SEC proposes crypto asset custody framework for investment advisers and regulated funds

The Proposal (the “Proposal”) would:

• permit registered investment advisers and registered management investment companies and business development companies (BDCs, and together with registered management investment companies, “regulated funds”) to self-custody crypto assets in certain circumstances subject to conditions
• permit advisers and regulated funds to maintain client or fund crypto assets with a state trust company, subject to conditions
• modernize the custody rules under both statutes, and
• update recordkeeping and disclosure requirements.²

Chairman Paul S. Atkins stated the Commission proposed “to close a gap that has left investment advisers and funds guessing how to effect lawful custody of an asset class that their clients increasingly demand” and called it “another significant step toward bringing our regulatory frameworks into the modern era.”³ The Proposing Release was published in the Federal Register on October 6, 2026, and the public comment period remains open for 60 days thereafter.⁴

Key takeaways

• Advisers and regulated funds would be permitted to self-custody crypto assets where no qualified custodian is available, subject to written determinations, safeguarding expertise, key management controls, cybersecurity requirements, internal control reports, and account statements.⁵
• The Proposal would create a dedicated pathway for advisers and regulated funds to custody crypto assets with state trust companies, bypassing the fact-specific analysis of whether a state trust company satisfies the statutory definition of a bank.⁶
• Self-custody is available only where no qualified custodian will maintain the asset, and cost is not a permissible basis. Advisers must maintain exclusive possession of key materials, obtain SOC 1 Type 2 reports, and send quarterly account statements.⁷
• Targeted amendments to both the Advisers Act and Investment Company Act custody rules would provide exceptions for authorized discretionary trading authority, standing letters of authorization, and inadvertent custody, eliminate the Public Company Accounting Oversight Board (PCAOB) registration requirement for accountants, and broaden eligible broker-dealer custodians.⁸
• The custody requirements reach only certain crypto assets, and the governing test differs by statute. For advisory clients that are not regulated funds, the Advisers Act custody rule covers only crypto assets that are “funds” or “securities,”⁹ so the SEC views digital commodities such as Bitcoin, Ether, and Solana as generally outside custody rule requirements. For regulated funds, the custody rule conditions reach crypto assets that are “securities or similar investments,” a broader category the Commission reads to include digital commodities such as Bitcoin, Ether, and Solana.
• Under the Advisers Act custody rule, advisers that are deemed to have custody of shares of mutual funds (including registered money market funds) could treat such mutual fund’s transfer agent as a qualified custodian.   
• New Form ADV and Form N-CEN questions would require disclosure of self-custody arrangements, state trust company use, and fund tokenization.

Background

Current custody rules under the Advisers Act and the Investment Company Act were designed to protect adviser client and regulated fund assets from loss, theft, misuse, and misappropriation, and to address custody of traditional assets.¹⁰

Since the advent of Bitcoin in 2008, the crypto asset market has grown significantly; the Proposing Release notes the crypto market reached a USD2.7 trillion market capitalization in May 2026. Unlike traditional assets, a permitted custodian may not be readily available to hold certain crypto assets, and custodial capabilities may lag an asset’s deployment by many months.

The Proposal follows a reversal in regulatory approach. The Commission’s 2023 Advisers Act safeguarding proposal, which would have extended the Advisers Act custody rule to substantially all client assets, including crypto assets, was formally withdrawn in June 2025.  In September 2025, the SEC staff issued a no-action letter stating that the staff would not recommend enforcement action against advisers and regulated funds that treated state trust companies as banks for crypto asset custody, subject to conditions, for purposes of the Advisers Act and Investment Company Act.¹¹

The Proposal would replace that staff position with new rules under both the Advisers Act (Rule 223-1)¹² and Investment Company Act (Rules 17f-8 and 17f-9), expanding on the staff’s state trust company position, adding a self-custody pathway, and further modernizing the custody framework under both statutes.

Key features of the Proposal

Self-custody under the Advisers Act

The Proposal would introduce an exception from certain requirements of the new Advisers Act custody rule (Rule 223-1), including the qualified custodian requirement,¹³ for advisers that self-custody crypto assets.¹⁴

“Self-custody” would mean, with respect to a client’s crypto asset, possession of any portion of the crypto asset’s key materials.15 “Key materials” includes any part of the private key necessary to access and effectuate transactions. The self-custody provisions apply only if an adviser actually possesses the key materials; mere authority to obtain possession confers custody but not self-custody.

