SEC proposes crypto custody rules and a broad overhaul of the adviser and fund custody framework

Key Takeaways

• limited self-custody. The Proposal would allow an adviser to self-custody a client’s crypto assets only when no qualified custodian is available and the adviser satisfies detailed safeguarding, cybersecurity, reporting, and contractual conditions. Proposed rule 17f-9 under the Company Act would extend a parallel framework to regulated funds, subject to board oversight
• new custodian category. State trust companies that do not meet the definition of “bank” could serve as crypto custodians under the Proposal, subject to initial and annual due diligence and segregation requirements
• broad modernization. The SEC would redesignate the Advisers Act custody rule as rule 223-1 and add exceptions for discretionary trading, standing letters of authorization (SLOAs), and inadvertent custody. It also would eliminate the PCAOB requirement for custody-rule accountants and amend the Company Act custody rules
• immediate planning. Advisers, regulated fund boards, and custodians should consider mapping current custody arrangements, identify gaps in controls and disclosures, and consider whether to comment before the comment period closes

Summary of Proposed Changes

Background

The Proposal responds to the growth of the crypto asset market and to a practical problem: advisers and regulated funds often cannot find custodians that are both legally eligible and technically able to safeguard particular types of crypto assets. Crypto assets also carry distinct risks. Transactions may be irreversible, key materials can be lost or stolen, and cybersecurity vulnerabilities differ from those of traditional assets. The Proposal is the SEC’s latest attempt to address custody, following its June 2025 withdrawal of the 2023 Safeguarding Proposal.

The crypto provisions would apply only to crypto assets that are funds or securities under the Advisers Act, or securities or similar investments under the Company Act. The Proposal would define a “crypto asset” as any digital representation of value that is recorded on a cryptographically secured distributed ledger.

Proposed Crypto Custody Framework

Adviser Self-Custody

The Proposal would permit an adviser to hold a client’s crypto asset without a qualified custodian only if the adviser satisfies each of the following conditions:

• qualified custodian unavailability. The adviser must determine in writing, with a reasonable basis after due inquiry, that no qualified custodian is available for the specific asset. The determination must be made before taking custody and at least quarterly thereafter. Blanket determinations are not permitted, and the adviser must move the asset to a qualified custodian as soon as reasonably practicable once one becomes available
• safeguarding expertise and systems. The adviser must document its expertise and maintain systems reasonably designed to prevent loss, theft, misuse and misappropriation. At a minimum, those systems must address private-key management, joint authorization of each transaction by at least two persons and client-specific crypto asset addresses
• cybersecurity and annual review. The adviser must mitigate cybersecurity risks and review its cybersecurity controls and safeguarding systems at least annually
• internal control report. An independent public accountant must deliver an internal control report within six months after the adviser first self-custodies crypto assets and annually thereafter
• quarterly account statements. Clients must receive statements identifying the onchain address, network, balances, and all transactions, with a legend urging comparison to onchain records. Advisers to pooled vehicles may rely on the audit provision instead
• UCC Article 8 election. The adviser and client must agree in writing to treat each self-custodied asset as a “financial asset” and the adviser as a “securities intermediary,” which is intended to protect client assets from the adviser’s creditors in insolvency
• airdrops. Under the Proposal, receipt of an unsolicited airdrop would not violate the custody rules if, as soon as reasonably practicable, the adviser or regulated fund either satisfies the self-custody conditions or places the asset with a qualified or permitted custodian

Regulated Fund Self-Custody

The Proposal would permit a regulated fund to hold crypto assets through its adviser if the adviser complies with proposed rule 223-1(b)(7). The regulated fund’s board would have two oversight duties. First, it must review the adviser’s qualified-custodian determination before the adviser holds the asset and at least quarterly thereafter. Second, before the adviser holds the asset and at least annually thereafter, it must determine that the asset would be subject to reasonable care if held by the adviser. The rule would not be available to unit investment trusts or face-amount certificate companies. Rule 17f-2 would continue to govern regulated fund crypto assets held at an affiliated custodian of the adviser.

