SEC Proposes Custody Rule Changes Allowing Advisers and Regulated Funds to Self-Custody Crypto Assets
On October 1, 2026, the Securities and Exchange Commission (SEC) proposed new rules and amendments to provide a tailored framework for the custody of crypto assets for registered investment advisers and regulated funds. Notably, the proposed changes would permit investment advisers to self-custody clients' crypto assets and to use state trust companies as custodians, subject to certain conditions. In 2023, the SEC proposed broad "Safeguarding" amendments that would have extended the custody rule to all client assets. The SEC withdrew that proposal in 2025. The current proposal takes a narrower approach focused on crypto assets.
The current custody rules under the Investment Company Act of 1940 and the Investment Advisers Act of 1940 were designed to protect adviser client and regulated fund assets from risk of loss, theft, misuse, and misappropriation. However, investors have increasingly sought investment exposure to crypto assets. This proposal seeks to address existing limitations inhibiting advisers' ability to provide advice related to crypto assets.
Self-Custody
Under the current rule framework, advisers typically custody client assets with a regulated qualified custodian. Because typical custodians may be unwilling or unable to hold certain crypto assets, the new proposal would permit advisers to self-custody crypto assets for their clients if they determine a permitted custodian is not available to maintain the crypto asset and confirm this remains the case on a quarterly basis. Self-custody means the adviser holds any portion of the private keys needed to access and transact in the crypto asset.
Other requirements for adviser self-custody include the following:
- The adviser must have expertise regarding the safeguarding of each crypto asset.
- The adviser must adopt systems to safeguard crypto assets against loss, theft, misuse, and misappropriation, and must review its safeguarding systems annually.
- The adviser must maintain each client's crypto assets in one or more crypto asset addresses on the crypto network storing only such client's crypto assets.
- The adviser must mitigate cybersecurity risks associated with safeguarding clients' crypto assets held in self-custody and, at a minimum, annually review its cybersecurity controls.
- Within six months of taking self-custody of crypto assets and on an annual basis thereafter, the adviser must obtain internal control reports from an independent public accountant concerning its control objectives relating to custodial services, including the safeguarding of crypto assets.
- The adviser must send account statements quarterly to each client for whom the adviser is self-custodying crypto assets.
Additionally, regulated funds would be permitted to maintain crypto assets in self-custody through the regulated fund's adviser if the adviser complies with the self-custody rule and the regulated fund's board of directors oversees the custody arrangement. "Regulated funds" include registered investment companies and business development companies.
State Trust Companies
The new proposal would also permit state trust companies to serve as custodians of advisory client and regulated fund crypto assets. Prior to engaging a state trust company and annually thereafter, an adviser or regulated fund must have a reasonable basis, after due inquiry, to believe the state trust company is authorized by the relevant state banking authority to provide crypto asset custody. Additionally, the following requirements must be met:
- The adviser or regulated fund must have a reasonable basis, after due inquiry, for believing that the state trust company maintains and implements written policies and procedures reasonably designed to safeguard crypto assets and related cash and/or cash equivalents from the risk of theft, loss, misuse, and misappropriation.
- The adviser or regulated fund must receive and review the state trust company's most recent annual audited financial statements.
- The adviser or regulated fund must receive and review the state trust company's most recent internal control report.
Additionally, all advisory client and regulated fund crypto assets must be segregated from the state trust company's proprietary assets.
The proposal also includes other items that would modernize the custody rules under the Investment Company Act of 1940 and the Investment Advisers Act of 1940. The proposal does not currently have any legal effect. The comment period on the proposal will remain open for 60 days following publication in the Federal Register.
For more information on the SEC's proposed crypto asset custody rule changes, please contact Eric Mikkelson, Heidi Wicker or the Stinson LLP contact with whom you regularly work.
