate control if:

They directly hold private keys in hardware security modules (HSM) or multi-signature structures under their authority. In this case, audit traceability and cybersecurity controls are the key evidentiary elements.

They redirect control through bank sub-custody where they hold documented managerial rights. A bank acts as a recognized control location, but the broker-dealer retains authority over securities movements.

They use multi-signature structures between the firm and a transfer agent, allowing signing procedures to meet control expectations without concentrating everything in a single entity.

Impact on Bitcoin and Ethereum ETF markets

For authorized participants and market makers facilitating creation and redemption flows in-kind, the SEC also introduced a more favorable capital treatment. Bitcoin and Ethereum positions held as intraday inventory qualify as “easily tradable,” reducing net capital deductions through a 20% commodities haircut.

A broker-dealer holding an average inventory of $50 millions in BTC or ETH would see a deduction of approximately $10 millions in their net capital requirements. This change makes in-kind operations more viable for firms operating with tight margins.

The withdrawal of the previous framework accelerates change

The SEC formally withdrew its 2019 joint statement with FINRA on digital asset custody, replacing it with FAQs that apply existing control location concepts. Simultaneously, the Federal Reserve withdrew supervision letters in April 2025 that required prior notification for certain crypto activities, moving bank involvement toward routine supervisory channels.

This regulatory coordination shortens timelines from conceptual design to effective supervisory conversations in the banking sector, although broker-dealers still must demonstrate control through verifiable records under the three main categories rule.

How examiners will verify control

Compliance teams will face scrutiny on how they document control over time. Self-custody structures offer a direct chain of evidence but require robust cybersecurity controls and scalable audit capacity. Bank sub-custody leverages a familiar perimeter for incumbents, though contractual terms must demonstrate what happens during security incidents.

In the next 12 to 18 months, the market will cluster around structures that produce repeatable evidence of control while minimizing operational exposure. The key decision remains whether the broker-dealer directly controls the cryptographic material or demonstrates managerial authority through qualified third parties.

Clarifications for retail and next steps

For retail-oriented firms, crypto assets that do not qualify as securities remain outside Rule 15c3-3(b), maintaining clear disclosures about which protections apply. Commissioner Hester Peirce described these guidelines as incremental changes that reduce friction to adapt to existing rules.

Upcoming signals include whether the SEC continues editing its FAQ index and whether FINRA issues standardized checklists for examiners on on-chain control verification.