This is our published view
The bench stands behind it
For your facts, in confidence, put the question to the firm.
The bench stands behind it
The position
What a VASP may do with a client’s virtual assets is fixed by the activity it is licensed to carry on, not by what it tells the client.
What a VASP may do with a client’s virtual assets is fixed by the activity it is licensed to carry on, not by what it tells the client. The activities sit on a spectrum. At one end, a custodian may do almost nothing with the assets: it may not rehypothecate them, and it may not even ask the client to consent to rehypothecation, because the rule bars the request as well as the act (Custody Services Rulebook, Rule III.B.2, current as at 1 July 2026). The assets are not the custodian’s to begin with, and it must keep control of them at all times (Rule III.B.1 and III.B.4). At the other end, an activity such as lending is built around deploying the client’s assets, so using them is the point of the service, not a departure from it. Between the two, use is permitted but gated: a manager may deal with client assets only on terms the client has expressly agreed.
So the first question is never what the firm promised. It is which activity this is, and where on the spectrum it sits. A firm cannot promise its way to the protected end if its licence places it at the permissive one, and, as the custody rule shows, at the protected end it cannot be argued down from it either. The position is set by the activity, and the activity is set by the licence.
One move cuts across the spectrum, and it is the one that decides what a client actually recovers if the firm fails. A single contractual term, that the assets are held “on behalf of” the client rather than belonging to the client, can shift the client’s legal position from owner of specific assets to creditor of the firm, whichever activity is involved. Where that term operates, the spectrum stops describing the client’s real exposure, and Section V takes it apart against the custody rule that says the opposite.
This article walks the spectrum from the protected end to the permissive one, then returns to that contractual term and to what the whole picture means when a firm goes down.
Custody is the protected end of the spectrum, and its protection has two halves: the assets stay the client’s, and the firm cannot deal with them as its own. Both are set as Rules.
The assets a custodian holds are not the custodian’s. Virtual assets held under Custody Services are not the VASP’s own assets, nor liabilities owed by it (Custody Services Rulebook, Rule III.B.1, current as at 1 July 2026). They are not the firm’s property, and the act of taking them into custody does not make them so.
The firm also cannot use them. A custodian may not authorise or permit the rehypothecation of assets it holds, and the prohibition applies “regardless of whether they have obtained a client’s consent” (Rule III.B.2). The rule reaches past the act to the request: the custodian may not even seek the client’s consent to rehypothecation in the course of providing custody. This is what fixes the custody end rather than leaving it to negotiation. Elsewhere on the spectrum, consent is the mechanism that unlocks use of client assets. Here consent is removed as a mechanism. A client cannot sign the protection away, and a firm may not ask them to.
Two further rules keep the assets identifiable and reachable. The custodian must segregate each client’s assets in separate wallets holding that client’s assets only (Rule III.B.3), and must maintain control of every asset at all times (Rule III.B.4). Segregation means a client’s holding is not pooled into an omnibus balance from which a shortfall is hard to attribute. Control, in a virtual-asset setting, means holding the keys, and holding them throughout, rather than passing that ability to a third party.
The separation is structural as well as operational. A custodian must be a separate legal entity from any group member carrying on other VA activities, with the single exception that it may also be licensed for VA Transfer and Settlement subject to strict internal segregation (Rules III.B.5 and III.B.6), and it must run custody through a dedicated team walled off from the firm’s other operations (Rule III.B.7). The assets are held away from the parts of the business that take risk.
The ban is on rehypothecation, and within its scope it is absolute. It is not a ban on every dealing a custodian may offer. The rulebook separately provides for staking from custody and for collateral wallet services, each in its own Part and under its own conditions (Custody Services Rulebook, Parts IV and V). Those are defined services with their own rules, not a loosening of III.B.2, and they are their own subject. The point that governs here is narrower and firmer: the one thing a custodian can never do, with or without consent, is rehypothecate.
So the protected end gives the client the strongest position the framework offers. The assets stay theirs, segregated and controlled, and the no-rehypothecation rule cannot be bargained away. Every other position on the spectrum is defined by how far it moves from this one. Section III takes the first step away, into the activity where use becomes possible once the client agrees to it.
VA management is the consent-gated middle of the spectrum. The act custody forbids outright, rehypothecation, a manager may carry out, but only on the client’s authority: the rule bars a manager from rehypothecating client assets “unless they have explicit prior consent from the client” (VA Management and Investment Services Rulebook, Rule II.D.1, current as at 1 July 2026).
The contrast with custody is exact, and it is the clearest illustration of how the spectrum works. Same act, and the rules diverge on the single question of consent. In custody, consent is irrelevant and may not even be sought (Section II). In management, consent is the very thing that permits the act. The protection that custody fixes by rule, management leaves to the client to grant or withhold. Consent, removed as a mechanism at the protected end, is the mechanism here.
The gate is not confined to rehypothecation. A manager may use a client’s assets, or exercise any authority over them, only on valid authorisation or specific instructions from the client (Rule II.D.2). The manager’s power over the assets is therefore derived rather than inherent. It comes from what the client has authorised, and it runs no further. A manager who deals with a client’s assets without that authority is in breach of the rule, whatever the merit of its investment judgement.
