CFTC offers narrow protection for noncustodial crypto developers

The Commodity Futures Trading Commission issued a no-action letter to Phantom, a provider of a widely used noncustodial wallet, and described the factual limits under which agency staff would not recommend enforcement against certain software developers. The letter sets out a narrow safe harbor for developers whose code only enables users to hold or move digital assets while the developer lacks access to users’ private keys and cannot move customer funds.

CFTC staff identified specific factors that weigh against treating a developer as a custodian. Those factors include an inability to access or control users’ private keys, no possession of users’ assets, and no capacity to transfer customer funds. The letter framed those facts as the basis for staff forbearance in the narrow scenario described to the agency.

Developers and projects that build browser-based wallets, open-source libraries and similar tooling have asked regulators for clearer rules distinguishing noncustodial software from custodial platforms. The letter to Phantom responds to such requests by describing the factual predicates staff would consider when deciding whether to recommend enforcement.

Some legal experts view the letter as a possible path toward more detailed guidance or rulemaking. Other experts note that no-action letters normally apply only to the party that receives them and to the specific facts presented, leaving developers outside those facts exposed to enforcement risk unless broader rulemaking or formal interpretive guidance follows.

The CFTC’s determinations about custody and intermediary roles intersect with the responsibilities of other U.S. regulators. How the agency’s standards align with banking, securities and consumer-protection rules will affect how developers design products and compliance programs.

A no-action letter is a staff statement that, given a particular factual scenario, the staff do not intend to recommend enforcement. Such letters do not change statutes or regulations and usually cover only the requester. Noncustodial wallets store private keys with users and sign transactions locally; custodial services hold keys or assets and typically retain the ability to move funds. That distinction has consequences for licensing, reporting and consumer-protection obligations.