SEC Proposes a New Framework for Crypto Asset Custody
On October 1, 2026, the U.S. Securities and Exchange Commission (SEC) proposed new rules and amendments addressing crypto asset custody by registered investment advisers and regulated funds. The proposal aims to modernize the existing custody framework and provide a clearer compliance pathway as digital asset markets evolve.
Under the proposal, investment advisers and regulated funds could be permitted to self-custody crypto assets under specified conditions. They could also use state-chartered trust companies as custodians for client or fund assets, subject to the proposed requirements. Other elements address financial statement audits, broker-dealer custodial services, recordkeeping, and disclosure obligations.
Traditional financial custody rules developed in a different market environment, while digital assets introduce distinct operational considerations. Ownership records, private-key management, on-chain transfers, and custodians' transaction permissions can all affect asset security and the allocation of responsibility. The SEC proposal seeks to address these practical issues and consider a regulatory framework better suited to crypto assets.
Importantly, the proposal is not a finalized custody regime. The SEC stated that the public comment period would remain open for 60 days following publication of the proposing release in the Federal Register. Firms assessing the potential impact should rely on the published proposal and currently applicable requirements rather than treating proposed arrangements as universally authorized.
Comparing the Risks of Self-Custody and Third-Party Custody
Self-custody allows an institution to manage its own private keys and asset-transfer processes. This can reduce reliance on external custodians, but it also places greater operational responsibility on the institution. Lost keys, misconfigured permissions, compromised signing procedures, or unauthorized insider activity can make assets inaccessible or expose them to transfers without proper approval.
Third-party custody can provide specialized key management, access controls, and operational procedures. However, it introduces other risks, including vendor concentration, service interruptions, permission errors, and dependence on external providers. Using a regulated custodian does not eliminate the need for ongoing oversight of asset control and service quality.
Custody arrangements should therefore reflect an institution's asset exposure, operating model, technical capabilities, and risk tolerance. Regardless of the model selected, firms should establish clear authorization procedures, segregation of duties, transaction approvals, key-recovery plans, and incident-response processes. These controls should be tested regularly rather than treated as documentation exercises.
Institutions operating across multiple blockchain networks or handling complex transactions should also ensure that on-chain records, internal ledgers, and client reporting remain consistent. Custody controls are not solely about keeping private keys secure. They must also enable firms to demonstrate ownership, track asset movements, and maintain reliable records during disputes or security incidents.
Preparing Compliance and Custody Risk Assessments
As regulatory proposals evolve, investment advisers, fund managers, and digital asset service providers should begin by mapping their current custody arrangements. This includes identifying assets managed internally, services provided by third parties, and the access and transfer permissions held by each participant.
Firms should maintain audit trails covering asset transfers, key management, permission changes, and operational incidents. Third-party custodians should be assessed on an ongoing basis for security controls, business continuity, incident reporting, and operational dependency. Contractual responsibilities should align with the way services actually operate.
KYT tools can complement custody controls by monitoring on-chain asset movements, identifying interactions with high-risk addresses, and investigating unusual transfers. Transaction monitoring, however, cannot replace custody safeguards. Even when an on-chain transfer shows no obvious risk indicators, an unauthorized internal action can still result in substantial losses.
Firms should continue tracking the SEC proposal and distinguish potential future requirements from obligations currently in force. Strengthening private-key management, asset reconciliation, vendor oversight, and incident response now can improve operational resilience and help institutions prepare for future regulatory developments.