SEC Proposes Custody Rule Updates

At a Glance

• After the rescission of the last Securities and Exchange Commission's custody rule proposal, the current Commission has advanced a proposal that permits self-custody of crypto assets, codifies the treatment of state trust companies for custody of crypto assets, and modernizes several long-standing custody requirements.
• In addition to modernizing several provisions of the existing custody rule and codifying several no-action positions, the SEC has proposed a framework that would, for the first time, permit investment advisers and regulated funds to self-custody crypto assets when a qualified custodian is not available, subject to detailed safeguarding, accountant-review, and board-oversight conditions.

On October 1, 2026, the Securities and Exchange Commission (SEC) proposed new rules and amendments under the Investment Advisers Act of 1940 (Advisers Act) and the Investment Company Act of 1940 (Investment Company Act). If adopted, the proposal would permit advisers and regulated funds to self-custody crypto assets in certain circumstances, codify that certain state trust companies can be treated as qualified custodians under the rule, modernize the existing custody rules to better reflect current industry practices and feedback, and update related recordkeeping and disclosure requirements.

Background

The current custody rules under the Advisers Act and the Investment Company Act were designed to protect client and regulated fund assets from risk of loss, theft, misuse, and misappropriation, but were drafted when traditional assets were the only assets that were widely used. Since the current rules' adoption, the crypto asset market has grown significantly with investors increasingly seeking exposure to and advice on these nontraditional assets. The complication is that for many crypto assets, a qualified custodian may not be readily available to hold them.

Some state-chartered limited purpose trust companies have sought to fill this gap. Although banks are qualified custodians under applicable regulations, whether a state trust company satisfies the statutory definition of "bank" requires a fact-specific analysis of state and federal law. In addition, custodians offering crypto custody, including state trust companies, have not been able to support all crypto assets given the large and growing number in the market, particularly nascent or novel assets.

On September 30, 2025, the SEC staff issued a no-action letter stating that, under the enumerated conditions, the staff would not recommend enforcement if advisers and funds treat state trust companies as banks for purposes of crypto asset custody. This proposal would codify the no-action letter into binding Commission rules.

Adviser Self-Custody of Crypto Assets

Under the proposed rules, an adviser may self-custody client crypto assets, subject to conditions including that the adviser:

• Determines that a qualified custodian is not available before taking self-custody, and quarterly thereafter
• Has safeguarding expertise for each crypto asset (and documents the basis for that determination), and adopts, implements, and maintains safeguarding systems, reviewed at least annually, that address private key management and require joint authorization of transactions by at least two people
• Holds each client's crypto assets in one or more addresses that store only that client's assets
• Mitigates cybersecurity risk and reviews its cybersecurity controls at least annually
• Obtains an internal control report from an independent public accountant within six months of taking self-custody and annually thereafter
• Sends account statements to clients at least quarterly
• Agrees in writing with the client to treat each crypto asset as a "financial asset," to provide additional protections under state law

One significant issue that we have seen arise with advisers dealing with crypto assets is that there may be a qualified custodian that would agree to custody the relevant crypto asset, but upon a due diligence review of that qualified custodian the adviser determines that it does not believe that the qualified custodian has the necessary safeguarding infrastructure to hold the crypto assets. We are hopeful this issue will be addressed in the final rule.

Regulated Fund Self-Custody

A regulated fund could self-custody crypto assets through its adviser if the adviser complies with the adviser self-custody rule (discussed above) and the fund's board oversees the arrangement by: (1) reviewing, initially and quarterly, the adviser's written report on the basis for determining that no qualified custodian is available; and (2) determining, before custody and annually, that the asset would be subject to reasonable care if self-custodied with the adviser.

State Trust Companies as Permitted Custodians

The rules also codify the position that advisers and funds may maintain crypto assets with a state trust company if, before engagement and annually thereafter, the adviser or fund has a reasonable basis, after due inquiry, to believe that the trust company is authorized by the relevant state banking authority to provide crypto asset custody services and maintains written policies and procedures reasonably designed to safeguard crypto assets and related cash and cash equivalents. The adviser or fund would also need to receive and review the trust company's most recent annual audited financial statements and most recent internal control report, and client or fund crypto assets would have to be segregated from the trust company's proprietary assets.

Investment Company Act Custody Rule Modernization

The proposal would remove antiquated conditions applicable to broker-dealer custodians, rescind the free cash account rule, and specify that business development companies (BDCs) may rely on the Investment Company Act custody rules.

Advisers Act Custody Rule Modernization

The proposal would also modernize the Advisers Act custody rules in the following ways:

• Discretionary trading authority. The proposed rules clarify where an adviser would not have custody solely due to discretionary trading authority under specific circumstances. If the rule is adopted as proposed, advisers should review the grant of discretionary trading authority in their client agreements to ensure that they are not so broad as to result in a determination that the adviser is deemed to have custody of the client's assets.
• Accountants. The requirement that accountants providing either the annual surprise examination or the private fund audits under the current rules be Public Company Accounting Oversight Board (PCAOB)-registered and subject to PCAOB inspection would be eliminated.
• Audit provision. The proposal codifies the extended delivery deadlines for audited financial statements for certain private funds that arose via no-action relief. In addition, the proposal would allow newly formed funds to have an initial extended audit period to avoid the expense of an audit where that audit would cover less than three months.
• Standing letter of authorization (SLOA). The proposal essentially codifies the position put forward in the Investment Adviser Association no-action letter from February 2017 wherein an adviser with custody solely because of a SLOA would not be subject to the surprise examination / independent verification requirement if certain criteria are met.
• Other changes. Client notices on opening a qualified custodian account would need to include the account number; a new exception addresses inadvertent custody; and the exception for registered investment companies would be extended to BDCs.

Recordkeeping, Accounting Guidance, and Form Amendments

The proposal includes corresponding recordkeeping requirements and allows records maintained on a crypto network to satisfy the recordkeeping rules, subject to certain conditions. Additionally, Form ADV and Form N-CEN would be amended regarding the information collected for custody of crypto assets and tokenized fund shares.

Practical Implications

• Custody gap analysis. Advisers and funds should inventory crypto asset holdings and custody-related authorities to identify where the proposed rules could expand options or change obligations.
• Self-custody readiness. Firms considering self-custody should assess whether they could document asset-specific safeguarding expertise, implement private key management and dual-authorization controls, segregate client addresses, and obtain an accountant's internal control report within six months.
• State trust company diligence. Current reliance on the 2025 State Trust Company no-action relief should be evaluated against the proposed due inquiry, policies and procedures, audited financial statement and internal control report review, and segregation conditions.
• Private fund audit relief. Fund-of-funds structures, foreign pooled vehicles, and newly formed vehicles may benefit from the extended deadlines, US GAAP reconciliation approach, and first-year accommodation; the elimination of PCAOB requirements may broaden the pool of eligible accountants.
• SLOA and discretionary trading. Advisers should review SLOA arrangements and trading authorities against the proposed exceptions, including the new recordkeeping requirement.
• Fund boards. Boards of funds contemplating crypto exposure should consider the quarterly report review and annual reasonable care determinations the proposal would require, and how these would fit within existing oversight processes.

What's Next

Comments are due 60 days after publication of the proposal in the Federal Register. The rulemaking proposal marks the start of the rulemaking process, and any final rules will be published and made available for analysis before they take effect.

For further information, you may contact the authors. Faegre Drinker's team will continue to monitor the rulemaking and its potential impact.

Legal clerks Noelle-Nadia Filali and James E. Burnett contributed to this update.