Why Is the SEC Revisiting Crypto Asset Custody Rules?
On October 1, 2026, the US Securities and Exchange Commission (SEC) proposed changes to the custody framework for registered investment advisers and regulated funds. The proposal covers rules under the Investment Advisers Act of 1940 and the Investment Company Act of 1940. It aims to establish a framework better suited to digital assets while updating certain recordkeeping, disclosure, and custody requirements.
The SEC said that traditional custody rules need to adapt as crypto markets and industry practices evolve. The proposal is intended to remove regulatory barriers that may limit investment advisers' ability to provide crypto-related investment advice, while giving regulated funds access to a broader range of digital asset investment strategies.
A key element would permit investment advisers and regulated funds to self-custody crypto assets under specified conditions. It would also allow them to use state trust companies as custodians if the applicable requirements are satisfied. The proposal includes updates to related recordkeeping and disclosure obligations to better reflect how digital asset custody operates in practice.
However, this remains a proposed rule rather than an effective new regulation. Firms should not assume that the SEC's announcement automatically authorizes every self-custody arrangement or third-party custody model. The permissible structures will depend on the final rules, applicable law, and any relevant conditions.
What Risks Do Self-Custody and Third-Party Custody Present?
Self-custody means an institution directly controls private keys or manages crypto assets through its own systems. This can reduce reliance on external custodians and provide greater operational flexibility. However, it also places more responsibility on the institution for key security, access controls, transaction authorization, and business continuity.
Lost, exposed, or improperly accessed private keys can lead to losses that may be difficult or impossible to reverse. Self-custody therefore requires more than assigning a technical team to hold keys. Institutions need multi-person approval processes, segregation of duties, secure backups, access logs, and tested recovery procedures.
Third-party custody can provide access to specialist security infrastructure and established operational controls, but it introduces counterparty, service interruption, and contractual risks. Institutions should assess a custodian's legal status, asset segregation arrangements, audit capabilities, disaster recovery procedures, and treatment of assets in the event of insolvency or operational failure.
For investment advisers and funds, custody decisions should reflect asset size, investment strategy, operational capacity, and risk tolerance. Cost and transaction speed should not be the only decision criteria. Even if final rules permit certain institutions to self-custody, not every institution will necessarily have the controls needed to do so safely.
How Should Advisers and Funds Prepare for Custody Compliance?
First, institutions should inventory their digital assets and current custody arrangements. They should identify which assets are held by third parties, which are managed internally, and who controls private keys, authorizes transactions, and maintains accounting records. An asset register and responsibility matrix can help reveal gaps in oversight.
Second, institutions should strengthen technical and operational controls. Those using self-custody should regularly test key recovery, permission revocation, transaction approvals, and incident response procedures. Institutions relying on third-party custodians should assess security controls, audit reports, asset segregation arrangements, and contractual protections. On-chain balances should also be reconciled regularly with internal records.
Third, firms should monitor the SEC's rulemaking process. Conditions in the proposal may change before a final rule is adopted. Compliance teams should track regulatory developments and reassess custody policies, internal controls, and disclosure processes once the final requirements become clear.
KYT can help identify fund flows involving high-risk addresses and suspicious transaction patterns, but it cannot replace private-key security, asset safeguarding, or internal authorization controls. An effective digital asset custody framework must address on-chain transaction risk, technical security, legal arrangements, and auditable operational procedures together.
The SEC's proposal reflects an effort to modernize traditional custody rules for the evolving digital asset market. For investment advisers, funds, and custody providers, the priority is not to assume that existing restrictions have already been lifted, but to evaluate current custody capabilities and prepare for potential changes once the rulemaking process is complete.