The U.S. Securities and Exchange Commission has proposed new custody rules for registered investment advisers and regulated funds that hold crypto assets. Issued on October 1, 2026, the package would permit self-custody in defined circumstances and recognize state trust companies as permitted custodians, subject to specific controls.

Self-custody would require a written finding

An adviser could use the proposed self-custody exception only after determining in writing that no permitted custodian is available for the particular crypto asset. The adviser would repeat that review every quarter. If a suitable custodian became available, the proposal would require the asset to move there as soon as reasonably practicable.

The exception therefore depends on the asset and the available custody market. It would not give an adviser a standing choice to keep every client asset in-house. A regulated fund would face a parallel framework, with its board responsible for determinations about reasonable care and the custody arrangement.

The controls reach keys, people and addresses

The SEC proposal describes an operating system for custody rather than a single security policy. An adviser would need documented expertise for safeguarding each asset and systems for private-key management. Crypto transfers would require joint authorization by at least two designated people. Client assets would also need to sit at blockchain addresses that hold only that client’s assets.

Cybersecurity controls and annual reviews of the safeguarding system would form another layer. An independent public accountant would prepare an internal-control report within six months after the adviser begins self-custody and annually afterward. Clients would receive account statements at least quarterly, including the address and network used to hold the asset.

A written agreement would classify each asset under the applicable state law and identify the adviser’s intermediary role. That contractual step connects on-chain control to a legal framework for ownership and custody duties.

State trust companies would face diligence

The proposal would expressly include qualifying state trust companies among permitted custodians. Advisers and funds would still have to investigate a trust company’s authority and controls. The SEC release discusses checks on state authorization, audited financial statements, internal-control reporting and asset segregation, with continuing review rather than one approval that lasts indefinitely.

For custody teams, the proposal separates three questions that are often collapsed into one: who can move the keys, which entity is legally responsible, and what evidence shows the controls work. Multi-person approval can reduce single-operator risk, while client-specific addresses can make segregation easier to test. Neither measure alone proves that the legal and operational requirements have been met.

The rulemaking is still open

The package remains a proposed rule under File No. S7-2026-35. The SEC lists December 7, 2026 as the public-comment deadline. Advisers, funds, custodians and clients should treat the controls as a proposal until the Commission completes the rulemaking process and publishes any final text.

Source: BlockchainReporter.