SEC Proposes New Crypto-Custody Options and Modernizes Custody Rules

What is new?

The Securities and Exchange Commission (SEC) has proposed conditional crypto asset self-custody and state trust company custody for registered investment advisers and regulated funds. The proposed rules would also modernize custody, recordkeeping, and reporting requirements under the Investment Advisers Act and Investment Company Act. The proposal was issued on October 1, 2026, and comments are requested by December 7.

Why did the SEC issue the proposal?

Existing custody rules were designed to protect adviser clients and regulated fund assets from risk of loss, theft, misuse, and misappropriation. However, those rules were designed for traditional assets and have not been updated to address the crypto asset market. This has left gaps in the regulatory environment; for example, where a “permitted custodian” may not support novel crypto assets and where there is a lack of clarity regarding when a state-chartered trust company can custody crypto assets. The SEC’s proposal seeks to address these and other limitations while retaining investor protections.

What would the proposal do?

• Permit conditional self-custody of crypto assets. An adviser would be permitted to hold crypto assets for advisory clients for which it provides investment advice, subject to conditions including:
  • The adviser determines (initially and quarterly thereafter) that a permitted custodian is not available to maintain the crypto asset and has a reasonable basis for determining that it has the safeguarding experience.
  • The adviser adopts, implements, and maintains the systems to safeguard each crypto asset against loss, theft, misuse, and misappropriation; and reviews those systems and the effectiveness of their implementation at least annually.
  • The adviser’s safeguarding systems would be required to address private key management and require joint authorization of any crypto-asset transactions by at least two people.
  • The adviser maintains client-specific crypto addresses and, at a minimum, conducts an annual review of its cybersecurity controls and the effectiveness of their implementation.
  • The adviser obtains an independent accountant’s internal control report within six months of taking self-custody of crypto assets, then annually thereafter.
  • The adviser provides quarterly statements to each client for which it self-custodies crypto assets.
  • The adviser obtains a written adviser–client election treating the asset as a “financial asset.”
  • For advisory clients that are regulated funds, fund boards would have additional oversight duties over the adviser, including:
    • reviewing (initially and quarterly thereafter) the investment adviser’s written report documenting the basis for the adviser’s determination that no qualified custodian is available to maintain the crypto asset
    • determining, prior to the investment adviser maintaining the crypto asset, that the crypto asset of the regulated fund would be subject to reasonable care if self-custodied with the regulated fund’s investment adviser
• Permit state trust company custody. Amendments to the Investment Advisers Act and Investment Company Act custody rules would permit custody of advisory client and regulated fund crypto assets by state trust companies, subject to the following requirements:
  • Before engaging a state trust company as a permitted custodian and annually thereafter:
    • The adviser or regulated fund must have a reasonable basis, after due inquiry, to believe that the state trust company is authorized by the relevant state banking authority to provide crypto-asset custody.
    • The adviser or regulated fund must have a reasonable basis, after due inquiry, to believe that the state trust company maintains and implements written policies and procedures reasonably designed to safeguard crypto assets and related cash and/or cash equivalents from the risk of theft, loss, misuse, and misappropriation.
    • The adviser or regulated fund must receive and review the state trust company’s most recent annual audited financial statements.
    • The adviser or regulated fund must receive and review the state trust company’s most recent internal control report.
    • All advisory client and regulated fund crypto assets must be segregated from the state trust company’s proprietary assets.

Other proposed changes. The proposal includes conditional exceptions for discretionary trading authority, inadvertent custody, and standing letters of authorization; removal of Public Company Accounting Oversight Board (PCAOB) registration and inspection requirements for accountants; revised pooled-vehicle audit provisions; and streamlined broker–dealer fund custody.

The proposal also includes amendments to address crypto custody and tokenized fund shares in Form ADV and Form N-CEN. Crypto-network records could satisfy recordkeeping requirements only subject to specified conditions.

How BRG can assist

BRG’s Financial Institution Advisory practice can help assess the proposal and prepare for potential changes. Support can include:

• Policy and process assessment. Assist with a gap analysis and design and implementation of new requirements.
• Controls and diligence review. Assess existing safeguarding procedures, cybersecurity controls, supporting documentation, and custodian diligence processes; and make recommendations to align with new requirements. Assist with preparing for an initial system and organization controls (SOC) review.
• Implementation planning. Evaluate resource needs and potential costs, develop a readiness plan, and prepare materials for discussions with auditors, boards, and legal counsel or a potential comment submission.
• Ensure oversight and key processes, structure, and operating protocols are properly designed and functioning as intended.
• Financial crime. Assist in evaluating whether anti-money laundering and sanctions activities are appropriately established for crypto-based custody activities.

To discuss your custody arrangements or a potential comment submission, contact BRG Managing Directors Paul Noring, Michael Canale, Michael Sullivan, or Barb Vanich.

This alert addresses selected provisions of the proposal as of October 13, 2026. It is for general information and is not a substitute for advice on your specific circumstances.