Why No Bank — or Anyone Else — Can Lawfully Hold Crypto in Custody For Now
An analysis of the structural failures in U.S. crypto regulation, where regulators, banks, and trust companies simulate custody without legal title, asset classification, or enforceable rights.
This is a personal, civic submission. I am a private individual. I am not a lawyer, do not give advice, and assert no institutional authority. What follows is a structured concern based on public disclosures and regulatory filings, expressed under rights of speech and public scrutiny. Please do not act on anything I say without getting your own professional advise.
The Uniform Law Commission (ULC) voted to approve a uniform model state law for the regulation of virtual-currency business activity in 2017. The Uniform Regulation of Virtual-Currency Businesses Act (URVCBA) provides a statutory framework for the regulation of companies engaging in “virtual-currency business activity.”
It was a more innocent time when we must have been more forgiving of ‘stupid.’ Take this masterpiece from DUKE LAW JOURNAL Vol. 65:569 in 2015. Really only a legal academic is capable of framing issues like this:
“Once upon a time, commodities—shells, grain, and metals—operated as primitive monetary technologies. Among these early prototypes, gold reigned supreme because, of all the naturally occurring elements, its physical properties made it most suitable to perform the functions of money. Despite its first-mover advantage of more than 4000 years, gold was eventually disrupted [...]”
Do they even know what technology means? You could say that what makes a gold bar is a technology. But certainly not gold itself. And you cannot write like this unless your job is writing Christmas greetings at Disneyland.
And the writer then says what he hopes to achieve by writing:
“Elevate the legal community's understanding of blockchain and ultimately inform policymakers and practitioners as they consider different regulatory regimes.”
Oh no. I may have found patient zero.
“In short, the blockchain is a ‘trustless’ technology [...] it can enable more efficient ownership verification and can enable more efficient title transfer.”
Maybe, maybe not. What our dear lawyer forgets is that ownership and transfer are not trustless. If I have ownership of a financial asset, I must have bought it to have ownership. And that, for instance, requires establishing — in some shape or form — that somebody and I agreed to sell me the asset against something. And that what I bought, in some shape or form, means something — and whatever it means, it stays like this.
If any of this requires enforcement that blockchain cannot meaningfully provide, then you don't have trustless — you have law. Of course, we can program almost everything. But in all cases, you need enforcement beyond what the EVM ever could do — which was just a deterministic algorithm.
Back to the real lawyers. The whimsical Uniform Law Commission (ULC) website has an enactment kit, and it tells us:
“The Supplemental Act is also designed to solve several problems that exist under current secured transactions law. For example, [it] treats virtual currency as a ‘financial asset,’ a user’s virtual-currency account with a business is classified as ‘investment property,’ and the virtual currency business is classified as a ‘securities intermediary’ under the UCC.”
So what? Since when does US securities law care what I call something? That would have been the question to ask.
But they ask themselves — which triggers this answer:
“If the virtual-currency business expressly agrees with users to treat virtual currency over which the virtual-currency business has control for the users as financial assets credited to the users’ securities accounts, then the adverse claim cut-off rule of Article 8 would apply.”
Blah blah blah — and suddenly we have security entitlement in crypto, and we’ve established an ability to govern ownership and title transfer of crypto under the law, and everyone is rich and protected.
But unfortunately, they don’t know the law that well. And perhaps that wasn’t a great start to begin with.
They claim to “not regulate virtual currency”:
“The URVCBA regulates neither distributed ledger technology nor virtual currency.”
This is quite a big statement if you know even a tiny bit about the law — like, for instance, me, who is not a lawyer.
Say you want to buy travel insurance and your trip is riding a pony through Iceland. You call your insurance agent and say, “I will go on holiday and so I wish to purchase travel insurance.” And they say, “No problem. Mode of transportation, please!” And you say: “Riding on a pony.” And the agent says: “Hmm.”
Hmm?
“Well, I can insure flights, or going by train, car, or bus — but not going by pony.” And you say: “Why not?” And he says: “Hmm. I don’t know why, but there is no box to check that says pony. And that means I can’t sell insurance. Maybe that means we don’t insure pony rides.”
