SEC Digital Asset Exchange Rules in 2026: What You Need to Do Now

The regulatory grey zone for crypto in the United States is closing. In its 2026 Unified Regulatory Agenda, the SEC placed three crypto-focused rulemakings at the Proposed Rule Stage, each carrying a target date of July 2026.

If your firm issues, custodies, or trades digital assets, these proposals will reshape your obligations. The firms that prepare now will move fast when the text lands. The firms that wait will be reading 200 pages of rule text under a comment clock.

This post breaks down what is coming, what is already in force, and the specific steps compliance teams should take before the proposals become final.

The three rules on the SEC's 2026 agenda

The SEC's June 2026 strategic plan named digital-asset rulemaking a top priority, and the regulatory agenda backs that up with three distinct entries. All three are logged as targets, not final filings, so treat the July 2026 dates as planning signals rather than compliance deadlines.

Here is what each one covers:

1. Crypto Assets Rule (RIN 3235-AN38). Addresses the offer and sale of digital assets, potentially including certain exemptions and safe harbors. This is the rule that could finally give issuers a defined path to market.

2. Broker-Dealer Requirements (RIN 3235-AN48). Would amend the net capital rule (15c3-1), the customer-protection rule (15c3-3), and recordkeeping rules 17a-3 and 17a-4, specifically for how they apply to crypto assets. Any firm that holds or clears digital assets for clients would face updated capital buffers and custody standards.

3. Crypto Market Structure Amendments (RIN 3235-AN49). Would amend Exchange Act rules governing crypto trading on alternative trading systems and national securities exchanges. The SEC framed the goal as providing clear rules of the road for the issuance, custody, and trading of crypto assets.

None of these has published proposed text yet. That gap is your window to get your house in order.

The classification shift you cannot ignore

Before you can decide which rules apply to a token, you have to know what that token is. In 2026 the SEC finally gave firms a framework for that question.

On March 17, 2026, the SEC issued an interpretive release introducing a five-category token taxonomy. It sorts digital assets into digital commodities, collectibles, tools, stablecoins, and securities.

That same period brought a joint SEC-CFTC interpretation classifying 16 major cryptocurrencies, including Bitcoin and Ethereum, as digital commodities. The practical effect is significant: the security-versus-commodity line that drove years of enforcement now has an interpretive anchor.

For compliance teams, classification is no longer a philosophical debate. It is a documented control. You need a defensible, evidenced rationale for how you categorise every asset you list, custody, or trade #cryptocompliance.

What is already in force

It is easy to fixate on the proposals and miss the guidance that already governs your operations. Two items matter most right now.

Custody under Rule 15c3-3. On December 17, 2025, the SEC Division of Trading and Markets issued a statement on how Rule 15c3-3 applies to broker-dealers custodying crypto asset securities. The Division stated it will not object to a broker-dealer deeming itself to have physical possession of a crypto asset security in the circumstances the statement describes.

Those circumstances hinge on control of private keys. The broker-dealer must maintain policies, procedures, and controls that are reasonably designed and consistent with industry best practices to protect keys from theft, loss, or unauthorized access.

Net capital and control locations. Earlier guidance from May 2025 confirmed that broker-dealers may custody non-security crypto assets, may treat crypto asset securities as held at a permissible control location under Rule 15c3-3(c), and may hold crypto as proprietary positions for net capital purposes, subject to applicable haircuts and other limitations.

Translation: the custody path exists, but it comes with evidence obligations. If you cannot show your key-management controls in writing, you cannot rely on the relief.

The relief that changed the front-end game

On April 13, 2026, SEC staff declared a conditional no-action position for what it called Covered User Interface Providers. These are entities that provide front-end interfaces for crypto trading but do not necessarily execute trades themselves.

Under the position, those providers may operate without full broker-dealer registration, provided they meet the stated conditions. If your product is a trading interface rather than an execution venue, this changes your registration analysis, but only if you can document that you meet every condition.

Where CLARITY fits

Congress is moving in parallel with the SEC. The CLARITY Act, which is expected to establish additional custody standards for digital commodity intermediaries, passed the House and awaits Senate approval as of mid-2026.

Do not build your programme around a bill that has not passed. Do build it so that a new statutory custody standard can be slotted in without a rebuild. Modular controls beat monolithic ones every time the law changes.

The SEC-CFTC coordination on classification is the tell here. When two agencies align on how 16 major assets are categorised, the direction of travel is set even before any single rule is final.

Firms that read that signal early are already re-papering their custody agreements and updating their control narratives. Firms waiting for perfect certainty will be doing the same work later, under more pressure, with less time.

Your pre-rule readiness checklist

You cannot comply with proposed text that does not exist yet. You can, however, close the gaps that every version of these rules will expect you to have closed. Here is where to focus.

• Build a token classification register. Document, for each asset, which of the five categories it falls into and the reasoning behind it. Attach the interpretive release and any legal analysis as evidence.

• Map your custody controls to Rule 15c3-3. Write down exactly how you achieve physical possession or control, how you protect private keys, and how you test those controls. Reference the December 2025 statement directly.

• Stress-test your net capital position. If you hold crypto as proprietary positions, model the haircuts and confirm you stay above your minimum under stress.

• Re-run your registration analysis. If any part of your business touches front-end interfaces, assess whether the Covered User Interface Provider conditions apply to you and evidence each one.

• Tighten recordkeeping now. Rules 17a-3 and 17a-4 are in the crosshairs of RIN 3235-AN48. Clean, immutable, retrievable records are the cheapest insurance you can buy before a rule tightens.

• Assign an owner and a review cadence. Someone on the team should own the SEC agenda and review it monthly, so a July proposal does not surprise you in August.

Ready to see what an auto-generated compliance tracker looks like for your organization?

🚀 RegentComply.ai generates audit-ready evidence packs mapped to your specific regulatory framework, in hours rather than weeks. Request a demo

Why evidence, not intent, is the deliverable

Regulators do not grade you on how compliant you feel. They grade you on what you can show. Every item on the checklist above turns into a question an examiner can ask, and each question needs an evidenced answer.

That is the part firms consistently underestimate. Building the control is one job. Proving the control worked, on a given date, with a named owner and a documented test, is a second and larger job.

Spreadsheets and shared drives cannot carry that weight across three overlapping rulemakings. When a proposal moves to final, you want to map new requirements onto existing evidence, not start from a blank sheet.

The next 90 days

The proposals are targeted for July 2026, which means comment periods and final rules will follow through the rest of the year and into 2027. Use the gap deliberately.

1. This month: stand up the token classification register and the custody control map.

2. Next month: complete the registration re-analysis and the net capital stress test.

3. Ongoing: assign the SEC agenda to a named owner and review it every month until each rule is final.

Firms that treat this period as preparation time will absorb the final rules as adjustments. Firms that treat it as quiet time will absorb them as emergencies.

The rules of the road are being written. Get your evidence in order before the road opens #GRC #digitalassets.

Ready to see what an auto-generated compliance tracker looks like for your organization?

🚀 RegentComply.ai generates audit-ready evidence packs mapped to your specific regulatory framework, in hours rather than weeks. Request a demo

GRC consultants: stop rebuilding compliance frameworks from scratch.

🟢 consult.regentcomply.ai lets you auto-generate client-ready compliance trackers for any framework, without going through your client's IT or procurement. Sign up directly and deliver faster, more structured engagements from day one.