The Securities and Exchange Commission proposed new custody rules for crypto assets on Thursday, covering registered investment advisers and the funds they manage. The proposal runs under the Investment Advisers Act and the Investment Company Act, and it does three large things at once: it lets advisers hold client crypto in limited circumstances, it opens the qualified custodian category to state trust companies, and it rewrites a set of audit and recordkeeping requirements that have nothing to do with crypto at all.
The part drawing attention is the first one. The commission's release calls it self-custody, and the label deserves the skepticism one commissioner applied to it, because the arrangement it describes is not an investor holding a key. It is an adviser holding the key for a client when no one else will.
That is the architecture of the whole proposal. The commission is not blessing a practice so much as regulating the shape it has taken in a market where the ordinary path was never built.
The proposal is a fallback with a condition attached
The custody rule that governs advisers has always required client assets to sit with a qualified custodian, a bank, a broker-dealer, or a trust company that meets the definition. For most asset classes that requirement is easy to satisfy. For crypto it has been close to impossible, because the traditional custodians have been slow to build the operational capacity to hold assets that move on a blockchain, and the release itself acknowledges that few such custodians offer robust services across a substantial range of crypto assets.
The proposal's answer is a documented exception. An adviser can take custody of client crypto if it determines that no permitted custodian is available to do the job. The determination has to be made before the assets move, documented as to its basis, and revisited at least quarterly. If a suitable custodian becomes available later, the assets have to be transferred to it as soon as is reasonably practicable.
Fees alone do not justify the decision. An adviser that finds a custodian expensive has not found one that is unavailable, and the release draws that line explicitly, which turns the exception into a test of the market rather than a test of the adviser's budget.
The determination is the soft spot in the framework
Everything downstream of the exception depends on a judgment the adviser makes about availability, and that judgment is the part of the proposal most likely to be litigated later.
An adviser that holds client crypto under the exception is asserting that nothing better existed. Examiners can revisit that assertion after the fact, with the benefit of knowing what the custodian market looked like on the day the assets moved and what the adviser asked before concluding it did not. A firm that ran a quick search and reached a convenient answer has created a record of it. A firm that documents inquiries across custodians, capabilities, and asset types has created a defense.
The quarterly refresh raises the stakes rather than lowering them, because the market changes. A custodian that could not hold a given asset in January may be able to hold it by April, and the proposal puts the burden on the adviser to notice and move. Custody arrangements are operationally expensive to unwind, and a rule that requires migration when a better option appears is a rule that will be tested by the first adviser that finds migration more costly than the determination.
State trust companies get a route into the category
The second expansion is quietly larger. The proposal would let state-chartered trust companies serve as qualified custodians for client and regulated fund crypto assets, which opens the category to a set of institutions that many states have spent the last several years authorizing specifically for this purpose.
The conditions are drawn from the no-action position the commission's staff took in September 2025. Before engaging one, and annually after that, an adviser or fund must have a reasonable basis for believing the trust company is authorized by its state banking regulator to provide crypto custody, and that it has written policies and procedures designed to keep those assets from being stolen, lost, misused, or misappropriated. The trust company's audited financial statements and internal control reports have to be reviewed, and client assets have to be segregated from the custodian's own.
For the states that built a crypto trust charter, the proposal converts a state license into national reach for federal purposes. For the commission, it moves supervision of the custodian to state banking departments, which have different staff, different expertise, and different budgets than the SEC. Whether that is a strength or a gap depends on what happens at the first failure.
The safeguards assume the adviser has become a custodian
The proposal's conditions read like a checklist written by people who have thought about how crypto gets lost. An adviser taking custody would need documented key management and security systems, transaction authorization by at least two people, and separate on-chain addresses for each client so that no client's assets are commingled with another's.
It would also need cybersecurity controls reviewed annually, an independent accountant's report on internal controls within six months of taking custody and annually after that, and quarterly statements to clients showing the address and network holding the assets, the period-end balance, and every transaction in the period.
Read closely, the requirements are the operational core of a trust company, applied to an investment adviser. That is the trade the proposal makes. In exchange for letting advisers hold assets they previously could not hold, the commission imports the controls that make holding them safe, and it makes the adviser's own auditor attest to them. The quarterly statement requirement is the part clients will feel, because it turns a black box into a list of addresses they can check.