An adviser relying on the self-custody exception must satisfy each of the following conditions:

• The adviser must determine in writing, prior to taking self-custody and no less frequently than quarterly thereafter, that it has a reasonable basis, after due inquiry, for believing that no qualified custodian will maintain the crypto asset. Cost is not a permissible basis. If a qualified custodian becomes available, the adviser must place the asset with it as soon as reasonably practicable.
• The adviser must have documented expertise regarding safeguarding each crypto asset and must adopt, implement, and maintain systems addressing: (A) key management, limiting access to key materials to supervised persons designated by the adviser, with the Commission’s view that the adviser must maintain exclusive possession of key materials;16 (B) joint authorization, requiring at least two designated persons (including a management person) to authorize transfers, paralleling the existing two-person requirement under Rule 17f-2(d) of the Investment Company Act; and (C) per-client segregation, maintaining each client’s crypto assets in addresses storing only that client’s assets.
• The adviser must mitigate cybersecurity risks and review its cybersecurity controls no less frequently than annually, covering risk assessment, threat identification and mitigation, and incident response and recovery.¹⁷
• Within six months of taking self-custody and annually thereafter, the adviser must obtain internal control reports from an independent public accountant. A SOC 1 Type 2 Report would satisfy the requirement; a SOC 1 Type 1 Report would not.¹⁸
• Quarterly statements must identify the crypto asset address, the crypto network, amounts held, all transactions during the period, and a statement urging the client to compare against on-chain balances.¹⁹
• The adviser and client must agree in writing to treat each self-custodied crypto asset as a “financial asset,” and the adviser as a “securities intermediary,” under Article 8 of the Uniform Commercial Code as enacted in the state law governing the agreement. The Commission describes this election as critical to client protection because a self-custodying adviser lacks the FDIC and SIPC backstops available to banks and broker-dealers; because state enactments of Article 8 vary, the governing-law clause becomes part of the custody analysis.²⁰

Self-custody under the Investment Company Act

A regulated fund may maintain crypto assets in self-custody through its adviser if the adviser complies with the self-custody provisions in the Advisers Act custody rule and the fund’s board oversees the arrangement. The board must review, initially and quarterly thereafter, the adviser’s written report documenting the basis for its determination that no qualified custodian is available, and must determine, prior to the adviser maintaining the asset and annually thereafter, that the fund’s crypto asset would be subject to reasonable care if self-custodied.⁵

State trust companies as qualified custodians

The Proposal would designate state trust companies as qualified custodians under both the Advisers Act and Investment Company Act, thereby permitting custody of advisory client crypto assets by state trust companies, subject to conditions.⁶ Prior to engaging a state trust company and annually thereafter, the adviser or regulated fund must determine in writing that it has a reasonable basis, after due inquiry, for believing that the state trust company:

• is authorized by the relevant state banking authority to provide custody services for crypto assets
• and maintains written policies and procedures reasonably designed to safeguard crypto assets. 

The adviser or fund must also receive and review the state trust company’s most recent annual audited financial statements and internal control report. All crypto assets held at the state trust company must be segregated from the state trust company’s proprietary assets.

The state trust company pathway would supersede the September 2025 staff no-action letter, but the proposed rule text omits that letter’s contractual bar on lending, pledging, or rehypothecating client crypto assets; the Commission instead requests comment on whether to address rehypothecation and whether clients should be permitted to consent to any such rehypothecation. The Commission estimates that roughly 19 state trust companies currently specialize in crypto custody.

Custody modernization

The Proposal includes targeted modernization amendments to both the Advisers Act and Investment Company Act custody rules. Under the Investment Company Act, the Proposal would expand eligible broker-dealer custodians to all registered broker-dealers (rather than only exchange members), subject to Exchange Act rule 15c3-3 or a comparable rule.²¹

Under the Advisers Act, the Proposal would: 

• except authorized discretionary trading authority from the custody rule, subject to conditions
• provide an exception from the surprise examination requirement where custody arises solely from a standing letter of authorization
• except inadvertent custody
• eliminate the PCAOB registration requirement for accountants engaged under the custody rule
• and require the client’s account number in the custodian notice.⁸

The Proposal also outlines expected revisions to the 2009 Commission Guidance on independent public accountant engagements under the custody rule.²²

Recordkeeping and reporting

Amendments to Advisers Act Rule 204-2 and Investment Company Act recordkeeping rules would add records corresponding to the self-custody, state trust company, and modernization rules.²³

Records required under applicable rules may be maintained and preserved on a crypto network, provided the adviser or fund can produce them promptly upon request in a “human-readable and reasonably usable electronic format.” 

New Form ADV questions in Item 9.F., Item 5.K., and Schedule D would require disclosure of self-custody arrangements, the approximate dollar amount of crypto assets held in self-custody, the number of clients whose crypto assets are self-custodied, and the crypto asset addresses used. Form N-CEN would add checkboxes for crypto asset self-custody, state trust company custody, and fund tokenization.

