SEC Proposes Custody Rule Updates and Crypto Custody Framework

On October 1, 2026, the SEC proposed significant amendments (the “Proposed Rules”) to the custody framework under the Investment Advisers Act of 1940, as amended (the “Advisers Act”), applicable to registered investment advisers (“RIAs”), and the Investment Company Act of 1940, as amended (the “Investment Company Act”), applicable to registered management investment companies and business development companies (“BDCs” and together with registered management investment companies “Regulated Funds”).

Currently, Rule 206(4)-2 under the Advisers Act regulates the custodial practices of RIAs and their maintenance of client funds and securities with qualified custodians (“Qualified Custodians”), subject to specified exceptions. Section 17(f) of the Investment Company Act and the rules thereunder require Regulated Funds to maintain their funds, securities and other assets with specified custodians (such specified custodians, together with Qualified Custodians, “Permitted Custodians”). The custody frameworks under both the Advisers Act and the Investment Company Act were designed to promote the safekeeping of traditional assets, not crypto assets. The Proposed Rules are an attempt to modernize the custody framework and to facilitate investment in crypto assets by RIAs and Regulated Funds while promoting the overarching policy goal of safekeeping client assets.

The Proposed Rules would modernize several aspects of the existing custody rules by addressing:

• discretionary trading authority;
• standing letters of authorization (“SLOAs”);
• inadvertent custody;
• the audit exception;
•  reporting and recordkeeping obligations; and
• certain other custody requirements applicable to RIAs and Regulated Funds.^[1]

The Proposed Rules would also establish a framework that permits (1) RIAs to self-custody certain client crypto assets, including crypto assets of Regulated Funds, and (2) RIAs and Regulated Funds to use qualifying state trust companies as Permitted Custodians of crypto assets.

The first portion of this memo discusses the modernization changes to the custody rules, while the second portion of this memo discusses the crypto custody framework included in the Proposed Rules.^[2]

The proposal is the latest in a line of recent releases tracking the SEC’s 2026 regulatory agenda relating to crypto assets and RIA regulatory modernization. Comments are due by December 7, 2026.

I. Key Custody Rule Modernization Changes 

A. RIA Custody Rule Modernization

Discretionary Trading Authority. RIAs have historically faced uncertainty regarding the custody implications of authorized trading settled on a non-delivery-versus-payment (or non-DVP) basis. The Proposed Rules would create an exception from the Advisers Act custody rule for client funds and securities over which an RIA has custody as a result of its discretionary trading authority. To rely on the proposed exception, the RIA must: (1) execute, and have authority only to execute, trades from and into designated client accounts in the client’s name (or have the transfer recorded in the client’s name on the issuer’s books and records); (2) have no authority to transfer client funds and securities to an account in the RIA’s name, an account controlled by the RIA, an account controlled by a related person, or other non-client accounts unless the transfer is directed by the client in connection with the trading; (3) have no authority to have transfers recorded in the RIA’s name or that of a related person; and (4) comply with the Advisers Act custody rule, including any applicable exceptions, with respect to any other activities, rights or authorities that independently cause the RIA to have custody.

SLOAs. The Proposed Rules would provide an exception from the independent verification requirement for client assets over which an RIA has custody solely as a result of authority granted under a qualifying SLOA, provided certain conditions are satisfied. If adopted, the exception would supersede the relief that RIAs have relied upon since the SEC staff’s 2017 no-action letter, providing greater regulatory certainty and reducing reliance on staff guidance. The proposed relief is generally conditioned upon the Qualified Custodian not being the RIA or a related person, the client’s written authorization being signed by the client and identifying the third-party recipient, and the RIA not having the ability to designate or change any information about the third party recipient.

Inadvertent Custody. The Proposed Rules would create an exception from the Advisers Act custody rule for funds and securities over which an RIA has custody solely due to provisions in a client’s custodial agreement, provided specified conditions are satisfied. The exception would be available where the RIA did not recommend, request or require the Qualified Custodian and either did not have a copy of the custodial agreement or lacked actual knowledge or reason to know that the custodial agreement conferred custody on the RIA or, upon learning of such authority, the RIA promptly repudiated it and requested that it be removed from the custodial agreement.

Changes to the Audit Exception. The Proposed Rules include several revisions that may be particularly relevant to RIAs to private funds relying on the annual audit exception to the custody rule. Among other things, the Proposed Rules would:

• Eliminate the requirement that the auditor is registered with, and subject to inspection by, the PCAOB.
• Extend the rule’s delivery deadline for audited financial statements to 180 days for fund-of-funds and 260 days for fund-of-funds-of-funds (each of which was previously reflected only in SEC staff guidance).
• With respect to pooled investment vehicles organized outside of the U.S. or with a general partner or other manager with a principal place of business outside the U.S., incorporate past SEC staff guidance to allow for the preparation of the audited financial statements for such vehicles according to accounting principles other than U.S. GAAP, provided they contain information substantially similar to the information contained in financial statements prepared in accordance with U.S. GAAP, including a reconciliation for material differences.
• Provide relief for certain newly formed pooled investment vehicles by permitting unaudited financial statements for an initial stub period followed by audited financial statements covering both the initial stub period and the subsequent full fiscal year.

