Summary

  • The SEC’s 1 October proposal treats an adviser’s crypto self-custody as a conditional route for covered assets, not a general replacement for qualified custodians. Each asset would need a written finding that no qualified custodian is available to maintain it, renewed at least quarterly.
  • For regulated funds, a majority-non-interested board would review that availability finding and separately decide whether the adviser’s arrangement provides reasonable care. The proposal remains open for comment; none of its new conditions is yet an adopted rule.

The exception follows the asset

The SEC’s proposed custody framework, issued on 1 October and published in the Federal Register on 6 October, would amend rules under the Investment Advisers Act and the Investment Company Act. It covers registered investment advisers and regulated funds, including registered investment companies and business development companies. The asset perimeter is narrower than “crypto” in ordinary conversation: the SEC says the adviser custody provisions reach crypto assets that are funds or securities, while the fund provisions concern securities or similar investments. A digital asset does not become a security simply because it uses a distributed ledger.

The proposed adviser self-custody route begins with a written, asset-specific finding. Before holding a covered asset, the adviser would need a reasonable basis, after due inquiry, to believe no qualified custodian is available to maintain it. A blanket statement covering every token would not do. The SEC points to the asset’s characteristics, the custody market and the services of custodians generally known in that market as relevant evidence. The adviser could not rely only on the cost of hiring a custodian.

The test would not end at entry. The adviser would reassess its finding in writing at least quarterly for assets still in its self-custody. If a qualified custodian became available, the adviser would have to place the asset with it as soon as reasonably practicable. The SEC asks whether the final rule should set a firm outer limit for that transfer, so the timing standard remains open to comment.

Possession brings a control burden

The proposal would require an adviser to document expertise in safeguarding each asset and to maintain the technology, hardware, software and processes needed to protect it against loss, theft, misuse and misappropriation. The systems would have to address key management, joint authorization of transactions and separation of each client’s crypto assets from those of other clients, the adviser and related persons. The proposal does not prescribe one wallet architecture or security product. It sets control objectives and leaves the technical design to the adviser’s circumstances.

That flexibility does not make the adviser’s role disappear when it hires a service provider. The SEC says the adviser remains responsible for its proposed obligations and needs enough expertise to oversee third-party functions. An outsourcing contract would therefore be evidence of a control arrangement, not a transfer of regulatory responsibility.

An independent public accountant would also prepare an internal-control report. The report would opine on whether custody controls were suitably designed and implemented and operated effectively for their objectives. The first report would be due within six months of the adviser taking self-custody, followed by at least annual reports while it continued to hold any client crypto assets itself. That is an independent test of controls over a period, not a guarantee that an asset will retain value or that loss is impossible.

A fund board has a distinct decision

For regulated funds, the adviser would not make the decision alone. Before the fund’s adviser began self-custody, a board including a majority of directors who are not interested persons would review the adviser’s written finding that no qualified custodian would maintain the asset. The board would review that finding quarterly thereafter.

A second board duty would run on a different cadence. Before custody began and annually afterward, the board would determine whether the asset would receive reasonable care if held by the adviser, considering relevant safekeeping factors. To make that judgment, the board would receive information that may include the adviser’s written expertise and system assessments, its annual review of safeguarding and cybersecurity controls, and an accountant’s internal-control report when one is available.

Serious safeguarding issues, including loss, theft, misuse or a material cyber event, would have to reach the board promptly rather than wait for the next scheduled review.

The two tests answer different questions. Quarterly review asks whether an outside custodian has become available. The annual reasonable-care decision asks whether this fund should accept the adviser’s custody arrangement. A positive answer to the first does not establish the second.

What the SEC has not settled

The SEC also proposes to recognize qualifying state trust companies as a permitted custody route for crypto assets. That could narrow the circumstances in which an adviser can rely on unavailability, but the proposal sets conditions for the category; it does not make every state-chartered trust company eligible.

The SEC’s rule page lists 7 December 2026 as the comment deadline. The proposal asks whether quarterly reassessment is the right interval, whether a transfer needs a fixed deadline, and how much specificity the rule should give to asset-level safeguarding expertise. Those questions matter because “reasonable basis” is a judgment that must be supported by records, not a self-executing market fact.

Lu Heng’s Note 73 distinguishes participation from authority to make a binding decision. That distinction helps frame this proposal without turning comment access into a vote: public submissions can expose weaknesses in the draft, the SEC will decide the final text, and a regulated-fund board would have a defined role in deciding whether its own fund may use adviser custody. Each role has a different object and record.

Sources: SEC proposal and release; SEC rule page and comment deadline; Federal Register proposing release; Commissioner Hester M. Peirce’s statement; Lu Heng, Note 73, editorial lens only.