Control Is the New Possession

May 22, 2026

On December 5, 2025, New York Governor Hochul signed Senate Bill S1840-A into law, making New York the 35th U.S. jurisdiction to enact the 2022 Amendments to the Uniform Commercial Code. The Revised UCC takes effect on June 3, 2026, with a one-year grace period that runs to June 3, 2027. [1] The team at Cahill put out a really clean client alert on the enactment that I’d recommend to anyone who wants the full doctrinal walkthrough. Lewis in particular has been one of the more reliably thoughtful voices on crypto commercial law for a decade, and the alert is a good tour of the mechanics.

My goal here is not to re-tread their ground but to build on it: to explain what the Revised UCC actually fixes, where the sharp edges still are, and what people should do. The short version is this: commercial law has been groaning under the weight of 2020s asset classes shoehorned into 1950s concepts. New York finally fixed the plumbing. Now the rest of us get to work out what flows through it.

To appreciate what the Revised UCC accomplishes, it helps to remember what secured lending against crypto collateral actually looked like under the pre-Amendments regime.

If your borrower pledged a bunch of Ether, your options were ugly. Ether isn’t a “deposit account,” isn’t “investment property” (because it isn’t a security held through a securities intermediary), isn’t “chattel paper,” isn’t “money” in any conventional sense, and isn’t a “negotiable instrument.” Practitioners mostly settled on classifying it as a “general intangible” under Article 9 and perfecting by filing a UCC-1 financing statement against the debtor. That worked, sort of, for some purposes. But it created two problems that never really went away.

First, there was no concept of negotiability for crypto. If someone bought Bitcoin from your borrower on the secondary market, that purchaser took the coins subject to your lien forever. There was no holder-in-due-course doctrine, no take-free rule, nothing to cleanse the asset of prior claims as it changed hands. A motivated secured party could, in theory, chase the collateral through ten wallets and claim it back from an innocent purchaser. That’s not how functioning financial markets work. It’s how a legal opinion ends with “we are unable to opine” and the deal falls apart.

Second, the idea of control, which the UCC already used for deposit accounts, investment property, and electronic chattel paper, had no analog for blockchain-native assets. You couldn’t perfect a security interest in Bitcoin by taking the private key. Or rather, you could, in the sense that operationally you would control the coins, but the UCC didn’t bless that approach with priority rules, and a later-filing party might still leapfrog you.

The upshot is that secured lending against digital assets has, for the last several years, been either overcollateralized, overengineered, or both. Credit facilities against crypto collateral routinely use custodial arrangements with negotiated contractual priorities, belt-and-suspenders UCC filings, and legal opinions that qualify themselves into unreadability. It works, but it’s expensive, it’s inconsistent across transactions, and it presumes a court someday won’t take a dim view of the whole arrangement.

What Article 12 Actually Does

The Revised UCC does four things that matter. It creates a new asset class, defines a perfection method tailored to that asset class, imports negotiability-style take-free rules, and sets a choice-of-law default.

The new asset class: Controllable Electronic Records. Section 12-102(a)(1) defines a “controllable electronic record” (CER) as a record stored in an electronic medium that can be subjected to “control.” The definition is intentionally broad and technology-neutral. It plausibly covers Bitcoin and Ether, GENIUS Act payment stablecoins, DeFi receipt tokens (LP tokens, vault shares, liquid staking tokens), NFTs, tokenized real-world assets, tokenized off-chain loan obligations, and more. Importantly, “investment property” is carved out, so tokenized securities remain in the Article 8 regime, but parties can elect to treat a CER as an Article 8 “financial asset” if it’s held through a securities intermediary. [2]

CERs can also carry “tethered” payment rights as “controllable accounts” and “controllable payment intangibles” (CPIs). Together, the three categories (CERs, controllable accounts, and CPIs) form the “Digital Assets” universe under the Revised UCC.

The perfection method: Article 12 Control. Section 12-105 defines when a person has “control” of a CER. The three elements are (i) the power to avail oneself of substantially all the benefit from the CER, (ii) the exclusive power to prevent others from doing the same and to transfer control to another person, and (iii) the ability to readily identify oneself as having those powers.

That’s statute-speak for something pretty simple: control means you hold the keys, you can spend the coins, you can keep others from spending them, and the system (whether that’s a blockchain, a custodian’s internal ledger, or a vault-and-registry combo) lets you prove it’s you.

Take-free rules for qualifying purchasers. Section 12-104 brings holder-in-due-course doctrine to CERs. A “qualifying purchaser” (i.e., someone who obtains control of the CER “for value, in good faith, and without notice of a claim of a property right” in it) takes the CER free of prior property claims. [3] The rule is exactly what’s been missing from the crypto secondary market: a legal basis on which buyers can acquire digital assets cleansed of prior liens, just like a negotiable instrument transferee.