There is also a default about whose assets these remain while the manager works with them. Assets a manager uses in connection with the service are, by default, held on behalf of the client, unless the Client Agreement expressly states otherwise (Rule II.D.3). The two halves have to be read together. The default is protective: used or not, the assets are treated as the client’s. But it is a default, and a term in the Client Agreement can displace it. That single reversal is where the client’s real position is decided, and Section V takes it up in full, because it is the point at which the spectrum stops describing what the client actually holds.
So management sits a defined and visible step from custody. The protections are real, but they are contingent: on the client’s consent for use, and on the Client Agreement’s silence for ownership, where custody’s protections are fixed by rule and cannot be signed away. The next step folds consent into the act of engaging the service, because on the activities it covers, using or moving the client’s assets is the service being bought. That is Section IV.
On the two activities at this end of the spectrum, using or moving the client’s assets is not a departure from the service. It is the service. So the question stops being whether the firm may touch the assets and becomes on what terms it may, and what the client is left exposed to when it does.
Transfer and settlement is the nearer of the two to the middle. A firm providing it may not sell, lend, rehypothecate, pledge, convert or otherwise use or encumber a client’s assets for the purpose of a transmission, transfer or settlement, except where the client has given explicit consent as part of the service (VA Transfer and Settlement Services Rulebook, Rule II.B.1, current as at 1 July 2026). What separates this from management is not the presence of consent but its timing. The consent is taken once, up front, as the client engages the service, and it is not sought transfer by transfer unless the client asks for that, so long as each movement stays within what was consented to (Rule II.B.2). Consent here is intrinsic: at the outset the client authorises the movement the service exists to perform, and the firm may then perform it within that scope. The protection is the scope. A firm that moves beyond what the client agreed to is outside the rule.
Lending is the permissive end, and here use is the whole point. Assets a lending firm holds may be used only on the terms of the lending service, and those terms must be set out in the Client Agreement (Lending and Borrowing Services Rulebook, Rule II.A.4). The rules are candid about what that means for the client. The firm must make clients fully aware when assets cannot be withdrawn, and where they can be, must complete withdrawal requests within twenty-four hours, subject to factors outside its control (Rule II.A.3); and it must run continuous counterparty due diligence so that client assets are not exposed to undue counterparty risk (Rule II.A.6). Both rules concede the same thing. Once assets are lent, the client may not be able to get them back on demand, and their return depends on borrowers performing. Lending moves the client from holding an asset to holding a claim.
Both activities carry the same default about whose assets these remain while in use. Assets a firm uses in connection with lending are held on behalf of the client unless the Client Agreement expressly states otherwise (Lending, Rule II.A.5), in wording identical to the management rule met in Section III (VA Management, Rule II.D.3). The same protective default, and the same single term that can switch it off, sit in both rulebooks word for word.
So the further along the spectrum a firm sits, the more the client’s protection rests on two things the custody end had removed from play: the terms written into the Client Agreement, and the firm’s own solvency and diligence. The one term that runs through both management and lending, and decides what the client actually holds, is Section V.
The most consequential term in this whole area is not in a rulebook. It is in the Client Agreement. Two of the rulebooks set a protective default about whose assets the client’s remain, and then allow one contractual term to reverse it. Which way that term runs decides what the client legally holds, and it can override where the activity sits on the spectrum.
The default is the same in both places, word for word. Assets a firm uses in connection with VA management, or with lending, are “held on behalf of the client unless the Client Agreement expressly states otherwise” (VA Management and Investment Services Rulebook, Rule II.D.3; Lending and Borrowing Services Rulebook, Rule II.A.5, current as at 1 July 2026). While that default holds, the assets are treated as the client’s even as they are used: the client’s assets, in the firm’s hands, not the firm’s own.
The reversal is the whole purpose of the clause. If the Client Agreement expressly states otherwise, the default switches off, and the client stops being treated as the owner of identifiable assets. What the client holds instead is a claim against the firm for value, rather than the assets themselves. That consequence is not a sentence the rulebook writes out; it is the ordinary meaning of assets no longer being held on the client’s behalf, and it is flagged here as an inference from the rule, not a further rule. The direction, though, is not in doubt: the term moves the client from owning assets to being owed them.
Custody runs the opposite way, and the contrast is exact. Assets held under custody are “not depository liabilities or assets of the VASP” (Custody Services Rulebook, Rule III.B.1), and that rule allows no contractual carve-out. In custody the client’s ownership is fixed by rule; in management and lending it is a default that a contract term can remove. The same framework therefore protects the client’s ownership absolutely in one activity and conditionally in two others, and the condition is a single line in an agreement.
This is why the term is easy to miss and important to find. It is a carve-out to a protective-sounding default, and it can sit inside a Client Agreement that otherwise reads reassuringly. Its presence, not the name of the activity or the tone of the marketing, decides whether the client owns assets or is owed them. The first question about any such arrangement is therefore not what the service is called, but what the Client Agreement says about whose assets these are.
