The U.S. Securities and Exchange Commission on October 1, 2026, published a 760-page proposed rule that would, for the first time, establish a federal custody framework for crypto assets held by registered investment advisers (RIAs) and regulated funds. The proposal covers approximately 17,100 SE...
"Existing custody frameworks were designed to protect the assets of advisory clients and regulated funds from loss, theft, misuse, and misappropriation — but addressed only traditional assets. That is an untenable situation in the 21st century." — Paul Atkins, Chairman, U.S. Securities and Exchange Commission
The U.S. Securities and Exchange Commission on October 1, 2026, published a 760-page proposed rule that would, for the first time, establish a federal custody framework for crypto assets held by registered investment advisers (RIAs) and regulated funds. The proposal covers approximately 17,100 SEC-registered advisers managing a combined $176.8 trillion in assets, according to Investment Adviser Association data.
The rule opens a conditional path to adviser self-custody — an arrangement where the adviser itself holds private keys to client crypto assets — while simultaneously expanding the universe of qualified custodians to include state-chartered trust companies. Comments are due December 5, 2026, under File No. S7-2026-35.
The proposal arrives against a backdrop of concentrated crypto custody. Coinbase reported $376 billion in assets on its platform at year-end 2025 and holds custody of over 80% of U.S. spot Bitcoin and Ethereum ETF assets. BitGo, which completed its NYSE IPO in early 2026, reported $104 billion in assets under custody. The SEC's framework would, if finalized, introduce competition from traditional adviser self-custody and dozens of state trust companies currently excluded from the qualified custodian definition.
The proposal amends two separate bodies of regulation: the Investment Advisers Act custody rule (Rule 206(4)-2) and the Investment Company Act custody provisions. It creates new rules — including proposed Rules 17f-8 and 17f-9 — that provide two express crypto custody pathways for registered investment companies and business development companies (BDCs).
Three structural changes define the proposal:
Qualified custodian expansion. State trust companies supervised by state banking regulators would qualify as permitted custodians for crypto assets, regardless of whether they meet the definition of "bank" under the Investment Company Act of 1940 or the Investment Advisers Act of 1940.
Self-custody exception. RIAs may hold client crypto assets directly — holding private keys themselves — but only under narrow, heavily documented conditions.
Audit modernization. Advisers would no longer be required to use a Public Company Accounting Oversight Board (PCAOB)-registered and inspected accountant to comply with custody rule requirements. Independent accountants would still be required, but the PCAOB registration mandate is removed.
The rule would take effect immediately upon finalization. No transition period is proposed.
The self-custody pathway is the most scrutinized component of the proposal. Under existing rules, all client assets must be held at a qualified custodian — a bank, broker-dealer, or futures commission merchant. The proposed exception permits advisers to hold crypto assets themselves, but the conditions are restrictive:
Availability determination. Before assuming custody of any specific crypto asset, the adviser must document in writing that, after reasonable inquiry, no qualified custodian will maintain that asset. This determination must be renewed quarterly. Blanket determinations covering multiple assets are prohibited — each asset requires individual analysis. Cost is not a permissible justification. If a qualified custodian becomes available, the adviser must transfer the asset "as soon as reasonably practicable."
Operational controls. The adviser must restrict private key access to designated supervised persons. Every transfer must be approved by at least two authorized individuals, including at least one member of management. The adviser must maintain separate blockchain addresses for each client.
Cybersecurity. Annual cybersecurity risk assessments are mandatory.
Independent review. The adviser must obtain SOC 1 Type 2 reports from an independent accountant within six months of initially self-custodying any asset, and annually thereafter.
Client disclosure. Quarterly statements must include blockchain addresses, balances, and transaction details for each client's self-custodied assets.
The SEC acknowledged in the proposal text the "inherent conflicts of interest associated with self-custody" — a phrase that drew pointed criticism from consumer protection groups.
The second major pathway expands who qualifies as a custodian. Under the current framework, crypto custodians must be banks, broker-dealers, or futures commission merchants. Many crypto-native custodians are state-chartered trust companies — entities that often fall outside these categories.
The proposal would add state trust companies as qualified custodians, subject to conditions:
This provision would benefit firms like Anchorage Digital, which operates as a federally chartered crypto bank, and potentially dozens of state-chartered entities currently providing crypto custody without qualified custodian status.
For registered investment companies and BDCs, the proposal creates two new rules:
Rule 17f-8 would govern custody of crypto assets that qualify as "securities and similar investments." Notably, the proposal treats digital commodities — including Bitcoin, Ethereum, and Solana — as falling within this broader category for fund custody purposes. This is a wider scope than the advisory client framework.
