SEC Proposes Crypto Asset Custody Framework for Investment Advisers and Regulated Funds

The SEC's proposed crypto custody framework would conditionally permit adviser self-custody when no qualified custodian is available, subject to strict operational conditions including dual-authorization and independent accountant review, while formally authorizing state-chartered trust companies as eligible custodians.

A. Executive Summary

On October 1, 2026, the Securities and Exchange Commission (SEC) voted to propose a comprehensive regulatory framework governing how registered investment advisers (RIAs), registered investment companies (funds), and business development companies (BDCs) custody client and fund crypto assets (Release Nos. IA-7023 and IC-36353, File No. S7-2026-35; SEC Release No. 2026-100). The proposal would update federal custody rules that long predated digital assets by creating two distinct custodial pathways: formally authorizing state-chartered trust companies to serve as eligible custodians alongside traditional qualified custodians, and conditionally permitting an adviser to self-custody crypto assets where no qualified custodian is available.

While heralded as a major step toward integrating digital assets into institutional portfolios, the proposal is far from a blanket deregulation. For General Counsel, Chief Compliance Officers, and digital asset risk teams, the proposal would contain stringent compliance gates, including a strict prohibition on key-sharing architectures, dual-authorization requirements for asset transfers, mandatory independent accountant review, mandatory Uniform Commercial Code (UCC) Article 8 classifications, and an explicit ban on citing custodian costs to justify self-custody, that would fundamentally alter institutional operational due diligence if adopted as proposed.

Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.

B. What Happened

On October 1, 2026, the SEC issued a Notice of Proposed Rulemaking to establish modernized custody standards under the Investment Advisers Act of 1940 and the Investment Company Act of 1940. The Commission recognized that existing safeguarding frameworks were designed around conventional certificated and uncertificated book-entry securities, creating persistent compliance friction for digital assets. As part of the proposal, the existing Advisers Act custody rule would be redesignated from Rule 206(4)-2 to new Rule 223-1.

The rulemaking package would establish two primary mechanisms and set specific conditions for each:

• Eligibility of State-Chartered Trust Companies: The proposal would expressly authorize state-chartered trust companies to serve as custodians for client and fund crypto assets alongside traditional qualified custodian categories (such as federally and state-chartered banks, registered broker-dealers, and futures commission merchants). This would provide formal regulatory codification, replacing the informal, fact-specific analysis and a September 2025 staff no-action letter that market participants have relied upon to treat state trust companies as banks for this purpose. Before engaging a state trust company, and annually thereafter, the adviser or fund would need a reasonable basis, after due inquiry, for believing the company is properly authorized and maintains adequate safeguarding policies, and would need to review its most recent audited financial statements and internal control report. All client crypto assets would need to be segregated from the trust company's proprietary assets.
  
  
• Conditional Adviser Self-Custody Exemption: The SEC proposed an exemption that would allow an investment adviser to maintain custody of client or fund crypto assets itself, subject to strict procedural prerequisites:
  
  
  • Lack of Qualified Custodian: The adviser would need to determine, in writing, before taking self-custody and quarterly thereafter, that no qualified custodian is reasonably available to hold the specific crypto asset.
    
    
  • Prompt Transfer Obligation: If a qualified custodian subsequently becomes available to hold the asset, the adviser would need to promptly transfer custody to that entity.
    
    
  • No "Cost" Justification: The SEC explicitly clarified that an adviser could not assert a qualified custodian is "unavailable" simply because the custodian's fees are high, commercially unattractive, or erode fund returns.
    
    
  • Documented Expertise and Segregated Addresses: The adviser would need documented expertise in safeguarding each specific crypto asset, including systems addressing private key management, and would need to hold each client's assets in one or more dedicated crypto asset addresses containing only that client's assets.
    
    
  • Dual Authorization: Any transaction involving a self-custodied crypto asset would require joint authorization by at least two people, with that control reviewed no less than annually.
    
    
  • Cybersecurity and Independent Review: The adviser would need to mitigate cybersecurity risks through at least annual reviews of its controls, and would need to obtain an internal control report from an independent public accountant within six months of taking self-custody and annually thereafter.
    
    
  • Client Reporting: Advisers would need to send account statements to each affected client at least quarterly, or provide equivalent information in a human-readable electronic format.
    
