SEC crypto custody rules for advisers and funds
SEC Chairman Paul Atkins proposed new rules for crypto asset management requiring advisers to perform quarterly self-custody determinations. Compliance involves significant expenses, including a $376,000 annual cost for mandatory internal control reports.
Regulatory shifts for crypto custody
The SEC proposed amendments to the Investment Advisers Act of 1940 and the Investment Company Act of 1940 on October 1, 2026. These changes target registered investment advisers and regulated funds, including business development companies. Chairman Paul Atkins stated that the new proposal provides a compliant path for advisers and funds to manage crypto assets. I view this proposal as the most practical step the Commission has taken to address the reality of digital asset management. The rule establishes a conditional path for self-custody. An adviser may hold client crypto assets directly only after they determine in writing that no qualified custodian will maintain the asset. This determination must undergo renewal every quarter. If a qualified custodian becomes available, the adviser must transfer the assets to that custodian as soon as reasonably practicable. The rule makes state-chartered trust companies eligible to act as qualified custodians for client and fund holdings. This inclusion helps address the concentration risk caused by the limited pool of currently capable custodians.
The rules require advisers to possess private cryptographic keys exclusively. Any arrangement where an adviser shares private cryptographic keys with a client or a technology provider violates this requirement. For clients other than regulated funds, the rule only reaches crypto assets that function as funds or securities.
| Custody Requirement | Mandatory Frequency or Value |
|---|---|
| Self-custody determination | Quarterly |
| Internal control report cost | $376,000 annually |
| Cybersecurity risk assessment | Annually |
| One-time compliance cost | $173,000 |
| Recurring annual compliance cost | $58,000 |
Operational costs for these rules remain high. The SEC expects the internal control report to cost $376,000 annually, alongside a $173,000 one-time cost and $58,000 in recurring annual costs. The adviser must obtain an internal control report from an independent public accountant within six months of taking self-custody and then repeat this process every calendar year thereafter. The SEC proposes to eliminate the requirement that accounting firms performing specified audit and examination engagements be registered with and subject to regular inspection by the Public Company Accounting Oversight Board. Advisers must also provide account statements to clients every quarter. These statements must identify the crypto asset address and network, the period-end balances, and all transactions. A legend in the statement must urge the client to compare the statement against the balances and transactions shown at the specific address and network.
Technicalities of self-custody
The proposal redesignates the adviser custody rule as Rule 223-1. Advisers must implement safeguarding systems that limit access to private cryptographic keys to designated supervised persons. These systems must also require joint authorization of transfers by two or more designated persons, including at least one management person. You should note that these requirements exclude one-person advisers from using the joint authorization protocol. If an adviser holds a private key alongside a custodian, the self-custody exception does not apply. The adviser and client must also agree in writing to treat each self-custodied crypto asset as a financial asset under the state law governing their agreement.
Advisers must perform written cybersecurity risk assessments at least once a year. They must also review the effectiveness of their safeguarding systems and cybersecurity controls within one year of taking self-custody and then annually. If an adviser obtains custody solely because of a custodial agreement they did not request or recommend, they may qualify for an exception. This exception requires the adviser to notify the client and custodian in writing to repudiate the authority.
Changes to broker-dealer and fund rules
The proposal rewrites Rule 17f-1 to change how registered funds and business development companies use broker-dealers. Funds may now use any broker-dealer registered under Exchange Act Section 15(b)(1), provided the custody follows Rule 15c3-3 or similar protections. I find the mandatory internal control report requirement to be a massive, expensive obstacle for smaller firms. The SEC estimates this report alone costs $376,000 per year, which creates a steep barrier for many advisers. The Commission also addresses uncertificated loan interests for BDCs and registered funds, though a solution for how to maintain these with a permitted custodian remains unresolved. How will firms manage the liquidity risks of uncertificated loans under these new custody standards?
The proposal includes a conditional exception for discretionary trading authority covering both delivery-versus-payment and non-delivery-versus-payment transactions. This addresses long-standing uncertainty concerning non-delivery-versus-payment transactions. The new eligibility condition might require changes to existing arrangements. The SEC asks if funds using broker-dealers whose custody of particular assets lacks 15c3-3 protection will need time to find different custodians.
Join the discussion