The rules reach fewer assets than the name suggests
The framework's scope is narrower than the headline. As the proposing release states, the Advisers Act amendments would apply only to crypto assets that are funds or securities, or, for a regulated fund account, a security or similar investment. The Investment Company Act rules would apply to crypto assets that are securities or similar investments.
For clients that are not regulated funds, the native coins that account for most of the market's value generally fall outside the rule's reach. Bitcoin, ether, and similar assets are not funds or securities, so an adviser holding them for an individual client is not governed by the custody amendments the commission just proposed.
That leaves an odd shape. The commission is building a detailed custody framework for one part of the crypto market, while the assets most investors want held sit outside it. The gap is not a drafting mistake, since the commission's jurisdiction follows the securities laws, but it means the proposal answers a question that the market has been asking less urgently than the one it leaves open.
One commissioner objected to the vocabulary
Commissioner Hester Peirce supported the proposal and objected to the term. In a statement published with the release, she wrote that the proposal uses self-custody in a way that does not reflect true self-custody by investors, and that she would have preferred shelf-custody to distinguish an adviser holding assets for clients from investors holding their own.
Her point is not semantic. Regulators have spent several years arguing about whether investors should be able to hold their own crypto without an intermediary, and the proposal uses the vocabulary of that debate to describe its opposite. Peirce wrote that regulators should protect investors' right to custody their own assets and not force them to custody with someone else, and then moved on to the substance of the proposal, which she described as expanding custody options.
The commission also considered the structural conflict in the arrangement. An adviser that holds client assets and also charges for managing them stands on both sides of the trade, which is why the release leans on the fund board's oversight for regulated funds and on the adviser's fiduciary duty for everyone else.
What the comment period will test
The proposal was approved by the commission and published for comment, which will run for 60 days after the release appears in the Federal Register. Nothing in it takes effect until the commission votes on a final version, and no one should treat the framework as the rule yet.
The comments worth watching are the ones that will test the availability determination, since that is where the framework meets the market. Custodians will be asked why they do not serve certain assets, and their answers will either support the premise that the exception is necessary or undercut it. Advisers will be asked what a quarterly determination costs to document and defend. State trust companies will be asked what their supervisors can see.
The proposal also arrives in the gap left by legislation. The Digital Asset Market Clarity Act, the market-structure bill that would have divided oversight of digital assets between the SEC and the Commodity Futures Trading Commission, failed a cloture vote in the Senate on September 15 by 49 to 50, well short of the 60 it needed. The Senate left Washington in early October and returns after the midterm elections, so the framework the bill would have created is not arriving this year.
In its place, the agencies are writing what they can inside their existing authority. The commission proposed a separate rule on crypto asset offerings in August, with comments closing October 20. Two limits come with that route, and both are structural rather than political. A rule can be rewritten by a later commission, unlike a statute, and several of the pieces the market wanted from the bill, including a licensing regime for spot-market intermediaries and priority for customer property in a bankruptcy, exist only in legislation. The custody proposal is careful work inside a boundary that did not move.
Primary sources
- U.S. Securities and Exchange Commission, SEC Proposal Would Address How Investment Advisers and Funds Can Custody Crypto Assets Under the Federal Securities Laws, Press Release 2026-100 (Oct. 1, 2026), for the scope of the proposal, the self-custody and state trust company provisions, and Chairman Paul Atkins' statement.
- U.S. Securities and Exchange Commission, Adviser and Regulated Fund Custody Rules; Crypto Custody Rules, Investment Advisers Act Release No. 7023 (Oct. 1, 2026), the proposing release, for the availability determination, its quarterly review, the treatment of custodian fees, the safeguards, the audit and recordkeeping amendments, and the statement of the rules' scope.
- U.S. Securities and Exchange Commission, Roller Coaster Ride: Statement on Proposed Adviser and Regulated Fund Custody Rules; Crypto Custody Rules, statement of Commissioner Hester M. Peirce (Oct. 1, 2026), for the shelf-custody objection and her description of the proposal's custody options.
- U.S. Securities and Exchange Commission, Safeguarding Advisory Client Assets, Investment Advisers Act Release No. 6240 (Feb. 15, 2023), the withdrawn 2023 custody proposal cited in the current release.