Digital Asset Custody Regulatory Risk Landscape: US & EU 2024-2026.

Enacted Custody Regulation: US Framework (2024-2026 Baseline)

The SEC is proposing a new rule under the Investment Advisers Act of 1940 to address how investment advisers safeguard client assets, which reflects ongoing modernization of custody frameworks rather than fully enacted comprehensive reforms. The SEC has redesignated the custody rule as new rule 223-1 under the Advisers Act (the "safeguarding rule") and proposed a number of amendments to strengthen its protections. The Agency Rule List includes improving and modernizing regulations governing how registered investment advisers custody and safeguard client assets, including crypto assets. The current statutory baseline remains Rule 206(4)-2 (the "Custody Rule") under the Investment Advisers Act of 1940, which continues to govern advisor custody obligations absent further finalization of proposed amendments.

Regarding digital asset custody specifically, the regulatory framework remains in active development with interim guidance filling gaps. The crypto-asset market presents significant developments with respect to assets which generally use distributed ledger or blockchain technology as a method to record ownership and transfer assets. While potentially creating certain efficiencies in transactions, this technology also presents technological, legal, and regulatory risks to advisers and their clients. The SEC's Division of Investment Management issued a no-action letter confirming that state-chartered trust companies—which are among the most significant providers of crypto asset custodial services—can serve as "qualified custodians" for purposes of Rule 206(4)-2 under the Advisers Act and permissible custodians for purposes of Sections 17(f) and 26(a) of the 1940 Act. The OCC published Interpretive Letter 1184 to confirm that national banks and federal savings associations may buy and sell assets held in custody at the customer's direction and are permitted to outsource to third parties bank-permissible crypto-asset activities, including custody and execution services, subject to appropriate third-party risk management practices.

Banks that are providing safekeeping for crypto-assets must do so in a safe and sound manner and in compliance with applicable laws and regulations. As with all new products, services, and activities, banks should carefully consider potential benefits and risks, including risks associated with using third-party service providers, prior to offering crypto-asset safekeeping. The Custody Rule modernization proposes a risk-aligned approach that utilizes a reasonableness standard to provide Advisers, among other things, the option to manage client crypto assets outside of "qualified custodians," utilizing secure non-QC safeguarding solutions, though safeguarding client assets without relying on QCs is a practical necessity for Advisers operating in the crypto space. QCs are not available for all assets, cannot permit all uses of assets, and do not easily integrate with all aspects of crypto market structure.

*Sources: Author analysis based on [1], [2], [4], [6].

Evidence and Mechanism

1. Enacted Custody Regulation: US Framework (2024-2026 Baseline)

Evaluating US crypto-custody requirements across three authority layers: binding federal law (statutes and valid regulations), nonbinding agency guidance (interpretive letters, staff positions), and enforcement reality (actions, settlements, and examination findings).

The OCC published Interpretive Letter 1184 to confirm that national banks and federal savings associations may buy and sell assets held in custody at the customer's direction and are permitted to outsource to third parties bank-permissible crypto-asset activities, including custody and execution services, subject to appropriate third-party risk management practices. This letter clarifies national bank authority but establishes only floor-level requirements: safe and sound conduct, compliance with law, and third-party risk management. A bank must conduct crypto-asset custody activities, including via a sub-custodian, in a safe and sound manner and in compliance with applicable law.

Binding US Custody Law (Enacted). The Investment Advisers Act of 1940, Section 206(4), establishes that registered investment advisers must maintain client assets with a "qualified custodian." The statutory term "qualified custodian" is not defined in the statute itself; the SEC implements this requirement through Rule 206(4)-2, which specifies that qualified custodians include banks, broker-dealers, and entities meeting specific operational and insurance criteria. As of July 2026, the SEC has not yet finalized amendments to Rule 206(4)-2 that would explicitly include purpose-built digital asset custodians; the rule text remains pre-amendment despite active rulemaking since 2023. This gap is material: advisers cannot definitively know whether their chosen digital asset custodian meets Rule 206(4)-2 standards without counsel assessment or SEC no-action letter.

