Questions

A wallet is a program or a device that holds the keys that move a person’s tokens. The tokens are entries on a public ledger called a chain. The wallet holds a secret number, the private key, and uses it to sign orders to move those entries. Whoever has the key can move the tokens; nobody else can, and no bank can reverse a move. A client may hold a wallet on a phone, on a small device made for the purpose, or at an exchange that keeps the keys for them. Ketju reads the ledger, so it needs only the wallet’s address.

An address is the public account number on a chain where a wallet receives tokens. On Ethereum it is 42 characters that start with 0x. Anyone can look up an address on a public explorer and see its balance and every transfer in or out. It does not show a name, but it can be linked to a person by an exchange record or a past payment. Sharing an address is safe in the sense that no one can take tokens with it. An address on one family of chains does not always exist on another, so a client must say which chain they mean. An advisor asks a client for addresses only.

A chain is the shared ledger that records who owns which tokens. Thousands of computers keep copies and agree on each new batch of changes by fixed rules, so no one firm keeps the books. Ethereum, Solana, and Bitcoin are chains. A token lives on one chain. The same name can exist on several, such as USDC on Ethereum and USDC on Solana, and each copy is a separate token with its own balance. For that reason Ketju lists the chain on every holding. The chain sets the fees, the speed, and the risks that come from the network itself.

A token is an entry on a chain that says an address owns an amount of something. The something can be a coin native to the chain, such as ETH, a dollar stand-in such as USDC, a share in a fund, or a claim on a loan. A program called a smart contract keeps the list of who owns how much, and it applies the rules of that token. The rules differ. Some tokens can be frozen by their maker and some cannot. Some pay interest and some do not. Because the contract holds the rules, a reader of the contract can see what the holder can and cannot do. Ketju calls the token the client holds the asset.

A stablecoin is a token that its maker promises to keep at one dollar. The risk depends on what stands behind the promise. Fiat-backed coins such as USDC and USDT keep cash and short-term US Treasury bills and promise to swap one token for one dollar. Crypto-backed coins such as Sky’s USDS lock other tokens as collateral. Synthetic coins such as USDe hold crypto against an offsetting short position instead of dollars. Algorithmic coins with no reserve failed in 2022. When a client says they hold dollars on-chain, the first question is which of these they hold, and who the issuer is.

In self-custody the client holds the keys, and at an exchange the exchange holds them. With self-custody, only the client can move the tokens, and nobody can recover them if the key is lost. At an exchange such as Coinbase or Kraken, the client has an account balance and a legal claim on the exchange. The tokens sit in wallets the exchange controls. If the exchange fails, the client becomes a creditor. This happened when FTX Trading filed for Chapter 11 bankruptcy in Delaware on November 11, 2022. Ketju records which of the two applies on the Custody line of each holding.

Sources: Kroll FTX case site (restructuring.ra.kroll.com/ftx, read 2026-10-16); Husch Blackwell alert on the FTX filing (huschblackwell.com/newsandinsights/ftx-files-for-bankruptcy-industry-contagion-possible, read 2026-10-16)

A seed phrase is a list of 12 or 24 ordinary words that can rebuild every key in a wallet. Whoever knows the words controls all the tokens, on every chain that wallet uses. The wallet shows the words once, when it is set up, and the owner is meant to write them on paper and store them safely. Phishing messages that ask for the words are a common way retail holders lose funds. The words work from any device, so a thief who has them needs nothing else.

An advisor never asks for a seed phrase because anyone who holds it can take every token and nothing can undo the transfer. An advisor also has no need for one: the ledger is public, so the address alone shows a client’s holdings. Holding a client’s phrase would also put the advisor in control of the client’s assets, which can bring the SEC custody rule and its duties into play. A client who is asked for their words by anyone claiming to be support, an advisor, or a platform should refuse. Ketju asks only for addresses.

A coin is the native money of a chain, and a token is any other asset recorded on a chain by a contract. ETH is the coin of Ethereum, SOL of Solana, and BTC of Bitcoin. USDC and stETH are tokens. The distinction matters in two ways. A coin is needed to pay the fees for any move on its chain. A token depends on its contract and its issuer, so it carries risks the coin does not. ETH has no issuer. USDC has one, Circle, and Circle can freeze it.

Sources: Circle USDC terms (circle.com/legal/usdc-terms, read 2026-10-16)

What backs a stablecoin depends on its kind, and the kind sets the risk. A fiat-backed coin is backed by cash and short-term Treasury bills held by the issuer. A crypto-backed coin, such as Sky’s USDS, is backed by tokens locked in a contract worth more than the coins issued. A synthetic coin, such as Ethena’s USDe, is backed by crypto held against an offsetting short position. An algorithmic coin has no reserve and relies on a market incentive. Terra’s UST was this kind. It lost its peg starting May 7, 2022 and fell far below one dollar within days. Each memo names the backing and the issuer who reports it.

Sources: Harvard Law School Forum on Corporate Governance, “Anatomy of a Run: The Terra Luna Crash” (corpgov.law.harvard.edu/2023/05/22/anatomy-of-a-run-the-terra-luna-crash, read 2026-10-16); Ethena documentation, underlying derivatives (docs.ethena.fi/protocol-overview/underlying-derivatives.md, read 2026-10-16); Circle transparency page (circle.com/transparency, read 2026-10-16)

USDC and USDT are both dollar tokens, but different companies issue them and the terms differ. Circle issues USDC and Tether issues USDT. Circle says USDC is backed by cash and cash equivalents. It says it holds most of them in the Circle Reserve Fund, a government money market fund, and the rest as cash at large banks. A Big Four accounting firm gives monthly assurance. Tether says its tokens are backed by its reserves. Both companies can freeze tokens at any address. Only approved customers redeem directly with either issuer, and everyone else sells on a market. USDC fell to about 87 cents in March 2023 when Circle disclosed $3.3 billion of its reserves sat at Silicon Valley Bank.

Sources: Circle transparency page (circle.com/transparency, read 2026-10-16); Circle USDC terms (circle.com/legal/usdc-terms, read 2026-10-16); Tether terms (tether.to/en/legal, read 2026-10-16); Tether transparency page (tether.to/en/transparency, read 2026-10-16); Decrypt on the SVB shortfall (decrypt.co/123224, read 2026-10-16)

A synthetic dollar is a token worth about one dollar because of an offsetting trade. Ethena’s USDe is backed by crypto and an offsetting short derivatives position, which Ethena opens when a user mints USDe and closes when a user redeems. If the crypto falls, the short gains, so the pair holds its dollar value. Ethena’s documents say the yield comes from funding rates on basis trades, lending revenue, and rewards on tokenized real-world assets. The risks are the venues that hold the positions and a fast crash. On October 10, 2025, USDe traded as low as 65 cents on Binance while it stayed near one dollar on-chain. Binance paid $283 million in compensation.

Sources: Ethena documentation (docs.ethena.fi/protocol-overview/underlying-derivatives.md and docs.ethena.fi/overview/ethena-overview.md, read 2026-10-16); The Block, Binance compensation (theblock.co/post/374295/binance-pays-283-million-in-compensation-following-fridays-depegs-covering-user-losses, read 2026-10-16); 21Shares (21shares.com/research/why-did-ethenas-stablecoin-remain-stable-onchain-but-depegged-on-binance, read 2026-10-16)

A wrapped asset is a token on one chain that stands for an asset on another chain. WBTC is a token on Ethereum that stands for bitcoin. A custodian holds the real bitcoin, and a network of merchants mints one WBTC for each bitcoin deposited and burns one when a holder redeems. Retail holders generally cannot mint or burn directly. The client therefore holds a claim on the custodian and the redemption process; the bitcoin itself stays with the custodian. If the custodian fails, is hacked, or changes hands, the token can lose its link to bitcoin. Ketju records the custodian of the underlying coins as a risk separate from Ethereum’s. Native bitcoin has no issuer.

Sources: Hiro, “A Developer’s Guide to Wrapped Bitcoin” (hiro.so/blog/a-developers-guide-to-wrapped-bitcoin-wbtc, read 2026-10-16); secondary sources agree on the merchant model, and the current custodian arrangement is described in the WBTC memo

A staked asset is a coin locked to help run a network, and the extra token is a receipt for it. Ethereum pays rewards to holders who lock 32 ETH per validator. Lido pools many holders’ ETH, runs the validators through node operators, and gives each depositor stETH. The balance of stETH grows as rewards arrive. Its wrapped form, wstETH, keeps a fixed count and rises in price instead. A holder cannot take back ETH on demand. They either sell the receipt on a market or file a withdrawal request, which enters a first-in, first-out queue and returns ETH when it is filled. The receipt can trade below one ETH when many holders want to sell at once.

Sources: Lido docs, withdrawal queue (docs.lido.fi/contracts/withdrawal-queue-erc721, read 2026-10-16); Lido help center FAQ (help.lido.fi/en/articles/7858292-faq-ethereum-withdrawals, read 2026-10-16)

A tokenized Treasury fund is a fund that holds short-term US Treasury assets and records its shares as tokens. The holder owns a share of the fund, which owns the bills. BlackRock’s BUIDL uses Securitize as administrator and transfer agent. Buyers must be qualified purchasers, and Securitize adds each approved wallet to a list. A transfer to a wallet not on the list fails. Ondo’s own OUSG page says OUSG is sold only to accredited investors and qualified purchasers who have onboarded to its Qualified-Access Funds. Redemption goes through the issuer on the issuer’s schedule. Each file states the terms for one program.