Other Changes. The Proposed Rules would also revise Form ADV and Form N-CEN to collect additional information regarding crypto asset custody and tokenized fund shares, update recordkeeping requirements, including permitting required records to be maintained on a crypto network if they can be produced promptly to the SEC in a human-readable and reasonably usable electronic format, and require custodial account numbers to be included in account notices.

B. Regulated Fund Custody Rule Modernization

BDCs. The Proposed Rules would extend the exception from the Advisers Act custody rule, which currently applies to accounts of registered investment companies, to include accounts of BDCs. The SEC explained that the Investment Company Act’s custody provisions apply to BDCs and that the amendment would help avoid duplicative or conflicting custody requirements.

Registered Broker-Dealers as Fund Custodians. The Proposed Rules would amend Rule 17f-1 under the Investment Company Act to permit any registered broker-dealer that carries customer securities accounts, rather than only broker-dealers that are members of a national securities exchange, to custody Regulated Fund securities or other investments. In addition, the Proposed Rules would eliminate Rule 17f-1’s written custodial contract requirement, as well as the segregation, rehypothecation, lien, examination, inspection and possession conditions. The SEC proposed eliminating these conditions, noting that certain requirements have become outdated in light of modern market practices and that others overlap with protections provided under the current regulatory regime applicable to registered broker-dealers.
Free Cash Accounts. The Proposed Rules would rescind Rule 17f-3, which permits a Regulated Fund to maintain a limited petty cash account outside its bank custodial arrangement.  In the proposal, the SEC noted that Regulated Funds appear to no longer use the rule and that technological advances in banking and payment processing have eliminated the need for such accounts.

Other Changes. The Proposed Rules would update information in Rules 17f-4 and 17f-7 addressing domestic and foreign securities depository custody requirements. The SEC  also requested comment on whether Rule 17f-2 should be amended to address custodians affiliated with a Regulated Fund’s RIA, the treatment of uncertificated securities that are not held through Rule 17f-4 securities depositories (e.g., shares of other Regulated Funds, privately offered securities, and certain types of loans), and whether Rule 17f-6 should be amended to address the custody of Regulated Fund cleared swap collateral maintained with futures commissions merchants.

II. Crypto Custody Framework

Adviser Self-Custody. The Proposed Rules would establish a framework permitting RIAs to self-custody certain client crypto assets. The framework would apply only to crypto assets that are client funds or securities for purposes of the Advisers Act and, in the case of Regulated Fund accounts, to crypto assets that are securities or similar investments for purposes of the Investment Company Act. In addition, the SEC proposed a new Investment Company Act rule that would permit a Regulated Fund to maintain crypto assets in custody with its adviser if the adviser complies with the proposed adviser self-custody rule and the Regulated Fund’s board oversees the custody arrangement.

An RIA would have “self-custody” if it possesses any portion of the key materials for a client’s crypto asset, including a non-controlling portion.  Before taking self-custody of each crypto asset, and no less frequently than quarterly thereafter, the RIA would have to document a reasonable basis, after due inquiry, for believing that no Qualified Custodian will maintain the crypto asset. If a Qualified Custodian becomes available, the RIA would have to transfer the asset to that custodian as soon as reasonably practicable. The RIA would be required to have, and document the basis for its determination that it has, expertise regarding the safeguarding of each crypto asset and adopt, implement and maintain systems addressing key management, joint transfer authorization and asset segregation. RIAs relying on the framework would also be subject to other safeguard requirements designed to protect client assets, including cybersecurity controls, independent public accountant internal control reports, annual reviews of safeguarding systems and cybersecurity controls, and client reporting.

Advisers utilizing self-custody generally would remain subject to the annual surprise examination requirement unless another exception applies, such as the audit exception for pooled investment vehicles. For Regulated Funds, the Proposed Rules would impose additional board approval and oversight requirements. The Proposed Rules also include limited relief for certain airdropped crypto assets, provided the RIA or Regulated Fund complies with the applicable self-custody requirements or transfers the asset to a Permitted Custodian as soon as reasonably practicable.

State Trust Company Custodians. The Proposed Rules would also establish a rule-based framework permitting RIAs and Regulated Funds to maintain crypto assets, together with related cash and cash equivalents, with state trust companies. The framework would provide a rule-based path for the use of certain state trust companies as crypto custodians, an area that previously required reliance on SEC staff guidance and fact-specific analyses, including the SEC staff’s 2025 no-action letter.

Before engaging a state trust company, and annually thereafter, RIAs and Regulated Funds would be required to determine that they have a reasonable basis, after due inquiry, for believing that the trust company is authorized by the relevant state banking authority to provide crypto asset custody and maintains and implements written policies and procedures reasonably designed to safeguard crypto assets and related cash and cash equivalents, and receive and review the trust company’s most recent audited financial statements and internal control report. Client and Regulated Fund crypto assets also would be required to be segregated from the trust company’s proprietary assets.

III. Conclusion

If adopted, the Proposed Rules would be a welcome change for crypto asset managers that were previously attempting to apply rules designed for traditional assets to crypto assets.  The Proposed Rules would also provide RIAs and Regulated Funds with a comprehensive rule-based framework in several areas that historically have been governed by SEC releases, staff interpretations and no-action relief.

We are available to assist clients in evaluating the Proposed Rules, preparing comment letters and assessing their potential impact on custody arrangements, compliance programs and reporting obligations. Please contact your primary contact in S&K’s Investment Management Group with any questions regarding the proposal.