SEC Rewrites Crypto Asset Custody Rules: Funds, Self-Custody, and State Trust Companies Enter the Same Framework

Figure 1 | U.S. Securities and Exchange Commission headquarters, this draft was published by the SEC

Once crypto assets enter the fund and investment adviser business, custody has consistently been one of the most difficult links to implement. Traditional securities can be registered in accounts at banks, broker-dealers, or specialized custodian institutions, where asset rights, ledgers, and regulatory responsibilities are relatively clear. Crypto assets rely on private key control, and the custodians available in the market may not cover all tokens and networks. New assets go live far faster than institutional custody products can complete approval and technical integration.

On October 1, 2026, the U.S. Securities and Exchange Commission released proposed rules IA-7023 and IC-36353, designing a new crypto asset custody framework for registered investment advisers and regulated funds. The draft allows advisers to directly custody client crypto assets under strict conditions, provides a clear entry point for state-chartered trust companies, and updates the existing custody rules for funds and advisers.

The draft uses the term "self-custody." Here, the subject is the investment adviser or the fund's investment adviser, while the assets are still held for clients by a professional institution. The focus of the regulatory design is how, when suitable external custodians are lacking in the market, an adviser can demonstrate that it has equivalent levels of control, audit, and asset segregation capabilities.

1. The rules first address who can custody

Figure 3 | The three main paths for crypto asset custody under the SEC draft

The custody rule under the Investment Advisers Act of 1940 applies to client funds and securities over which an adviser has custody, while the custody rule under the Investment Company Act of 1940 covers securities and similar investments held by funds. Traditional institutions such as banks and broker-dealers constitute common permitted custodians. After the emergence of the crypto market, state-chartered limited-purpose trust companies began offering custody services, but whether they qualify as a "bank" under federal rules must be determined case by case in light of state and federal law.

Asset coverage is also a practical obstacle. Large custodians prioritize networks with higher liquidity and mature technology, while newly issued tokens, staked assets, or on-chain rights with special structures may lack services for a long time. Even if a fund forms an investment judgment, it may abandon a trade because there is no acceptable custody path.

The SEC draft offers three options. When an existing qualified custodian can support the asset, funds and advisers continue to use the traditional path; state trust companies can take on crypto assets after meeting special due diligence and segregation requirements; and when no permitted custodian can indeed be found, advisers may adopt conditional direct custody. The three paths serve the same goal: keeping asset control, client rights, and responsible entities identifiable.

Institutions must determine the intended path at the investment approval stage, because custody costs, trade timing, and asset servicing capabilities will directly affect whether a fund can execute its strategy. Custody arrangements will enter internal review alongside investment decisions.

The scope of the rules is tied to the statutory custody obligations of advisers and funds. It does not rewrite the securities attributes of all crypto assets at once, nor does it place every token into the same category. Whether an asset constitutes a security or similar investment under fund rules still must be determined based on product rights and the specific transaction.

2. Direct custody by advisers requires a complete control system

Figure 2 | Institutional self-custody places two security keys, asset custody, and document auditing into the same control system

Before choosing direct custody, an adviser must determine that no permitted custodian in the market can custody the asset and must keep a written record of that basis. This judgment is completed before self-custody begins and is updated at least quarterly thereafter. Once external custody services become available, the adviser needs to reassess the prior arrangement.

The draft requires advisers to confirm item by item that they possess custody knowledge related to the assets and to document the basis for their judgment. Private key formats, transaction authorization, contract upgrades, and asset recovery methods vary greatly across blockchains, and institutions cannot use a single broad "digital asset security policy" to cover all assets. The custody system must at least address loss, theft, misuse, and misappropriation risks, and its actual operating effectiveness must be reviewed annually.

Private key management is written into the core controls. Each crypto asset transaction requires joint authorization by at least two people, reducing the chance that a single person can independently transfer assets away. Client assets must also go into on-chain addresses that hold only that client's assets, with institutions relying on address separation to maintain account boundaries between clients. Wallet labels, on-chain balances, and internal client ledgers must correspond continuously.

Cybersecurity controls must likewise be reviewed at least annually. This covers hardware devices, signing environments, access permissions, backup and recovery, vendor management, and incident response. An on-chain transfer is brief, but the control chain behind it can involve multiple systems and personnel. Advisers need to prove that each authorization action can be traced to a specific client, trade instruction, and approval record.

3. The threshold for self-custody extends from private keys to corporate governance

Figure 4 | Main control requirements advisers must continuously meet for self-custody

The SEC embeds independent audits into the self-custody process. Within six months after an adviser begins directly custodying crypto assets, it must obtain an internal control report issued by an independent public accountant, updated annually thereafter. The report focuses on control objectives related to custody services and their operation, turning private key security from an internal matter for the technical team into a governance matter inspectable by external professional institutions.

Clients receive account statements at least quarterly. The statements must be consistent with on-chain addresses, internal general ledgers, and transaction histories. On-chain records can prove what happened at an address, but they do not automatically show which client the address belongs to, who authorized the transaction, or what contractual protections apply to the balance. Account statements take on the work of converting public chain data into records of client rights.

Advisers must also agree in writing with clients to treat each crypto asset held directly as a "financial asset" under applicable state law. This arrangement borrows the securities holding structure of Article 8 of the Uniform Commercial Code, giving clients clearer property rights and priority protections when assets are held through an intermediary. The specific effect depends on the agreement, account structure, and applicable state law, and the contract text will become part of the custody design.