Choice-of-law default. Section 12-107 sets up a choice-of-law waterfall. Parties can expressly designate a jurisdiction as the CER’s jurisdiction (as long as that jurisdiction has enacted the Amendments); if they don’t, the CER’s own “system” rules apply; and if that fails, the District of Columbia is the residual default.

Together these four moves turn Digital Assets from legal orphans into a proper asset class with a perfection regime, a priority scheme, and a transfer doctrine. That is not nothing.

Control, Properly Understood

The most consequential piece of Article 12 for Web3 practitioners is the control concept, because it finally reconciles commercial law with the actual architecture of digital asset custody.

The statute is drafted to be technology-neutral, which means Article 12 Control can be established through a lot of different arrangements:

• A custodian holding the assets in a pooled omnibus structure, so long as the custodian can identify the position as held for the purchaser.
• An electronic vault or e-registry (think the MERS® eRegistry system for e-Notes) where the system guarantees a unique authoritative copy and exclusive controller rights.
• A self-custodied wallet, where the purchaser holds the private keys directly.
• A multisig arrangement, which is the one I want to spend a minute on.

Multisig does not defeat exclusivity. This was a genuine open question before the Amendments, and the resolution is correct. Under § 12-105(b)(2) and Official Comment 5, the exclusivity requirement is not defeated if power is shared with other persons, even if any party can act unilaterally, so long as the person seeking to establish control is not dependent on another person’s concurrent exercise of power. Translation: a 2-of-3 Safe where you hold one signer and a co-signer can act with either of the other two still lets you satisfy the control test, provided you can act on your own. If the arrangement required your signature plus someone else’s, you’d lose exclusivity on your own but might still have it jointly.

Smart-contract liquidation does not defeat control. This is the one I think DeFi builders should have tattooed on their forearms. Under § 12-105(b)(1), exclusivity is not impaired when control is limited by “a protocol programmed to cause a change, including a transfer or loss of control.” Official Comment 5 uses exactly this rationale: “a transfer of control resulting from a program that is a part of a system’s protocol is inherent in the controllable electronic record and does not impair the exclusivity of the power of the person in control of the record.”

That means if your collateral is sitting in a decentralized lending protocol and the smart contract is programmed to liquidate the position upon a health-factor breach, you can still have Article 12 Control of the collateral for UCC purposes. The protocol’s automated transfer doesn’t kill your control any more than the possibility of a bank’s setoff right kills your control over a deposit account. That clarification matters enormously for lending-against-DeFi-positions structures and for any credit arrangement where collateral lives inside a protocol rather than a custodian’s cold storage.

Indirect control through another person. Section 12-105(e) lets a party have control through another person who acknowledges holding for them. Practically, this enables the collateral agent pattern that structured credit transactions already use for other asset classes: a third-party custodian holds the keys, acknowledges holding for the secured party, and the secured party is perfected by control.

This is the architecture that institutional crypto lending has already been building toward with qualified custodians, tri-party arrangements, and contractual priorities. Article 12 now provides the statutory backbone those arrangements have been missing.

Take-Free

If Article 12 Control is the piece practitioners will talk about, the take-free rules are the piece they should be talking about. Import holder-in-due-course doctrine into the crypto market and the consequences ripple outward in ways that haven’t fully registered yet.

The rule, again, is that a qualifying purchaser of a CER (for value, in good faith, without notice) takes the CER free of competing property claims. [4] Two points on top of that are worth underlining.

First, the Revised UCC expands the “filing is not notice” rule to make clear that a filed UCC-1 financing statement does not, by itself, constitute notice to a qualifying purchaser of a CER. [5] This is a significant shift – previously, a secured party could file a UCC-1 and rely on constructive notice to defeat later purchasers. Under Article 12, that constructive notice doesn’t reach CER purchasers. If you want to bind a later purchaser of Bitcoin to your lien, filing is not enough: you have to prevent them from becoming a qualifying purchaser, which really means you need to take control yourself.

Second, the take-free rule has a carve-out for CERs that represent off-chain interests. If the CER evidences an interest in an underlying asset (e.g., a token that represents a claim to a real-world asset held in a SPV) the qualifying purchaser takes the CER free of claims on the CER itself, but takes the underlying interest subject to existing property claims on that underlying. [6] For CERs with controllable payment rights tethered to them, the take-free protection extends to those payment rights. For CERs without any tethered interests (e.g., Bitcoin) the full take-free applies. See Uniform Commercial Code Amendments (2022), Prefatory Note to Article 12, Comment 3 (applying the qualifying purchaser standard to a hypothetical Bitcoin transaction).

What this means in practice: Bitcoin is now treated, for property-law purposes, closer to the way negotiable bearer paper has historically been treated. A tokenized real-world asset is closer to a bill of lading: the token cleanses, but only as to the token. And a stablecoin representing a dollar claim against an issuer gets take-free protection on the CER and the payment right, which is basically exactly the cash-like treatment the stablecoin industry has been asking for.