Sources: Ondo OUSG page (ondo.finance/ousg, read 2026-10-16); BUIDL structure from secondary summaries of the offering terms (eco.com/support/en/articles/15254013-buidl-deep-dive-2026 and coinpaprika.com/education/blackrock-buidl-fund-what-it-is-and-how-it-works, read 2026-10-16); BlackRock and Securitize offering documents were not retrieved, so no minimum is stated here

A tokenized stock is a token that tracks a share’s price, and the holder owns whatever the issuer’s terms say they own. That can be a claim on the issuer, a claim on shares a custodian holds, or a record of shares at a transfer agent. The three differ in what happens on a dividend, on a vote, and on the issuer’s failure. A claim on the issuer ranks with the issuer’s other creditors. Shares held in the holder’s name do not. The client should ask who the issuer is, where the shares sit, and whether the token can be redeemed for them. Ketju reads those terms and writes them in the file.

A depeg is when a token that should trade at a fixed price trades below it. A stablecoin that sells for 95 cents has depegged. A small gap on one market can clear in minutes, because traders buy the cheap token and redeem it for a dollar with the issuer. A gap that does not clear means holders doubt the backing or the redemption. The cause may be a bank failure, as with USDC in March 2023, a collapse of the design, as with Terra in May 2022, or a loss at a manager, as with Stream Finance’s xUSD in November 2025. Holders who sell during a depeg lock in the loss, and holders who wait carry the risk that the price never returns.

Sources: Decrypt, Stream Finance xUSD (decrypt.co/347285, read 2026-10-16); Decrypt, USDC and SVB (decrypt.co/123224, read 2026-10-16); Harvard Law School Forum on Corporate Governance, Terra (corpgov.law.harvard.edu/2023/05/22/anatomy-of-a-run-the-terra-luna-crash, read 2026-10-16)

A failed stablecoin leaves holders with whatever the issuer’s remaining assets or a later process pay. Terra’s UST lost its peg in May 2022, and with its sister token LUNA it erased tens of billions of dollars in value within days. Published estimates run from about $40 billion to $60 billion, depending on the date and method. UST had no reserve to pay holders. In early November 2025, Stream Finance disclosed that an outside fund manager had lost about $93 million. Stream stopped deposits and withdrawals, and xUSD fell to between 26 and 51 cents depending on the source and the hour. Other lenders had accepted xUSD as collateral and took losses. The sources we read report no recovery plan for Stream holders.

Sources: Decrypt, “Stream Finance Stablecoin Plunges 77%” (decrypt.co/347285, read 2026-10-16); Cointelegraph (cointelegraph.com/news/stream-finance-pauses-platform-finds-93m-loss, read 2026-10-16); Richmond Fed, “Why Stablecoins Fail” (richmondfed.org/publications/research/economic_brief/2022/eb_22-24, read 2026-10-16); Coinpaprika Terra post-mortem (coinpaprika.com/education/terra-luna-collapse, read 2026-10-16)

Aave is a lending program on Ethereum and other chains, and a client who deposits is lending to borrowers through it. The client supplies a token such as USDC to a pool and gets a receipt token back. The receipt grows in value as borrowers pay interest. Borrowers must post more collateral than they borrow, so the pool is covered if prices fall. The client can withdraw at any time, if the pool has cash. If borrowers have taken nearly all of it, withdrawals wait until loans are repaid or new deposits arrive. The loss risks are a bug in the code, bad debt after a price crash, and a faulty price feed.

Sources: Aave V3 overview (aave.com/docs/aave-v3/overview, read 2026-10-16, title and summary only)

Lido is a staking program, and a client who stakes with it deposits ETH and receives stETH. Lido sends the ETH to validators run by a set of node operators. The network pays rewards, and Lido keeps 10 percent of them as a fee. Half of the fee goes to the node operators and half to the Lido treasury. The Lido DAO sets the fee and can change it by vote. The client holds a token that can be sold at any time but may not trade at exactly one ETH. The risks are a bug in Lido’s contracts, a penalty on its validators, and a vote that changes the rules. The withdrawal queue has its own answer on this page.

Sources: Lido docs, tokens integration guide (docs.lido.fi/guides/lido-tokens-integration-guide, read 2026-10-16)

Morpho is a lending program, and a client who deposits usually puts money in a vault that a curator manages. Morpho’s documents define the curator as the risk configuration role: the curator configures adapters, caps, and fees, and most of those actions wait behind a timelock. The vault contracts are immutable, so upgrades cannot change their core guarantees after deployment. The client still carries the risk of the curator’s choices. A curator who allows a weak collateral token can expose depositors to it, and the timelock gives depositors time to withdraw before a change takes effect. Ketju reviews the vault, the curator, and the markets it uses.

Sources: Morpho docs, vaults (docs.morpho.org/learn/concepts/vault, read 2026-10-16)

Sky is the program formerly named MakerDAO, and a client who uses it either holds its dollar tokens or locks assets to borrow them. The program issues DAI and USDS against collateral, and token holders vote on the rules, including which collateral it accepts. The rebrand from Maker to Sky took place in 2024. The client’s risks are the quality of the collateral, the vote of token holders, and the contract code. Whether the issuer can freeze the token differs between DAI and USDS, and each memo states the answer for the token it covers. A client who only holds the token carries the same risks without using the borrowing function.

Every yield comes from someone paying it, and the first task is to find who. A lending program pays depositors interest that borrowers pay. A staking program pays the network’s rewards. A Treasury fund pays what the US government pays on its bills. A synthetic dollar such as USDe pays what traders pay in funding rates on futures, along with lending and bond income, according to Ethena’s documents. Some programs pay in their own token, which only has value if new buyers keep arriving. If a yield cannot be traced to a borrower, a network, a bond, or a trade, it may be paid out of the money of later depositors. The memo for each protocol names the payer.

Sources: Ethena documentation (docs.ethena.fi/overview/ethena-overview.md, read 2026-10-16)

A yield far above the US Treasury rate means someone is paying for a risk, and the depositor holds that risk. When a program offers 20 percent on a dollar token, it either lends to borrowers who may not repay, borrows against deposits, pays in a token that may fall, or needs new deposits to pay old ones. Terra’s Anchor program paid about 20 percent on UST, and researchers found the yield subsidy grew unsustainable as deposits grew. Stream Finance’s xUSD relied on loops of borrowing. One analyst quoted by Decrypt counted about $170 million in assets against $530 million in borrowing.

Sources: Decrypt, Stream Finance (decrypt.co/347285, read 2026-10-16); Harvard Law School Forum on Corporate Governance, Terra and Anchor (corpgov.law.harvard.edu/2023/05/22/anatomy-of-a-run-the-terra-luna-crash, read 2026-10-16)

An admin key is the power to change how a contract works, held by a person, a company, or a group of signers. Many protocols let a key holder change settings, add or remove collateral, pause markets, or replace the code. Such a key can also be a vote by token holders, with a delay before the change takes effect. The mechanism and the delay vary. A key held by one person with no delay can change the rules overnight. A key held by a set of signers that acts only after a public wait gives holders time to withdraw. Ketju names who holds the key and how long the delay is, and it reports a change as Key changed.

An upgrade replaces the code that a contract runs while keeping its address and balances. The contract is split in two. A proxy holds the funds and the records, and it points to a second contract that holds the logic. The owner of the proxy can point it at new logic. This lets a team fix bugs, and it also lets the team change the rules for assets already deposited. The safeguard is who may order the upgrade and how long a notice must be given. Some contracts, such as Morpho’s vaults, are built so that upgrades cannot change their core guarantees. Each memo states which kind it is, and Ketju records changes under the heading Terms changed.

Sources: Morpho docs, vaults (docs.morpho.org/learn/concepts/vault, read 2026-10-16)

A pause is a switch that stops some or all actions in a contract, such as deposits, borrows, or withdrawals. Teams add it to stop an attack in progress. It also lets a team stop depositors from withdrawing. A pause on new deposits does not hurt a holder. A pause on withdrawals does, because the client cannot withdraw until the team lifts it. Stream Finance suspended all deposits and withdrawals in early November 2025 after the loss. Ketju records who can pause, what they can pause, and whether the holder can still withdraw during it. A change in that power appears in Changes.

Sources: Cointelegraph, Stream Finance (cointelegraph.com/news/stream-finance-pauses-platform-finds-93m-loss, read 2026-10-16)

A liquidation is the forced sale of a borrower’s collateral to repay a loan that has become too large for it. Aave defines health factor as the total collateral value, weighted by each asset’s liquidation threshold, divided by the total borrowed value. A position with a health factor below 1 can be liquidated. A liquidator repays part of the debt and takes collateral at a discount. In Aave V3 the close factor is 0.5, so one call covers at most half the debt, with larger shares allowed in some cases. A client who borrows against crypto sees the loan closed at a loss when prices fall quickly. For a depositor, the risk is bad debt, if collateral falls faster than liquidators can sell it.

Sources: Aave FAQ and V3 documentation (aave.com/faq and aave.com/docs/aave-v3/overview, read 2026-10-16, through a search summary); bonus and thresholds are set per reserve by governance

Protocols fail from design, from code, from a manager’s loss, or from an attacker, and each case has a date and a figure. Terra, May 2022: the UST design collapsed and erased tens of billions of dollars. Euler Finance, March 13, 2023: a flaw in the donation function let an attacker take about $197 million, and about $177 million came back later. Curve Finance, July 30, 2023: a bug in some Vyper compiler versions broke the reentrancy lock in several pools. Estimates of loss run from about $20 million net to $69 million gross. Stream Finance, early November 2025: an outside manager lost about $93 million and withdrawals stopped. Ketju checks the same four causes in every memo.