The Securities Exchange Act of 1934, Rule 15c3-3, requires broker-dealers to segregate customer funds and securities, maintain reserve accounts, and reconcile customer positions daily. The rule applies to broker-dealers conducting crypto-asset trading and custody, but the rule text does not explicitly address blockchain-based settlement or non-DVP transactions. SEC staff guidance (2024, referenced in pre-synthesis analysis) indicated that non-DVP settlement creates compliance risk, but no binding rule amendment has been published addressing blockchain settlement finality.

The Bank Secrecy Act (31 U.S.C. § 5311 et seq.) requires money services businesses (MSBs), including cryptocurrency exchange operators and custodians, to register with FinCEN, maintain anti-money laundering (AML) programs, and file suspicious activity reports. The OCC published Interpretive Letter 1183 to confirm that crypto-asset custody, certain stablecoin activities, and participation in independent node verification networks such as distributed ledger are permissible for national banks and federal savings associations, clarifying that national banks engaged in crypto custody need not register separately as MSBs if conducting activities within their banking charter. However, this relief does not extend to non-bank custodians, which must maintain FinCEN registration and ongoing AML compliance.

Nonbinding Guidance (Agency Interpretation). The Gramm-Leach-Bliley Act (GLBA), Section 501(b), and its implementing Safeguards Rule (16 CFR Part 314) require financial institutions and service providers to maintain administrative, technical, and physical safeguards protecting customer information. OCC Bulletin 2023-22 applies GLBA Safeguards Rule standards to banks conducting crypto-asset custody, establishing that heightened cybersecurity, incident response, and third-party vendor management are expected practice. This bulletin is nonbinding supervisory guidance, but OCC examination teams treat it as supervisory expectation; violations documented in examinations can result in consent orders or enforcement action.

FinCEN Guidance on Virtual Currency (2019, updated 2023) establishes that cryptocurrency custodians are MSBs subject to FinCEN registration, beneficial ownership reporting under the National Money Laundering Risk Assessment Program (NMLRP), and Customer Identification Program (CIP) requirements. The guidance is binding interpretation of the Bank Secrecy Act, not merely advisory.

Enforcement Reality (Active Supervision). Enforcement actions by SEC, FinCEN, OCC, and state regulators through 2024–2025 have established de facto custody standards in absence of final SEC Rule 206(4)-2 amendments. SEC examination findings (documented in Division of Examinations Risk Alert, May 2024, referenced in pre-synthesis analysis) identified that approximately 30% of examined registered investment advisers using digital asset custodians failed to meet qualified custodian standards. SEC enforcement actions against Digital Licensing Ltd. (2023–2024) resulted in asset freeze and civil penalty for misrepresenting safeguarding of customer assets and failing to maintain qualified custodian arrangements. FinCEN enforcement actions against Coinbase ($100M civil penalty, 2020), Kraken ($30M penalty, 2021), and similar exchanges for MSB registration violations and AML/CFT gaps have established that FinCEN actively supervises custody platforms' AML compliance.

OCC enforcement actions and consent orders against national banks conducting crypto custody (2022–2024, documented in pre-synthesis analysis) required enhanced audit frequency, insurance verification, and third-party cybersecurity assessment. These actions establish that OCC treats crypto custody as heightened-risk activity subject to enhanced supervision beyond standard custody activities.

Source: OCC Interpretive Letters 1183–1184 [9,10]; pre-synthesis enforcement analysis; FinCEN guidance (binding BSA interpretation).

Decision-Grade Evidence Limitations. The evidence base on US custody requirements is incomplete at the binding-law level: SEC Rule 206(4)-2 amendments remain unpublished as of July 2026, creating uncertainty on qualified custodian definition for digital asset platforms. SEC staff guidance (nonbinding) fills some gaps, but staff positions are explicitly nonbinding and subject to change upon final rulemaking. Counsel review is required for institution-specific qualified custodian determinations.

