The US Securities and Exchange Commission (SEC) on 1 October 2026 proposed new custody rules that would give registered investment advisers and regulated funds a dedicated framework for holding crypto assets. The package, made under the Investment Advisers Act of 1940 and the Investment Company Act of 1940, would let advisers and funds keep crypto assets in self-custody in certain circumstances and use state trust companies as custodians, both subject to conditions.
Regulated funds here means registered investment companies and business development companies. The proposal also carries a broader clean-up of custody rules that, according to Chairman Paul S. Atkins, have not been amended for decades.
"Today, the Commission proposed to close a gap that has left investment advisers and funds guessing how to effect lawful custody of an asset class that their clients increasingly demand," by Chairman Paul S. Atkins of the U.S. Securities and Exchange Commission
The gap the SEC is trying to close
The current rules require client and fund assets to sit with a permitted custodian. That works for shares and bonds, but the SEC's fact sheet acknowledges that a permitted custodian may not be readily available for certain crypto assets. Custodians that do serve the market have not been able to support every token, particularly nascent or novel ones.
Some state chartered limited purpose trust companies have stepped in to offer crypto custody. Banks already count as permitted custodians, but whether a state trust company meets the statutory definition of a bank currently turns on a fact specific analysis of state and federal law. For advisers, that has meant legal uncertainty over which providers they can use.
In his accompanying statement, Atkins put the timing problem plainly.
"However, with newly developed crypto assets, custodial capabilities may lag an asset's deployment by many months. That is a substantial problem, one which today's proposal intends to solve," by Chairman Paul S. Atkins of the U.S. Securities and Exchange Commission
Self-custody, with a long list of conditions
The most notable change is a new route for an adviser to hold a client's crypto asset itself. Under the proposal, that is allowed only if the adviser first determines that no permitted custodian is available for the asset, and then repeats that check every quarter. The adviser must also:
- have, and document, expertise in safeguarding each crypto asset, with systems covering private key management and joint authorisation of transactions by at least two people, reviewed at least once a year;
- keep each client's crypto assets in one or more addresses on the network that hold only that client's assets;
- manage cybersecurity risk and review its controls at least annually;
- obtain internal control reports from an independent public accountant within six months of first taking self-custody, and every year after that;
- send account statements to affected clients at least quarterly; and
- agree in writing with the client to treat each self-custodied crypto asset as a financial asset, which brings additional protections under applicable state law.
A new rule under the Investment Company Act would let a regulated fund self-custody crypto through its adviser, provided the adviser meets those conditions and the fund's board oversees the arrangement. The board would review the adviser's written report on why no qualified custodian is available, first and then quarterly. It would also have to decide before custody begins, and every year after, that the asset would be subject to reasonable care.
State trust companies get a defined role
The second pillar would permit state trust companies to provide custody and advice to clients and regulated funds on crypto assets. Before appointing one, and annually thereafter, the adviser or fund would need a reasonable basis, after due inquiry, to believe that the trust company is authorised by its state banking authority to provide crypto custody and has written policies and procedures to safeguard the assets. It would also have to receive and review the trust company's latest audited financial statements and internal control report. Client and fund crypto assets would have to be segregated from the trust company's own.
That approach runs parallel to the federal route. Our earlier analysis of the Office of the Comptroller of the Currency's charter signal for digital asset firms looked at the national trust bank path; the SEC proposal would give state chartered providers a clearer place in adviser custody without requiring them to qualify as a bank.
Wider custody housekeeping
Beyond crypto, the proposal would redesignate the Advisers Act custody rule under Section 223 of the Advisers Act and revise several long-standing requirements. According to the fact sheet, it would:
- remove the requirement that accountants doing custody rule work be registered with, and inspected by, the Public Company Accounting Oversight Board;
- extend audited financial statement delivery deadlines for funds of funds and adjust timing for pooled vehicles formed near the end of their fiscal year, while requiring statements to follow U.S. Generally Accepted Accounting Principles, with an exception for foreign pooled vehicles;
- create exceptions for discretionary trading authority, standing letters of authorisation and inadvertent custody; and
- remove outdated conditions for broker-dealer custody of fund assets and rescind an unused rule on free cash accounts.
Recordkeeping rules would be updated to match, and records kept on a crypto network could satisfy those requirements, subject to conditions. Form ADV and Form N-CEN would collect more information about the custody of crypto assets and tokenised fund shares.
Why it matters
This is not the SEC's first attempt at rewriting adviser custody. A 2023 Safeguarding Proposal was never adopted, and the Commission formally withdrew it on 12 June 2025. This time the focus is a crypto-specific pathway, and Atkins framed it as one part of a wider programme that includes the agency's proposed Regulation Crypto Assets.
Regulators elsewhere are also looking at how crypto is safeguarded. In the European Union, the European Securities and Markets Authority has put crypto asset service provider custody resilience under review, a useful reference point for global managers comparing regimes.
The public comment period will remain open for 60 days after the proposed release is published in the Federal Register.