If the object (virtual currency or pony) is not recognized or defined as something you can legally own, then the law looks at crypto when you have a problem and says:
“I told you we don’t insure pony rides. And I can’t help you if the pony turns out to be a donkey. Get yourself a different pony. Bye!”
The UCC 8 generally is used for governing securities entitlements particular for indirect holdings i.e. can invest holds the securities investment vis an intermediary who in turn connects to a CSD like DTC. It governs a relationship of customer who is the owner of the property and the intermediary who is merely a bailee,
The term "financial asset" is wider than securities to give the ability to add more assets classes if they would be brought into the clearing system DTC. It does not, however, extend to commodity contracts. And to assure that UCC 8 says financial asset and UCC9 says ‘investment property" is that it can apply the provisions of Article 9 to financial assets and to commodities futures.
Article 8 is not about defining property — it's about codifying how intermediaries treat accounts. It never pretends to vest ownership of the underlying asset. Instead:
The “security entitlement” is a contractual package of rights against the intermediary.
It is not a title, not equity, and not a claim to any specific asset unless the intermediary complies.
The regime’s “finality” is the finality of accounting entries, not ownership of real objects.
The CFTC Does Not Make or Enforce Property Law
Declaring an asset a “commodity” does not grant it the legal attributes of ownership under state law. The CFTC may say Bitcoin is a commodity — but that does not create a title system, nor does it enable custody under trust, bailment, or security entitlement rules. If the law does not recognize ponies, the CFTC can say it’s a commodity all day long — but it still cannot regulate a pony swap without that legal foundation.
If the CFTC forgets this — as it often does — it will find out when it tries to enforce any rulebook violation about a pony swap when courts must ask: what exactly was the object, and what legal basis grounds its use? Hint: mining a lump of physical gold is different to non-physical stuff! The same logic applies in criminal law: the perfect crime is not one where there’s reasonable doubt about whether you did it, but one where there's the slightest uncertainty about what law you broke — because you can’t be charged without what for. The same principle applies to things and rights.
Bitcoin is not a traditional ledger:
There is no canonical, enforceable “book” that defines ownership.
There is no authority that maintains or authenticates the ledger.
There is no legal registry akin to land titles or shareholder registries.
It has no legal recognition of what it records — only a set of network rules about what counts as valid state.
Bitcoin is a distributed transaction validator — not a ledger, not a record of rights, and not a title system.
If Bitcoin is not a ledger but a rule-based process that generates an ephemeral ledger-like state, then it is legally fatal to claims of ownership, custody, or title — and therefore, a futures contract on Bitcoin traded under CFTC jurisdiction is structurally impossible and legally incoherent
“Control” = Convenience for Creditors
The concept of control originates under UCC8 to determine when a creditor can act without the debtor’s consent — that’s it. This was driven by market operational needs (e.g., repo markets), not property theory.
Control under UCC8 is about:
“You can enforce your interest without further action by the debtor.”
It requires:
The agreement of the intermediary
That you can sell or transfer without additional consent
Banking people talk about control from at least two different perspectives:
Control over collateral — so that nobody can benefit from it other than the secured party (myself). That’s UCC Article 8.
Control over intermediated securities — via legal authority to instruct an agent so that nobody can benefit from it other than the investor (not myself). That’s not UCC Article 8.
If the assets in question are securities held in an indirect holding system via CSDs, then these two forms of control have similarities. They are not identical — they flow through shared pipes but also have a clear logical separation. A custodian can perform both functions, sometimes even at the same time. It depends, as always.
The U.S. has no federal custody law. Custody in the U.S. is state-law driven.
There is no unified federal statute that defines or governs custody of financial or digital assets. Instead, state law (such as New York Banking Law) determines what qualifies as "custody" — including duties of segregation, safekeeping, and title recognition.
It also includes asset management obligations, etc. What matters is the type of asset being held — and that’s not just a question of the asset itself, but whether the asset is regulated. For example, custody of a Coca-Cola share for a 1940 Act fund creates a different set of obligations than custody of the same share held for an individual.