At a glance

Practical implications

Advisers considering self-custody

Registered investment advisers trying to determine whether the self-custody provisions of the new rules are workable should consider the following practical implications:

• The determination of whether a qualified custodian is available for a crypto asset is asset-by-asset and cannot rest on cost, so the gating analysis must be documented and refreshed quarterly.
• Exclusive possession of key materials means current arrangements that share key shares with clients, affiliates, or wallet vendors would need to be unwound.
• The use of third-party vendors is permissible, but vendor diligence must confirm the provider cannot access key materials or unilaterally move assets.
• The six-month internal control report deadline and the SOC 1 Type 2 standard create an audit-readiness timeline, and the Commission estimates the internal control report alone at roughly USD376,000 per adviser each year.
• A self-custodying adviser also remains subject to the annual surprise examination unless the client is a pooled investment vehicle relying on the audit provision.
• The written financial asset election requires client documentation changes and a state-law analysis under Article 8 of the Uniform Commercial Code.

Regulated funds and boards considering self-custody

Boards of registered funds should consider the following:  boards would take on a recurring oversight role, initial and quarterly review of the adviser’s no-QC-available report, an annual reasonable-care determination, and board designation by resolution of the supervised persons with key materials access, with an officer of the fund among the joint authorizers.

All advisers (including those with no crypto asset exposure)

The modernization amendments—including  discretionary trading authority, standing letter of authorization, and inadvertent custody exceptions; removal of the PCAOB requirement; changes to audit timing; the new requirement that a client’s account number must appear in the client notice; and the redesignation of Advisers Act custody requirements to Rule 223-1—would reach advisers with no crypto assets and would require conforming updates to compliance manuals, custodial agreements, and Form ADV responses. 

The Commission proposes no transition period: advisers and funds could rely on the self-custody and state trust company provisions, and would need to comply with the modernization amendments, as of the effective date, although the Commission asks whether more time is needed, including for advisers that hold key materials today.

Those considering submitting comments on the Proposal have until December 5, 2026 to do so.

Footnotes

1.  Investment Adviser and Regulated Fund Custody Rules; Crypto Custody Rules, Advisers Act Release No. IA-7023 (Oct. 1, 2026) (the “Proposing Release”).

2. SEC, Fact Sheet, Investment Adviser and Regulated Fund Custody Rules; Crypto Custody Rules (Oct. 1, 2026). 

3. Chairman Paul S. Atkins, Statement on Proposal to Address the Custody of Crypto Assets Under the Investment Advisers Act and the Investment Company Act (Oct. 1, 2026), available at https://www.sec.gov/newsroom/speeches-statements.

4. Proposing Release, supra note 1, Comment File No. S7-2026-35.

5. Proposed rule 223-1(b)(7); proposed rule 17f-9.

6. Proposed rule 17f-8; proposed rule 223-1(a)(1).

7. Proposed rule 223-1(b)(7)(i).

8. Proposed rule 223-1(b)(9); proposed rule 223-1(b)(10).

9. 17 CFR § 275.206(4)-2.

10. 17 CFR § 275.206(4)-2 (to be redesignated as 17 CFR § 275.223-1).

11. Simpson Thacher & Bartlett, SEC No-Action Letter (Sept. 30, 2025).

12. The Proposal would replace the Advisers Act custody rule (currently Rule 206(4)-2, issued under Section 206(4) of the Advisers Act) with new Advisers Act Rule 223-1, issued under Section 223 of the Advisers Act.

13. Currently, under Advisers Act Rule 206(4)-2, registered investment advisers are required to maintain assets for which they have custody with a “qualified custodian,” a category that currently only includes banks, broker-dealers, futures commission merchants, and foreign financial institutions that customarily holds financial assets for customers.

14. The Proposal defines the term “crypto asset” to mean any digital representation of value that is recorded on a cryptographically secured distributed ledger.

15. Proposed rule 223-1(d)(16).

16. Proposed rule 223-1(b)(7)(ii)(A) through (C).

17. Proposed rule 223-1(b)(7)(iii).

18. Proposed rule 223-1(b)(7)(iv).

19. Proposed rule 223-1(b)(7)(vi).

20. Proposed rule 223-1(b)(7)(viii).

21. 17 CFR § 240.15c3-3.

22. Commission Guidance Regarding Independent Public Accountant Engagements Performed Pursuant to Rule 206(4)-2 Under the Investment Advisers Act of 1940, Advisers Act Release No. 2969 (Dec. 30, 2009) [75 FR 1492 (Jan. 11, 2010)].

23. Proposed rule 204-2(a)(26).