  Where the advisory client is a regulated fund, the fund's board would separately need to review the adviser's unavailability determination, both initially and quarterly, and independently determine, before the arrangement begins and annually thereafter, that the fund's crypto asset would receive reasonable care under self-custody.
  
  
• UCC Article 8 Status: To rely on the self-custody exemption, the adviser and client would need to enter into a written agreement explicitly stipulating that the crypto assets are treated as "financial assets" and that the adviser acts as a "securities intermediary" under applicable state law adopting Article 8 of the Uniform Commercial Code (UCC).
  
  
• Bifurcated Asset Scope:
  • Standard Advisory Clients: Under the Advisers Act custody rule, the framework would cover crypto assets that are legally "funds or securities." The SEC has separately addressed which major crypto assets it views as falling outside this category in other recent statements; readers should confirm the current list directly against SEC guidance rather than assume any specific token's classification.
    
    
  • Regulated Funds and BDCs: Under the Investment Company Act, the rule would encompass all crypto assets held by registered funds and BDCs under the broader statutory category of "securities and similar investments." Face-amount certificate companies and unit investment trusts would not be able to rely on the proposed fund self-custody or state trust company provisions at all.

The proposed rules would be subject to a 60-day public comment period following publication in the Federal Register.

(Official Source: SEC Release Nos. IA-7023 and IC-36353, File No. S7-2026-35, October 1, 2026)

Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.

C. Why It Matters for Legal & Compliance

This proposal would provide long-awaited regulatory pathways for institutional digital asset strategies, but it would introduce complex commercial and operational liabilities if adopted. Three points stand out:

1. The Key-Sharing and Multi-Party Computation (MPC) Dilemma

A significant portion of institutional crypto custodians and self-custodying asset managers use Multi-Party Computation (MPC) or key-sharding technologies, where private key shares are divided among the adviser, a technology vendor, and sometimes the client or an independent backup agent. The SEC's proposing release would establish a rigid supervisory baseline: possessing any portion of a cryptographic private key would constitute custody. To rely on the self-custody exemption, the adviser would need to maintain exclusive possession and control of the key materials. Arrangements where private key shards or signing authority are shared with third-party software providers or clients would not satisfy this standard.

In practice: a firm currently using a vendor-assisted MPC setup, where the vendor holds one key share and the adviser holds another, would not qualify for self-custody under this proposal as written. That firm would need to either restructure its key management so the adviser alone controls all key materials, or migrate those assets to an authorized state-chartered trust company instead.

2. Commercial Law Liabilities Under UCC Article 8

Requiring advisers to agree in writing to act as "securities intermediaries" holding "financial assets" under Article 8 of the UCC is designed to protect clients in the event of adviser insolvency by keeping crypto holdings out of the adviser's bankruptcy estate. However, this requirement would introduce substantial legal duties. Under UCC Article 8, a securities intermediary is bound by statutory duties to obtain and maintain financial assets corresponding to client entitlements, honor client entitlement orders, and refrain from encumbering assets without explicit authorization.

In practice: this isn't just a label change. Agreeing to be a "securities intermediary" means taking on a defined set of legal obligations under state commercial law, obligations that exist independently of, and in addition to, the adviser's fiduciary duties under the Advisers Act. Standard investment advisory agreements and custodial disclosures would need a substantive overhaul to reflect these commercial code duties, not just updated defined terms.

3. Fiduciary Oversight of State-Chartered Trust Companies

Expanding the qualified custodian pool to include state-chartered trust companies would solve a market bottleneck, but it would elevate counterparty due diligence requirements. Regulated trust companies vary widely in capital reserves, supervisory examination frequency by state banking departments, cybersecurity defenses, and insolvency regimes. Institutional advisers and fund boards would need to establish defensible, ongoing vendor-risk frameworks to evaluate trust company custodians, rather than treating state chartering as a perfunctory check-the-box approval, and would need to conduct that diligence on an annual recurring basis, not just at onboarding.

In practice: two state-chartered trust companies can look similar on paper while differing significantly in actual safeguards. An adviser can't treat "state-chartered" as a single pass/fail criterion; the proposal would require an ongoing, documented evaluation of each specific trust company's financial condition and control environment, repeated annually.

Compliance & Risk Insight: The "Quarterly Unavailability" and "Cost" Traps

The most significant compliance risk for asset managers would be treating the self-custody provision as an open door to operate internal proprietary wallets. The SEC appears to have deliberately constructed the self-custody provision as an exception of last resort, layered with ongoing operational obligations rather than a one-time qualification.

