Custody Battle: The SEC Reshapes the Rules for Advisers and Funds

On October 1, 2026, the Securities and Exchange Commission (the “SEC”) proposed new rules and amendments that would address how investment advisers may custody client crypto funds and securities, and how investment companies and business development companies may custody crypto securities and similar assets.[1]

Although the proposed rules would broadly modernize the regulatory framework for custody of client assets, a major focus is custody of crypto assets. As investor interest in crypto has grown, so have concerns that existing rules simply do not address how investment advisers could invest in this emerging asset class without running afoul of decades-old custody rules that were designed for safekeeping of traditional stocks and bonds.

The proposed rules would address these concerns by removing a regulatory barrier that currently restricts the ability of advisers to invest in certain types of crypto assets.Among other things, the proposed rules under the Investment Advisers Act of 1940 (the “Advisers Act”) and the Investment Company Act of 1940 (the “1940 Act”) would allow registered investment advisers, under certain specific conditions, to:

• “self-custody” client and Regulated Fund crypto assets when they determine that no “qualified custodian” is available to maintain a crypto asset; and
• maintain custody of crypto assets with state trust companies authorized by a state banking authority, provided that certain safeguards are in place.

Our take

The proposed rules reflect a significant, practical step forward in the regulation of investment advisers and investment companies. They would establish a more workable framework for custody of crypto assets, an asset class that is growing in market acceptance. The framework would accommodate technological advances, an area in which the existing framework has fallen short. For example, investment advisers who want to invest in novel assets that rely on developing technologies may not be able to find qualified custodians capable of providing custodial services for those assets because custodians may face high upfront costs or lack the necessary technology infrastructure.

In January 2025, the SEC established the Crypto Task Force (the “Task Force”) to develop a comprehensive regulatory framework for crypto assets. The Task Force solicited public comments and met with industry stakeholders to better understand the compliance challenges crypto investors face. The proposed rulesrespond to concerns raised through the Task Force’s public engagement.

We note that the SEC proposed to redesignate the Advisers Act custody rule as new Rule 223-1 under section 223 of the Advisers Act. The redesignation would better align with the specific statutory authority regarding registered investment adviser custody of client assets.Rule 206(4)-2 currently resides under section 206 (the anti-fraud section), and the redesignated rule would no longer be framed as relating to a fraudulent, deceptive or manipulative practice under that section.The proposed redesignation, however, would leave advisers’ fiduciary obligations regarding custody and safeguarding of client funds and securities intact. Advisers must continue to take reasonable steps to safeguard client funds and securities, act in the clients’ best interests, and eliminate conflicts or provide full and fair disclosure.

This redesignation does not appear to change the rule’s requirements, although the SEC asked for public comment as to whether there are any practical implications for this revision.

The current custody rules

The current custody rules, which were designed to address safekeeping of traditional assets, like stocks and bonds, limit the types of financial institutions that are eligible to serve as custodians of client or fund assets.

• Registered investment advisers. Rule 206(4)-2 under the Advisers Act (the “Advisers Act custody rule”) provides that registered investment advisers with custody of “client funds or securities” must keep them with a “qualified custodian,” subject to certain exceptions. This generally means a bank, registered broker-dealer, futures commission merchant, or certain foreign financial institutions.
• Regulated Funds.Section 17(f) of the 1940 Act requires each registered investment company and business development company (a “BDC” and, together with registered investment companies, each a “Regulated Fund” and collectively, “Regulated Funds”) to “place and maintain its securities and similar investments” in the custody of banks or broker-dealers, or in self-custody in accordance with SEC rules. Rule 17f-2 under the 1940 Act permits a fund to hold its own assets, subject to conditions designed for stock certificates rather than crypto assets.

Investment advisers and Regulated Funds currently face compliance challenges when they want to hold crypto assets. The SEC has acknowledged that without a workable regulatory framework that would expand the universe of permitted custodians, “advisory clients (including Regulated Funds) would be limited in their ability to invest in certain crypto assets.”