Federal regulators like the SEC, CFTC, or OCC oversee the conduct of regulated entities (e.g. broker-dealers, FCMs, banks), but they do not define the legal nature of custody across all asset classes.
Where federal law does speak (e.g. SEC's Rule 15c3-3 for broker-dealers), it builds on top of state property and contract law, not in replacement.
In blockchain systems, "control" is a technical function, not a legal one. It refers to the ability to execute transactions — specifically, the exclusive access to private keys associated with a blockchain address or wallet. Whoever possesses the private key can transfer, move, or otherwise use the associated digital asset. This is sometimes described as de facto control, but not de jure ownership.
Blockchain Systems Are Structurally Incapable of Fulfilling Legal Custody Obligations
Blockchains are structurally unable to satisfy the requirements of lawful custody. There is no mechanism to associate a keyholder with legal title, trust, or bailment status. No real-world identity can be established over on-chain artifacts without substantial new law. You may have a private key and be able to sign transactions — and you can demonstrate this while riding a pony — but a pony is not a plane or a car, and nothing you can say changes that, regardless of how “decentralized” your pony’s journey may be.
Because what matters is not that you’ve found a novel way to traverse Iceland without sitting in a car or bus. What matters is that I can verify what you claim against something I can trust. If you allege that the pony was stolen, I have no way of knowing if there ever was a pony, or if it was your pony, or if Ingibjörg is missing one of hers. But if you rent a car, I can verify — independently of your testimony — whether the vehicle existed, and whether it was lawfully in your possession.
Because the law, like the blockchain, requires trust-minimized verification and proof. And unless the blockchain allows the law to find what it needs, pony travel insurance won’t be on offer.
The SEC’s 2023 consultation on custody included this observation:
“What has also developed, however, is a practice by custodians in which the custodian lists assets for which it does not accept custodial liability on a client’s account statement on an accommodation basis only; the custodian does not attest to the holdings of or transactions in those investments or take steps to ensure that the investments are safeguarded appropriately (‘accommodation reporting’). The custodian merely reports the holdings or transactions as reported to it by the adviser. This practice undermines the account statement’s integrity and utility in helping to verify that the client owns the assets and they have not been stolen or misappropriated. We view the integrity of custodial account statements to be critical to the safeguarding of client assets. Clients should be able to review their account statements to evaluate the legitimacy of any movement within their account, whether it is a trade, a payment, or a fee withdrawal.”
This is one of the most incoherent statements ever made about custody. It suggests a legal doctrine whereby recording something on an account can turn an Icelandic pony into a real car. Since the law has no such power of transubstantiation, the SEC’s stated view about the “required integrity” or “legitimacy” of statements amounts to this: a regulatory obligation to break real law.
If an asset type does not allow a custodian to offer custody services, then the custodian is obliged to transparently inform clients where that is so. What the SEC is advocating amounts to no-fault liability regime — in which a custodian would effectively underwrite insurance policies that state: whatever happens, whoever is at fault, the custodian bank will pay up.
Since no lawful custodian would ever make such a promise, the observed market practice of “accommodation reporting” is the only legitimate and law-abiding action. The SEC’s objection to it is not a mark of regulatory insight — it is evidence of a fundamental misunderstanding of what integrity means.
To claim regulation of the use of a thing, the law must first be able to recognize the thing — its ontological and legal status.
If the legal system does not:
recognize virtual currency as property (because there is no title, no res, no enforceable entitlement),
or as money (because it lacks sovereign backing, legal tender status, or convertibility obligations),
or as a security (unless so designated under Howey or Reves tests),
then no regulatory regime can meaningfully claim to regulate its use in any legal sense.
This is the core incoherence of the URVCBA and similar frameworks: they attempt to regulate function (exchange, storage, transfer) without grounding in form (what kind of legal object is being exchanged, stored, or transferred). That is:
You cannot regulate the use of a legal nullity.
If the asset is not legally recognized — or is ontologically incoherent as an object of law — then claims to regulate its use are simulations. The act says: "we don’t regulate the currency, we regulate its use." But if there is no recognized currency, then what is being used?
