SEC Crypto Custody Rule Proposal: What Advisers Need to Know

Video transcript

The SEC's October 2026 proposal would let advisers self-custody client crypto, under strict key management and cybersecurity conditions.

It is still a proposal. Comments are due December 7, 2026, and nothing changes until a final rule is adopted.

Advisers could self-custody crypto no qualified custodian will hold. Regulated funds could do so through a complying adviser. And state trust companies could act as custodians.

The definition is broad. Holding any portion of a client's key materials, even one MPC share or multisig key, would count as self-custody.

Self-custody brings conditions: a written finding that no custodian will take the asset, joint approval of every transfer, an annual cyber risk assessment, and an accountant's control report.

Trust company custodians would face four checks, before engaging and every year: state authorization, key management and cybersecurity policies, audited GAAP financials, and an internal control report.

The proposal does not prescribe technical safeguards. So turn practices into evidence: ceremony records, a key inventory, a recovery test, and proof one approver cannot move funds alone.

Before a final rule, map every place you hold client key material. Confirm the control report covers signing, test whether one compromised device can move assets, and comment by December 7 if the conditions do not fit.

Guardian's OpSec audit covers custody, key ceremonies and multisig signing. Read the full article, or talk to Guardian before the rule is final.

On October 1, 2026, the SEC proposed crypto custody rules for registered investment advisers and regulated funds. The Federal Register published the release on October 6.

It is a proposal, open for comment until December 7, 2026. Nothing changes until the Commission adopts a final rule.

Two parts matter most to security teams. Advisers could hold client crypto themselves, and state trust companies could act as qualified custodians, both under conditions on key management and cybersecurity.

This article explains the technical and security side of the SEC's proposed Adviser and Regulated Fund Custody Rules; Crypto Custody Rules. It is not legal advice; confirm how it applies to you with counsel.

Where Things Stand

The 2023 proposal would have redesignated and amended the adviser custody rule, and was never adopted. The 2026 release is a new proposal, File No. S7-2026-35.

What Was Proposed

The release covers advisers under the Advisers Act and regulated funds under the Investment Company Act. Its crypto parts would apply only to crypto assets that are funds or securities.

• Adviser self-custody: rule 223-1(b)(7) would let an adviser hold client crypto assets itself, under conditions.
• Fund self-custody: rule 17f-9 would let a regulated fund hold crypto through a complying adviser, with board oversight.
• State trust companies: rules 223-1(d)(13)(v) and 17f-8 would let them custody crypto assets, under conditions.
• Redesignation: rule 206(4)-2 would become rule 223-1, with modernizing amendments.
• Records: required records could live on a crypto network, if produced promptly in human-readable form.

Self-custody would have a precise meaning: "possession of any portion of a client crypto asset's key materials". Key materials would be private keys "or any part thereof" needed to transact.

Read literally, an adviser holding one MPC share or one multisig key would have self-custody, unless it holds it as a qualified custodian.

The release asks whether advisers that hold portions of key material today would need time to comply.

State Trust Companies as Custodians

The proposal defines a state trust company as one organized under state law, supervised and examined by a state bank supervisor, and permitted to exercise fiduciary powers.

Before engaging one, and annually after, the adviser would have to:

• Determine in writing, after due inquiry, that its state banking authority has authorized it to custody crypto assets.
• Determine that its written safeguarding policies address, "at a minimum, private key management and cybersecurity".
• Review its latest audited financial statements, prepared under U.S. GAAP.
• Review its latest internal control report, with an independent accountant's opinion on whether controls operated effectively throughout the period.

Client crypto assets would also have to be segregated from the trust company's own assets.

These conditions largely track the staff's September 30, 2025 no-action letter. The release notes that letter, like all staff statements, "has no legal force or effect".

If a final rule is adopted, the Commission's views would supersede inconsistent staff views. The release asks whether staff should delay rescinding the letter.

Self-Custody Conditions

Under proposed rule 223-1(b)(7), an adviser that self-custodies would have to meet every condition below.

If a qualified custodian becomes available, the adviser would have to move the asset to it "as soon as reasonably practicable".

For a regulated fund, its board would designate the key-access persons by resolution, and the management person would have to be a fund officer.

