SEC and New York DFS Release New Cryptocurrency Guidance on Custody and Blockchain Analytics

The U.S. Securities and Exchange Commission (SEC) and the New York Department of Financial Services (NYDFS) recently took independent actions to clarify financial institutions’ obligations and supervisory expectations regarding providing custody services for and managing transactions involving digital assets. This Advisory analyzes each of these regulatory actions and provides key takeaways for financial institutions navigating the evolving digital asset regulatory landscape.

This Advisory is part of a series by Arnold & Porter covering the evolution of the digital asset landscape in the U.S. Please visit the Arnold & Porter Cryptocurrency & Digital Assets page to review the other Advisories in the series, including an Advisory on Federal Banking Agencies Clarify Approach to Bank-Permissible Crypto-Asset Activities.

I. New York DFS Issues Updated Guidance on Custodial Structures for Virtual Currency

On September 30, 2025, the NYDFS updated prior guidance to financial institutions that custody “virtual currency” assets under New York law regarding how such assets are to be custodied and safeguarded to ensure consumer protection in the event of an insolvency or similar proceeding. The guidance replaces prior guidance from 2023 to provide additional direction, especially regarding the use of third parties to assist in safeguarding customer assets (“sub-custodians”).

Key Requirements

The updated guidance emphasizes four key areas of focus for NYDFS-regulated financial institutions when developing structures and processes for custodying customers’ virtual currency:

• Segregation of and Separate Accounting for Customer Virtual Currency. Financial institutions must separately account for and segregate customer virtual currency from the corporate assets of the institution itself and maintain clear records to identify customer assets and trace customer transactions. The guidance notes that custodians may use varying custodial structures, including individual on-chain digital wallets or omnibus accounts; however, in the case of the latter, the custodian must maintain adequate internal records to ensure each customer’s beneficial interest is identifiable and current, and that customer funds are safeguarded at all times.
• Limited Interest in and Use of Customer Virtual Currency. The NYDFS expects custodians only to take possession of a customer’s virtual currency for custody and safekeeping purposes. Accordingly, custodians should treat virtual currency as belonging solely to the customers and should not use virtual currency for the custodian’s own use (for example, as collateral for a loan).
• Sub-Custody Arrangements. Custodians may use sub-custodians to provide custody and safekeeping services for customers’ virtual currency only after performing adequate due diligence on the sub-custodian and seeking the prior approval from NYDFS for a material change to the custodian’s business activities. This process requires a custodian to provide the NYDFS with adequate documentation for its review, including, for example, the terms of the proposed arrangement, any risk assessments conducted by the custodian, a copy of the proposed service agreement, and relevant policies and procedures of the sub-custodian. The updated guidance adds that NYDFS expects a proposed service agreement to contain an acknowledgement by the sub-custodian that all virtual currency will be handled in accordance with NYDFS regulations and standards. The updated guidance also adds that NYDFS expects sub-custodians to be either (1) chartered or licensed by NYDFS or (2) subject in their home jurisdiction to a supervisory and regulatory regime for custodial activities that is, as determined by NYDFS, substantially similar to NYDFS’s regime.
• Customer Disclosure. Custodians are expected to clearly disclose in writing the general terms and conditions of their products, services, and activities, and to obtain written acknowledgment from the customer of receipt of such disclosures before the custodian’s first transaction with a customer. Custodians must also disclose additional information as required by NYDFS and make the disclosures easily accessible on the custodian’s website.

II. SEC Provides No-Action Relief for State Trust Companies Custodying Digital Assets

On September 30, 2025, the SEC’s Division of Investment Management Staff issued a no-action letter addressing the treatment of state trust companies as qualified custodians for digital assets held by investment funds under applicable SEC custody regulations.

Background on Custody Requirements

Under Section 206(4) of the Investment Advisers Act of 1940 and Section 26(a) of the Investment Company Act of 1940, and SEC regulations implemented under each statutory provision, registered investment advisers (RIAs) and registered investment companies (RICs) are generally required to entrust client assets to certain “qualified custodians,” a term which includes “banks,” as defined by each statute, and certain other regulated financial institutions. Under both statutes, the term “bank” is defined to include, among other things, a “banking institution” or “trust company” “whether incorporated or not, doing business under the laws of any State or of the United States, a substantial portion of the business of which consists of receiving deposits or exercising fiduciary powers similar to those permitted to national banks under the authority of the Comptroller of the Currency,” and which is “supervised and examined by State or Federal authority” having supervision over banks, and which is “not operated for the purpose of evading the provisions” of the 1940 Act or Advisers Act, as applicable.

