CFTC carves narrow regulatory safe harbor for crypto wallets

The Commodity Futures Trading Commission issued guidance that creates a narrow regulatory safe harbor for developers of noncustodial crypto wallets. The document says certain software providers that never control users’ private keys or handle customer funds may not have to register as commodity brokers or similar CFTC-regulated entities.

The guidance explains which wallet-related activities could trigger obligations under the Commodity Exchange Act and outlines a limited set of operational practices that make custody or brokerage treatment less likely. It targets developers of noncustodial wallets and software tools that let users store and transfer digital assets without turning over key control to a third party.

The commission listed factors it will consider when assessing whether a firm must register. Those factors include whether the developer can move user assets, holds or commingles customer funds, or provides services that resemble order execution, clearing or margin lending. Firms that only provide software, do not exercise control over user keys and do not custody funds are less likely to be treated as registrants.

The guidance is conditional and narrow. Firms that follow the described behaviors and operational safeguards may avoid classification that triggers registration and ongoing supervision, but the document does not create an automatic exemption. The commission retained authority to pursue enforcement in cases of fraud, manipulation or other misconduct. Hybrid models that combine software with optional custodial services will be evaluated on their specific facts and circumstances.

Legal teams and wallet developers are expected to review code, user agreements and operating practices to align with the factors the commission identified. The agency highlighted documentation and transparency as important elements, including clear disclosures to users about who controls keys and how assets are handled.

The guidance does not affect enforcement or rulemaking by other regulators. Firms should consider parallel obligations under state laws and actions by agencies that oversee securities, banking and consumer protection. Developers that offer custodial services, lending, staking on behalf of customers or derivatives-like products should assume they may face registration requirements and supervision.

Wallets are broadly categorized as custodial, where a company controls private keys for users, or noncustodial, where users retain sole control. After several industry failures involving commingled funds, federal agencies have increased scrutiny of where custody begins and what activities constitute financial intermediation. The CFTC’s document attempts to draw clearer lines for software providers that seek to remain on the noncustodial side of that distinction.