The Staff Accounting Bulletin 121 said customers' crypto assets in banks should be held on the banks' own balance sheets. That should have been a rule, not guidance, the GAO says, but the SEC says the policy remains unchanged in the meantime. The Government Accountability Office issued a finding that the Securities and Exchange Commission was in the wrong when it didn't send SAB 121 to Congress, as it should with an official rule.The SEC responded Tuesday that the conclusion only affects the guidance as interpreted under the Congressional Review Act and not the status of the bulletin itself.The U.S. Securities and Exchange Commission (SEC) was out of bounds when it issued its controversial "Staff Accounting Bulletin 121," according to the Government Accountability Office (GAO), and Congress should have had a chance to review it.The 2022 guidance, which the industry says threatens crypto investors' ability to find safe harbors for their assets, should have been treated as a formal rule, the GAO concluded in a report issued on Tuesday. The congressional watchdog is contending that, according to federal rulemaking procedures, the accounting bulletin should have gone through a different process, including submission to Congress before it went into effect. Still, that finding doesn't have any direct effect on the bulletin's ongoing status as technically nonbinding SEC policy, the agency indicated on Tuesday.SAB 121 holds that financial firms that hold customers' crypto assets record those assets on their own balance sheets – requiring capital be maintained against them. The industry and Republican U.S. lawmakers have argued that it jeopardizes the willingness of regulated banks to act as crypto custodians, and it treats crypto holdings differently than other assets."We find that the bulletin does meet the definition of a rule under the Administrative Procedure Act and that no exception applies," according to the finding of the GAO, an independent watchdog that works for the U.S. Congress. "Thus, the bulletin is subject to the Congressional Review Act’s submission requirement."It’s likely that the bulletin will now be submitted for congressional review, though the details on the mechanics of that aren't yet clear. Once a new federal rule arrives in their hands, lawmakers are granted a window of opportunity to reject it under the Congressional Review Act (CRA)."The GAO opinion expresses its view that SAB 121 is a 'rule' for purposes of the CRA," the SEC said in a statement. "The opinion does not otherwise affect the status of SAB 121."But people in the crypto industry took this legal upbraiding as another SEC setback."Today, the GAO recognized SAB 121 for what it is: regulation under the guise of staff guidance," said Nathan McCauley, CEO and co-founder of Anchorage Digital Bank, in a statement. He said the bulletin "makes it economically impossible for SEC-reporting banks – some of the most trusted financial institutions worldwide – to custody digital assets at scale."SEC Commissioner Hester Peirce had also previously objected to the commission's decision on the bulletin, saying it represented the SEC's "scattershot and inefficient approach to crypto."The GAO noted the SEC argued that the accounting policy wasn't treated as a rule because it is not an “agency statement” of “future effect.” Rulemaking at a federal agency such as the SEC includes several steps. An idea must first be proposed and opened to multiple stages of public comment before it can be finalized and submitted to Congress. Then, the lawmakers have a chance to kill it."This will be brought up for a vote of disapproval," Cody Carbone, vice president of policy for the Chamber of Digital Commerce, said in a posting on X. "Each chamber of Congress now has until December 31 to pass a resolution of disapproval to invalidate the rule."