Rule 17f-9 would address self-custody by funds under conditions parallel to the adviser framework, with the additional requirement of board oversight.
Fund boards would be required to approve the selection of crypto custodians, review custodial arrangements periodically, and oversee compliance with the new rules.
The proposal adds new Form ADV disclosure requirements. Advisers engaging in crypto custody would be required to report:
Records must be maintained for five years. In a nod to the underlying technology, the SEC stated that records may be kept on blockchains, provided they are "producible in human-readable format."
The proposal includes over 300 specific questions for public comment, with particular attention to smart contracts, DeFi protocols, and the question of when a custodian continues "maintaining" assets that have been deployed into on-chain protocols.
The proposal was approved unanimously by the five-member Commission, but the commentary diverged.
Chairman Paul Atkins framed the proposal as closing "a gap that has left investment advisers and funds guessing how to effect lawful custody of an asset class that their clients increasingly demand," calling it "another significant step toward bringing our regulatory frameworks into the modern era."
Commissioner Hester Peirce, who led the SEC's Crypto Task Force and departed the Commission the same week, said she hoped the proposal "foreshadows that a calm end to the regulatory roller coaster ride is imminent." In her statement, Peirce noted that the prior 2023 custody rulemaking "suggested that many advisors were already on the wrong side of the law" when managing crypto assets.
Commissioner Mark Uyeda stated that "safeguarding client assets is one of the fundamental investor protections in the regulatory framework," while adding that "regulations must provide both robust investor protection and operational practicality."
The response from outside the Commission was divided.
Better Markets, a financial reform advocacy group, issued a statement from Securities Policy Director Benjamin Schiffrin arguing the SEC was "so beholden to the crypto industry, and so desperate to give the crypto industry everything it wants, that it is willing to throw out the regulatory framework that has long protected investors." Schiffrin contended that allowing adviser self-custody would "expose investors to the very high risk of loss the SEC exists to prevent." On state trust companies, Better Markets argued they "are subject to an inconsistent hodgepodge of less rigorous rules and less oversight."
The crypto custody industry offered a more measured response. The proposal, if finalized, could simultaneously legitimize existing state-trust-company custodians and create new competition from advisers opting to self-custody — a dynamic that cuts both ways for incumbents.
The proposal enters a market where crypto custody is heavily concentrated. According to Forbes, Coinbase received conditional OCC approval for a federal national trust charter in April 2026 and custodies over 80% of U.S. spot Bitcoin and Ethereum ETF assets, reporting $376 billion in assets on platform at year-end 2025. BitGo completed its NYSE IPO in early 2026 and holds $104 billion in assets under custody.
According to industry research, the institutional crypto custody market is valued at approximately $3.5–3.7 billion in 2026 and is projected to grow to $7.7–14.4 billion by the early 2030s, depending on the source.
If finalized, the rule could reshape competitive dynamics in several ways:
Adviser self-custody is unlikely to affect the largest assets — Bitcoin and Ethereum have multiple qualified custodians readily available. The pathway matters more for long-tail tokens, staked assets, and DeFi positions where custodian support is limited or nonexistent.
State trust company recognition could lower barriers for smaller, specialized custodians to compete for institutional mandates currently dominated by Coinbase and BitGo.
The quarterly availability review creates a ratchet mechanism: once a qualified custodian offers support for a given asset, the self-custody option closes. This design implicitly incentivizes custodians to expand asset coverage.
Form ADV disclosure will, for the first time, produce aggregated data on how much crypto RIAs actually self-custody — a figure currently unknown to regulators and the public.
The 60-day comment period, ending December 5, 2026, will test whether the industry views the conditions as workable or whether the quarterly reassessment, dual-authorization, and per-asset documentation requirements impose compliance costs that neutralize the self-custody benefit.
The SEC's crypto custody proposal is a structural document, not a headline concession. The self-custody pathway reads more like an emergency provision than an open invitation — limited to assets no custodian will touch, time-bound by quarterly reviews, and layered with controls that mirror institutional custody standards. The more consequential provision may be the state trust company expansion, which could widen the competitive field beyond the current Coinbase-BitGo duopoly.
Whether the rule survives the comment process intact depends on two unresolved questions the SEC itself flagged: how custody applies when assets are deployed into DeFi protocols via smart contracts, and whether the per-asset quarterly review is operationally feasible for advisers holding diversified crypto portfolios. The 300-plus questions embedded in the proposal suggest the Commission knows it does not yet have all the answers.
The comment deadline is December 5, 2026.