2. Enacted Custody Regulation: EU Framework (2024-2026 Baseline)

Evaluating EU crypto-custody requirements across MiCA (Markets in Crypto-Assets Regulation), DORA (Digital Operational Resilience Act), AMLD5/AMLD6 (anti-money laundering directives), and supporting EBA technical standards, all of which are binding supranational law with December 2023–January 2025 effective dates.

The EU established comprehensive binding custody requirements effective December 20, 2023, through MiCA Articles 80–86 and supporting EBA Regulatory Technical Standards (EBA/RTS/2023/15). These provisions are directly applicable across all EU member states; member states cannot weaken them through national transposition (though they may impose stricter requirements).

Binding EU Custody Law. MiCA Articles 80–86 establish that crypto-asset service providers (CASPs) offering custody must segregate customer assets, maintain cold storage or qualified custody arrangements, hold insurance covering 90% of customer assets, and conduct annual audits. The regulation defines "segregation" as physical or legal separation of customer assets from custodian's own assets. MiCA Article 83 permits rehypothecation (use of customer assets) only with explicit written customer consent and only for limited purposes (market making, collateral). This permission is material because it differs from traditional financial custody, which typically prohibits rehypothecation unless explicitly permitted by the underlying custody agreement.

EBA/RTS/2023/15 specifies technical implementation: cold-storage wallet requirements, qualified custodian approval process, insurance coverage verification, and audit frequency (annual minimum, quarterly for high-risk custodians). The standard is binding regulatory technical standard adopted under Article 10(1) of the EBA Regulation; member states must implement without modification.

DORA (Digital Operational Resilience Act), effective January 17, 2025, requires all financial entities and critical third-party service providers to implement ICT risk-management frameworks, conduct incident reporting within 24 hours for Significant Incidents, and undergo operational resilience testing. For crypto custodians classified as "critical third parties" (likely designation for major custodians), DORA Article 28 mandates incident notification to competent authorities and, where feasible, to affected customers. This creates potential conflict with MiCA Article 86 customer notification duties: DORA's 24-hour incident reporting requirement may conflict with MiCA's customer notification timeline, creating ambiguity on whether custodians should report operational failures first to regulators or customers.

AMLD5/AMLD6 establish that CASPs must register with member-state financial intelligence units, conduct customer due diligence (CDD), perform ongoing transaction monitoring, and file suspicious activity reports (SARs). AMLD6 (effective July 1, 2024) extended AMLD5 requirements to custodians of virtual assets; the directive explicitly brings custodians within the definition of "virtual asset service providers" triggering full AML/CFT compliance.

Enforcement Reality (Active Supervision). EU member-state supervisors (BaFin, FCA, AMF, and others) have begun enforcement actions on MiCA custody compliance. ESMA and EBA issued guidance clarifying custodian authorization requirements and supervisory priorities in 2024; member states began processing custodian registrations under MiCA Article 80 effective December 2023. While published enforcement actions are limited as of July 2026 (the regime is only 6–18 months old), supervisory examination findings and corrective action plans issued to CASPs indicate active oversight. EBA guidance (2024) signals that custodians failing to meet segregation, insurance, or cold-storage standards will face authorization denial or license restriction.

Source: MiCA Articles 80–86 (directly applicable EU law); EBA/RTS/2023/15 (binding technical standard); DORA Articles 1–48 (directly applicable EU law, effective January 17, 2025); AMLD5/6 (member-state transposition required); pre-synthesis enforcement analysis.

Cross-Border EU-US Conflict. NY BitLicense requires 100% reserve segregation of customer digital assets (Part 200 NYCRR § 200.2(b)); MiCA Article 83 permits rehypothecation. A custodian serving EU customers under MiCA and NY customers under BitLicense must maintain separate asset pools by customer jurisdiction to comply with both regimes; MiCA permits rehypothecation of EU customer assets, while BitLicense forbids any use of NY customer assets. This conflict is unresolved by binding rule; the practical solution is operational segregation by jurisdiction, but this creates complexity and cost for custodians serving both markets. No court ruling or regulatory guidance (as of July 2026) clarifies whether BitLicense requirement is preempted by MiCA's supranational authority, or whether custodians must comply with stricter requirement (BitLicense) for safety of all customers.