Sources: Swivel post-mortem of Euler (swivel.substack.com/p/post-mortem-euler-liquidation-vulnerability, read 2026-10-16); The Block, Euler funds returned (theblock.co/post/224705/euler-hacker-returns-funds, read 2026-10-16); REKT, Curve and Vyper (rekt.news/curve-vyper-rekt, read 2026-10-16); Nexus Mutual claims guide for Curve (forum.nexusmutual.io/t/curve-finance-loss-event-30-july-2023-claims-guide/1188, read 2026-10-16); Decrypt, Stream (decrypt.co/347285, read 2026-10-16); Harvard Law School Forum on Corporate Governance, Terra (corpgov.law.harvard.edu/2023/05/22/anatomy-of-a-run-the-terra-luna-crash, read 2026-10-16). Curve’s own post-mortem was not opened, and the loss total is disputed across sources

An audit is a review of a contract’s code by an outside security firm, and it does not mean the contract is safe. The firm reads the code, reports flaws, and the team fixes some of them. The report covers the code at one date. A later upgrade is new code. An audit does not cover bad economic design, a compromised admin key, or a faulty price feed. Press reports name Halborn and Certora among the firms that reviewed Euler Finance, and its CEO said it had ten audits in two years, yet it lost about $197 million on March 13, 2023. Ketju lists an audit among its sources and does not treat it as a verdict.

Sources: Binance Square / Cryptonews, “Euler Finance Hacked Despite 10 Audits in 2 Years, Says CEO” (cryptonews.net/news/security/20684043, read 2026-10-16); Sherlock on Euler (paragraph.com/@sherlock/zx327zgT0lMRPOId9Grb, read 2026-10-16); the list of firms comes from press reports, not from Euler’s own disclosure

Oracle risk is the risk that a protocol reads a wrong price. A lending program cannot see markets, so it reads a price from a feed called an oracle. If the feed is wrong, the program may allow loans that are not covered or liquidate loans that are. An attacker who can move the price on a thin market, even briefly, may borrow against inflated collateral and leave the program with bad debt. A protocol that values a stablecoin at a fixed one dollar keeps lending against it when it depegs. The memo names the feed and what happens if it fails.

Ethereum is the oldest and largest chain for tokens and lending programs, and it holds the most value. Solana is a faster, cheaper chain with its own coin SOL and its own tokens. Base is a chain run by Coinbase that records its transactions on Ethereum, so it settles through Ethereum. Arbitrum is another chain of that type, run by Offchain Labs, with a separate token and separate programs. Each holds its own copy of a token. A client’s USDC on Base is a different token from USDC on Ethereum. Ketju lists the chain for every holding, because the chain sets the fees, the speed, and some of the risks.

A bridge is a program that moves value between chains by locking a token on one and issuing a copy on the other. The copy is a claim on the locked original. If the bridge fails, the copy is worth less than the original, or nothing. Ronin lost about $625 million in March 2022 when an attacker took five of its nine validator keys. Wormhole lost about $320 million on February 2, 2022, when an attacker minted 120,000 wrapped ETH on Solana without a deposit. Nomad lost about $190 million on August 1, 2022, after an upgrade set a key variable to zero. Native USDC, which Circle issues on a chain, is not a bridged claim. Ketju’s file shows which one the client holds.

Sources: Halborn on Ronin (halborn.com/blog/post/explained-the-ronin-hack-march-2022, read 2026-10-16); CoinDesk on Ronin (coindesk.com/tech/2022/03/29/axie-infinitys-ronin-network-suffers-625m-exploit, read 2026-10-16); Spark research on Ronin, Wormhole, and Nomad (spark.money/research/stablecoin-bridge-hack-postmortem-lessons, read 2026-10-16); CoinMarketCap, worst hacks of 2022 (coinmarketcap.com/academy/article/the-worst-hacks-of-2022, read 2026-10-16)

Finality is the point after which a transaction cannot be reversed, and a reorg is the replacement of recent blocks with different ones. Before finality, a payment that looks complete can disappear. Ethereum divides time into 12-second slots and 32-slot epochs of 6.4 minutes. A block is finalized after two epochs of agreement, about 12.8 minutes. For an advisor, a balance read a few seconds after a transfer can differ from the final balance. Ketju reads each chain’s state and ties the file to a read date, so a reader can tell when a balance was taken.

Sources: ethereum.org, proof of stake (ethereum.org/en/developers/docs/consensus-mechanisms/pos, read 2026-10-16, for slot and epoch length); Dwellir, “Blockchain Finality Explained” (dwellir.com/blog/what-is-blockchain-finality, read 2026-10-16, for the two-epoch figure)

Gas is the fee paid in a chain’s native coin to have a transaction included. On Ethereum it is paid in ETH. On Solana it is paid in SOL. The fee rises when the chain is busy. A wallet that holds only a stablecoin and no native coin cannot move the stablecoin on a chain that charges fees in its own coin. This is a practical risk for a client who is told to sell in a hurry. Some newer chains work differently. Tempo, for example, has no native coin to read, and Ketju handles it as a flag on the chain table. Ketju notes the native coin of each chain.

A layer 2 chain is a chain that runs faster and cheaper than Ethereum and posts a record of its transactions to Ethereum. Base and Arbitrum are layer 2 chains. Their operators run a sequencer, a computer that orders the transactions. A withdrawal to Ethereum through Arbitrum’s official route waits out a dispute window that Arbitrum’s documents give as about 6.4 days, and in another passage as about seven. Faster withdrawals go through other bridges for a fee. The operator may hold upgrade keys that can change the rules, and Ketju records who holds them.

Sources: Arbitrum docs, L2 to L1 messaging (docs.arbitrum.io/how-arbitrum-works/deep-dives/l2-to-l1-messaging, read 2026-10-16)

A chain halt is when a chain stops producing blocks, and a client can lose the ability to move assets, though not usually the assets. Solana halted in September 2021 for about 17 hours after bot traffic flooded it. It halted again on February 6, 2024 for about five hours, until validators coordinated a restart. Sources count several more halts in 2022. During a halt nothing can be sold, redeemed, or used as loan collateral. A borrower whose loan needs a top-up cannot post it, and when the chain restarts a liquidation may run first. Ketju records the chain of every holding for this reason.

Sources: StatusGator, “Solana Outages: A History of Solana Mainnet Blockchain Failures” (statusgator.com/blog/solana-outage-history, read 2026-10-16); Crypto Briefing (cryptobriefing.com/solana-block-production-halts-validators-confirm-major-outage, read 2026-10-16). Durations differ by a few hours across sources

The holder of the keys controls the assets, so the first fact about any position is who that is. It can be the client, an exchange, a bank or broker-dealer, or a group of signers on a shared wallet. Ketju calls this the Custody line and shows it as one of the four layers. An address does not say who holds the keys. The advisor learns it from the client or from the statement. Each case differs in what happens at death, at theft, and at bankruptcy. The next answers take those cases in turn.

An exchange account is a contract between the client and the exchange, which gives the client a claim against the exchange. The exchange holds the tokens in its own wallets, and its terms say what happens in a failure. When FTX Trading filed for Chapter 11 on November 11, 2022, customers became creditors in a Delaware bankruptcy case, and they waited for payment through a court process. Some exchanges publish proof of reserves or segregate customer assets, and the terms differ by firm and country. Ketju records the exchange as the Custodian.

Sources: Kroll FTX case site (restructuring.ra.kroll.com/ftx, read 2026-10-16); PBWT bankruptcy update (pbwt.com/bankruptcy-update-blog/crypto-company-ftx-files-massive-bankruptcy-in-delaware, read 2026-10-16)

A qualified custodian is a firm that the SEC custody rule allows to hold client assets for an adviser who has custody. The rule, 17 CFR 275.206(4)-2, lists four kinds. They are a bank or an FDIC-insured savings association; a broker-dealer registered with the SEC that holds the assets in customer accounts; a registered futures commission merchant for certain client funds; and a foreign financial institution that keeps client assets apart from its own. Whether a given crypto custody firm falls into one of these depends on its charter and registration. An advisor with custody of client funds must use one. Ketju does not rule on whether a given firm qualifies; the firm’s counsel does.

Sources: 17 CFR 275.206(4)-2(d)(6) (law.cornell.edu/cfr/text/17/275.206(4)-2, read 2026-10-16)

A hardware wallet is a small device that stores a key and signs transactions inside it, so the key never touches a computer. A thief who gets onto the client’s computer or phone cannot copy the key. The device still depends on the seed phrase written at setup. A client who loses the device can rebuild the wallet from the phrase on a new one. A client who loses both, or who has the phrase stolen, loses the assets. A hardware wallet protects against remote theft but cannot stop a bad transaction the owner approves, such as a payment to a scammer’s address, because the device signs whatever the owner confirms.

A multisig is a wallet that needs several keys to approve a move, such as 3 of 5. No one key can move funds alone. Companies and protocols use them for treasuries and admin powers, and families can use them for estates. The risk then rests with the signers: if enough keys are lost, the funds are stuck, and if enough signers are tricked, the funds are taken. On February 21, 2025, about $1.5 billion in ETH left a Bybit cold wallet. Attackers had injected code into the Safe wallet interface and hid the transaction the signers approved. The FBI attributed the theft to North Korea’s TraderTraitor group.

Sources: Huntress threat library on Bybit (huntress.com/threat-library/data-breach/bybit-cryptocurrency-exchange-data-breach, read 2026-10-16); Picus Security on the FBI attribution (picussecurity.com/resource/blog/fbi-north-korean-lazarus-group-bybit-crypto-heist, read 2026-10-16); the FBI notice itself was not opened, and secondary sources give different dates for the attribution

If a client dies or loses the key and the seed phrase, no one can recover the tokens, because no company can reset a key on a chain. If the phrase exists, whoever has it can take the assets, whether an heir or a thief. A client with self-custody needs a written plan: where the phrase is stored, who may use it, and what the executor should do. A client at an exchange or a custodian has a normal estate process, with a death certificate and court papers. Advisors should record the Custody line for every holding so that the estate team knows which case applies.

Whoever holds a freeze power in the token’s contract or terms can stop an address from moving the token. Circle can block USDC addresses and freeze the funds, and Tether can blacklist addresses and freeze USDT. Issuers of tokenized funds can block transfers by taking a wallet off the approved list. A protocol may have a pause that stops withdrawals. An exchange or custodian can halt an account. ETH and BTC have no issuer and no such power. Ketju shows this as Nobody, Issuer, Protocol, or Custodian.

