Short answer: Crypto is not automatically a security or a commodity. Its legal status depends on the particular asset, how it is issued and used, and what activity a firm or adviser performs. That classification drives custody, broker-dealer, exchange, disclosure, tax and insolvency rules. Advisers must also distinguish direct ownership from an exchange-traded product (ETP), because control of private keys, reporting, fees and possible SIPC treatment can differ materially.
Start with three questions: asset, activity and firm role
FINRA defines crypto assets as assets issued or transferred using distributed-ledger or blockchain technology. FINRA also says a particular crypto asset may or may not be a security. The analysis therefore begins with the asset and the transaction, not with the word “crypto.” Ask:
As an Amazon Associate I earn from qualifying purchases.
- What exactly is the token or instrument, and what rights does it confer?
- What is happening—issuance, sale, trading, staking, lending, custody, brokerage, advice or portfolio management?
- What is the firm’s role and jurisdiction: investment adviser, broker-dealer, commodity firm, fund, custodian or technology provider?
The SEC-CFTC interpretation described in the CFTC’s March 17, 2026 release provides a taxonomy covering digital commodities, digital collectibles, digital tools, stablecoins and digital securities. It also addresses airdrops, protocol mining, staking and wrapping. The category is a starting point, not a blanket exemption: the same token can create different legal questions in different transactions.
Free tools Windows power users keep installed
One-click scans. No signup required.
An investment contract can arise when the elements of that legal test are present and can cease to apply when facts change. Distribution method, promised managerial efforts, purchaser expectations and the network’s operation all matter. Document the analysis for each product and update it when the token, protocol or business model changes.
#1 Best Overall
Why the classification matters
Classification can determine whether federal securities laws, commodities rules, broker-dealer registration, exchange requirements, custody safeguards and offering disclosures apply. A non-security token is not automatically unregulated: FINRA rules that do not depend on securities status can still apply to a member firm, and state money-transmission, consumer-protection and custody laws may be relevant.
CFTC Chairman Michael S. Selig said on March 17, 2026: “For far too long, American builders, innovators, and entrepreneurs have awaited clear guidance on the status of crypto assets under the federal securities and commodity laws.” The statement explains the policy rationale for the interpretation; it is not a legal safe harbor for any product.
Custody: who controls the keys and the client’s assets?
“Do I need a qualified custodian?” cannot be answered without separating four arrangements:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Direct ownership: The client holds the asset and controls the private keys, usually through a wallet. The adviser may provide planning or education without taking possession or control, but access, loss and security remain the client’s responsibility.
- Adviser control: If the adviser can withdraw, transfer or otherwise control client assets, the investment-adviser custody analysis is implicated. Policies, agreements, examinations, statements and other safeguards may be required under the applicable custody regime.
- Broker-dealer custody: A broker-dealer holding a crypto-asset security must analyze Exchange Act Rule 15c3-3(c) and whether the asset is maintained at an otherwise qualifying control location.
- Third-party custody: A bank, trust company, broker-dealer or other provider may hold the asset under a contractual and regulatory arrangement. Verify the provider’s authority, segregation, insurance, withdrawal controls and insolvency treatment rather than assuming the label “custodian” is sufficient.
What the SEC staff FAQ says about broker-dealer control
The SEC staff FAQ says a broker-dealer may establish control of a crypto-asset security under Rule 15c3-3(c) at an otherwise qualifying control location. That is a staff view applied to the rule’s existing framework; it does not turn every wallet or platform into an approved control location.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
The SEC’s 2020 special-purpose broker-dealer statement was a temporary staff position or safe harbor. It did not amend Rule 15c3-3. Firms should not treat that statement as a permanent rule or as permission to skip a current control-location, capital, books-and-records or customer-protection analysis.