It’s like regulating the speed limits of magic ponies. There are no magic ponies. And thus whatever you do, you won’t get in trouble with the law for speeding riding on an actual magic pony. However, saying you have a magic pony can be risky depending on why, when, and where you say that.
The URVCBA (Uniform Regulation of Virtual-Currency Businesses Act) is not about defining ownership, assets, or custody in terms of property law. It targets the business activity involving virtual currency — notably transfer, exchange, and storage — and tries to do so with a licensing and compliance framework, not by altering underlying legal doctrines like property rights or UCC-based entitlements.
Key Incoherencies of URVCBA:
No Asset Definition: URVCBA does not — and cannot — define what virtual currency is in a legal sense beyond "representation of value." It doesn't provide the ontological or proprietary basis necessary for title, ownership, or custody.
Business Regulation ≠ Property Law: Licensing a firm to "store" virtual currency does not create the legal foundation for what custody means under banking law or trust law. The act says: if you do this kind of business, follow these rules — but it never establishes what the "this" actually is at a legal-thing level.
Custody Simulacrum: By enabling licensed entities to claim they "hold" or "custody" digital assets without defining holding as a legal relation to an asset, the act enables misrepresentation. What looks like custody becomes de facto IOU tracking — especially when the assets are lent, staked, pooled, or commingled.
No Title Integrity: If virtual currency lacks the attributes of a UCC Article 8 "financial asset" (which includes control, segregation, and transferability under a securities entitlement regime), then no entitlement can attach — even if the parties claim to opt-in.
Regulatory Paper Trail ≠ Legal Substrate: The DFS, SEC, and others have constructed a network of licensing, exemptive orders, and no-action letters — but without anchoring these acts in a defensible legal ontology of the asset, they are regulating behavior while the object remains undefined. That gap is fatal.
Courts struggle with this because there is no physical object to seize, no legal title to adjudicate and no registry the state can rely on. So we pretend that possession by private key is good enough—unless there's fraud or theft, at which point the legal system collapses into ad hoc rulings. And replacing factual control for entitlement makes theft a legal way to ownership.
The entire structure is self-referencing and meaningless without a custody asset a custodian could hold in custody using UCC 8.
It pretends custody exists without custody, entitlements without assets, obligations without ownership. And the regulators’ act of licensing these structures becomes a form of complicity — not oversight.
Gemini was accused of offering unregistered securities where assets were lent, not held in custody. Gemini operates under a NY trust license implying compliance with banking law — yet offered products lacking core custody features (segregation, control, entitlement).
NYDFS issued a consent order highlighting deficiencies in recordkeeping, monitoring, and contractual clarity — yet permitted the same platform to continue representing custody services. Similar misalignments appear in Coinbase’s staking programs and in other fund structures relying on qualified custodians to fulfill fiduciary mandates.
Custody under law requires:
Title or entitlement
Control
Safekeeping duty
However, what is marketed as “custody” in crypto cannot meet the legal duty for custody. It:
Transfers assets to third parties (e.g., borrowers)
Relies on UCC opt-in structures designed for claims, not property
Avoids legal consequences through contractual disclaimers and semantic ambiguity
It creates a real dilemma:
When a Bank or Trust Company Offers Custody, they are contractually and statutorily binding themselves to applicable law e.g., Gemini to New York Banking Law (or equivalent), under the terms of their charter or license.
Gemini is a New York Trust Company.
Its license compels it to meet:
NY Banking Law fiduciary and safekeeping duties
UCC-compliant legal structures for asset control and segregation
Common law expectations of bailment, not mere recording
The NY DFS Issues the Licenses
It defines the conditions of operation for trust companies under NY Banking Law.
DFS Enforces Fiduciary Standards
It is legally mandated to supervise:
Fiduciary conduct
Safekeeping
Recordkeeping
Asset segregation
Prudential operations
DFS Reviewed and Approved Gemini’s Custody Model
It reviewed documents, systems, contractual forms, and public claims.