Sources: Circle USDC terms (circle.com/legal/usdc-terms, read 2026-10-16); Tether terms (tether.to/en/legal, read 2026-10-16)

Yes. Circle’s terms say Circle reserves the right to block the transfer of USDC to and from an address on chain, and to freeze associated USDC, temporarily or permanently. The terms also say Circle may be required by a legal order to freeze USDC. A holder whose address is blocked may forfeit rights tied to the USDC, including the ability to redeem it for dollars. The USDC stays at the address but cannot move. Redemption directly with Circle is open only to users with a Circle Mint account in good standing, and Circle may delay or decline a redemption it believes is suspicious. A client who holds USDC in a wallet therefore depends on Circle’s terms. Freeze: Issuer.

Sources: Circle USDC terms (circle.com/legal/usdc-terms, read 2026-10-16)

Yes. Tether’s terms let it blacklist any address that holds Tether tokens. They also let it freeze or confiscate funds in a user wallet as a sanction for prohibited use, and freeze tokens when a government directs it to. The terms also say Tether may either freeze a user’s tokens or seize and recover against them as a remedy. Redemption directly with Tether requires a verified customer, the right is personal to that customer, and fiat is paid only to a bank account in the customer’s name. Certain persons are excluded, and US persons are barred unless Tether agrees to an eligible contract participant. Everyone else sells USDT on a market, at the market price. Freeze: Issuer.

Sources: Tether terms and conditions (tether.to/en/legal, read 2026-10-16)

Tokenized fund issuers keep an allowlist of wallets, and only wallets on the list can receive the token. The issuer or its transfer agent adds a wallet after it checks that the buyer qualifies. A holder who tries to send the token to a wallet not on the list sees the transfer fail. Securitize does this for BUIDL, and Ondo says OUSG can be invested in, redeemed, transferred, or received only by buyers onboarded to its Qualified-Access Funds. An issuer can remove a wallet from the list, which is why the Freeze line for these funds reads Issuer. A client’s Eligibility reads Qualifies, Does not qualify, or Not stated against the issuer’s own terms.

Sources: Ondo OUSG page (ondo.finance/ousg, read 2026-10-16); BUIDL whitelist from secondary summaries (eco.com/support/en/articles/15254013-buidl-deep-dive-2026, read 2026-10-16)

How a client sells or redeems depends on the holding, and the memo lists the route. A coin such as ETH sells on an exchange within minutes. A stablecoin sells on a market at the market price, or redeems with its issuer only if the client is an approved customer. Staked ETH waits in a queue whose length depends on how many holders want to withdraw. A deposit in a lending program withdraws at once if the pool has cash. A tokenized fund redeems through its issuer on the issuer’s schedule. A token moved over Arbitrum’s official route waits about 6.4 days. In a failure, every one of these can stop, as Stream Finance’s withdrawals did in November 2025.

Sources: Lido docs, withdrawal queue (docs.lido.fi/contracts/withdrawal-queue-erc721, read 2026-10-16); Arbitrum docs (docs.arbitrum.io/how-arbitrum-works/deep-dives/l2-to-l1-messaging, read 2026-10-16); Circle USDC terms (circle.com/legal/usdc-terms, read 2026-10-16); Cointelegraph, Stream (cointelegraph.com/news/stream-finance-pauses-platform-finds-93m-loss, read 2026-10-16)

A withdrawal queue is a line in which withdrawal requests are filled in order as cash becomes available. Lido’s queue works this way for stETH. The holder asks to withdraw, receives a numbered claim as an unstETH token, and can collect ETH once the request is finalized. Lido’s documents say the wait depends on the size of the line, the rate at which Ethereum lets validators leave, and the ETH Lido holds in reserve. The amount paid is capped at the stETH sent in, so the holder earns no rewards while the request waits. The alternative is to sell stETH on a market, at the market price.

Sources: Lido docs, withdrawal queue (docs.lido.fi/contracts/withdrawal-queue-erc721, read 2026-10-16); Lido, how withdrawals work (lido.fi/how-lido-works/withdrawals, read 2026-10-16)

A redemption window is a set time when a fund will exchange tokens for cash. A token moves on a chain at any hour, but the fund behind it settles on its own schedule. A fund may accept requests only before a daily cutoff, pay on a later day, and pause during a bank holiday. A holder who needs cash on a weekend can sell the token on a market if one exists, at the market price, or wait for the issuer’s next window and receive the fund’s value. The two prices can differ in a crisis. Ketju records the window and the cutoff in each memo, as part of how a holder sells or redeems.

Sources: Ondo OUSG page, on redemption through its Qualified-Access Funds (ondo.finance/ousg, read 2026-10-16); the cutoff and settlement terms of each fund are set out in that fund’s file

A secondary market is a place where holders sell to other holders instead of to the issuer, and the price is set by buyers. On-chain markets pool tokens in a contract, and the price moves with the size of the trade. A large sale in a small pool moves the price against the seller. In a crisis the market price falls below the redemption value, as USDC did in March 2023, when it traded near 87 cents until US regulators guaranteed Silicon Valley Bank’s deposits. Ketju flags assets that are too small to sell at size and records the reason under Not approved.

Sources: Decrypt, USDC and SVB (decrypt.co/123224, read 2026-10-16); The Block, March 11, 2023 (theblock.co/news/business/2023-03-11-usdc-will-remain-redeemable-1-for-1-with-u-s-dollar-circle-says-219075, read 2026-10-16)

Approved means Ketju’s research found no limit on use of the asset or protocol. The finding covers the protocol or fund and says nothing about whether it suits a particular client. Ketju reads the contracts, the issuer’s terms, and the history of incidents, and it gives the verdict only when the evidence supports it. Ketju gives a verdict. The advisor makes the recommendation and decides whether the holding fits the client. Each approval carries a memo, a review date, and sources, so a reader can check the finding and see how old it is.

Approved with limits means the research supports use within the limits the memo sets. The limits can be a size, a chain, a form of the token, a condition on the freeze key, or a condition on how a holder sells or redeems. The approval does not cover a holding outside the limits. For example, a memo may approve a token on Ethereum and not its bridged copy on another chain, because the bridge adds a risk the memo did not review. The advisor reads the limits in the memo before relying on the verdict, and the client file lists them beside the holding.

Not approved means the asset or protocol is not on the approved list, and the reason is shown beside it. The reason may be a finding against it, a structure that is outside what Ketju approves, a size too small to sell at scale, or the choice of another provider over it. A standing fact, such as a size limit, comes with a condition under which Ketju will review it again. Not approved does not say the holding is a fraud; it says Ketju’s research does not support the holding, and it gives the reason.

Under review means the evidence does not yet settle the question. Ketju has opened the research and has not finished it. A holding under review has no approval and no finding against it, so the advisor has nothing from Ketju to rely on yet. Ketju lists what it is waiting for in the memo, such as a reply from an issuer or a document not yet published. A change from Under review to another verdict appears in Changes as Verdict changed, and the advisor is told if a client holds the asset.

A memo is Ketju’s written review of one protocol or fund, dated, with its sources. It states the verdict, the limits, what the asset is, who holds the controls, how a holder sells or redeems, and a change log. Memos are public in the Register, so an advisor can send one to a client. Ketju replaces a memo when it revises it and keeps the earlier issue in an archive with its date, so an error or a changed judgment can be read later. The advisor can show a reviewer which memo stood on the day of a decision.

Sources: Ketju Register (ketjuresearch.com/register); practice described in Ketju’s registry rules

A file states, for one tokenized program, what the holder owns, who may hold it, and who can freeze it, with sources. The client file is a dated, printable page for one client that lists each holding by asset, protocol, chain, and custody, with the verdict and the freeze line. It shows sources and read dates under each eligibility row and the changes in the last 90 days. The firm’s name is at the top. The advisor can print it for the firm’s records, and the terms it used appear as footnotes on the last page.

Sources: docs/VISION.md, “The surfaces” (Ketju internal spec, 2026-10-16)

The file is dated because holdings, terms, and verdicts change, and a file without a date cannot show what was known when. A compliance reviewer can see which facts the advisor had on the date of the decision. Sources are quoted so a reader can check the claim at the issuer, the filing, or the post-mortem. Ketju shows where each statement came from and when it was read, so an examiner can follow the same path to the same page.

Each day Ketju reads each client’s wallets and the sources behind each memo. It records a change only if a client holds the thing and something that matters moved. Ketju sends an alert when the verdict changes, when the issuer’s terms change so that an eligibility answer changes, when the freeze or admin key changes, when how a holder sells or redeems changes through a queue, a window, or a pause, or when Ketju corrects a fact in a memo. Ketju does not send an alert for price moves, for supply changes, or for a re-read that found nothing.

Sources: docs/VISION.md, “Changes” (Ketju internal spec, 2026-10-16)

It covers it to the extent your agreement with the client makes it part of your advice, and the duty itself can never be waived. The SEC’s fiduciary interpretation (Release IA-5248, effective July 12, 2019) says the duty “may not be waived, though it will apply in a manner that reflects the agreed-upon scope of the relationship.” The scope can be narrowed by contract, but only with full and fair disclosure and the client’s informed consent. For example, if you sell full financial planning, a client’s self-bought crypto is a fact you need, because the duty of care starts with a reasonable inquiry into the client’s financial situation, experience, and goals. If you manage one account and say so in writing, a holding outside it sits outside your advice. The SEC has not said how this applies to held-away crypto in particular. Counsel would read your agreement and Form ADV Part 2A first, and ask whether they match what you do.