The October 1, 2026 custody proposal
The SEC Crypto@SEC page records an October 1, 2026 proposal that would, if adopted, revise adviser and regulated-fund custody requirements. Subject to conditions, the proposal would permit adviser self-custody and custody by state-chartered trust companies, modernize custody provisions and update related records and disclosures. It is a proposal, not current law. Until final action and an effective date, follow the rules presently in force and obtain counsel’s view on any transition period.
For operational planning, maintain a written asset-flow map: client wallet or account, signing authority, trading venue, settlement path, omnibus or segregated account, reconciliation owner and recovery process. A hardware wallet can be an optional self-custody tool, but no wallet is SEC-approved, SIPC-insured or automatically sufficient for an adviser’s custody obligations. Test key-recovery procedures, dual approval, address whitelisting, incident response and succession instructions before using self-custody in a client process.
SIPC: when is crypto protected?
SIPC protection generally extends to “securities” under the Securities Investor Protection Act. The SEC FAQ answers no for customer claims involving non-security crypto assets. It warns that non-security crypto assets may not be protected by any other specific insolvency regime, leaving customers exposed if a broker-dealer fails.
The ordinary SIPC limit cited by the SEC is $500,000 for securities and cash, including a $250,000 cash-only limit. That figure is not crypto insurance. The asset must first qualify for SIPA protection, and the account and intermediary must fall within SIPC’s scope. A platform’s marketing language, a wallet provider’s insurance and a token’s liquidity do not change that legal threshold.
Questions to ask about insolvency
- Is the asset legally a security, and is the intermediary a SIPC member?
- Are customer assets segregated from the firm’s proprietary assets?
- Who owns the private keys and what records prove each customer’s entitlement?
- Can the provider rehypothecate, lend, stake or otherwise encumber the asset?
- What happens to withdrawals, forks, airdrops and pending trades during a wind-down?
Put answers in the client file and explain that market-value loss, fraud, hacking and an insolvency shortfall are different risks. SIPC is not a guarantee against price declines.
U.S. tax reporting: digital assets are property
The IRS treats digital assets as property, not currency. Taxpayers must report digital-asset transactions even when a transaction does not produce a gain or loss. Advisers should establish a recordkeeping process at acquisition, receipt, transfer, exchange and disposition rather than waiting for year-end.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Records every client should preserve
- Date and time of each acquisition, receipt, sale, exchange or other disposition.
- Number of units and the asset’s identifier.
- Fair market value in U.S. dollars at the relevant event and the valuation method used.
- Cost basis, including fees that properly adjust basis, and the wallet or account involved.
- Transaction IDs, statements, Form 1099-DA data and evidence of transfers between a client’s own wallets.
The IRS requires broker Form 1099-DA reporting for covered transactions on or after January 1, 2025. Brokers report gross proceeds for transactions from that date and basis for certain transactions beginning January 1, 2026. A client should reconcile the form to complete records; a form can omit wallet-to-wallet activity or contain basis limitations.
Rank #4
Events that can trigger reporting
The IRS identifies staking, mining, rewards, airdrops, exchanges, payments and digital-asset fees among events that can require a “Yes” answer to the digital-assets question on the return. Receiving an asset, disposing of it for property or services, exchanging one token for another and using it to pay a bill can have different income and gain-or-loss consequences.
Wrapping, liquidity-provider transactions, lending, short sales and notional-principal transactions require particular care. The IRS page identifies temporary reporting exceptions for some of these transactions pending further guidance. “Temporary exception” does not mean permanently tax-free; retain records and obtain tax advice on the facts and tax year involved.
FINRA obligations for member firms
FINRA says its securities rules and rules that do not depend on securities status may impose obligations on member firms and associated persons conducting crypto activities. FINRA has encouraged firms to notify it when they or affiliates engage in crypto activities, including activities involving non-security assets.
