#
Consumer protections are fragmented across NY BitLicense capital/cybersecurity/custody standards, a not-yet-effective federal GENIUS Act disclosure requirement, and non-binding SEC staff custody guidance for crypto asset securities.
At the federal level, the GENIUS Act requires permitted payment stablecoin issuers to publish monthly reserve disclosures giving holders visibility into backing assets, but this requirement only becomes binding once the statute becomes operative -- meaning the consumer-facing transparency benefit it promises is not yet available in practice, notwithstanding that the underlying claim carries Confirmed confidence as a statement of enacted law. This claim shares the same Tier-4-only sourcing pattern that led Challenger review to downgrade the analogous stablecoin-module disclosure claim, though it was not itself independently named in that review; this is flagged here for reviewer awareness rather than independently corrected, since composition does not generate new Challenger-style downgrades absent an actual fold instruction.
Separately, the SEC's Division of Trading and Markets has published guidance for broker-dealers on the custody of 'crypto asset securities,' addressing consumer-facing custody standards specifically for tokenized securities. This is staff-level guidance rather than a formal rule, and is held at Probable confidence accordingly, reflecting its lower procedural weight relative to a Commission rule or statute.
Taken together, US consumer protection for crypto is real but uneven: a mature, in-force state licensing regime in New York; a federal disclosure promise that exists in statute but not yet in operative effect; and non-binding staff guidance covering a narrower custody question for tokenized securities specifically. No single federal consumer-protection framework yet spans the full range of crypto asset types and business models.
Outlook
The consumer protection picture will shift meaningfully once the GENIUS Act's disclosure and redemption requirements become operative, at which point payment stablecoin holders will gain a statutory transparency and insolvency-priority backstop that does not currently exist in practice. Until then, the state licensing baseline -- concentrated in New York but not yet surveyed across other states -- remains the most concrete source of enforceable consumer protection for crypto business customers. Reviewers should also watch whether the SEC elevates its broker-dealer custody guidance from staff-level status to a formal rule, which would meaningfully strengthen the confidence basis for consumer-facing custody protections around tokenized securities.
Consumer Protection
On 1 October 2026 the SEC proposed rules, Release Nos. IA-7023 and IC-36353, creating a crypto-asset custody framework for registered investment advisers and regulated funds and business development companies. Among the proposal's features is a provision permitting state trust companies to serve as qualified custodians in certain circumstances, a departure from a custody framework that had previously been understood to favour federally chartered or more traditional custodial structures. The proposal carries a 60-day comment period and remains at the proposal stage, not yet finalized.
This development represents an expansion of the regulatory toolset addressing crypto-asset consumer and investor protection beyond the anti-fraud enforcement posture that has characterized much of the SEC's activity in this space historically. Rather than relying solely on Securities Act and Exchange Act anti-fraud provisions applied after the fact, the proposed custody framework would establish forward-looking structural requirements governing how crypto assets held on behalf of advisory clients and regulated funds are safeguarded, addressing custody and segregation risk directly rather than through post-hoc enforcement.
The practical significance of permitting state trust companies as qualified custodians in certain circumstances is that it would broaden the population of entities eligible to provide custodial services to the regulated-adviser market, potentially increasing competition and optionality in a custody market that has to date been served by a comparatively narrow set of providers. Because the rule remains proposed rather than final, the specific circumstances under which a state trust company would qualify, and the conditions attached to that qualification, remain to be settled in the final rule text.
Outlook
The proposal's 60-day comment period means the custody framework will not reach final-rule status within this cycle. The key open question going forward is whether the final rule preserves the state-trust-company qualified-custodian pathway as proposed, narrows it, or expands it, and what specific conditions will attach to that eligibility.
1 earlier distinct update(s)
Consumer Protection
The most material consumer-protection development this cycle is the SEC's proposed custody framework, Release No. 2026-100, issued October 1, 2026, which would permit conditional self-custody of crypto assets by registered investment advisers and would qualify state trust companies as permitted custodians under federal rules. This proposal replaces a 2025 staff no-action letter and follows the withdrawal of a broader 2023 custody proposal, marking the third iteration of the SEC's attempt to settle how registered advisers and funds may hold crypto assets on behalf of clients. The proposal is significant because custody has been one of the more persistent points of regulatory ambiguity for crypto-adjacent investment products, and a finalized rule would give advisers and fund sponsors a clearer compliance pathway than the current patchwork of no-action relief and informal guidance.
Beyond custody, no bespoke crypto market-abuse regime exists in the United States distinct from general securities and commodities antifraud authority; market manipulation and fraud involving crypto assets continue to be addressed under the Investment Advisers Act, Investment Company Act, and general antifraud provisions of the securities and commodities laws rather than under crypto-specific market-conduct rules. This is a structural gap rather than a new development this cycle, but it remains the operative baseline against which the custody proposal should be read: custody rules address where and how assets are held, not how trading in those assets is policed.
Outlook
The SEC's custody proposal is mid-rulemaking and not yet final; its ultimate scope — particularly which state trust companies qualify as permitted custodians and under what conditions self-custody by an adviser would be permitted — will determine how much operational flexibility registered advisers gain relative to the status quo. Whether a bespoke crypto market-abuse regime distinct from general antifraud authority will emerge is not addressed by any pending rulemaking identified this cycle and remains an open question.
Sources and findings (3)
- T4 · The BlockNew York State Department of Financial Services (NYDFS) — BitLicense-regulated firms to meet strict capital-reserve, cybersecurity, compliance and consumer-protection standards, including custody controlsretrieved M4bindingin forcenew
- T4 · The BlockGENIUS Act (Pub. L. 119-27) — permitted payment stablecoin issuers to publish monthly reserve disclosures giving holders visibility into backing assets, once the statute becomes operativeretrieved M4bindingenacted not yet effectivenew
- T4 · The BlockSEC Division of Trading and Markets — guidance for broker-dealers on custody of 'crypto asset securities,' addressing consumer-facing custody standards for tokenized securitiesretrieved M3bindingin forcenew