Sources: SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16

You advise on a holding when you tell a client what to do with it or whether it is sound. That includes “keep it,” “sell it,” and “that one is fine.” Saying nothing is not advice, but if your agreement covers the topic, saying nothing can still fall short of the duty of care. IA-5248 also requires a reasonable investigation before you advise, so that your advice does not rest on “materially inaccurate or incomplete information.” Whether the asset is a security affects registration. The duty applies either way. The SEC and CFTC interpretation of March 17, 2026 (Release 33-11412, effective March 23, 2026) names Bitcoin, Ether, Solana, and thirteen other assets as “digital commodities.” Those are not securities. A firm that advises on securities owes the fiduciary duty across the whole relationship. A client’s non-security crypto therefore still falls inside the conversation you agreed to have.

Sources: SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16; SEC Release 33-11412, sec.gov/files/rules/interp/2026/33-11412.pdf, read 2026-10-16; SEC release page for S7-2026-09 (effective date), sec.gov/rules-regulations/2026/03/s7-2026-09, read 2026-10-16

It becomes your problem when something you do ties you to it. Four common triggers apply: you put it in a plan, a report, or a risk review; you bill on it; you know about it and your agreement covers the topic; or you gain any power to move it. The last one is a custody question. The Advisers Act custody rule, Rule 206(4)-2(d)(2), defines custody as “holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them.” A client who keeps every key alone, and who gives you only a public address to read, has given you no such authority. The first three triggers concern duty and turn on what your agreement says; only the last concerns custody. Write down which triggers apply to each client, so the file shows why you did or did not act.

Sources: 17 CFR 275.206(4)-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-2, read 2026-10-16; SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16

Document the holding, what you told the client, the facts behind it, and the client’s decision in the client’s words. Rule 204-2(a)(7) requires you to keep “originals of all written communications received and copies of all written communications sent” that relate to a recommendation or advice given. So the best record is a dated letter or email that names the asset, the protocol, the chain, and who holds the keys, says what you advised and why, and says the client chose otherwise. Add the date of the research you relied on and the date you will look again. Rule 204-2(e)(1) sets retention at five years from the end of the fiscal year of the last entry, the first two years in an appropriate office of the firm.

Sources: 17 CFR 275.204-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2, read 2026-10-16

No rule requires it. The SEC has not said that a client’s refusal of advice about a held-away holding ends the relationship. The duty is to give advice in the client’s best interest, to disclose conflicts, and to respect a client’s informed decision. Counsel would ask whether your firm’s own written procedures set a stricter term, such as a signed acknowledgment, removal of the holding from fee calculations, or a limit on what you will discuss. Rule 206(4)-7(a) requires written policies “reasonably designed to prevent violation” of the Act, so whatever term you adopt should be written down and applied the same way to every client.

Sources: SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16; 17 CFR 275.206(4)-7, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-7, read 2026-10-16

Expect the standard request list applied to crypto. The Division of Examinations’ risk alert of September 6, 2023 lists what examiners typically ask for. The list covers the compliance policies in effect, the tests you ran, annual review reports, the record of compliance exceptions, and the inventory of compliance risks and conflicts. It also covers advisory agreements, fees, powers of attorney, and the service providers you use. The Division’s Fiscal Year 2026 Examination Priorities for advisers name adherence to fiduciary standards, the effectiveness of compliance programs, and never-examined and recently registered advisers. The document does not mention crypto or digital assets. The Division says its priorities are not exhaustive, so absence from the list is not an exemption. Plan for questions on how you decided, what you knew, who held the keys, and what you told the client.

Sources: SEC Division of Examinations risk alert, Sept. 6, 2023, sec.gov/files/risk-alert-ia-risk-and-requesting-documents-090623.pdf, read 2026-10-16; SEC Division of Examinations, Fiscal Year 2026 Examination Priorities, sec.gov/files/2026-exam-priorities.pdf, read 2026-10-16

It should show what the holding is, what could go wrong with it, and what you did about it. At minimum: the asset, the protocol, the chain, and who holds the keys; the issuer and the terms for holders; who can freeze it or change its code; how the client sells or redeems and how long that takes; any limit on who may hold it; the finding you relied on with its date; the sources behind that finding with the dates read; what you told the client; and the client’s decision. IA-5248 says a reasonable belief that advice is in the client’s best interest “requires that an adviser conduct a reasonable investigation into the investment sufficient not to base its advice on materially inaccurate or incomplete information.” The file is your proof that you did it. Rule 206(4)-7 requires written policies, so the file should follow the process your policy names.

Sources: SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16; 17 CFR 275.206(4)-7, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-7, read 2026-10-16

No rule sets a number of days for a holding. Two schedules apply. The first is Rule 206(4)-7(b), which requires you to review your compliance policies and how well they work “no less frequently than annually.” The SEC staff’s risk alert of September 14, 2026 found firms that let that review run past twelve months, including first reviews at eighteen months after registration. It also says firms should consider interim reviews after significant compliance events, changes in business arrangements, and regulatory developments. The second is the monitoring frequency you promised the client. IA-5248 lets you set that by agreement, with full and fair disclosure and informed consent. Ketju’s methodology page says it re-examines approved memos at least quarterly, and that it reviews a memo again the week a review condition occurs.

Sources: 17 CFR 275.206(4)-7, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-7, read 2026-10-16; SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16; SEC Division of Examinations risk alert, Sept. 14, 2026, sec.gov/files/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426.pdf, read 2026-10-16; Ketju methodology, ketjuresearch.com/methodology, read 2026-10-16

Find the clients who hold it, decide whether your advice changes, tell them in writing if it does, and record both the change date and the date you acted. A change to Not approved, or a change in who holds a freeze key, may call for a conversation about how the client would sell or redeem. Check that first, because a queue or a redemption window sets how fast a client can leave. Rule 204-2(a)(7) requires you to keep the written communications that relate to your advice. An examiner can compare the date a change was published with the date you reacted. An examiner will weigh a short gap with a written note differently from a long gap with none. The September 14, 2026 risk alert also found firms whose annual reviews did not record incidents of non-compliance, so log a missed reaction as an exception.

Sources: 17 CFR 275.204-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2, read 2026-10-16; SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16; SEC Division of Examinations risk alert, Sept. 14, 2026, sec.gov/files/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426.pdf, read 2026-10-16

You may rely on research for facts, and you still own the decision and the duty. IA-5248 requires a reasonable investigation, so reliance means you read the finding, check that it covers the client’s holding, and record the date. The September 14, 2026 risk alert found policies that “delegated the execution of services and/or operations to others, but did not identify how the adviser should oversee” them. The SEC withdrew its outsourcing proposal (“Outsourcing by Investment Advisers”) on June 12, 2025, so the SEC has set no vendor test yet. Your procedures should say which research you use, what a finding lets you do, and who checks that the research still covers what clients hold. If a vendor handles client data, amended Regulation S-P requires that service providers notify you of a breach as soon as possible and no later than 72 hours after they learn of it.

Sources: SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16; SEC Division of Examinations risk alert, Sept. 14, 2026, sec.gov/files/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426.pdf, read 2026-10-16; Withdrawal of Proposed Regulatory Actions, Federal Register 2025-11110, federalregister.gov/documents/2025/06/17/2025-11110/withdrawal-of-proposed-regulatory-actions, read 2026-10-16; SEC Release 34-100155 (Regulation S-P), sec.gov/files/rules/final/2024/34-100155.pdf, read 2026-10-16

Keep them five years from the end of the fiscal year of the last entry, and keep the first two years in an appropriate office of the firm. That is Rule 204-2(e)(1) under the Advisers Act. Advertisements and other communications you send to more than ten people follow a related schedule: five years from the end of the fiscal year in which you last published or sent them, the first two in an office of the firm. A client file, a letter that records a refusal, a research report you relied on, and the annual compliance review all count. The September 14, 2026 risk alert found firms that wrote review reports but did not keep the supporting testing records or corrective-action notes. Keep your own copy of anything a vendor holds for you, because the retention duty is the firm’s. A state-registered adviser follows its state’s rule, so ask your state regulator for the period.

Sources: 17 CFR 275.204-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2, read 2026-10-16; SEC Division of Examinations risk alert, Sept. 14, 2026, sec.gov/files/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426.pdf, read 2026-10-16

No, if the client alone holds every key and you have no power to move anything. Rule 206(4)-2(d)(2) defines custody as “holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them.” On a chain, the question is who can sign. Whoever holds the private key, or any portion of it, can move the asset. The SEC’s October 1, 2026 custody proposal (Release IA-7023) defines self-custody as “possession of any portion of a client crypto asset’s key materials.” It also says that authority to obtain the keys without holding them is custody, but not self-custody. If you are one signer on a multisig, hold a key share, or keep a seed phrase on file, you have custody. If you only watch a public address, you do not.

Sources: 17 CFR 275.206(4)-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-2, read 2026-10-16; SEC Release IA-7023, sec.gov/files/rules/proposed/2026/ia-7023.pdf, read 2026-10-16

The SEC has not said. Its definition turns on holding assets or having authority to obtain them, and a public address gives neither. Anyone can read a public address on a chain explorer, and reading it shows balances and transfers but cannot sign anything. Counsel would apply the rule’s words to the access you actually have: if it cannot move or obtain an asset, it is not custody. The answer changes if the access can do more than read. An exchange API key that can withdraw, a signing permission, or an on-chain approval that lets your address spend a client’s tokens is authority to obtain possession. Before you accept any access, write down what it can and cannot do, and keep that note with the client file.

Sources: 17 CFR 275.206(4)-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-2, read 2026-10-16; SEC Release IA-7023, sec.gov/files/rules/proposed/2026/ia-7023.pdf, read 2026-10-16

The 2023 safeguarding proposal is withdrawn, and a new custody proposal replaced it on October 1, 2026. The SEC withdrew the 2023 proposal on June 12, 2025 (Advisers Act Release No. 6885). The new one is Release IA-7023 (File No. S7-2026-35), published in the Federal Register on October 6, 2026, with comments due December 7, 2026. It would redesignate the Advisers Act custody rule as proposed Rule 223-1, make state trust companies qualified custodians for crypto, add an adviser self-custody path with conditions, and add an inadvertent-custody exception. It proposes no transition period and does not address a client who holds their own wallet. It is a proposal, so today’s Rule 206(4)-2 still governs.