State Trust Companies

The Proposal would add State trust companies as permitted crypto custodians regardless of whether those State trust companies would otherwise meet the definition of “bank” under the Company Act or the Advisers Act. A “State trust company” would be an entity organized under state law, supervised and examined by a state bank regulator, and permitted to exercise fiduciary powers. Before engaging the company and at least annually after that, the adviser or regulated fund would need a reasonable basis, after due inquiry, to believe the company is authorized to provide crypto custody and maintains written safeguarding policies. The adviser or regulated fund also must receive and review the company’s audited financial statements and internal control report. The company must segregate client assets from its proprietary assets, and regulated fund custodial agreements must say so. An adviser or regulated fund utilizing a State trust company that does meet the definition of “bank” would not be subject to the foregoing provisions that are unique to State trust companies.

DeFi and Trading Platforms

The Commission does not propose DeFi-specific rules. Instead, it explains that an adviser could deposit client crypto assets in a smart contract only if the asset remains in adviser self-custody or with a permitted custodian, or an exception applies. It requests extensive comment on staking, lending, and receipt tokens. The Commission also declined to propose a standalone trading-platform custody rule. It does, however, seek comment on the conditions under which advisers could place client assets on a platform for trading. Such conditions could include a 24-hour holding limit, regulatory oversight of the platform, and review of the platform’s internal control reports.

Modernization of the Custody Rules

Advisers Act Rule Amendments

• redesignation. Rule 206(4)-2 would become rule 223-1 under Advisers Act in light of the additional authority Congress provided the SEC under the Dodd-Frank Act to prescribe investment adviser custody rules in section 223 of the Advisers Act. An adviser’s fiduciary obligations would continue to apply
• discretionary trading exception. Custody arising from discretionary trading authority would be excepted from the entirety of rule 223-1 if three conditions are met. Trades must move only from or into accounts in the client’s name. The adviser cannot transfer assets to itself, a related person, or a non-client account, except as client-directed in connection with trading. And the adviser must comply with the rule for any other basis of custody. The Commission expects to rescind the DVP discussion in its 2003 adopting release
• SLOAs. The Proposal would codify the SEC staff’s 2017 no-action relief to the Investment Adviser Association. An adviser that has legal custody solely from a qualifying SLOA would be excepted from the surprise examination requirement, but not from rule 223-1’s other conditions. To qualify, the custodian may not be the adviser or a related person, and the adviser may not designate or change the recipient’s information
• inadvertent custody. The Proposal would except custody arising from a custodial agreement if the adviser did not recommend, request, or require the client’s choice of custodian. The adviser also must either lack knowledge of the authority or promptly repudiate it in writing. Advisers that routinely recommend custodians may not be able to rely on this exception
• accountants and audits. The Proposal would eliminate the PCAOB registration and inspection requirement for custody-rule accountants. Audited financial statements would have to follow US GAAP, with an exception for foreign pooled vehicles. Delivery deadlines would extend to 180 days for funds of funds and 260 days for funds of funds of funds. Advisers could deliver statements to an investor’s independent representative, and new relief would apply to pools formed within 90 days before fiscal year-end
• other changes. The privately offered securities exception would carry over unchanged, with new Form ADV reporting. Notices of new custodial accounts would include the account number, and accountants would file material discrepancy notices electronically. BDCs would be added to the registered investment company exception. The proposing release also provides the Commission’s views on segregation, seller escrow accounts, and accommodation reporting

Company Act Rule Amendments

The Proposal would also make broader changes to the Company Act custody rules. It would add references to BDCs throughout those rules. It would expand rule 17f-1 to permit custody with any registered broker-dealer subject to Exchange Act rule 15c3-3 or similar protections. It would also rescind rule 17f-3 and Form N-17f-1 and make conforming amendments to rules 17f-4 and 17f-7. For BDCs, these changes would largely codify current industry practice. BDCs could expressly rely on the Company Act custody rules to the same extent as registered closed-end funds. Advisers also would be excepted from the Advisers Act custody rule for BDC client assets under proposed rule 223-1(b)(5).

