Safeguarding crypto after SAB 121: what custodians record now

SAB 122 removed the on-balance-sheet safeguarding liability. Custodians now ask two questions: do we control the assets, and is a loss probable?

2026-10-17 · 5 min read

If your company holds crypto for customers, the balance sheet may look very different from 2022 to 2024. The SEC staff's rule that forced a safeguarding liability onto the balance sheet is gone, but it was replaced with judgment, not with nothing: you still need a control analysis, a loss-contingency assessment and clear disclosure.

What SAB 121 required

Staff Accounting Bulletin 121 was issued on March 24, 2022 [1]. It told SEC filers that hold crypto for platform users to show a liability for the obligation to safeguard those assets, and to recognize a matching asset, both measured at the fair value of the crypto held [1]. It also called for disclosures about the types and amounts held, concentrations, who holds the keys and insurance coverage [1].

The effect was mechanical. A custodian holding 50 million dollars of customer bitcoin grossed up both sides of its balance sheet by 50 million dollars, and those amounts moved every reporting date with the market price, even though the custodian did not own the bitcoin. Banks in particular found this hard to reconcile with capital rules.

What SAB 122 changed

On January 23, 2025 the SEC staff issued SAB 122, which rescinded the guidance (Topic 5.FF) that SAB 121 had added [2]. An entity with a safeguarding obligation now decides whether to recognize a liability, and how to measure it, using the loss contingency guidance in ASC 450-20 under US GAAP or IAS 37 under IFRS [2].

The rescission had to be applied on a fully retrospective basis in annual periods beginning after December 15, 2024, with earlier adoption allowed, and with clear disclosure of the effect of the change in accounting principle [2]. In practice that means prior periods shown in the financial statements are restated to remove the SAB 121 asset and liability, with any difference in carrying amounts adjusted through opening retained earnings for the earliest period presented [4].

Question one: do you control the assets?

SAB 122 did not change the threshold question. If the facts show that the custodian controls the crypto it holds, it is the accounting owner: it recognizes the crypto as its own asset together with a liability to return equivalent assets to customers [4]. Deloitte makes the same point: recognizing crypto on the balance sheet still depends on control, and the contingency guidance applies to the safeguarding obligation where control is absent [3].

Control is a facts-and-circumstances assessment. Terms that commonly point toward control include a right to lend, pledge or otherwise use customer assets for the custodian's own purposes, and commingled holdings where customers lack an identifiable claim. Terms that commonly point away from it include segregated customer accounts and legal protections that keep customer assets out of the custodian's estate. These are indicators, not a checklist; the custody agreement and legal analysis drive the answer.

The FASB added a project in November 2025 to clarify derecognition guidance for crypto transfer arrangements, focused on whether control has passed [6]. As of October 2026 that work is still in progress, so the existing control guidance continues to apply.

Question two: is a loss probable?

Where the custodian does not control the assets, the safeguarding obligation is a contingency. Under ASC 450-20 an accrual is recorded only when it is probable that a loss has been incurred and the amount can be reasonably estimated [3]. Deloitte notes that an entity that has not suffered a loss event would not be expected to record a liability when adopting SAB 122 [3].

IAS 37 works in a similar way for IFRS reporters. A provision is recognized when there is a present obligation from a past event, an outflow is probable and a reliable estimate can be made [5]. Contingent liabilities that do not meet those tests are not recognized, but they are disclosed unless an outflow is remote [5]. Note that probable is not defined identically in the two frameworks, so the same facts can lead to different answers.

Disclosure still does the heavy lifting

With the gross-up gone, the notes and MD&A carry the information. SAB 122 points filers to Regulation S-K Items 101, 105 and 303 along with the relevant FASB guidance on loss contingencies and risks and uncertainties [2]. KPMG lists ASC 275 among the requirements that continue to apply [4]. Readers will still want to know the amounts held for others by asset, how keys are held, what insurance exists and what concentrations you face, even though SAB 121 no longer mandates that list [1][3].

What to do

• Re-read each custody and terms-of-service agreement and document the control conclusion per product, not once for the whole platform.
• If you adopted SAB 122, keep the restatement workpapers: opening retained earnings adjustment and the change-in-principle disclosure.
• Set up a quarterly ASC 450-20 or IAS 37 review covering hacks, key losses, reconciliation breaks and customer claims.
• Keep reconciling customer balances on-chain to the internal ledger; an off-balance-sheet obligation still needs a complete record.
• Watch the FASB derecognition project for any change to the control assessment for lent or pledged crypto.

Sources

1. Staff Accounting Bulletin No. 121 (U.S. Securities and Exchange Commission)
2. Staff Accounting Bulletin No. 122 (U.S. Securities and Exchange Commission)
3. SAB 121 and Done: SEC Issues SAB 122 to Rescind Guidance on Safeguarding Crypto Assets (Deloitte (DART))
4. SEC rescinds SAB 121 (KPMG)
5. IAS 37 Provisions, Contingent Liabilities and Contingent Assets (IFRS Foundation)
6. FASB Adds to Its Technical Agenda Another Project on the Accounting for Crypto Assets (Deloitte (DART))

General information for finance teams, current as of publication. Not legal, tax or accounting advice.

All Newsroom explainers