Self-custody option. The SEC proposed to add a new provision that would allow advisers to hold in self-custody the crypto assets of their advisory clients, including Regulated Funds, for which they provide investment advice (proposed Rule 223-1(b)(7), the “adviser self-custody rule”). The SEC would also add a new 1940 Act rule to allow a Regulated Fund to maintain its crypto assets in self-custody through its adviser if the adviser complies with the adviser self-custody rule, subject to oversight by the fund’s board of directors (proposed Rule 17f-9, the “fund self-custody rule”).

Custody versus self-custody. The proposed Advisers Act custody rule distinguishes between custody and self-custody of an asset. For purposes of the proposed rule, an adviser could have custody of an asset without having self-custody.

Custody defined. The Advisers Act defines “custody” as holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them.An adviser also has custody if a related person holds client assets, directly or indirectly, or has the authority to obtain possession of those assets.

The Advisers Act custody rule would retain the three prongs of the current definition of custody of “client funds or securities,” generally summarized as follows:

• Possession of client funds or securities (including, for purposes of the proposed rule, possession of client crypto assets via self-custody);
• Any arrangement under which the adviser is authorized to withdraw funds or securities maintained with a custodian upon the adviser’s instruction (e.g., drawing on client funds to pay the adviser’s fee); and
• Any capacity (e.g., general partner, managing member) that gives the adviser or its supervised person legal ownership or access to client funds or securities.

When it comes to crypto assets, the proposed rule draws an important distinction. The mere authority to obtain possession of the key material to a client’s crypto asset, without actually possessing the key materials, would not impute self-custody of the crypto asset to an adviser.A ccess to the key material, however,would give the adviser custody of the crypto asset, because the adviser effectively would have the authority to obtain possession of the crypto asset.

This distinction is significant, because an adviser with custody of a crypto asset, but not self-custody of the crypto asset, would not be required to comply with the proposed adviser self-custody rule. The adviser, however, would be required to comply with the other requirements of the Advisers Act custody rule.

Self-custody defined. For purposes of the proposal, self-custody of a crypto asset generally means that the adviser holds a client’s crypto asset through possession of any part of the cryptographic private keys (“key materials”) necessary to access and effectuate transactions in the crypto asset, or by a Regulated Fund holding the crypto asset through an adviser that complies with the adviser self-custody rule, in each case without maintaining the crypto asset at a “qualified custodian” as defined in the Advisers Act custody rule (or, in the case of a Regulated Fund, a permitted custodian).

The proposed self-custody rule generally would not apply to crypto assets that are maintained by an adviser or its related person when they act in the capacity of a “qualified custodian.”

Custody, or no custody?

The SEC said that although a crypto asset “may or may not” meet the definition of a security under the federal securities laws, the proposed Advisers Act custody rule would “only apply with respect to crypto assets that are funds or securities (or, with respect to the account of a Regulated Fund, a security or similar investment), and the proposed Investment Company Act custody rules would only apply with respect to crypto assets that are securities or similar investments.”

The Proposing Release states that crypto assets subject to the Advisers Act custody rule include:

• Crypto assets that are digital representations of funds (e.g., cash, bank accounts, payment stablecoins issued by permitted payment stablecoin issuers under the GENIUS Act or by foreign payment stablecoin issuers registered under section 18 of the GENIUS Act, and tokenized deposits); or
• Digital securities (commonly known as “tokenized” securities).

The Proposing Release specifically states that crypto assets native to a crypto network (e.g., Bitcoin, Ether, Solana) generally are not subject to the Advisers Act custody rule for clients other than Regulated Funds, because they are not funds or securities. When an adviser self-custodies them for a Regulated Fund’s account, however, they would qualify as “securities and similar investments,” and both the adviser self-custody rule and the fund self-custody rule would apply.

The release does not resolve how the Advisers Act custody rules would apply to a non-security crypto asset sold under an investment contract. The SEC addressed this issue in its March 2026 security interpretation, which stated that a non-security crypto asset can be offered and sold subject to an investment contract that is itself a security.[2] In the Proposing Release, the SEC asks whether any guidance or additional changes to its custody rules are needed for these assets.

