SEC Self-Custody Rules entered the policy record on October 1, 2026, when the SEC proposed changes that would address how registered investment advisers and regulated funds can custody crypto assets under federal securities laws, including limited use of self-custody, state trust companies as custodians, and updated recordkeeping and disclosure requirements, according to the SEC proposal announcement. As of October 25, 2026, the proposal had not been finalized, and the comment period remained open until December 7, 2026.
The proposal matters because crypto custody is not only a legal classification issue. It is a technical operating model built around private keys, transfer authority, system access, audit evidence, and client reporting. The proposal could give some advisers a path to hold assets that lack qualified custodian support, but it would also add controls that may be costly and hard to maintain. This is not financial advice, and the rule text may change after public comments.
SEC Self-Custody Rules And Asset Management
SEC Self-Custody Rules Definition
The proposed definition is specific. Self-custody would exist when an adviser or regulated fund, through its adviser, holds any part of the private key needed to access or move crypto assets without using a permitted custodian, as described in the Federal Register proposing release. That framing is technically significant because possession of only part of a signing arrangement can still create custody exposure if that part is needed for transfer authority.
Under the SEC Self-Custody Rules, an adviser would not be able to choose self-custody merely because it prefers direct control. The adviser would need written documentation, both initially and quarterly, that no qualified custodian is available for the specific crypto asset. If a qualified custodian later becomes available, the adviser would need to move the asset to that custodian when reasonably practicable.
What Changes For Advisers And Funds
The proposal would permit registered investment advisers and regulated funds to self-custody crypto assets only under certain circumstances. It would also allow state trust companies to serve as custodians for client or fund crypto assets. Those changes could matter for assets or strategies that are hard for traditional custodians to support, including some assets tied to staking, governance participation, forks, airdrops, or DeFi access.
The operational conditions are demanding. The proposal describes safeguarding systems against loss, theft, misuse, and misappropriation. It also includes dual, or joint, authorization for transactions, annual reviews of safeguarding and cybersecurity controls, and quarterly statements to clients that disclose the address used, balances, and transaction history.
- Written availability analysis: The adviser would need evidence that no qualified custodian is available for the asset.
- Quarterly reassessment: The custodian availability analysis would need to be updated every quarter.
- Joint authorization: Crypto transfers would need more than one authorized approval path.
- Client reporting: Quarterly statements would need address, balance, and transaction history details.
- Control review: Safeguarding and cybersecurity controls would be reviewed annually.
Custody Market Gaps And Adoption Barriers
Custodian Availability Is The Central Gate
The Federal Register release reported that, as of December 2025, about 60.1% of registered investment advisers, or roughly 9,883 advisers, reported that they or related persons had custody over about $60.8 trillion in client assets. It also reported that only 136 advisers used specialist crypto custodians among 39 such custodians identified across their businesses. Those numbers show why the custody question is larger than crypto alone: many advisers already operate under custody obligations, but far fewer appear to rely on specialist crypto custody providers.
For crypto asset management, the narrow gate is not just whether a custodian exists in name. The practical question is whether a qualified custodian can support the specific asset and its technical features. If a custodian cannot support a token’s transfer mechanics, governance rights, fork handling, or other asset-specific operations, the adviser may avoid the asset or strategy rather than absorb custody uncertainty.
Impact On Investor Choice, Without Hype
The proposal could expand the set of assets that advisers can consider for client or fund strategies where no qualified custodian is available. That possibility should be read carefully. The rule would not make every unsupported asset suitable for every mandate, and it would not remove fiduciary, disclosure, operational, or cybersecurity duties. It would create a conditional route, not a broad permission slip.
Adoption barriers may remain high for smaller advisers. The proposal’s written findings, transaction authorization requirements, quarterly client statements, cybersecurity review cycle, and transfer obligation after custodian availability all require staff time, systems, and outside assurance. A smaller firm may decide that the cost and liability profile outweigh access to assets that lack qualified custody support. For related risk analysis on the same issue, see this discussion of crypto custody risk.
Cost, Controls, And Security Tradeoffs
Private Key Risk And Control Design
Self-custody places private key control closer to the adviser or fund. That can reduce dependence on an external custodian for unsupported assets, but it also concentrates operational risk inside the adviser’s control environment. The proposal identifies risks including mismanagement of private keys, theft or loss, conflicts of interest when the adviser also holds custody, audit assurance limits, and liability.
The required joint authorization model is meant to reduce single-person transfer risk. Still, controls are only as reliable as their implementation, review, and evidence. A policy that requires two approvals is different from a system that technically prevents unilateral movement of assets. The proposal’s annual review requirement gives a review cycle, but annual review does not eliminate day-to-day key handling risk.
Cost Burden For Smaller Firms
The cost estimates in the release are material. Internal control reports are estimated at about $376,000 per year per adviser. For regulated funds using fund self-custody through their adviser, the estimated one-time compliance cost is about $53,037 per fund, with annual costs around $21,660. These figures could make self-custody practical for some firms and uneconomic for others.
| Cost Area | Research Figure | Security Relevance |
|---|---|---|
| Adviser internal control report | About $376,000 per year | Creates external evidence around custody controls |
| Fund one-time compliance cost | About $53,037 per fund | Supports initial process and documentation setup |
| Fund annual compliance cost | About $21,660 per year | Supports recurring review and reporting obligations |
These costs should be compared with the risk of asset loss, failed reporting, inadequate authorization, or a later finding that a qualified custodian was available. For readers interested in broader perspectives on technology and security issues, see how Camp Techwise covers similar technical topics within this network.
Practical Questions For Crypto Asset Managers
SEC Self-Custody Rules Questions For Managers
Before relying on self-custody, a manager would need a defensible answer to several operational questions. The first is asset-specific: is there truly no qualified custodian available for that crypto asset? The second is procedural: can the firm document that finding at the start and refresh it quarterly? The third is technical: can the firm maintain dual authorization in a way that prevents one actor from moving assets alone?
Client reporting is another stress point. The proposal’s quarterly statement requirement includes address used, balances, and transaction history. That means wallet address management, balance reconciliation, and transaction records must be reliable enough for recurring client communications. If those records are incomplete or difficult to reconcile, the custody model may fail in practice even if the firm has written policies.
What The Proposal Does Not Solve
The proposal does not remove uncertainty around the phrase “no qualified custodian available.” It also does not guarantee that accounting firms with the needed crypto custody assurance experience will be available at a reasonable cost. If custodians expand support for more assets, the cases where self-custody is permitted may narrow. If support remains limited, advisers may still face high assurance and reporting costs.
The proposal also does not make self-custody low risk. Private key loss, theft, misuse, conflicts, and audit limits remain live issues. The control framework is designed to mitigate those risks, not erase them. That distinction matters because crypto transfers can be hard to reverse once executed, and client reporting after the fact cannot substitute for sound authorization controls before transfer.
Crypto Asset Management Under SEC Self-Custody Rules
Crypto asset management under SEC Self-Custody Rules would likely be more document-heavy, control-heavy, and cost-sensitive than some market participants expect. The proposal could help advisers consider assets that lack qualified custodian support, but only after written analysis, recurring reassessment, joint authorization, cybersecurity review, and client statement obligations.
The adoption barrier is therefore not only regulation. It is the combined weight of private key operations, assurance capacity, reporting accuracy, and liability. Larger advisers may be better positioned to absorb those requirements. Smaller advisers may find that the costs and control burden limit practical use. Until the SEC finalizes the proposal, the safest reading is conditional and evidence-based: the rule may create a path for self-custody, but it would not make self-custody simple.