The incoming letter requesting no-action relief questioned whether state trust companies — often in the form of companies specifically chartered to deal with digital assets — are deemed to meet the definition of a “bank,” and therefore be a “qualified custodian.” The incoming letter noted that it was not clear whether a substantial portion of a given state trust company’s business consists of receiving deposits or exercising fiduciary powers similar to those permitted to national banks, and that such a determination inherently involves a facts and circumstances analysis.

The No-Action Relief

The no-action letter confirms that the Division of Investment Management Staff will not recommend enforcement action against RIAs, RICs, or business development companies (RICs and business development companies, together, “Regulated Funds”) for treating state trust companies as “qualified custodians” when a state trust company meets the following requirements:

• The trust company is authorized by its state regulator to provide custody services for digital assets and related cash and cash equivalents.
• The trust company has implemented written policies and procedures reasonably designed to safeguard digital assets and related cash and cash equivalents (e.g., private-key management, cybersecurity), with such determinations having been made based upon review by the RIA or Regulated Fund of recent audited financial statements and satisfactory internal control reports from the state trust company.
• The trust company operates pursuant to a written custodial agreement consistent with SEC requirements for proper safekeeping of digital assets.

Additional conditions of the no-action relief provided by the SEC Staff are that each RIA or Regulated Fund (1) must disclose to their clients (in the case of an RIA) or to its board of directors or trustees (in the case of a Regulated Fund) the material risks associated with using a state trust company for digital asset custody services and (2) separately determine that using a trust company’s services is in the best interests of its clients or shareholders, as applicable, prior to using a state trust company as a digital asset custodian.

III. New York DFS Issues Guidance on Blockchain Analytics for Banking Organizations

On September 17, 2025, the NYDFS issued an industry letter providing additional guidance to financial institutions on the use of blockchain analytics tools for monitoring virtual currency transactions.

What Are Blockchain Analytics?

Blockchain analytics tools are software used to trace and analyze transactions recorded on blockchain networks. These tools help financial institutions:

• Monitor virtual currency transactions for suspicious activities.
• Trace the flow of virtual currency across blockchain networks.
• Identify connections between blockchain addresses and real-world entities.
• Assess risk levels associated with particular transactions.

Key Guidance Points

In its guidance, the NYDFS encourages all New York banking institutions to consider leveraging blockchain analytics tools to enhance compliance programs and risk frameworks. In particular, NYDFS recommends that these institutions consider the use of such tools in the following contexts (potentially among others):

• Screen wallets of customers that disclose or exhibit virtual currency activity to assess risk exposure.
• Verify sources of funds coming from virtual currency service providers.
• Engage in holistic ecosystem monitoring to assess customers’ exposure to money laundering, sanctions violations, or other crimes.
• Identify and gauge third-party risk (e.g., customer counterparties).
• Compare expected versus actual activity (e.g., dollar thresholds) of customers engaged in virtual currency activity.
• Utilize insights from monitoring to improve risk assessments and risk appetite.
• Weigh the risks of providing new products and services involving virtual currency.

Conclusion

The regulatory guidance summarized in this Advisory, collectively, provides financial institutions with greater insight into how regulators expect financial institutions to navigate certain emerging risks and opportunities afforded by digital assets. In light of the guidance, financial institutions may wish to evaluate how the agencies’ interpretations and expectations relate to their existing and planned custody and safekeeping activities with respect to digital assets, and their outsourcing of such functions, as well as potential opportunities to expand or modify their digital assets operations and corresponding internal controls. Financial institutions should also continue to remain vigilant for further regulatory developments, as state and federal regulators continue to clarify their expectations regarding digital assets.

If you would like more information about the content of this Advisory, please contact any of the authors of this Advisory or your usual Arnold & Porter contact. The firm’s Financial Services and Cryptocurrency & Digital Assets teams would be pleased to assist with any questions that you may have.

© Arnold & Porter Kaye Scholer LLP 2025 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.