Sources: SEC Release IA-7023, sec.gov/files/rules/proposed/2026/ia-7023.pdf, read 2026-10-16; Withdrawal of Proposed Regulatory Actions, Federal Register 2025-11110, federalregister.gov/documents/2025/06/17/2025-11110/withdrawal-of-proposed-regulatory-actions, read 2026-10-16

Under the current rule, qualified custodians are banks and savings associations, registered broker-dealers, registered futures commission merchants, and certain foreign financial institutions. On September 30, 2025, the SEC’s Division of Investment Management issued a no-action letter on state trust companies. The staff said it would not recommend enforcement if an adviser treats a state trust company as a bank for crypto and the cash tied to those trades, on conditions. Before engaging it and each year after, the adviser needs a reasonable basis to believe that the state authorizes it to custody crypto and that it keeps written safeguarding policies. The adviser must review its audited GAAP financial statements and a recent SOC 1 or SOC 2 report. The custody agreement must bar lending or pledging without written consent and must segregate client assets. The adviser must disclose the material risks and determine the arrangement is in the client’s best interest. The October 2026 proposal would write a state trust company path into the rule.

Sources: SEC staff no-action letter, Simpson Thacher & Bartlett LLP (Sept. 30, 2025), sec.gov/rules-regulations/no-action-interpretive-exemptive-letters/division-investment-management-staff-no-action-interpretive-letters/simpsonthacherbartlett093025, read 2026-10-16; SEC Release IA-7023, sec.gov/files/rules/proposed/2026/ia-7023.pdf, read 2026-10-16

Read-only means the tool reads what a public chain already shows about an address and has no way to sign. A chain is a public ledger. Anyone can look up an address and see its tokens and transfers. Moving a token needs a signature made with a private key, so reading an address needs no key. That matters to you because custody under Rule 206(4)-2(d)(2) turns on authority to obtain possession. If a research tool held a key, or if you gave it a permission that could spend, your firm could acquire custody through the tool. Ketju’s site says it “does not manage assets, take custody, or accept compensation from any protocol it covers,” and its sample flow starts with a pasted wallet address. Check any tool you use for what it can sign before you connect it.

Sources: 17 CFR 275.206(4)-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-2, read 2026-10-16; Ketju home page, ketjuresearch.com, read 2026-10-16; Ketju methodology, ketjuresearch.com/methodology, read 2026-10-16

It can. Custody is defined by authority to obtain possession, and on a chain several things give that authority without a copy of the key. A multisig that lists your address as a signer is one. A smart account with a session key you control is another. A token approval that lets your address spend a client’s tokens is a third. The October 2026 proposal says that authority to obtain key materials without holding them is custody, though not self-custody, and the custody rule’s other duties would then apply. The SEC has not named token approvals or session keys, so applying the definition to them is reasoning from its words. Counsel would ask whether you can move the asset without the client’s further consent. Before any on-chain setup, list who can sign, who can approve, who can change signers, and whether the client can remove you.

Sources: SEC Release IA-7023, sec.gov/files/rules/proposed/2026/ia-7023.pdf, read 2026-10-16; 17 CFR 275.206(4)-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-2, read 2026-10-16

It covers an advertisement, and a letter to one client about that client’s holding is usually not one. Rule 206(4)-1(e)(1) defines an advertisement as a communication to more than one person, or to one person if it includes hypothetical performance, that offers advisory services with regard to securities to prospective clients. The rule took effect May 4, 2021. A web page, a newsletter, or a social post about stablecoin yields is an advertisement if it offers your services. It then falls under seven general prohibitions, including no untrue or unsubstantiated material statement and no discussion of benefits without a fair and balanced treatment of risks. A private note to a client about a holding is advice, and the books-and-records rule covers it instead.

Sources: 17 CFR 275.206(4)-1, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-1, read 2026-10-16; SEC Release IA-5653 (effective date), sec.gov/files/rules/final/2020/ia-5653.pdf, read 2026-10-16

You can state a yield only if you can prove it and show its risks beside it. The yield on a stablecoin held in a wallet comes from a lending protocol, a fund, or a platform other than the issuer. The GENIUS Act, signed July 18, 2025, bars a permitted payment stablecoin issuer from paying holders “any form of interest or yield” solely for holding the coin (section 4(a)(11)). The prohibition takes effect on the earlier of 18 months after enactment or 120 days after final regulations. The OCC proposed implementing rules in the Federal Register on March 2, 2026, and says issuers might try to pay yield through third parties. Under Rule 206(4)-1(a), an advertisement may not make a material statement you cannot substantiate on request, and may not discuss benefits without fair and balanced treatment of risks. The SEC has not said whether a quoted yield is “performance.” Counsel would treat it as a statement of fact that needs proof and risk disclosure, and as hypothetical performance if you project it.

Sources: GENIUS Act, Public Law 119-27, govinfo.gov/content/pkg/PLAW-119publ27/html/PLAW-119publ27.htm, read 2026-10-16; OCC proposed rule, Federal Register 2026-04089 (Mar. 2, 2026), federalregister.gov/documents/2026/03/02/2026-04089/implementing-the-guiding-and-establishing-national-innovation-for-us-stablecoins-act-for-the, read 2026-10-16; 17 CFR 275.206(4)-1, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-1, read 2026-10-16

Only with net returns beside them. Rule 206(4)-1(d)(1) bars gross performance unless the advertisement also shows net performance with at least equal prominence, over the same period, using the same method. Rule (d)(2) requires one-, five-, and ten-year periods for most portfolios, and (d)(5) requires extracted performance to come with the total portfolio’s results, or an offer to give them promptly. A crypto portion pulled out of a larger account is extracted performance. A staff FAQ updated March 19, 2025 says the staff would not recommend enforcement for showing gross extracted performance without net extracted performance. That holds if four conditions are met. The rule defines hypothetical performance to include model portfolios, backtests, and targeted or projected returns, which brings policy and disclosure duties under (d)(6). Show what a protocol paid separately from what a client earned after fees and losses.

Sources: 17 CFR 275.206(4)-1, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-1, read 2026-10-16; SEC Marketing Compliance FAQ, sec.gov/rules-regulations/staff-guidance/division-investment-management-frequently-asked-questions/marketing-compliance-frequently-asked-questions, read 2026-10-16

Yes, as a statement of fact that you must be able to prove. A verdict is the research firm’s finding about an asset or protocol, so say whose it is and when it was made. Rule 206(4)-1(a)(2) bars a material statement of fact that you lack a reasonable basis to substantiate on demand. Use the exact verdict word: “Approved with limits” differs from “Approved,” and the limits belong beside it. The rule’s “third-party rating” provisions apply to “a rating or ranking of an investment adviser,” so a rating of an asset falls outside that definition. Never write that the research firm recommends anything, because the recommendation is yours. Keep the page, with its date, as an advertisement record under Rule 204-2(a)(11).

Sources: 17 CFR 275.206(4)-1, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-1, read 2026-10-16; 17 CFR 275.204-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2, read 2026-10-16

A check that shows a prospect what they hold is your advertisement, so it must be accurate, fair, and kept. It may state what each holding is and the verdict, with the source and date. It must not promise a result, show performance, or imply that the verdict is your advice. It should name who gave the verdict. Keep the exact page as it appeared, with its date, under Rule 204-2(a)(11). The SEC’s December 16, 2025 risk alert says staff found advisers using lead-generation firms and referral arrangements without recognizing that they created an endorsement or testimonial. Rule 206(4)-1(e)(5) defines an endorsement to include a statement by a person other than a current client that “refers any current or prospective client” to the adviser. Counsel would ask whether anyone is paid for referrals and whether the tool’s operator says anything about you.

Sources: 17 CFR 275.206(4)-1, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-1, read 2026-10-16; 17 CFR 275.204-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2, read 2026-10-16; SEC Division of Examinations risk alert, Dec. 16, 2025, sec.gov/files/exams-riskalert-mrkt-rule-2512-508.pdf, read 2026-10-16

Yes, with disclosures, oversight, and no disqualified promoter. Rule 206(4)-1(b) requires you to disclose prominently that the testimonial came from a current client, that any cash or non-cash compensation was paid, and any material conflict. You need a reasonable basis to believe the testimonial follows the rule, and a written agreement with anyone you pay. Compensation of $1,000 or less in twelve months is de minimis and relieves some conditions. The December 16, 2025 risk alert found that the most common failure was missing or unclear disclosure, including reviews copied from third-party sites without saying so, and “refer-a-friend” programs not treated as endorsements. On January 15, 2026 the staff added an FAQ covering people subject to certain self-regulatory organization orders. A client’s comment about a holding is also a testimonial if it is about you.

Sources: 17 CFR 275.206(4)-1, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-1, read 2026-10-16; SEC Division of Examinations risk alert, Dec. 16, 2025, sec.gov/files/exams-riskalert-mrkt-rule-2512-508.pdf, read 2026-10-16; SEC Marketing Compliance FAQ, sec.gov/rules-regulations/staff-guidance/division-investment-management-frequently-asked-questions/marketing-compliance-frequently-asked-questions, read 2026-10-16

An accredited investor is a person who meets a test in Rule 501(a) of Regulation D. For a natural person, the common tests are net worth over $1,000,000, alone or with a spouse or spousal equivalent, not counting the primary residence; or income over $200,000 in each of the last two years, or $300,000 jointly, with a reasonable expectation of the same this year. A person who holds a Series 7, Series 65, or Series 82 license in good standing also qualifies, under the SEC’s order of August 26, 2020 (Release 33-10823). On October 6, 2026 the SEC published notices seeking comment on adding the CFA charter, the CFP certification, the CPA license, Series 79, 86, and 87 licenses, and a FINRA exam. These notices ask for comment and are not rules. Rule 501(a) also lets an issuer rely on what it “reasonably believes” about a buyer at the time of sale.