Gemini cannot meet these because:
Crypto is not an asset under UCC 8
Gemini does not hold legal title
“Ownership” is simulated via UCC opt-in without legal object
There is no mechanism for enforcement of title or exclusion
Therefore: no legal custody ever existed, despite public claims, customer contracts, and regulatory approval.
DFS Licensed Gemini Knowing This
DFS did not merely fail to detect — it structured and approved the custody regime.
DFS is bound by its supervisory mandate to enforce New York Banking Law.
DFS allowed the issuance of custody representations that are legally impossible.
DFS did not intervene despite being aware (e.g., through 2024 settlement and ongoing oversight).
Gemini is unable to honour any fiduciary obligations claiming to offer custody over an asset that doesn’t meet the requirements of a financial asset needed for custody.
DFS is in breach of supervisory enforcement duty.
The system has created legal simulation of ownership under state authority.
That is a concern not just of Gemini but of the supervisory regime — an illusion of legal structure under the banner of regulation if it would amount to
Misrepresentation in financial services (NY Gen Bus L. §349)
Breach of fiduciary duty under banking law
Fraud in the inducement of contract
Supervisory negligence or dereliction of duty
If DFS knowingly permitted:
The public offering of custody functions
Without legally sufficient custody structure
Under a regime that compels statutory adherence
Then DFS is complicit in this arrangement and jointly liable in any harm resulting from it. When a fund manager puts the funds of their investors at risk by participating in this market and if these structures collapse, the harm will not be limited to investors:
Auditors will have signed off on nonexistent control
Fund managers will have breached fiduciary duty without realizing it
Regulators will have approved what they were mandated to prevent
This article is a record that the risks were publicly visible.
Every crypto custodian claiming UCC 8 coverage without holding:
a real financial asset, or
a securities account backed by such an asset,
is structurally non-compliant. They pretend to offer legal custody with no enforceable ownership, and regulators endorse a legal impossibility. So that claim cannot be true.
It’s a Legal Breach, Not Just a Logical One:
Custody is not just a private promise — it's a public legal role:
It must be enforceable in bankruptcy
It must survive the intermediary
It must resist third-party claims
It must deliver asset, not just value
None of these are satisfied by UCC 8 entitlement alone.
So when Gemini, Coinbase, or BlackRock ETFs base custody structures on UCC 8 logic without a qualifying object, they are not just using the wrong legal form —
They are offering a structure that cannot meet the definition of custody under any law — and this is enabled by DFS, SEC, and others.
The law is regulating behavior about something it does not recognize as being.
This is the paradox:
Custody is a legal relationship to a recognized object.
If the object doesn’t exist (legally), then the custody is fiction.
The law commission (ULC) asserts:
“We don’t define the asset. We regulate what people do around it.”
But that’s like saying:
“We don’t recognize magic ponies. But here are the rules for how to rent one.”
This is not just incoherent. It’s structurally invalid.
Regulation of conduct cannot substitute for recognition of thing.
Legal obligations cannot be anchored to a non-object.
Custody cannot exist without an asset to custody.
Getting licensed to provide custody of digital assets if there is no legal concept of “custody” for those digital assets under property or trust law, then the license is invalid in substance, even if procedurally issued. No regulator can license the provision of a service that lacks legal possibility. To do so is to engage in simulation, misrepresentation, and dereliction of statutory duty.
A publicly listed company, with U.S. Securities and Exchange Commission oversight, offering services that cannot exist under the law the SEC is mandated to enforce.
Anyone relying on such entities as a qualified custodian — including:
Pension funds
Asset managers
Public company treasurers
ETF sponsors
...may be exposed to liability for:
Fiduciary breach
Improper asset handling
False accounting assumptions about asset segregation and control
Auditors may have signed off on structures that do not meet legal custody standards.
Each piece, examined in isolation, appears technically sound:
UCC Article 8 allows financial asset “opt-in” status — but only creates relational claims, not title.
Trust licenses imply fiduciary standards — but cannot override the absence of a legal asset.
Bank charters suggest enforceability — but don’t grant power to create property out of code.
Regulatory frameworks claim to oversee “activity” — but avoid defining what the activity is of.