When funds use adviser self-custody, the board of directors assumes additional oversight. The board reviews the written report that "no permitted custodian is available" at the outset and quarterly thereafter, and must determine before self-custody begins and annually thereafter whether the asset is subject to reasonable care. The board therefore needs to understand asset technology, external markets, and adviser controls, rather than merely approving a general custody policy.

4. State trust companies gain a clearer entry point

State-chartered trust companies are important participants in the U.S. crypto custody market. The SEC draft allows advisers and regulated funds to place crypto assets with such institutions, but requires clients to complete special due diligence before signing and to review it at least annually.

Due diligence first confirms whether the trust company is authorized by the relevant state banking regulator. The adviser or fund must also assess whether its written custody policies cover theft, loss, misuse, and misappropriation risks, and obtain the most recent audited financial statements and internal control report. The focus shifts from "holding a state charter" to capital, controls, and actual service capabilities.

State trust companies must segregate client and fund crypto assets from their own assets. For on-chain wallets, this means addresses, wallet permissions, and internal records can identify client rights; for staking, forks, airdrops, or network migrations, the contract must also explain how new assets and operational rights are handled. Asset segregation will directly affect clients' recovery path in the event of institutional bankruptcy or operational accident.

This set of rules will also widen the gap among custodians. Trust companies able to provide audit reports, financial transparency, per-client segregation, and multi-chain operations will find it easier to enter the vendor lists of advisers and funds. Smaller service providers will need to bear the costs of ongoing audits, system upgrades, and compliance personnel, and market share may further concentrate among a few institutions.

5. Records, trading authority, and traditional custody rules are updated together

The draft also addresses several old issues in traditional rules. The SEC plans to update the conditions under which broker-dealers provide custody for funds, clarify that business development companies may use the relevant fund custody rules, and adjust the delivery deadlines for audited fund financial statements. The scope of this part of the reform goes beyond crypto assets.

The investment adviser rules are proposed to add exceptions related to discretionary trading authority, long-term powers of attorney, and inadvertent custody. When clients grant advisers trading authority, the account control method may cause the adviser to technically touch the funds; the new rules attempt to distinguish normal trading authority from full custody based on actual risk, reducing duplicative obligations in form.

Recordkeeping is also being connected to blockchain. Qualifying on-chain records can satisfy retention requirements under the Advisers Act and the Investment Company Act, while institutions must still ensure records are retrievable, reproducible, and tied to client identities. Hash values or block explorer links can only prove that on-chain data exists; complete archives should also retain authorization, valuation, client instructions, and exception handling materials.

Asset servicing will make records more complex. Staking rewards, protocol upgrades, forks, and airdrops may change client holdings, and advisers need to decide in advance whether to participate, who approves, and how new assets are attributed. Every on-chain operation simultaneously affects custody, valuation, and client reporting, and policy documents should translate technical events into clear business processes.

Form ADV and Form N-CEN will add information about crypto asset custody and tokenized fund shares. Regulators can thereby learn which advisers use direct custody, which funds rely on state trust companies, and which networks assets are concentrated on. Information scattered across individual examinations will gradually form a comparable data set.

6. The market will recalculate the cost of custody services

For investment advisers, direct custody brings asset selection space but also ongoing investment. Two-person authorization, segregated addresses, cybersecurity reviews, internal control reports, and quarterly judgments all become fixed costs. Self-custody is commercially viable only when an asset truly lacks external custody services and its investment value is sufficient to cover these costs.

Fund boards need to establish a new review rhythm. Custodian availability changes with the market; a chain that lacks institutional services today may have qualified providers within a few months. Boards need comparative materials on service scope, pricing, insurance, and control reports, and quarterly meetings will also add technology and operational topics.

External custodians, meanwhile, gain new product directions. Supporting more networks, shortening asset onboarding time, providing per-client addresses, and offering standardized control reports can directly reduce advisers' reasons to adopt self-custody. Competition in custody services will expand from "can private keys be stored" to auditing, legal structure, asset servicing, and regulatory data output.

Insurance and liability terms will also enter procurement comparisons. Losses from private key theft, internal personnel violations, smart contract failures, and network outages have different sources, and insurance coverage may not align with custody contract liability. Funds and advisers need to verify deductibles, indemnity caps, subcontractor liability, and claims procedures, and set out in advance the funding sources after an incident occurs.

The draft is still at the comment stage, and the comment period will last 60 days after the document is published in the Federal Register. The market will focus on the implementation costs of quarterly availability judgments, per-client addresses, two-person joint authorization, and state trust due diligence. The final text may also adjust specific conditions.

The SEC this time chose to enter crypto asset custody through day-to-day controls. Private keys remain important, but what truly determines whether an institution can custody assets over the long term is whether authorization, segregation, auditing, board oversight, and client records can be linked into a continuously operating system. Crypto custody thus moves closer to traditional fund governance while retaining operational requirements tailored to the technical features of on-chain assets.

This article is solely for legal, policy, and industry research exchange, aiming to provide objective analysis of digital finance, stablecoins, digital assets, and related regulatory developments. It does not constitute any form of investment advice, legal opinion, tax opinion, or other professional advice, nor does it constitute any recommendation, promotion, or solicitation for any financial product, digital asset, or commercial project. The regulatory rules, market data, and institutional information involved in this article are mainly derived from public sources and may change due to adjustments in laws and regulations, regulatory policies, market conditions, and project progress. Readers should make independent judgments in light of the latest public information and comply with the laws and regulations applicable in their country or region. The author and publishing platform assume no responsibility for any investment, trading, or other business decisions made in reliance on the content of this article.