When a membership filing may be needed
A prospective member firm seeking a crypto business line may need a New Membership Application. An existing member making a material crypto-related business change may need a Continuing Membership Application. The filing question is fact-specific: describe products, counterparties, custody, technology, jurisdictions, revenue, supervision and conflicts rather than relying on a generic “technology only” label.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Supervision and associated persons
Review outside-business-activity and private-securities-transaction requirements when an associated person operates, promotes or receives compensation from a crypto venture. Written supervisory procedures should cover communications, recommendations, suitability or best-interest analysis as applicable, valuation, conflicts, customer complaints, cybersecurity, sanctions screening, books and records, and escalation of suspicious activity.
Keep evidence that supervisors tested the controls. Crypto markets can trade continuously, use unfamiliar venues and create rapid changes in token features; an annual paper review is not a substitute for monitoring that matches the actual risk.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Direct crypto versus an exchange-traded product
Neither structure is automatically safer or more suitable. Compare the client’s objective, time horizon, loss tolerance and ability to manage keys with the product’s legal and operational features.
Recommended Free Tools
| Issue | Direct ownership | Exchange-traded product (ETP) |
|---|---|---|
| Asset status | Analyze the specific token and each activity. | The ETP is generally a security, while its exposure may reference a security or non-security asset; read the offering documents. |
| Custody | Client or a selected custodian controls keys; recovery and transfer controls are critical. | The product sponsor and its custodians handle underlying assets; the investor holds a security interest in the ETP, not the private keys. |
| Trading and valuation | Venue liquidity, spreads, outages and token-specific pricing can vary widely. | Trades during market hours on an exchange, with market price, premiums or discounts and product liquidity to consider. |
| Insolvency and SIPC | Non-security crypto generally is not protected by SIPC. | SIPC analysis applies to the brokerage security and account; it does not guarantee the underlying asset’s value or eliminate sponsor and market risks. |
| Fees and conflicts | Network fees, trading spreads, custody charges and staking or lending economics may apply. | Expense ratios, brokerage commissions, bid-ask spreads, tracking difference and sponsor compensation may apply. |
| Tax records | Client must capture wallet activity, basis, transfers and dispositions. | Broker reporting may simplify records, but reconcile Form 1099-DA and product distributions to the client’s return. |
| Control and use | May permit transfers, payments or protocol participation, subject to law and platform terms. | Usually provides price exposure without protocol rights or direct transfer capability. |
The SEC FAQ notes that crypto ETP activity remains subject to federal anti-fraud and anti-manipulation provisions. Explain that an ETP can reduce key-management work without removing volatility, tracking, sponsor, custody or market-structure risk.
A practical adviser workflow
- Inventory the exposure. Record the token, contract or ETP, issuer or sponsor, trading venues, wallets, counterparties and jurisdictions.
- Classify the asset and activity. Apply the SEC-CFTC taxonomy and investment-contract analysis; document uncertainty and obtain legal advice where facts are novel.
- Map custody and control. Identify who can sign transactions, where assets are held, how they are segregated and how recovery works.
- Check regulatory perimeter. Evaluate adviser custody, broker-dealer customer-protection rules, FINRA notice or membership filings, state requirements and commodity obligations.
- Build the tax file. Capture units, dates, dollar values, basis, fees, transfers and Form 1099-DA data, then reconcile before filing.
- Compare implementation choices. Present direct ownership and ETP alternatives with costs, liquidity, conflicts, tax administration, insolvency treatment and the client’s loss capacity.
- Monitor change. Revisit the analysis after protocol upgrades, staking or lending changes, new custody arrangements, regulatory releases or a client’s change in objectives.
How to use SEC FAQs and agency statements
SEC staff FAQs are useful indicators of current staff views, but they are not statutes or final rules. The SEC states: “These responses, like all staff statements, have no legal force or effect: they do not alter or amend applicable law, and they create no new or additional obligations for any person.” The statement is from SEC Division of Trading and Markets staff, May 15, 2025.
Use the FAQ alongside formal rules, releases, state law and firm counsel. Cite the date and status of every proposal, interpretation or staff statement in internal memoranda. If the October 1, 2026 custody proposal changes, update procedures rather than treating the proposal as an existing permission.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