Conditions for self-custody of crypto assets. If an adviser wants to maintain self-custody of a crypto asset for its client, it must comply with the following conditions:

• Qualified custodian determination. Before taking self-custody of each crypto asset, and at least every quarter afterward, the adviser must determine in writing that it has a reasonable basis, after due inquiry, to believe that no qualified custodian (for a Regulated Fund, a bank or other custodian permitted under section 17(f) of the 1940 Act) will maintain that asset. If the adviser later determines that a qualified custodian has become available, it must move the asset to that custodian as soon as reasonably practicable.
• Safeguarding expertise and systems. The adviser must have real expertise in safeguarding each crypto asset and document why it believes it has that expertise. It must also set up and maintain systems that protect the asset from loss, theft, misuse, and misappropriation, and review those systems every year to confirm that they are effective. The adviser’s safeguarding systems must address:
  • Private key management;
  • Joint authorization of crypto asset transactions by at least two people; and
  • Maintaining each client’s crypto assets in one or more addresses corresponding only to that client’s crypto assets on the crypto network.
• Cybersecurity. The adviser must mitigate cybersecurity risks to the crypto assets it holds, assess those risks in writing at least once a year, maintain measures to detect, respond to and recover from cyber threats and incidents, and review its cybersecurity controls, and how well they’re working, at least once a year.
• Internal control reports. The adviser must obtain a written internal control report from an independent public accountant concerning its safeguarding of crypto assets within six months of taking self-custody of a client crypto asset and at least once each calendar year thereafter. The accountant must opine on whether the controls are suitably designed and implemented and operating effectively throughout the period, and must verify that the crypto assets are reconciled to the crypto network.
• Self-custody account statements. The adviser must send account statements to clients at least quarterly, identifying the crypto asset address on the crypto network that stores the client’s assets and the network on which that address operates, the amounts stored at the end of the period, and all transactions from that address during the period.
  • Each statement must include language “urging the client to compare the account statements” with the balances and transactions shown on the relevant crypto network for the client’s address. The adviser may instead transmit the same information in a human-readable, usable electronic format if it also sends the client a notice identifying the address and network.
• Financial asset election. The adviser and client must agree in writing that the crypto asset is a “financial asset” and that the adviser is a “securities intermediary” under state law.
• Fund board oversight. The board of directors of a Regulated Fund must oversee the arrangement as follows:
  • The board, including a majority of the directors who are not “interested persons” of the fund (the “independent directors”), must determine that the fund’s crypto asset will be subject to reasonable care if the adviser maintains it, before the adviser begins to maintain the asset and annually thereafter.
  • The board, including a majority of the independent directors, must review the written report documenting the adviser’s qualified custodian determination before the adviser maintains the crypto asset, and quarterly thereafter.
• Airdrops. The rule would deem the receipt of a distributed (airdropped) crypto asset to not violate the custody rules, provided that the adviser or the Regulated Fund, as soon as reasonably practicable, either complies with the self-custody conditions for that asset or places and maintains it with a qualified custodian.
• Recordkeeping. The SEC is proposing corresponding recordkeeping requirements related to the self-custody rules.

State trust company custody. The new rules would specifically permit custody of client and Regulated Fund crypto assets by a state-chartered trust company (“State trust company”) subject to the following conditions:

• State regulation. The adviser or Regulated Fund must have a reasonable basis to believe that the relevant state banking regulator has authorized the State trust company to provide crypto asset custody.
• Policies and procedures. The adviser or Regulated Fund must have a reasonable basis to believe, “after due inquiry,”that the State trust company maintains and implements written policies and procedures reasonably designed to safeguard the client crypto assets and related cash.
• Audited financial statements. The adviser or Regulated Fund would be required to receive and review the State trust company’s most recent annual audited financial statements, initially and annually thereafter.
• Internal control reports. The adviser or Regulated Fund would be required to receive and review the State trust company’s most recent internal control report, initially and annually thereafter.
• Segregation of assets. Advisory client crypto assets would be required to be segregated from the State trust company’s proprietary assets.Regulated Funds would be required to enter into a custodial services agreement with the State trust company that provides for asset segregation.
• Recordkeeping. The SEC is proposing corresponding recordkeeping requirements related to the State trust company rules.

