The SEC's Crypto Custody Proposal Lets an Adviser Hold Client Coins Only If No Custodian Is Available. Who Decides?

On 1 October 2026 the SEC unveiled a proposal that would let registered investment advisers, registered investment companies and business development companies hold client crypto themselves, but only when no permitted custodian is available, and only after documenting that finding and repeating it every quarter (The Block; Finance Magnates). It would also formally recognise state-chartered trust companies as eligible custodians. The headline version, that the SEC is opening custody to crypto, misses where the rule does its work. The substance is a conditional with one open term, available, and the open question is who gets to decide when that condition is met.

The two routes in plain terms

Under the Advisers Act custody rule, client funds and securities must generally sit with a qualified custodian. Commissioner Hester Peirce said in her statement that advisers have been waiting, in her words, gritting their teeth and holding on for dear life, for workable rules (as quoted by AlphaMaven). The SEC first proposed changes to custody in 2023, which, according to WealthManagement, would likely have forced crypto to meet the qualified-custodian rules as written. The new proposal takes a different path with two routes.

The first route is a state trust company. Per AlphaMaven's account of the proposal, such a custodian qualifies if it holds state authorisation, keeps audited financial statements, maintains safeguards against loss and theft, and segregates client holdings from its own assets. The adviser must verify those conditions rather than assume them. Finance Magnates reports that advisers and funds would check authorisation, controls and segregation, with annual control and cybersecurity reviews including independent accountant reporting.

The second route is self-custody by the adviser, which is the conditional. Advisers may hold client crypto directly only when no permitted custodian can provide the service for that asset. They must document the determination, reassess it quarterly, and move the asset once a custodian becomes available (AlphaMaven). The accompanying controls, as reported by WealthManagement and AlphaMaven, include demonstrated expertise in safeguarding each asset, dedicated client addresses, private-key management safeguards, approval by at least two authorised people for any transfer, quarterly account statements to clients, at least annual cybersecurity review, and board oversight for funds. Peirce clarified that in this context self-custody means an adviser acting as the custodian of client assets, not an investor directly controlling their own coins.

The test that does the work: no permitted custodian

Finance Magnates reports that the exception is partly aimed at newer or less widely supported tokens. That is the realistic population: assets that no qualified custodian will list, because of thin liquidity, unusual signing mechanics or legal uncertainty. For a fund that holds such a token on behalf of clients, the alternative to this rule is either not holding the asset or holding it outside the custody framework.

The weakness is the word available. As reported, the adviser makes the determination, writes it down and repeats it. The sources we read describe no third-party attestation, no defined threshold for unavailability, and no safe harbour. Availability is not binary in practice. A custodian can exist but decline a small client, quote a price that makes the strategy uneconomic, or take months to onboard a token. Whether any of those count as unavailable is exactly what an adviser, with an incentive to hold the asset, will argue. That incentive is acknowledged: Better Markets cites the SEC's own recognition of inherent conflicts of interest in self-custody. The proposal's text may answer some of these questions, and we have not read it; the point is that none of the reporting does.

This is why the quarterly reassessment is the control that matters. A one-time determination would convert a temporary gap into a permanent exemption, because custodians' offerings change faster than an adviser's filing habits. Repeating the finding every quarter forces a fresh record and requires moving the asset when the answer changes. By our arithmetic, an adviser holding 30 long-tail tokens under this route would owe 120 documented determinations a year. That is manageable for a firm that takes it seriously and a paper exercise for one that does not, and enforcement will depend on examiners reading those records.

Who benefits and who is exposed

The beneficiaries are visible. Advisers and funds with crypto exposure that no custodian supports gain a lawful way to hold it. State trust companies gain a regulatory signal that can be sold to adviser clients. The Investment Adviser Association called the proposal a positive framework and asked for a custody rule that is more workable and effective, and Josh Burton of Silver Regulatory Associates described it as the culmination of years of work and said custody has long been the hardest part of RIA compliance in crypto (both via WealthManagement). SEC Chair Paul Atkins said in announcing it that existing rules and regulations have not kept pace.

The exposed parties are clients whose adviser holds assets itself. Better Markets said the proposal subjects investors to the very high risk of loss the SEC exists to prevent, and its securities policy director, Benjamin Schiffrin, said there is no reason for the SEC to endanger investors by letting advisers hold client crypto and accused the agency of being beholden to the crypto industry (WealthManagement). That is a characterisation of motive that the evidence cannot test, but the underlying concern is concrete: private keys held by a firm are a single target, and the proposal's answer is process controls rather than structural separation. Burton, a supporter, himself warned that due diligence remains paramount in a fast-moving industry.

The state-trust-company route has its own gap, which is our reasoning rather than anything in the reporting. State chartering standards and supervisory depth differ by state. A federal rule that leans on state authorisation inherits that variation, and the proposal's mitigations, audited financials and segregation, address solvency and commingling more than operational security. Whether that is enough is a question for the comment period, not for this article.

What the evidence does not establish

Several things are unsettled. The sources we read do not report a vote or any dissent. The SEC has been shrinking: AlphaMaven reports that Peirce departed on 2 October, leaving two commissioners, and that the SEC recently lowered its quorum requirement from three to two. We could not confirm from a second outlet how the commission acted on this item, so we do not say. Nor do we know the Federal Register publication date that starts the 60-day clock, or how the final text treats edge cases such as an adviser that is affiliated with a custodian. Atkins also said, as quoted by The Block, that more regulatory proposals are on the horizon, which suggests this is one piece of a wider package rather than a standalone rule.

WealthManagement links the timing to the failure last month of Congress to pass digital asset market-structure legislation, while Burton says the custody rules are years in the making and not a response. Both can be partly true. A rulemaking of this kind does not appear in a week, but its release date can be chosen. DrafterDaily's earlier piece on the SEC's investment-contract safe-harbour proposal deals with a different question, whether a token is a security; this proposal deals with who holds it.

What to watch

The comment period will show whether the definition of available gets tightened. The comments worth reading are those from custodians, who can say whether they decline or price out the tokens the rule is aimed at, and from investor-protection groups, who will argue for third-party verification of the unavailability finding. A final rule that adds an independent attestation would change the character of the proposal; one that keeps the adviser's self-certification would leave the quarterly reassessment as the only brake. For clients, the practical step is to ask an adviser holding crypto three things: who is the custodian, if there is none, why not, and when that finding was last reviewed.