Recordkeeping and Reporting

The Proposal would require records supporting self-custody, State trust company use, and SLOA reliance. Regulated funds would also keep State trust company and self-custody materials for at least six years, the first two in an easily accessible place. Advisers and regulated funds could maintain records onchain if they can promptly produce them in a human-readable, reasonably usable format.

Form ADV, Part 1A, Item 9 would be restructured to capture reliance on specific exceptions and State trust company use, with new questions on crypto self-custody and tokenized private funds. Exempt reporting advisers would also answer the tokenized fund questions. PCAOB questions would be removed. Form N-CEN would add items on crypto self-custody, State trust company custody, and tokenized fund shares. Form ADV-E would receive conforming changes.

Timeline

Advisers and regulated funds would be able to rely on the self-custody and State trust company rules as of the effective date, once they satisfy the conditions. The Advisers Act modernization amendments and the Company Act custody and recordkeeping amendments would require compliance as of the effective date. The Commission asks, however, whether a transition period of six months, one year, or another length would be appropriate. Advisers and regulated funds could rely on the new rules before updated forms are available and would report once the IARD and EDGAR systems are updated.

Key Takeaways / What Advisers Should Consider Doing Now

While the Proposal is pending, advisers should consider creating an inventory of their custody arrangements and performing a gap analysis against the proposed conditions.

• all registered advisers. Advisers can inventory their custody arrangements, including custodial agreements, SLOAs, discretionary trading authority, fee deduction, and instances of potential inadvertent custody. They can map each arrangement to the proposed exceptions. Advisers can catalogue their reliance on staff guidance the Proposal would supersede, such as the 2017 IAA SLOA letter and IM Guidance Update 2017-01. And they can begin scoping the Form ADV, Part 1A, Item 9 changes they would need to make and discuss the changes with their independent public accountant
• advisers with crypto exposure. An adviser with such exposure can identify crypto assets for which it or a related person holds key materials. Such a firm can begin preparing an asset-by-asset custodian availability analysis that can support the initial determination. It may also be helpful to begin benchmarking wallet architecture, two-person authorization, client-specific addresses, and cybersecurity controls against the proposed conditions. It also can begin planning for the internal control report, quarterly statements, UCC Article 8 agreements, airdrop procedures, and Form ADV, Part 2A disclosures. If relevant, the firm can begin State trust company due diligence
• private fund advisers. Such advisers may wish to review audit-provision timing for funds of funds and newly formed funds. These advisers also can confirm continued reliance on the privately offered securities exception and plan for the new Form ADV reporting. Finally, private fund advisers can assess seller escrow arrangements against the Commission’s stated views.
• advisers to regulated funds. These advisers can evaluate whether self-custody fits each regulated fund’s strategy. They also can design a process for the quarterly review of qualified-custodian determinations and the annual reasonable-care determinations. These advisers also can plan updates to custody policies for amended rule 17f-1 and new rules 17f-8 and 17f-9 and prepare for the new Form N-CEN items
• timeline and comments. Because the modernization amendments would require compliance as of the effective date, advisers should consider building a compliance roadmap now. They also should consider commenting on the length of any transition period before the comment period closes

Our team is monitoring the Proposal closely and is prepared to help clients assess operational impacts, review custody and disclosure practices, and prepare comment submissions. Please contact us with any questions.

This alert summarizes a proposed rule for general informational purposes. It is not legal advice, and any final rules may differ materially from the Proposal.

__________

If you have any questions about this Legal Briefing, please feel free to contact any of the attorneys listed or the Eversheds Sutherland attorney with whom you regularly work.