Crypto Custody Risk moved higher on the regulatory agenda on October 1, 2026, when the U.S. Securities and Exchange Commission proposed “Adviser and Regulated Fund Custody Rules; Crypto Custody Rules,” Release Nos. IA-7023 and IC-36353, under the Investment Advisers Act and Investment Company Act SEC proposal notice. The proposal did not make self-custody a default operating model. It set conditions around when registered advisers and regulated funds could hold crypto assets outside a qualified custodian, with a focus on controls, documentation, client reporting, and cyber readiness.
The proposal matters because custody failures in crypto often have a different failure pattern than failures in ordinary recordkeeping systems. If private key material is lost, misused, or exposed, many blockchain transactions cannot be reversed through a central operator. The SEC’s October 6, 2026 Federal Register notice described self-custody as carrying higher custodial risks, including loss, theft, misuse, and misappropriation, and noted that advisers may lack the experience, expertise, or controls needed to safeguard such assets Federal Register notice.
Why Crypto Custody Risk Changed In October 2026
The proposed framework treated custody as an operating system, not just a legal label. It linked legal permission to technical controls: who can approve transfers, how keys are protected, how records are reconciled, and how clients can compare statements with on-chain activity. That framing is useful for compliance teams because a custody program can fail even when account ledgers look orderly.
Self-Custody And Crypto Custody Risk
The proposal would allow advisers to self-custody crypto assets only when no qualified custodian is reasonably available. Advisers would need to document that conclusion in writing before assuming self-custody and reaffirm it at least quarterly after doing so. This creates an evidence trail, but it does not remove the core operational hazard: the adviser becomes responsible for processes that qualified custodians usually build as a primary business function.
The proposal treats Crypto Custody Risk as partly technical and partly organizational. A firm can buy secure hardware, separate duties, and draft written procedures, yet still face risk if staff do not understand transfer approval, key backup, incident response, or recovery limits. For crypto assets, an error in signing authority or key handling can affect the asset itself, not only the record of ownership.
Qualified Custodians And State Trust Companies
The proposal would add a new category of permitted custodian: state-chartered trust companies could custody client or fund crypto assets even if they did not meet the definition of “bank” under existing laws. That permission would be subject to initial and annual due diligence. The operational question for advisers is not only whether an entity is permitted, but whether its controls, reporting, segregation practices, and recovery processes fit the assets being held.
For advisers evaluating related custody obligations, a narrower technical discussion of SEC custody rules can help connect policy language to control design. For those interested in additional resources, materials and references can be found within the network at Stamps in Class.
Control Duties For Private Keys And Transfers
Private key management sits near the center of the proposal’s operational concerns. The research record points to requirements for safeguarding expertise, cybersecurity protections, joint authorization of transfers, and procedures for managing private keys. These controls aim to reduce loss, theft, misuse, or misappropriation, but they do not make the system risk-free.
Joint Authorization As A Control Boundary
Joint authorization can reduce single-person failure. In practice, it means a transfer should not depend on one employee, one device, or one approval path. This type of control can reduce insider risk and accidental transfer risk, but it also adds maintenance duties. Firms need current role mappings, backup approvers, offboarding procedures, and tested escalation paths.
For Crypto Custody Risk, the weak point is often the gap between policy and daily operation. If a written procedure says two approvals are required but emergency workflows bypass that step, the control may not work when pressure rises. If backup key material exists but is not inventoried or tested, a firm may discover a recovery problem only after an incident.
Internal Control Reports
The proposal would require an internal control report from an independent public accountant within six months after advisers first self-custody crypto assets and then annually. The report would assess whether controls are suitably designed, implemented, and operating effectively. This is more than a paperwork task. A design can look reasonable while implementation remains weak, and implementation can pass an initial review but degrade as staff, vendors, and wallets change.
Annual reporting may help create a review rhythm. It may not catch every configuration change or every operational shortcut between reviews. That is why continuous recordkeeping, exception tracking, and change control still matter. The proposal’s structure points toward a custody program that can be explained, tested, and audited, rather than a process based only on trusted individuals.
Client Reporting And On-Chain Reconciliation
The proposed quarterly account statements would include client-specific addresses, network identifiers, balances, and all transactions. The statements would also carry a legend urging clients to compare the information with on-chain records. That feature addresses information asymmetry: clients may not know whether their reported balance matches observable blockchain activity unless the statement gives enough detail to check.
Why Address-Level Detail Matters
Address-level detail can support reconciliation, but it has limits. A blockchain record may show movement between addresses, yet it may not explain internal ownership records, omnibus structures, fee treatment, or custody arrangements. Network identifiers matter because the same asset name may exist across more than one network or token standard. If statements omit network context, reconciliation can become ambiguous.
The client statement requirement may improve transparency, but it also increases operational work. Advisers would need systems that can pull transaction data, map it to client records, preserve history, and reduce mismatches before statements are issued. Errors in address mapping, network labeling, or balance calculation could create confusion even without theft.
Cybersecurity And Incident Readiness
The proposal includes cybersecurity requirements: at least annual written risk assessments, measures to detect, mitigate, and remediate threats, and incident response and recovery plans. These requirements reflect the fact that custody systems are not only vaults. They are connected workflows involving people, devices, software, networks, vendors, and approval channels.
Incident Response Limits
Incident response plans are necessary, but they have a hard limit in crypto custody. Many blockchain transfers cannot be reversed after confirmation. A response plan can help isolate affected systems, preserve evidence, notify the right parties, and stop further damage. It may not restore assets moved under valid cryptographic signatures if no recovery mechanism exists.
That limitation should shape testing. A useful exercise should ask how quickly the firm can identify abnormal transfer requests, suspend signing, validate key integrity, and confirm which assets remain under control. The proposal’s annual risk assessment requirement gives advisers a minimum review cycle, but high-change environments may need more frequent internal checks.
Maintenance Burden
Custody controls age. Wallet software changes, hardware reaches end-of-life, employees leave, vendors update procedures, and new assets may introduce different network behavior. A custody system that worked at launch can become weaker if key rotation, access reviews, backup tests, and incident drills are not repeated. This is a cost issue as much as a security issue, because control maintenance requires staff time, expertise, and independent review.
Operational Risk In Custody Systems
The SEC’s October 2026 proposal framed custody as a controlled exception when advisers self-custody crypto assets, not as a routine shortcut around qualified custodians. Its main operational message is cautious: written records, joint authorization, key management, client statements, accountant reports, and cybersecurity plans can reduce risk, but they cannot erase the technical properties of bearer-style private keys or irreversible settlement.
Crypto Custody Risk remains elevated where infrastructure weaknesses, lost key material, weak approval controls, or poor reconciliation meet assets that can move quickly and finality that is difficult to reverse. For advisers, funds, and clients, the practical question is whether the control environment can be documented, tested, and maintained over time. The proposal supplied a regulatory structure for that question, but the quality of execution would still determine whether custody systems withstand routine operations and stress events.