Safeguarding Policies in Practice

The key management requirement "does not prescribe specific technical safeguards". Instead, the release describes practices advisers could consider.

The adviser's compliance policies under rule 206(4)-7 would need to address each element. Here is how each practice becomes testable evidence.

Key generation and storage

• Encrypt every level of key generation, with designated authenticators present at a secure, monitored site.
• Back up keys, and consider air-gapping and hardware security modules.
• Evidence: ceremony records, a key inventory per client address and a dated recovery test.

See our guides to the key ceremony and to HSM vs KMS.

Signing

• MPC or multisig, so no one person can move assets alone.
• Multi-factor authentication to verify each designated approver.
• Measures that prevent blind signing, and allowlists for recipient addresses.
• Extra safeguards for hot wallets, given malware and attack risk.
• Evidence: the signing policy's rules, and a test showing one approver cannot move funds.

Cybersecurity and continuity

Effective safeguarding systems should "generally address business continuity and disaster recovery", the release says. It notes advisers may already run cybersecurity programs under Regulation S-P.

Scope the annual assessment to the wallet stack and the chains.

For expertise, the release suggests evaluating each network's extensibility and governance. It also asks whether advisers should weigh the quantum computing threat.

For a deeper look at custody models and custodian evidence, see our crypto custody guide.

Before a Final Rule

• Comment on File No. S7-2026-35 by December 7, 2026, if the conditions do not fit your setup.
• List every place you hold any portion of client key material, including MPC shares and co-signer keys.
• For each trust company custodian, gather evidence for the four checks the proposal lists.
• Check that the control report's scope covers key management and signing, not just the ledger.
• Draft the cybersecurity risk assessment for your signing stack.
• Test whether one person, or one compromised device, can move client assets.

If adopted as proposed, trust company custodians should expect requests for key management and cybersecurity policies, audited GAAP financials and an internal control report.

How Guardian Helps

Guardian's OpSec audit covers custody and key ceremony: where keys live, who holds which share, and what a quorum requires in practice.

It also reviews multisig signing: what a signer actually sees before approving, and what it takes to slip a malicious payload past them.

For allocators, Guardian's underwriting reviews the control and custody behind a position: signer sets, thresholds, timelocks and admin keys.

Frequently Asked Questions

Is the SEC crypto custody rule final?

No. The Commission issued it as a proposal on October 1, 2026, and the Federal Register published it on October 6. Comments are due December 7, 2026. Nothing changes until a final rule is adopted and takes effect.

What happened to the SEC's 2023 Safeguarding proposal?

The Commission formally withdrew it on June 12, 2025, with notice in the Federal Register on June 17, 2025 (90 FR 25531). The October 2026 release is a separate, new proposal.

Can a state trust company be a qualified custodian for crypto today?

If it meets the Advisers Act definition of a bank, a fact-specific inquiry, the release says. Separately, under a September 30, 2025 no-action letter, staff would not recommend enforcement against advisers treating qualifying ones as banks for crypto custody.

Would holding one MPC key share count as self-custody?

Under the proposed definition, possessing any portion of a client crypto asset's key materials would be self-custody, unless held as a qualified custodian. The release asks whether advisers holding key portions today would need time to comply.

Sources

• Federal Register: SEC, Adviser and Regulated Fund Custody Rules; Crypto Custody Rules, proposed rule, 91 FR 63870 (October 6, 2026)
• SEC: Adviser and Regulated Fund Custody Rules; Crypto Custody Rules, Release Nos. IA-7023 and IC-36353, File No. S7-2026-35 (October 1, 2026)
• Federal Register: SEC, Withdrawal of Proposed Regulatory Actions, 90 FR 25531 (June 17, 2025)
• SEC Division of Investment Management: Simpson Thacher & Bartlett LLP no-action letter on state trust companies (September 30, 2025)
• SEC Division of Trading and Markets: Statement on the Custody of Crypto Asset Securities by Broker-Dealers (December 17, 2025)
• Guardian: Crypto Custody: How It Works and How to Choose a Custodian
• Guardian: What Is a Key Ceremony? How Custodians Generate Crypto Keys
• Guardian: HSM vs KMS for Crypto Signing Keys
• Guardian: OpSec Audit