Who Can Move Your Money? The Question Regulators Are Starting to Ask

On September 17, the Congressional Research Service published a report on the GENIUS Act, the US law that governs payment stablecoins. Most of it concerns issuers and their reserves. One passage deserves a slower read. The report notes that the Act's definition of a digital asset service provider leaves out self-custodial software, along with the business of building and operating interfaces to it. It adds that the exclusion for distributed ledger protocols appears to extend to DeFi applications such as lending markets and decentralized exchanges.

A research report is not a court ruling, and "appears to" is doing honest work in that sentence. Still, it describes a line lawmakers drew deliberately. It is also the line I would draw if you asked me what matters most about any financial tool you use.

The line is drawn at control

Strip away the terminology and the distinction comes down to one test. Can the company behind the product move your assets without you?

A bank can. An exchange can. When Deutsche Bank announced on September 16 that it plans to offer digital asset custody to institutional clients in Europe, the plan was explicit: the bank will manage the wallets and the private keys. That is a legitimate service, and for some clients it is the right one. It also means the bank carries the obligations that come with holding other people's property, because it does hold it.

Self-custodial software sits on the other side. It prepares a transaction and shows you what it will do. Then it waits for your signature. Without that signature, nothing happens. The developer cannot touch funds it never controlled.

This is why regulators keep arriving at the same place. Most custody rules exist to protect people from the custodian: from its insolvency or its temptation to use client assets. When there is no custodian, many of those protections have nothing to attach to.

Why this should matter to you

It is easy to read a story like this as something for compliance departments. I would read it as a description of what you are actually relying on.

When a product holds your keys, you are trusting a company's solvency and its willingness to let you withdraw when you ask. Every exchange failure tests that trust in public, usually at the worst possible moment.

When a product never holds your keys, the trust moves. You rely on the code to do what it says, and on yourself to keep access. The legal framing follows that shift, and your own questions should follow it too. If you want the fuller picture of what that responsibility involves, What Self-Custody Really Means covers it.

Orokai was built around this distinction. The platform is software. It does not hold user funds, and access is recovered through guardians you choose rather than through a company that can reset your account. That detail matters more than it seems. A provider that can restore your access on its own can usually take it away on its own as well. We designed recovery so that Orokai has neither ability.

What remains unsettled

It would be dishonest to present any of this as resolved. On September 15, the CLARITY Act, the broader US market structure bill, failed a Senate cloture vote 49 to 50. That leaves much of the American framework resting on agency guidance rather than statute, and guidance can change along with the people who write it.

The same CRS report raises a question it does not answer: what anti-money-laundering obligations follow a stablecoin once it leaves an issuer or an exchange and moves into self-custody or a DeFi application. I expect that question to shape the next round of rules more than any other.

Other jurisdictions are working on the same boundary with their own vocabulary. The UK's Financial Conduct Authority published perimeter guidance on September 16 describing when crypto activities require authorization. Two days earlier, the DeFi Education Fund and a16z asked the SEC for a safe harbor that would keep decentralized exchange protocols, and certain apps that give access to them, outside exchange registration requirements.

None of this guarantees an outcome, and none of it is legal advice. For a broader look at how rules apply to people who hold their own assets, see Self-Custody and Regulation: What Users Should Know.

A question worth keeping

Whatever the rules look like next year, the test in that CRS passage is one you can apply today. Before you deposit anything anywhere, ask who besides you can move it. If the answer is someone, you are using a custodian, and you should know which one and which rules protect you from it. If the answer is no one, you are using software, and your access depends on the recovery method you chose, so choose it with the same care you would give the assets themselves.