Sources: 17 CFR 230.501, ecfr.gov/current/title-17/chapter-II/part-230/section-230.501, read 2026-10-16; SEC Release 33-11443 (published Oct. 6, 2026; footnote 155 cites the 2020 order and the potential designations), sec.gov/files/rules/proposed/2026/33-11443.pdf, read 2026-10-16

A qualified purchaser is a person with far more in investments than an accredited investor needs. Section 2(a)(51) of the Investment Company Act of 1940 defines it. A natural person must own “not less than $5,000,000 in investments.” A company or other entity acting for its own account or for other qualified purchasers must own and invest, on a discretionary basis, not less than $25,000,000. The Commission defines what counts as “investments.” A fund that relies on Section 3(c)(7) of that Act has outstanding securities “owned exclusively by persons who, at the time of acquisition of such securities, are qualified purchasers,” and that is how it avoids registering as an investment company. Accredited investor and qualified purchaser are two separate tests. A client can meet the first and fail the second.

Sources: 15 U.S.C. 80a-2(a)(51), law.cornell.edu/uscode/text/15/80a-2, read 2026-10-16; 15 U.S.C. 80a-3(c)(7), law.cornell.edu/uscode/text/15/80a-3, read 2026-10-16

They are private funds, sold in private offerings, so the issuer must limit who can hold them. Ondo’s OUSG documentation says the tokens are not registered under the Securities Act and are “available solely to persons who are accredited investors” and qualified purchasers. Ondo’s product page says OUSG is offered under Regulation D Rule 506(c), which sells only to accredited investors and requires the issuer to verify them. Securitize’s launch announcement for BlackRock’s BUIDL (March 20, 2024) says the fund issues shares under Rule 506(c) and Section 3(c)(7), with a $5 million initial minimum. Section 3(c)(7) limits owners to qualified purchasers. The mechanism is on chain: the issuer keeps an allow-list of approved wallets, and a transfer to a wallet not on it can fail. The file shows what the issuer’s terms say as Qualifies, Does not qualify, or Not stated.

Sources: Ondo OUSG important notes, docs.ondo.finance/qualified-access-products/ousg/important-notes, read 2026-10-16; Ondo OUSG product page, ondo.finance/ousg, read 2026-10-16; Securitize, BlackRock launches BUIDL (Mar. 20, 2024), investors.securitize.io/news/news-details/2024/BlackRock-Launches-Its-First-Tokenized-Fund-BUIDL-on-the-Ethereum-Network-03-20-2024/default.aspx, read 2026-10-16; 15 U.S.C. 80a-3(c)(7), law.cornell.edu/uscode/text/15/80a-3, read 2026-10-16

Mostly no, for the offering itself, but states keep their power over fraud. Securities sold under Commission rules issued under Securities Act Section 4(a)(2), which includes Rule 506, are “covered securities” under Section 18(b)(4)(F). A state may not require registration of them. It may require a notice filing that is “substantially similar” to the federal one. Section 18(c)(1) leaves each state its authority to act on fraud. Your own state adviser rules still apply if you are state-registered, and they vary by state. The SEC’s August 18, 2026 proposal, Regulation Crypto Assets (press release 2026-76), would preempt state registration for securities sold under its new exemptions. It is a proposal.

Sources: 15 U.S.C. 77r, law.cornell.edu/uscode/text/15/77r, read 2026-10-16; SEC press release 2026-76, sec.gov/newsroom/press-releases/2026-76-sec-proposes-new-regulation-crypto-assets, read 2026-10-16

Tell the client in writing, put the facts in the file, and stop short of helping them work around the issuer’s terms. The SEC has not said what an adviser must do about a client’s ineligible holding. The issuer carries the duty to take reasonable steps on who buys; Rule 501(a) speaks of what “the issuer reasonably believes” at the time of sale. If the file shows Does not qualify, the client may have given the issuer wrong information, or the issuer may use a different test than you applied. Ask the client how they came to hold it. The issuer’s documents govern what it can do next, so counsel should read them. Do not advise the client to buy more. Record what the client says and decides.

Sources: 17 CFR 230.501, ecfr.gov/current/title-17/chapter-II/part-230/section-230.501, read 2026-10-16; SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16

The IRS treats it as property, so each sale or swap is a taxable disposal. Notice 2014-21 states that “virtual currency is treated as property” and that general tax principles for property apply. The IRS digital assets page, last updated September 2, 2026, repeats that digital assets are “property, not currency.” A trade of one token for another is an exchange of property, so the client has a gain or loss measured against cost basis, even between two dollar stablecoins, where the amount is often small. The Form 1040 asks every year whether the client received, sold, exchanged, or disposed of a digital asset. Mining, staking, and similar activity count as receipts. The client’s tax preparer computes the tax.

Sources: IRS Notice 2014-21, irs.gov/pub/irs-drop/n-14-21.pdf, read 2026-10-16; IRS digital assets page, irs.gov/filing/digital-assets, read 2026-10-16

Staking rewards are income when the client gains control of them. Revenue Ruling 2023-14 holds that a taxpayer includes the fair market value of staking rewards in gross income. The year is the one in which the taxpayer gains “dominion and control,” meaning the ability to sell, exchange, or otherwise dispose of them. That value then becomes the basis of the new units. The IRS digital assets page also lists T.C. Memo. 2026-46 under the heading “Cryptocurrency staking rewards are income.” Revenue Procedure 2026-20 supersedes Rev. Proc. 2025-31 and applies to tax years ending on or after October 6, 2026. It protects the tax status of certain investment trusts that stake, and it does not decide how a client reports rewards. The SEC’s March 17, 2026 interpretation says protocol staking activities described in it do not involve the offer and sale of a security. That is a securities-law conclusion and does not change the tax result.

Sources: IRS Revenue Ruling 2023-14, irs.gov/pub/irs-drop/rr-23-14.pdf, read 2026-10-16; IRS digital assets page, irs.gov/filing/digital-assets, read 2026-10-16; IRS Revenue Procedure 2026-20, irs.gov/pub/irs-drop/rp-26-20.pdf, read 2026-10-16; SEC Release 33-11412, sec.gov/files/rules/interp/2026/33-11412.pdf, read 2026-10-16

The IRS has not said, for either one by name, so the answer rests on the arrangement behind the payment. Counsel would start from Rev. Rul. 2023-14: a client generally has income when they gain control of what they are paid. The character of the income, interest or dividend or something else, depends on the contract or on the fund’s own tax documents. Brokers do not have to report these payments. Notice 2024-57 provides that brokers need not file Form 1099-DA for staking, lending, wrapping, and liquidity provider transactions until further guidance, and the form’s instructions say “Do not report rewards and staking payments on Form 1099-DA.” No form may show the income, so the client’s own records must.

Sources: IRS Form 1099-DA instructions, irs.gov/instructions/i1099da, read 2026-10-16; IRS Notice 2024-57, irs.gov/pub/irs-drop/n-24-57.pdf, read 2026-10-16; IRS Revenue Ruling 2023-14, irs.gov/pub/irs-drop/rr-23-14.pdf, read 2026-10-16

Form 1099-DA is the broker’s report of a client’s digital asset sales. Brokers must report gross proceeds for transactions on or after January 1, 2025, and basis for covered transactions on or after January 1, 2026. A covered asset is one acquired after 2025 in a custodial account the broker holds until the sale. Anything acquired earlier is noncovered, and basis reporting on it is voluntary. For 2025 transactions the IRS will not impose penalties if the broker makes a good-faith effort, under Notices 2024-56 and 2025-33. Only a U.S. broker files. The final regulations do not reach decentralized, non-custodial brokers. Congress disapproved the Treasury rule that would have reached them (H.J. Res. 25, Public Law 119-5, approved April 10, 2025). A client’s own sales on a wallet or protocol produce no form, and the client must still report them.

Sources: IRS Form 1099-DA instructions, irs.gov/instructions/i1099da, read 2026-10-16; IRS digital assets page, irs.gov/filing/digital-assets, read 2026-10-16; Public Law 119-5 (H.J. Res. 25), govinfo.gov/content/pkg/PLAW-119publ5/html/PLAW-119publ5.htm, read 2026-10-16

It means the client tracks cost basis separately for the units in each wallet or account. The 2024 final regulations, at Treas. Reg. 1.1012-1(j), apply the specific identification or first-in, first-out rules to units “held within a single wallet or account,” for dispositions on or after January 1, 2025. Revenue Procedure 2024-28 let taxpayers make a reasonable one-time allocation of unused basis. The allocation goes to the wallet or account holding the same number of remaining units as of January 1, 2025. It cannot be used for assets acquired or transferred in on or after that date. Notice 2025-07 gives temporary relief to taxpayers who used other methods to identify units held in a broker’s custody. For a practice, a client with several wallets, a broker account, and a protocol position needs one record per place.

Sources: IRS Revenue Procedure 2024-28, irs.gov/pub/irs-drop/rp-24-28.pdf, read 2026-10-16; IRS Notice 2025-07, irs.gov/pub/irs-drop/n-25-07.pdf, read 2026-10-16; IRS digital assets page, irs.gov/filing/digital-assets, read 2026-10-16

The IRS has not said. Section 1091 of the Internal Revenue Code, titled “Loss from wash sales of stock or securities,” disallows a loss on a sale of “shares of stock or securities” when the taxpayer buys substantially identical ones within thirty days before or after. Notice 2014-21 treats virtual currency as property. Counsel would read the statute’s words and conclude that spot crypto that is not a security falls outside Section 1091, and that a security, including a tokenized security, may fall inside. The SEC and CFTC interpretation of March 17, 2026 says digital securities are securities. A rule that depends on a statute’s text can change if Congress changes the text, so check the current text of Section 1091 before telling a client they may sell at a loss and buy back.