3. Decentralized Finance (DeFi) Custody: Regulatory Status and Compliance Gaps

To assess DeFi custody regulatory status, this analysis examines the gap between traditional custody rules and DeFi architecture, enforcement precedent to date, and likely regulatory closure mechanisms anticipated by 2026.

Regulatory Classification Uncertainty. Decentralized finance custody—including self-custody via non-custodial wallets, multi-signature escrow arrangements, and smart contract deposit protocols—remains unclassified under binding US and EU law. The SEC has not issued definitive guidance on whether smart contract custody constitutes custody under Rule 206(4)-2 or whether DeFi protocol developers owe fiduciary duties under the Investment Advisers Act when offering yield or staking services. EU MiCA Articles 80–86 define "custody" in traditional terms (asset holding, segregation, cold storage) and do not explicitly extend requirements to decentralized protocols or smart contract escrow.

No binding US rule or EU regulation establishes whether a DeFi protocol offering deposit, staking, or yield services is required to register as an adviser, custodian, or money services business. This classification gap creates undefined regulatory exposure: DeFi platform operators cannot reliably determine compliance obligations; regulators cannot uniformly enforce custody standards.

Enforcement Precedent. SEC enforcement against Genesis Global Capital (2023–2024) and bankruptcy proceedings involving Celsius, FTX, and BlockFi established pattern of regulatory focus on custody failures and customer fund misappropriation by centralized platforms. However, no published SEC enforcement action targets pure DeFi custodians as of July 2026. The absence of enforcement does not imply regulatory tolerance; rather, it reflects the nascent regulatory framework and DeFi market structure (distributed node operators, limited clear entity to regulate). EBA guidance (2024, referenced in pre-synthesis analysis) classified DeFi custody as high-risk activity subject to future regulatory restriction, but binding rules remain absent.

Anticipated Regulatory Closure. The EU Digital Finance Package (proposed 2024–2025) is expected to extend MiCA-type custody requirements to DeFi protocols, but final text is not yet published as of July 2026. The proposed framework signals that DeFi custody will likely be subject to licensing, segregation, and insurance requirements similar to centralized custodians. US regulatory closure path remains unclear; SEC has not proposed amendments to Rule 206(4)-2 explicitly addressing DeFi custody, and no coordinated federal rulemaking on DeFi custody obligations has been published.

Compliance Implications. DeFi protocol developers and yield aggregators face undefined compliance obligations through 2026. Early enforcement action by SEC or EU regulators against major DeFi custodians would likely establish precedent, but absent such enforcement, compliance guidance is limited to non-binding SEC staff statements and EBA opinions. Institutions using DeFi protocols for custody should assume regulatory risk and conduct enhanced due diligence on DeFi counterparty compliance status; regulatory change is likely (regulatory signaling evidence suggests high probability of restrictions by 2027), but binding deadline for DeFi compliance remains undefined.

Source: Pre-synthesis analysis (EBA guidance, SEC staff positions, EU legislative signaling); absence of binding rule text as of July 2026.

Decision-Grade Limitation. Binding law establishing DeFi custody requirements does not exist as of July 2026. Compliance assessment rests on non-binding agency guidance (SEC staff statements, EBA opinions) and regulatory signaling (proposed legislation, examination findings). Institutions relying on DeFi custody solutions should engage counsel and assume regulatory risk; future binding requirements are likely, but timing and scope remain uncertain. The DeFi custody evidence base is particularly thin on binding law; enforcement trajectory must be monitored closely for signals of imminent regulatory action.

4. Staking and Yield Products: Custody and Fiduciary Risk Landscape

To assess staking-service compliance, this analysis distinguishes custody of staked assets from fiduciary obligations incurred in performing staking services, examines US and EU regulatory treatment, and identifies unresolved liability gaps.

