Key Takeaways
- • On October 1, 2026, the SEC proposed rules under the Advisers Act and Investment Company Act permitting registered investment advisers and regulated funds to self-custody crypto assets, and to custody them with state trust companies, subject to conditions.
- • Self-custody is available only where no qualified custodian will maintain the asset; cost is not a permissible basis, and advisers must hold exclusive possession of key materials, obtain SOC 1 Type 2 reports, and send quarterly account statements.
- • The proposal would designate state trust companies as qualified custodians and would replace the September 2025 staff no-action letter with formal rules (Rule 223-1 and Rules 17f-8 and 17f-9).
- • Targeted modernization amendments would except authorized discretionary trading authority and inadvertent custody, eliminate the PCAOB registration requirement for custody-rule accountants, and broaden eligible broker-dealer custodians.
- • The Proposing Release was published in the Federal Register on October 6, 2026, opening a 60-day public comment period; the Commission estimates roughly 19 state trust companies currently specialize in crypto custody.
Summary
The U.S. Securities and Exchange Commission proposed on October 1, 2026 new rules and amendments under the Investment Advisers Act of 1940 and the Investment Company Act of 1940 addressing custody of crypto assets, according to A&O Shearman's analysis of the proposal. The proposal would permit registered investment advisers and registered management investment companies and business development companies (collectively, regulated funds) to self-custody crypto assets under certain conditions, permit them to maintain client or fund crypto assets with a state trust company, modernize the custody rules under both statutes, and update recordkeeping and disclosure requirements. Chairman Paul S. Atkins said the Commission aimed "to close a gap that has left investment advisers and funds guessing how to effect lawful custody of an asset class that their clients increasingly demand." The Proposing Release was published in the Federal Register on October 6, 2026, and the comment period remains open for 60 days.
Self-custody under the Advisers Act would be an exception to the new Rule 223-1, including its qualified custodian requirement. Self-custody means possessing any portion of a crypto asset's key materials; mere authority to obtain possession confers custody but not self-custody. Advisers must determine in writing, before self-custody and at least quarterly thereafter, that no qualified custodian will maintain the asset, and cost is not a permissible basis. They must document safeguarding expertise, maintain key management and joint authorization controls (at least two designated persons, including a management person, to authorize transfers), segregate each client's assets by address, and review cybersecurity controls at least annually. Advisers must obtain internal control reports from an independent public accountant within six months of self-custody and annually thereafter, with a SOC 1 Type 2 report required and a Type 1 report insufficient. Client and adviser must also agree in writing to treat the assets under UCC Article 8, a step the Commission calls critical because self-custodying advisers lack FDIC and SIPC backstops.
For regulated funds, self-custody through the adviser is permitted if the adviser complies with the Advisers Act provisions and the fund's board oversees the arrangement, reviewing the adviser's written report initially and quarterly. The proposal would also designate state trust companies as qualified custodians under both statutes, requiring advisers and funds to determine in writing that the trust company is authorized by its state banking authority and maintains adequate safeguarding policies, and to review its audited financials and internal control report. The proposal omits the contractual bar on lending, pledging or rehypothecating client crypto assets found in the September 2025 no-action letter, and the Commission has requested comment on that issue.
According to the proposal, the custody requirements apply to certain crypto assets, with the governing test differing by statute. The SEC views digital commodities such as Bitcoin, Ether and Solana as generally outside Advisers Act custody requirements, while for regulated funds the Commission reads the broader "securities or similar investments" category to include them. The proposal reverses the SEC's approach following the withdrawal of the 2023 safeguarding proposal in June 2025.
Self-custody under the Advisers Act would be an exception to the new Rule 223-1, including its qualified custodian requirement. Self-custody means possessing any portion of a crypto asset's key materials; mere authority to obtain possession confers custody but not self-custody. Advisers must determine in writing, before self-custody and at least quarterly thereafter, that no qualified custodian will maintain the asset, and cost is not a permissible basis. They must document safeguarding expertise, maintain key management and joint authorization controls (at least two designated persons, including a management person, to authorize transfers), segregate each client's assets by address, and review cybersecurity controls at least annually. Advisers must obtain internal control reports from an independent public accountant within six months of self-custody and annually thereafter, with a SOC 1 Type 2 report required and a Type 1 report insufficient. Client and adviser must also agree in writing to treat the assets under UCC Article 8, a step the Commission calls critical because self-custodying advisers lack FDIC and SIPC backstops.
For regulated funds, self-custody through the adviser is permitted if the adviser complies with the Advisers Act provisions and the fund's board oversees the arrangement, reviewing the adviser's written report initially and quarterly. The proposal would also designate state trust companies as qualified custodians under both statutes, requiring advisers and funds to determine in writing that the trust company is authorized by its state banking authority and maintains adequate safeguarding policies, and to review its audited financials and internal control report. The proposal omits the contractual bar on lending, pledging or rehypothecating client crypto assets found in the September 2025 no-action letter, and the Commission has requested comment on that issue.
According to the proposal, the custody requirements apply to certain crypto assets, with the governing test differing by statute. The SEC views digital commodities such as Bitcoin, Ether and Solana as generally outside Advisers Act custody requirements, while for regulated funds the Commission reads the broader "securities or similar investments" category to include them. The proposal reverses the SEC's approach following the withdrawal of the 2023 safeguarding proposal in June 2025.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.