Custody modernization. The SEC also proposed several amendments to the 1940 Act and Advisers Act custody rules to address current industry practices and respond to feedback from industry participants. Among other things:

• 1940 Act Rules
  • BDCs. The rules would add references to BDCs throughout the 1940 Act custody rules to clarify that BDCs, like registered investment companies, may rely on the rules to use permitted custodians other than banks.
  • Rule 17f-1 – broker-dealer custodians. The proposed rules would expand permissible broker-dealer custodians to include all registered broker-dealers and to replace the existing conditions with a single condition: the broker-dealer’s custody must be subject to the SEC’s customer protection rule (Rule 15c3-3). As written, Rule 17f-1 only permits broker-dealers that are members of a national securities exchange to maintain custody of fund assets.
  • Rule 17f-3 – free cash accounts rule. The SEC would rescind this rule.
  • Rule 17f-2 – fund self-custody. The SEC is seeking comment on how to modernize this and other 1940 Act custody rules.
• Advisers Act Rules
  • Redesignation to section 223 of the Advisers Act.The SEC would redesignate the Advisers Act custody rule (currently Rule 206(4)-2) as new Rule 223-1, under section 223 rather than section 206 (the anti-fraud section).
  • Discretionary trading. The rules would specify when the Advisers Act custody rule does not apply to an adviser with discretionary trading authority.In 2003, the Commission stated that trading authority is outside the custody rule only in the context of delivery versus payment (DVP) trading. The proposed exception would apply if the adviser (i) executes trades only from and into designated client accounts in the client’s name, (ii) has no authority to transfer client assets to accounts in its own name or controlled by it or its related persons, or to any account that is not the client’s unless the client directs the transfer in connection with the trading, and (iii) complies with the rule for any other activities that give it custody. The SEC expects to rescind its 2003 discussion if the exception is adopted.
  • Audits. The proposed rules would:
    • require that audited financial statements be prepared in accordance with U.S. generally accepted accounting principles (U.S. GAAP), except that foreign pooled investment vehicles could use other accounting principles, with a reconciliation to U.S. GAAP;
    • extend the delivery deadline for audited financial statements from 120 days to 180 days for funds of funds and to 260 days for funds of funds of funds, and permit delivery to an investor’s independent representative; and
    • modify the timing of delivery for audited financial statements for pooled investment vehicles formed toward the end of the fiscal year.
  • BDCs. The proposed rules would clarify that the Advisers Act custody rule’s exception for registered investment companies also includes BDCs.
  • Inadvertent custody. The rules would except an adviser from the custody rule when its custody is inadvertent, if (i) the adviser did not recommend, request or require that the client select the qualified custodian, and (ii) the adviser either has no copy of, or knowledge or reason to know of, a custodial agreement that confers custody on it or, if it does know, promptly notifies the client and the custodian in writing that it repudiates that authority and asks that it be removed.
  • Segregation of assets. The SEC expects to provide its views on the requirement for segregation of assets. Specifically, the SEC expects to say that client bank deposits do not violate the Advisers Act custody rule’s requirement that funds and securities be maintained in segregated accounts, because a deposit gives the client a separate liability of the bank, recorded in the client’s name.

Timing and public comments

Public comments are due 60 days after publication of the proposed rules in the Federal Register.

In the interim, current law still applies.Nothing changes until the SEC finalizes the proposed rules.

The proposed rules would let advisers and funds rely on the self-custody rules and the State trust company rule once effective and as soon as they can meet the conditions and recordkeeping requirements. Many of the modernization amendments would apply on the effective date.

General information only; not legal advice, attorney advertising

This summary is for general information only, not a comprehensive analysis of the SEC’s custody proposals and does not constitute legal advice. You should seek advice from your counsel before relying, acting or refraining from acting, upon the contents of this alert.

[1] Proposed Rule: Adviser and Regulated Fund Custody Rules; Crypto Custody Rules, Investment Advisers Act Rel. No. 7023 (Oct. 1, 2026) (the “Proposing Release”).

[2] Application of the Federal Securities Laws to Certain Types of Crypto Assets and Certain Transactions Involving Crypto Assets, Securities Act Release No. 11412 (Mar. 17, 2026) [91 FR 13714 (Mar. 23, 2026)] (“Security Status Interpretation”).