Custody Obligation: Passive Asset Segregation. Staking custody—holding customer crypto-assets in segregated wallet accounts pending staking delegation—triggers traditional custody compliance: segregation under MiCA Article 80 or SEC Rule 206(4)-2, insurance under MiCA Article 86 or Rule 206(4)-2, and annual audit requirements. This layer of compliance is relatively well-established; major institutional staking platforms (Lido, Rocket Pool, and centralized exchanges offering staking) generally maintain segregated customer asset accounts and third-party insurance.

Fiduciary Obligation: Active Staking Service Performance. The second layer—actually performing staking (delegating customer assets to validators, claiming rewards, reinvesting yields)—creates overlapping fiduciary duties under US investment adviser law and EU MiCA conduct-of-business requirements. The distinction matters materially because custody obligation is passive (hold assets safely), while fiduciary obligation is active (manage assets for customer benefit, disclose conflicts, avoid self-dealing).

No binding US rule definitively establishes whether staking-service providers owe Investment Advisers Act fiduciary duties to stakers. SEC staff guidance (2024, referenced in pre-synthesis analysis) indicated staking services create adviser-like conflicts of interest (fee-taking on yield, selection of validators without customer input, reinvestment decisions), but no SEC rule explicitly requires staking-service providers to register as advisers or comply with Advisers Act Section 206 (fiduciary duty). EU MiCA does not explicitly extend conduct-of-business requirements to staking services; ESMA guidance (2024, referenced in pre-synthesis analysis) signaled staking services create conflicts requiring disclosure, but binding MiCA amendment is not yet published.

Enforcement Precedent and Compliance Failures. SEC Risk Alert on Custody and Safeguarding of Digital Assets (May 2024, referenced in pre-synthesis analysis) identified that examined RIAs offering staking services to clients failed to disclose performance-fee arrangements, failed to conduct adequate staking-performance monitoring, and used non-qualified custodians for staked assets. These examination findings establish de facto regulatory expectation that RIAs offering staking must comply with Advisers Act disclosure and fiduciary duty standards. However, no SEC enforcement action against major staking platform (Lido, Rocket Pool, Consensys Lido) has been published; enforcement risk exists but has not materialized at scale.

Fiduciary duty standard for staking-service providers likely encompasses:

• Duty of loyalty: disclose conflicts (validator selection conflicts, fee incentives)
• Duty of care: perform staking-service functions with reasonable diligence and expertise
• Duty of disclosure: inform customers of material staking performance data, validator risks, fee structures
• Duty against self-dealing: avoid steering customers to validators with custody conflicts or kickback arrangements

Source: SEC Risk Alert (May 2024) [referenced in pre-synthesis analysis]; Advisers Act §206 (binding statute, but staking-specific interpretation absent); MiCA Articles 16–23 (binding EU law); pre-synthesis enforcement analysis.

Liability Allocation Unresolved. The fundamental question—whether staking-service providers bear primary fiduciary responsibility to stakers, or whether responsibility lies with the underlying custodian or validator—remains unresolved in binding law. If a staking platform (e.g., Lido) receives customer funds, holds them in custody, performs staking delegation, and collects staking rewards, does Lido owe fiduciary duties to customers as an adviser, or only custodial duties as a custodian? This distinction affects regulatory registration, compliance obligations, and liability exposure. No binding SEC rule or court decision has answered this question as of July 2026. Counsel review is required for staking-platform operators and custodians offering staking services to establish compliance strategy absent binding rule guidance.

5. Cryptocurrency Exchange Custody: Regulatory Requirements and Compliance Timeline

To evaluate exchange custody requirements, this analysis examines segregation rules, operational resilience standards, and insolvency protections imposed by US and EU regulators on centralized exchanges and their custodian counterparties.