Sources: 26 U.S.C. 1091, law.cornell.edu/uscode/text/26/1091, read 2026-10-16; IRS Notice 2014-21, irs.gov/pub/irs-drop/n-14-21.pdf, read 2026-10-16; SEC Release 33-11412, sec.gov/files/rules/interp/2026/33-11412.pdf, read 2026-10-16

The SEC has not said that you cannot, and the fee must match a service you actually provide. Counsel would ask what the fee buys and whether you disclosed the conflict. IA-5248 says conflicts need full and fair disclosure and informed consent. The agreement and Form ADV Part 2A should say what the service is, how the assets are valued, and when. For regulatory assets under management, Form ADV Item 5.F counts “securities portfolios” where you give continuous and regular supervisory or management services. An account is a securities portfolio if at least 50% of its value is securities. The SEC has not said how crypto counts in that test. The March 2026 interpretation says digital commodities are not securities and digital securities are, so an adviser would sort each token by that distinction. The September 14, 2026 risk alert lists billing practices that deviate from policies among the gaps firms missed.

Sources: SEC Release IA-5248, sec.gov/files/rules/interp/2019/ia-5248.pdf, read 2026-10-16; Form ADV instructions, sec.gov/files/formadv-instructions.pdf, read 2026-10-16; SEC Release 33-11412, sec.gov/files/rules/interp/2026/33-11412.pdf, read 2026-10-16; SEC Division of Examinations risk alert, Sept. 14, 2026, sec.gov/files/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426.pdf, read 2026-10-16

The Department of Labor takes a neutral position and has done so since May 28, 2025. On that date it issued Compliance Assistance Release 2025-01 and rescinded Release 2022-01 in full. The 2022 release told plan fiduciaries to use “extreme care” before offering crypto. The 2025 release says that standard does not appear in ERISA, and the Department now neither endorses nor disapproves a fiduciary who decides crypto belongs in a plan. A footnote extends the reasoning to other digital assets, including tokens and coins. Prudence and loyalty still govern, judged on the facts of each plan. On March 31, 2026 the Department published a proposed safe harbor for choosing designated investment alternatives (to be codified at 29 CFR 2550.404a-6), with comments closed June 1, 2026. A Federal Register search on October 16, 2026 showed the proposal and no final rule.

Sources: DOL EBSA Compliance Assistance Release 2025-01, dol.gov/agencies/ebsa/employers-and-advisers/plan-administration-and-compliance/compliance-assistance-releases/2025-01, read 2026-10-16; DOL proposed rule, Federal Register 2026-06178 (Mar. 31, 2026), federalregister.gov/documents/2026/03/31/2026-06178/fiduciary-duties-in-selecting-designated-investment-alternatives, read 2026-10-16

Section 4975 of the Internal Revenue Code does not name crypto. It regulates who deals with the account and how. Section 4975(c)(1) lists prohibited transactions between a plan, which includes an IRA, and a disqualified person: lending money, furnishing goods or services, using plan assets for the benefit of a disqualified person, and a fiduciary dealing with plan assets “in his own interest or for his own account.” It also bars a fiduciary from receiving consideration for his own account from any party dealing with the plan in a transaction involving plan assets. Under Section 4975(e)(3)(B), a person who “renders investment advice for a fee” about plan property is a fiduciary. So an adviser paid for advice on an IRA is a disqualified person. Whether a particular crypto arrangement falls inside these categories depends on who deals with whom, and counsel should read it against the statute.

Sources: 26 U.S.C. 4975, law.cornell.edu/uscode/text/26/4975, read 2026-10-16

Under the rule now in force, a paid adviser on retirement money is a fiduciary if the five-part test regulation is met. The Department’s 2024 Retirement Security Rule never took effect. Courts stayed it in 2024, and final judgments vacated it on March 12, 2026 in the Eastern District of Texas and on March 17, 2026 in the Northern District of Texas. The Department’s Federal Register notice of March 20, 2026 implements the vacatur effective April 20, 2026, restores the prior text, and says the five-part test regulation was never replaced. The notice covers the Code’s definition in Section 4975(e)(3)(B), which reaches IRAs. A registered adviser owes the SEC fiduciary duty on top of any ERISA or tax-code status. The prohibited transaction rules in Section 4975 reach an adviser who takes consideration from a party dealing with the account.

Sources: DOL notice of court vacatur, Federal Register 2026-05492 (Mar. 20, 2026), federalregister.gov/documents/2026/03/20/2026-05492/retirement-security-rule-definition-of-an-investment-advice-fiduciary-notice-of-court-vacatur, read 2026-10-16; 26 U.S.C. 4975, law.cornell.edu/uscode/text/26/4975, read 2026-10-16

Ketju is a research service. Its site says that for a client’s wallet it shows “what they own, whether they may own it, and who can freeze it,” reads the wallet every day, and emails advisors when a term, key holder, or answer changes. The site also says Ketju is “research, not investment advice, and nothing here is an offer or solicitation.” It “does not manage assets, take custody, or accept compensation from any protocol it covers.” Ketju states findings as verdicts. The recommendation to a client is yours, and so is the duty that goes with it. The methodology page also says observed yield never decides whether a position is approved. The verdict is one input to your decision, and your written procedures say how your firm uses it.

Sources: Ketju home page, ketjuresearch.com, read 2026-10-16; Ketju methodology, ketjuresearch.com/methodology, read 2026-10-16

They fit as a defined input, and your procedures say how to use it. Rule 206(4)-7(a) requires written policies “reasonably designed to prevent violation” of the Act and its rules, and the September 14, 2026 risk alert found firms whose practice and policy had drifted apart. Ketju’s methodology page defines the words. Approved with limits means “the research supports use within the limits the memo sets.” Not approved means “Ketju does not approve the protocol, and the memo states why.” Under review means “the evidence does not yet settle it.” A procedure might say what your firm does at each word: discuss the holding within the limits, record the reason and tell the client, or note that the evidence is unsettled and look again at the next report. Your chief compliance officer owns that decision.

Sources: 17 CFR 275.206(4)-7, ecfr.gov/current/title-17/chapter-II/part-275/section-275.206(4)-7, read 2026-10-16; SEC Division of Examinations risk alert, Sept. 14, 2026, sec.gov/files/examinations-observations-regarding-investment-adviser-annual-compliance-review-091426.pdf, read 2026-10-16; Ketju methodology, ketjuresearch.com/methodology, read 2026-10-16

The client file is a dated page that shows what a client held and what the research said at the time. Ketju’s home page shows a sample household with one row per holding: what it is, whether the client may own it, and who can freeze it, each with a source citation. The methodology page says each tokenized program gets an eligibility file that states what the holder owns, who may buy, hold, transfer, and redeem, who can freeze, pause, or claw back, how a holder sells or redeems, and which observable event would change those answers. You keep the file to show an examiner, a client, or your own compliance officer what you knew and when. It does not replace your advice letters or your notes of client decisions. Under Rule 204-2(e)(1) you keep your records five years from the end of the fiscal year of the last entry, so keep your own copy of each file you print.

Sources: Ketju home page, ketjuresearch.com, read 2026-10-16; Ketju methodology, ketjuresearch.com/methodology, read 2026-10-16; 17 CFR 275.204-2, ecfr.gov/current/title-17/chapter-II/part-275/section-275.204-2, read 2026-10-16

Ketju’s site gives three limits. It is research, not investment advice, so it does not tell you what a client should do. It says “a protocol’s quality cannot remove control held by an issuer, chain operator, or custodian,” so a good finding does not remove freeze risk. And it covers what it has reviewed: the home page says Ketju researched 245 on-chain protocols one by one and applied published class rules to the rest of 714. A token with no memo has no verdict. The methodology page also says Ketju “does not infer eligibility from a token’s presence in a wallet,” so a client’s eligibility needs the client’s facts. The site makes no statement about tax, suitability, or your firm’s legal duties. Ask your counsel about suitability and your firm’s legal duties, and your client’s tax preparer about tax.

Sources: Ketju home page, ketjuresearch.com, read 2026-10-16; Ketju methodology, ketjuresearch.com/methodology, read 2026-10-16

It names who can stop the client from moving a token. Ketju’s methodology page says its files record who can freeze, pause, or claw back, with the contract function named and read on chain. The words are Nobody, Issuer, Protocol, and Custodian. A fiat-backed stablecoin issuer usually keeps a blacklist function in its contract. The GENIUS Act, in section 4(a)(5), requires a permitted payment stablecoin issuer to keep technical capabilities, policies, and procedures to block, freeze, and reject specific or impermissible transactions that violate law. A custodian can also freeze an account. A client who needs to leave a position fast may not be able to if someone else holds the freeze power. That bears on how the client could sell or redeem, on what you tell the client, and on how you describe the risk in any advertisement.

Sources: GENIUS Act, Public Law 119-27, govinfo.gov/content/pkg/PLAW-119publ27/html/PLAW-119publ27.htm, read 2026-10-16; Ketju methodology, ketjuresearch.com/methodology, read 2026-10-16

Ketju’s site says it reads the wallet every day, and its sample flow begins with a pasted wallet address. A public chain publishes the balances and transfers for every address, so a read of an address needs no key. A public read misses what the chain does not show. It cannot tell which person controls an address, so you must confirm that a pasted address belongs to the client. It cannot see assets held in a custodian’s pooled account unless a statement lists them. It cannot see assets on a chain the tool does not read. And a token with no memo has no verdict. These limits come from what a ledger shows. Ask any research tool which chains it reads and how often.

Sources: Ketju home page, ketjuresearch.com, read 2026-10-16; Ketju methodology, ketjuresearch.com/methodology, read 2026-10-16