Control > Filing

Under the Revised UCC, a security interest in a CER can still be perfected by filing. But Section 9-326A makes clear that a security interest perfected by Article 12 Control takes priority over one perfected by filing even if the filing pre-dated the control. [7] When two secured parties both have control, Section 9-322(a)(1)’s first-to-file-or-perfect rule decides priority. [8]

For leveraged finance, this is a real change. A syndicated credit agreement with an “all assets” security package and a filed UCC-1 no longer automatically has senior position on crypto collateral. A later lender who takes Control (e.g., through a tri-party custodial arrangement) leapfrogs the earlier filer.

If you work on leveraged credit facilities for companies that might hold CERs (and that increasingly means any company, not just the obvious ones, but treasury departments have been quietly accumulating BTC since 2021), you have a documentation problem to solve in the next twelve months:

1. Audit existing facilities to see whether the borrower has CERs that your UCC-1 nominally covers but that a later Control-based lien could jump over.
2. Expand control agreement requirements, or at least blocked-wallet / custodial acknowledgment concepts, to cover CERs the borrower may hold.
3. Consider the Article 8 election. If the CERs are held through a securities intermediary, parties can elect to treat them as “financial assets” and perfect by securities account control agreement, which is a familiar playbook that doesn’t require climbing the Article 12 learning curve. [9]

Electronic Money and the Stablecoin Question

The Amendments create a new collateral category “electronic money” defined as a medium of exchange authorized or adopted by a domestic or foreign government in electronic form. Central bank digital currencies would fit. The digital form of existing sovereign money (think a future Fed-authorized tokenized dollar) would fit. Payment stablecoins issued under the GENIUS Act would not fit this definition, because GENIUS Act stablecoins are issued by licensed private issuers, not governments; they are more naturally CERs with tethered payment rights.

For electronic money, the perfection rules are similar to those for CERs, with one important twist: a security interest in electronic money can only be perfected by control, not by filing. The only exception is when the electronic money constitutes identifiable cash proceeds of other collateral. If a CBDC ever arrives in the U.S. (which, per the current administration’s position, it very much won’t) this is the regime that would govern credit transactions collateralized by it.

For the stablecoin question, the more immediate and practical point is that Article 12 finally gives GENIUS Act payment stablecoins the commercial-law treatment their economics have always demanded. A well-structured payment stablecoin is a CER with a controllable payment intangible tethered to it. The qualifying purchaser takes free of competing claims on both the token and the redemption right. That is, legally, exactly how cash works. It’s the treatment the stablecoin industry has been pushing toward for years without having a statute that unambiguously delivered it.

The Choice-of-Law Trap

The most underappreciated risk in the whole regime is the choice-of-law trap.

As of April 2026, 34 jurisdictions have enacted the 2022 Amendments, and seven more (Alaska, Maryland, Massachusetts, Mississippi, Ohio, South Carolina, and Tennessee) have introduced legislation. That still leaves a meaningful number of states that have not adopted and have not introduced. A court sitting in one of those states, applying its own choice-of-law rules, might conclude that no jurisdiction’s version of Article 12 governs, and treat the CER as a mere “general intangible” under the pre-Amendments framework, without the take-free rules, without Control-based perfection, without the super-priority doctrine.

That’s a bad outcome, especially if you’re a qualifying purchaser who thought you took clean title, or a Control-based secured party who thought you had priority over an earlier filer.

The mitigation strategy is threefold, and it’s what practitioners should be inserting into every CER-touching deal now:

• Designate an enacting state as the CER’s jurisdiction under Section 12-107(c). New York is the obvious candidate for financial deals, since the financial contracts market is already predominantly New York-law governed.
• Choose an enacting state’s law as the governing law of the underlying agreement.
• Consider forum selection clauses that keep disputes in courts that have adopted the Amendments.

None of this perfectly eliminates the risk, because a forum court is not bound to honor choice-of-law elections if it decides the relevant question is one of property rather than contract. But it substantially reduces the surface area, and it’s cheap to do.

The Revised UCC takes effect on June 3, 2026. The grace period runs through June 3, 2027.

[1] See N.Y. U.C.C. Law §§ 12-101 et seq.

[2] N.Y. U.C.C. Law § 8-102(a)(9)(iii).

[3] N.Y. U.C.C. Law § 12-102(a)(2).

[4] N.Y. U.C.C. Law § 12-104(e), (g)-(h).

[5] N.Y. U.C.C. Law § 9-331(c).

[6] N.Y. U.C.C. Law § 12-104(f).

[7] N.Y. U.C.C. Law § 9-326A.

[8] See Uniform Commercial Code Amendments (2022) § 9-326A cmt. 2.

[9] N.Y. U.C.C. Law §§ 8-102(a)(9)(iii), 8-106(d).

Written by David Lopez Kurtz