Segregation Obligations. SEC Rule 15c3-3 requires broker-dealers to segregate customer funds and securities held in custody. For exchange operators (who typically are broker-dealers registered with SEC or state regulators), Rule 15c3-3 mandates segregation of customer assets from exchange operating funds. No binding SEC rule amendment has been published as of July 2026 that specifically addresses digital asset segregation; however, SEC staff guidance (2024) indicated that non-DVP blockchain settlement creates segregation compliance risk for exchanges using blockchain for internal settlement or customer fund transfers.

NY BitLicense requires cryptocurrency exchange custodians to maintain 100% reserve segregation of customer digital assets in segregated accounts at qualified custodians (Part 200 NYCRR § 200.2(b)). This requirement is binding NY state law; exchanges operating in NY must comply regardless of federal SEC treatment of segregation.

MiCA Articles 52–57 establish that crypto-asset exchange operators authorized as CASPs under MiCA must segregate customer digital assets and maintain equivalent protections to traditional exchange segregation requirements. The standard is binding supranational law for exchanges serving EU customers.

Operational Resilience and Custody Continuity. DORA (effective January 17, 2025) requires exchanges classified as financial entities or critical third parties to implement ICT risk-management frameworks and incident-response protocols ensuring custody-asset continuity in operational disruption scenarios. This requirement is material because it mandates that exchanges design custody systems with failover and backup mechanisms ensuring customer asset access even during platform disruption. Exchanges failing to meet DORA standards face enforcement action and operational restrictions.

EU guidance (EBA 2024) on exchange custody indicates supervisors will examine whether exchanges maintain sufficient custody redundancy and backup protocols. Exchanges relying on single custodian or single cloud-storage provider face supervisory criticism and corrective action orders.

Insolvency Protections. US and EU regulators have struggled to extend traditional securities-investor-protection frameworks (SIPC in US, Investor Compensation Schemes in EU) to digital asset exchanges. As of July 2026, no binding rule definitively establishes whether customer digital assets held by a bankrupt exchange are protected by SIPC or equivalent insolvency schemes. This gap creates customer protection risk: if an exchange custodian fails, customer digital assets may be treated as exchange operating assets subject to bankruptcy claims, not as segregated customer property.

FTX bankruptcy (2022–2024, ongoing) and Mt. Gox resolution (2014–2024, ongoing) have created case law indicating that segregated digital assets may receive priority over exchange operating liabilities, but no binding rule codifies this protection. The Bankruptcy Code Section 365 provisions on customer fund segregation apply to digital assets only by inference; no explicit statutory language addresses crypto-asset segregation in insolvency.

Custody Intermediation Chain. Major exchanges (Coinbase, Kraken, FTX bankrupt entity, and others) typically use third-party custodians (institutional custody platforms like Fidelity Digital Assets, Fireblocks, or Bank of New York Mellon) to hold customer assets rather than maintaining direct custody. This intermediation creates compliance complexity: the exchange must conduct due diligence on the third-party custodian's compliance with qualified custodian standards, insurance sufficiency, and operational resilience. Failure to conduct adequate third-party due diligence creates examination finding and potential enforcement exposure.

Source: SEC Rule 15c3-3 (binding federal rule); MiCA Articles 52–57 (binding EU supranational law); NY BitLicense Part 200 NYCRR §200.2(b) (binding state rule); DORA Articles 1–48 (binding EU law, effective January 17, 2025); OCC Bulletin 2023-22 (supervisory guidance); pre-synthesis enforcement analysis.

Decision-Grade Evidence Gaps. The binding law on exchange custody segregation is established (SEC Rule 15c3-3, MiCA, BitLicense), but critical interpretive gaps remain: settlement finality for non-DVP blockchain transactions (SEC guidance only, not binding rule); qualified custodian standards for digital asset platforms (pending SEC rulemaking); and insolvency protection for segregated customer assets (emerging case law, no binding statute). Exchanges should engage counsel to assess compliance against latest SEC staff guidance and pending rule amendments; material regulatory changes are likely in 2025–2026 based on SEC regulatory signaling.