Firms would need to navigate several specific traps:

1. The "Cost" Exclusion Trap: Many asset managers prefer self-custody because institutional crypto custodians charge premium basis-point custody fees and onboarding minimums. The SEC's text would explicitly foreclose this rationale: compliance teams could not claim that a qualified custodian is "unavailable" because its services are cost-prohibitive or commercially unfeasible. If a single qualified custodian in the market supports the token, regardless of pricing, the adviser would be legally barred from self-custodying that asset.
   
   
2. The Quarterly Tracking Burden: Because the written unavailability determination would need to be renewed every quarter, compliance could not treat custodial analysis as a static onboarding event. An asset manager self-custodying a basket of secondary altcoins would need to run quarterly market sweeps. The moment an authorized trust company or broker-dealer announces custody support for an asset in that basket, the adviser's self-custody exemption for that token would terminate, triggering a mandatory operational migration.
   
   
3. The Ongoing Verification Burden: Beyond the quarterly unavailability check, the proposal would layer on annual cybersecurity reviews, annual dual-authorization control reviews, and an independent accountant's internal control report within six months of starting self-custody and annually thereafter. Firms that treat self-custody qualification as a one-time compliance exercise would be substantially underprepared for the ongoing documentation burden this proposal would actually impose.

In practice: budgeting for self-custody under this framework isn't a single upfront cost. It's a recurring annual compliance program in its own right, with its own accountant engagement, its own cybersecurity review cycle, and its own market-monitoring function, on top of the underlying custody and security infrastructure

Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.

D. Action Items for Organizations

• Audit Private Key Architecture and Vendor Contracts: Review existing custodial setups to determine whether private keys or key shares are held internally, through MPC software, or via third-party custodians. Confirm whether any internal wallet framework would satisfy the SEC's proposed "exclusive possession" mandate, and identify which arrangements rely on shared-key structures that would not qualify.
  
  
• Map the Full Self-Custody Compliance Stack: Beyond key custody, inventory what would be needed to support self-custody under the proposal as drafted: segregated per-client wallet addresses, a dual-authorization transaction process, an annual cybersecurity review cycle, an independent accountant engagement, and a quarterly client statement process.
  
  
• Update Advisory Agreements for UCC Article 8: Work with corporate counsel to draft standard contractual addenda designating self-custodied crypto holdings as "financial assets" and establishing the adviser's status as a "securities intermediary" under applicable state law adopting Article 8 of the Uniform Commercial Code.
  
  
• Establish a Formal "Qualified Custodian Availability" Review Protocol: Design an auditable, quarterly compliance workflow to document the unavailability of qualified custodians for any self-custodied tokens, ensuring the review explicitly excludes fee considerations from the evaluation criteria.
  
  
• Confirm Current Crypto Asset Classifications Directly: Before relying on any characterization of a specific token as falling outside the Advisers Act's funds-or-securities prong, confirm the SEC's current position directly against its guidance rather than relying on summaries, given how actively contested some token classifications remain.
  
  
• Differentiate Product Scope by Entity Type: Map digital asset holdings across separate accounts and pooled vehicles. Apply standard Advisers Act funds-or-securities tests for individual client mandates, ensure registered funds and BDCs treat all crypto asset holdings as subject to the 1940 Act safeguarding requirements, and confirm whether any entity in scope is a face-amount certificate company or unit investment trust that would be excluded from the proposed self-custody and trust company provisions entirely.
  
  
• Perform Enhanced Due Diligence on State Trust Companies: Develop a dedicated counterparty vetting framework for state-chartered trust companies, auditing their state regulatory examination records, audited financial statements and internal control reports, SOC 1 Type II / SOC 2 Type II reports, private key segregation practices, and insurance policy exclusions, on a recurring annual basis.
  
  
• Prepare for Fund Board Governance Obligations: Where a regulated fund's adviser intends to rely on self-custody, prepare board materials supporting the board's own independent, annual determination that self-custody is consistent with reasonable care for the fund's crypto assets.
  
  
• Prepare Stakeholder Comments: Engage internal legal, risk, and portfolio teams to analyze the specific economic and operational impacts of the proposal, preparing formal feedback before the 60-day comment window closes following Federal Register publication.

Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.

Disclaimer: This article does not constitute legal advice. Readers should seek legal or tax advice from their professional advisers regarding their specific regulatory and legal obligations.