Summary

  • The US SEC proposes a conditional route for state trust companies to custody crypto assets, with initial and annual checks by investment advisers and eligible regulated funds.
  • Audited financial statements and an independent custody-controls report would do different jobs. The proposal is not in force; comments are due on 7 December 2026.

An audited balance sheet can tell an investment adviser something useful about a potential custodian. It cannot, by itself, settle who may reach the private keys that move a client's crypto assets. That second question takes the adviser from the accounts into the way custody is actually run.

The US SEC's 1 October custody proposal puts both kinds of evidence into a proposed route for state trust companies. It would let registered investment advisers and eligible regulated funds use those companies for crypto custody under specified conditions. Choosing a provider would involve more than checking its charter. The adviser or fund would have to establish the basis for its choice, put that judgment in writing and revisit it annually.

The recurring work matters as much as the initial permission. A company may keep its name and charter while the law around its activities, the technology it uses and the threats to its systems change.

The first question belongs to state law

Under the proposed route, a trust company would have to be organised under state law, subject to supervision and examination by a state banking authority, and permitted to exercise fiduciary powers. But those characteristics would not finish the adviser's inquiry. Before engagement, and each year afterwards, the adviser or fund would need a written determination that it had a reasonable basis, after due inquiry, to believe the company was authorised under the relevant state framework to custody crypto assets.

That is an activity-specific question: does this company's authority cover the service being bought? A legal opinion or a certification from the company could help answer it alongside other diligence. The proposal does not make either document an automatic pass, nor does it describe due inquiry as a limitless search for every conceivable risk.

The Federal Register text, in section II.C, also preserves the existing route for a state trust company that already meets the applicable definition of a bank. The new category is not an announcement that every state-chartered provider is currently barred, or that every one would qualify tomorrow.

Following the key

Once the authority to provide custody is established, the inquiry becomes more tangible. The adviser or fund would also have to determine that it had a reasonable basis for believing the company maintained and implemented written safeguards against theft, loss, misuse and misappropriation. Private-key management and cybersecurity would be essential subjects.

The release offers examples of what to look at: how keys are generated, who can access key material, where it is stored and how many people must authorise a transaction. Those details can tell an adviser far more about the custody arrangement than a reassuring description of secure storage.

They are examples for assessment, not a universal engineering specification. The SEC is not, in this proposal, prescribing one storage design or a fixed number of signatories for every provider. It is asking the party entrusting the assets to assess whether the provider's arrangements are reasonably designed to protect them—and whether those arrangements are implemented.

The distinction carries through to the audit evidence. The adviser or fund would receive and review the latest annual financial statements before engagement and annually thereafter, confirming that they were prepared under US generally accepted accounting principles and audited by an independent public accountant. A separate internal-control report would address whether custody controls were effectively designed, implemented and operated throughout the period covered. That report would concern the current or preceding calendar year.

These are two pieces of evidence, not two names for the same document. Reliable accounts and effective custody controls answer different parts of the decision to entrust assets.

The file stays open

Client assets would also have to be segregated from the company's own assets. Segregation is a longstanding custody principle, not a protection invented by this proposal. The proposed route carries it into the conditions for using these providers. Other possible requirements, including particular reserve or insurance levels, appear among questions for consultation; they should not be mistaken for settled obligations.

The annual checks would bring the adviser back to the file. Has the legal basis changed? Do the safeguards still address the risks posed by current technology and threats? The adviser would be renewing the justification for its custody choice, not renewing the company's state charter. Its existing fiduciary duties in selecting and monitoring custodians would continue.

For a provider, that makes the ability to supply usable evidence part of the commercial relationship. For the adviser, it means reading the documents together without letting one stand in for another. A strong financial audit does not answer a legal-authority question; a legal opinion does not show how private-key access worked during the year.

As of 26 October, this remains a proposal. The SEC docket sets 7 December 2026 as the comment deadline. The fund route covers management investment companies and business development companies, rather than every type of fund, and sits within a wider package that also addresses crypto self-custody.

The final rule may change. The useful idea in the proposal is already clear: permission to offer custody and a sound decision to buy it are related, but separate, judgments. One names the activity the company may undertake. The other needs evidence about what happens to the client's assets after they arrive.

Editorial update, 26 October 2026: The related institution has been corrected from Thailand's SEC to the US SEC responsible for this proposal. The original publication date and article URL are retained; the text now explains the proposed conditions in greater detail.