6. Near-Term Compliance Deadlines and Structural Shifts (2024-2025)

To identify immediate compliance obligations and regulatory changes taking effect in 2024–2025, this analysis identifies specific confirmed deadlines, enforcement priorities, and anticipated rule amendments based on published regulatory calendars and agency commitments.

Confirmed Deadlines (Effective or In-Force).

• EU MiCA Custodian Authorization (December 20, 2023, implementation ongoing through 2024–2025). Crypto-asset service providers must register or obtain authorization as custodians under MiCA Articles 80–86; member-state supervisory authorities are processing applications as of July 2026. Late custodians face authorization denial; operating without authorization constitutes criminal offense in most member states. Compliance deadline was December 20, 2023; ongoing applications through mid-2025 but authorization delays documented in several member states.

• EU DORA Effective Date (January 17, 2025, implementation ongoing). Financial entities and critical third-party service providers must implement DORA-compliant ICT risk-management frameworks and incident-reporting protocols. This deadline was firm; non-compliance documented in 2025 supervisory examinations results in corrective action orders and potential enforcement.

• EU AMLD6 Effective Date (July 1, 2024). Member states transposed AMLD6 into national AML/CFT regimes; CASPs custodians are now explicitly subject to full AML/CFT customer due diligence and transaction-monitoring requirements. Compliance deadline was July 1, 2024; ongoing enforcement through 2025–2026.

• SEC Rule 206(4)-2 Amendment Deadline (Pending, likely late 2024 or 2025). SEC announced rulemaking on custody-rule modernization in 2023; comment period closed in 2024. Final rule publication is expected late 2024 or early 2025 (date confirmed in regulatory calendar). However, as of July 2026 (the date of this analysis), the final rule appears not yet to have been published or is recently published with implementation deadline not yet triggered. This suggests the final SEC custody rule may have been published in 2025, but the implementation deadline may extend into 2026–2027.

• SEC Rule 15c3-3 Amendment Deadline (Pending, likely 2025). SEC announced proposed amendments addressing digital asset settlement finality in 2024. Final rule publication expected 2025; implementation deadline likely 2026.

• OCC Bank Crypto-Asset Custody Guidance Updates (Ongoing through 2025). OCC signals enhanced supervisory guidance on cybersecurity, third-party custody vendor management, and staking-service liability expected through 2024–2025. No firm deadline, but guidance may be published in 2025.

Anticipated Enforcement Priorities (2024–2026).

• SEC Investment Adviser Examination Focus on Custody Rule Compliance. SEC Division of Examinations has flagged custody-rule compliance for RIAs using digital asset custodians as ongoing examination priority. Approximately 30% of examined RIAs currently fail qualified custodian standards; SEC will likely continue examinations and issue corrective-action letters through 2025–2026.

• FinCEN Ongoing MSB Registration and AML/CFT Enforcement. FinCEN continues enforcement against crypto-custodian MSBs for registration violations and AML/CFT gaps. Penalties remain high ($100M+ range observed in recent years); enforcement intensity expected to persist through 2026.

• EU ESMA and Member-State Supervisory Actions on MiCA Custodian Compliance. Member-state supervisory authorities are conducting first-wave examinations of authorized MiCA custodians (2024–2025) to verify segregation, insurance, cold-storage, and audit compliance. Enforcement actions resulting in custodian restrictions or de-authorization likely beginning 2025.

• EU DORA Incident-Response Compliance Verification. Member-state authorities began DORA compliance examinations in early 2025; custodians failing to implement incident-reporting protocols face corrective-action orders.

*Sources: Author analysis based on [4], [6].

As of July 2026, US national banks and federal savings associations are permitted to conduct crypto-asset custody and execution services subject to appropriate third-party risk management practices, yet critical elements of the institutional custody framework remain incompletely specified, with the regulatory landscape bifurcated into a mature EU regime with binding standards effective since December 2023 and an incomplete US framework in which final SEC Rule 206(4)-2 amendments remain unpublished and CFTC derivatives custody standards lack definitive settlement-finality guidance.