How far the reversal carries when the firm actually fails, whether the client’s claim is held apart from the firm’s estate or ranks alongside general creditors, is a separate question, and it turns on how the framework’s ring-fence meets federal insolvency law. The rulebooks set the default and permit its reversal; what an insolvency does with the result is the subject of the companion article “If my VASP fails, where does my crypto sit?”. This section identifies the mechanism and its direction, and stops at the framework’s edge.
So the spectrum describes what a firm may do with client assets; this term describes what the client is left holding when it does. Section VI puts the two together on the question that matters most, what a client actually recovers if the firm goes down.
Every distinction in this article converges on one practical question: if the firm fails, what does the client get back? The article has already produced the two variables that answer it. Where the activity sits on the spectrum sets how far the firm may have used the assets. Whether the held-on-behalf default has been reversed sets whether the client owns assets or is owed value. Together they decide the client’s position, and they weigh far more than whether the firm is “regulated.”
Custody gives the client the strongest position the framework offers. The assets are not the firm’s (Rule III.B.1), they are segregated client by client (Rule III.B.3), the firm must keep control of them throughout (Rule III.B.4), and they can never be rehypothecated (Rule III.B.2). Taken together, the rules position a custody client’s holdings as identifiable and held apart from the firm’s own estate. That is the strongest recovery footing the framework provides, though what an insolvency ultimately does with assets held on that footing is a separate question, and Section VII marks where it sits.
The position weakens as the activity moves along the spectrum, even while the held-on-behalf default still holds. A manager or a transfer firm working within that default handles the client’s assets rather than its own, but the assets are in use or in motion, and the client’s practical control over them is reduced to that extent. Lending goes furthest. The assets are deployed by design, and the firm’s own rules require it to warn clients that they may not be able to withdraw (Rule II.A.3) and to run continuous counterparty due diligence because client assets carry counterparty risk (Rule II.A.6). Before any failure, a lending client’s position has already shifted from holding an asset to holding a claim that depends on borrowers performing.
The single variable that can override all of this is the held-on-behalf reversal. Wherever the Client Agreement has switched the default off, the client is owed value rather than holding assets, and recovery then depends on the firm’s own solvency. That is the weakest position of the set, and it can sit beneath any of the permissive activities, carried by one line of an agreement rather than by the name of the service.
What gives these differences their edge is that they are differences of control and of reversibility. Once a client’s assets have been used, moved or lent, the client can no longer simply take them back; recovery runs through the firm, or through a counterparty the firm chose. In custody, control is held for the client by rule. At the permissive end, control is given up as part of the service, and control given up is hard to recover: an asset passed to a counterparty returns only if that counterparty performs, which is precisely the exposure a failing firm tends to crystallise.
So being VARA-licensed does not, by itself, tell a client or a counterparty what it stands to recover. Two firms, both licensed and both regulated, can leave a client in opposite positions. The questions that decide the outcome are narrower: which activity is this firm licensed to carry on, and what does its Client Agreement say about whose assets these are. The licence describes the regime. The activity and the agreement describe the exposure.
How much of the client’s position survives the firm’s actual insolvency, whether assets held on the client’s behalf are genuinely kept out of the estate or are drawn back into it, is the question this article has deliberately stopped short of. Section VII marks that edge, and hands it to the companion article “If my VASP fails, where does my crypto sit?”.
What is settled here is the spectrum and its fixed points. What a firm may do with a client’s virtual assets is set by the activity it is licensed to carry on and, at the permissive end, by one term in the Client Agreement. The custody ban anchors the protected end and cannot be consented around; the consent gate in management, the intrinsic consent in transfer and settlement, and the use-by-design of lending mark the steps away from it; and the held-on-behalf default, identical in the management and lending rulebooks, sets whose assets these remain until a contract term says otherwise. Each of these rules was read at source for this article, and the four rulebooks it rests on all sit on their 19 June 2025 version.
What is open is the question the article has stopped short of at every turn, and it is the one that matters most in a failure: what an insolvency actually does with the client’s position. The rulebooks set the default and permit its reversal, but they do not by themselves decide whether assets held on a client’s behalf are genuinely kept out of the firm’s estate, or how a client who is owed value ranks against other creditors. That turns on how the framework’s ring-fence meets federal insolvency law, and it is the subject of the companion article “If my VASP fails, where does my crypto sit?”. This piece establishes what the client holds going into a failure; it does not decide what the client recovers coming out of one.
There is also a currency point particular to this area. The single most consequential variable, the held-on-behalf reversal, does not live in a rulebook. It lives in the Client Agreement. Checking the current rulebook is therefore necessary but not sufficient: the client’s real position is visible only in the specific agreement, which can differ from firm to firm and change without any rulebook being amended. And the rulebooks themselves are versioned independently and remain open to amendment, so the spectrum’s fixed points, settled as they are today, are worth confirming at the point they are relied on.
So the throughline holds to the end. The licence names the regime. The activity and the Client Agreement name the exposure. And the last question, what an insolvency makes of it, is the open edge this article hands to the next.
For your facts, in confidence, put the question to the firm.
The bench stands behind it