SEC Proposes New Crypto Asset Custody Rules and Overhaul of Adviser, Registered Fund, and BDC Custody Rules

On October 1, 2026, the SEC published a release (the “Release”) containing proposals that, if adopted, would (i) permit investment advisers and regulated funds (as defined below), subject to certain conditions, to self-custody crypto assets if a qualified custodian is unavailable, and (ii) modernize various Advisers Act custody requirements and 1940 Act custody rules.

I. Scope: “Crypto Asset” and “Self-Custody” Definitions

The Release would redesignate Advisers Act Rule 206(4)-2 (i.e., the adviser custody rule) as new Rule 223-1.

Proposed Rule 223-1(d)(3) would define “crypto asset” as “any digital representation of value that is recorded on a cryptographically secured distributed ledger,” a definition broad enough to capture tokenized traditional securities. Although a crypto asset may or may not meet the definition of a “security” under the federal securities laws, proposed Rule 223-1 would apply only with respect to crypto assets that are “funds or securities” (and the proposed 1940 Act custody rules would only apply with respect to crypto assets that are “securities or similar investments”).

Adviser “self-custody” under proposed Rule 223-1(d)(16)) would mean possession of “any portion” of a client crypto asset’s “key materials,” meaning the private keys or any part of them necessary to access and transact in the asset. Holding a single multi-party computation or multi-signature share alongside a third-party custodian would therefore constitute self-custody. The one carveout covers key materials held by the adviser or a related person solely in its capacity as a qualified custodian under proposed Rule 223-1(a)(6), and such an arrangement would remain subject to the existing internal control report and surprise examination framework.

II. Adviser Self-Custody of Crypto Assets (Rule 223-1(b)(7))

A. Structure of the Self-Custody Exception

Proposed Rule 223-1(b)(7) would apply to crypto assets that are self-custodied by an adviser. It is framed as an exception from paragraphs (a)(1) (qualified custodian), (a)(2) (client notice) and (a)(3) (custodian account statements) of the redesignated rule, but it would not constitute an exception from the adviser custody rule as a whole. The remainder of proposed Rule 223-1 would continue to apply, including the surprise examination requirement in paragraph (a)(4), unless an exception, such as the audit provision ((b)(4)), is available.

Proposed Rule 223-1(b)(5) would preserve the existing exception for registered funds and extend it expressly to BDCs (collectively with registered funds, “regulated funds”). With respect to self-custody of crypto assets belonging to regulated funds, the adviser would be required to satisfy only paragraph (b)(7).

B. Adviser Qualified Custodian Determination

Before taking self-custody of each crypto asset, and at least quarterly afterward, an adviser would be required to determine in writing that it has a reasonable basis, after due inquiry, for believing that “no qualified custodian will maintain the crypto asset” (proposed Rule 223-1(b)(7)(i)). The Release states that the SEC anticipates that an adviser’s reasonable basis for its determination “would be formed by due inquiry of material facts concerning, among other things, each individual crypto asset and its characteristics; the custodial marketplace for the crypto asset; and whether custodians generally known in the custodial marketplace provide custodial services for a crypto asset in question.”

• If the adviser determines that a qualified custodian has become available, the adviser would be required to place the crypto asset with the qualified custodian “as soon as reasonably practicable.”
• For regulated fund accounts, a permitted custodian would mean a custodian permitted under 1940 Act Section 17(f) and the rules thereunder, including state trust companies that qualify under proposed new Rule 17f-8.

C. Self-Custody Safeguarding Expertise and Systems

With respect to self-custody of crypto assets, an adviser would be required to have, and to document the basis for, expertise regarding the safeguarding of each crypto asset. It would be required to adopt, implement and maintain systems necessary to safeguard each asset against loss and misappropriation (collectively, “safeguarding systems”). In connection with an adviser’s self-custody services, the adviser would be permitted to obtain assistance from third parties, but the adviser would remain responsible for its obligations under the adviser self-custody rule, and it should therefore have the expertise to ensure that it is complying with the adviser self-custody rule on an ongoing basis (including overseeing third-party service providers). At a minimum, the safeguarding systems must provide for:

• Key management. Access to key materials must be limited to supervised persons designated by the adviser. For regulated fund accounts, those persons must be designated by resolution of the fund’s board.
• Joint authorization. Every transfer must be authorized by two or more designated persons, at least one of whom is a “management person.” For regulated fund accounts, that person must be an officer of the fund.
• Address-level segregation. Each client’s assets must be held in addresses that store only that client’s crypto assets, which effectively prohibits omnibus wallets.

D. Adviser Self-Custody Cybersecurity, Internal Control Report and Annual Review

Proposed Rule 223-1(b)(7) also would require the following in connection with an adviser’s self-custody of crypto assets:

• Cybersecurity (Proposed Rule 223-1(b)(7)(iii)). The adviser would be required to mitigate cybersecurity risks, including implementing (i) periodic, and at least annual, written assessments of cybersecurity risks to self-custodied assets and the safeguarding systems, (ii) measures reasonably designed to detect, mitigate and remediate threats and vulnerabilities, and (iii) measures reasonably designed to detect, respond to and recover from cybersecurity incidents.
• Internal control report (Proposed Rule 223-1(b)(7)(iv)). The adviser would be required to obtain a written internal control report from an independent public accountant within six months of taking self-custody of a client crypto asset and at least once each calendar year thereafter. The report must contain an opinion on whether controls were suitably designed and implemented and operating effectively throughout the period. The accountant must verify that the crypto assets are reconciled to the crypto network.
• Annual review (Proposed Rule 223-1(b)(7)(v)). Within one year of taking self-custody of each crypto asset, and at least annually afterward, the adviser would be required to review the safeguarding systems and cybersecurity controls and the effectiveness of their implementation, and document that review in writing.

E. Self-Custody Account Statements

Because there would be no independent custodian, in connection with an adviser’s self-custody of crypto assets, the adviser would be required to provide quarterly account statements to each client whose crypto assets the adviser self-custodies (proposed Rule 223-1(b)(7)(vi)).

• Each statement would identify the crypto asset address and the crypto network on which it operates, show end-of-period amounts and all transactions from the address, and urge the client to compare the statement against on-chain balances and transaction data. In lieu of a consolidated statement, the adviser would be permitted to transmit the required information quarterly in a human-readable and reasonably usable electronic format, provided it sends a notice identifying the address and network.
• For pooled vehicles where the adviser or a related person is the general partner (or equivalent), statements would be sent to each limited partner or other beneficial owner. A client would be permitted to designate an “independent representative” to receive the statements (proposed Rule 223-1(a)(7)).
• Proposed Rule 223-1(b)(7)(vii) specifies two exceptions to the account-statements requirement: (i) pooled investment vehicles that satisfy the audit provision ((b)(4)), and (ii) all regulated fund accounts.

F. “Financial Asset” and “Securities Intermediary” Elections

Proposed Rule 223-1(b)(7) would provide that the adviser and client must agree in writing to treat each self-custodied crypto asset as a “financial asset” and to treat the adviser as a “securities intermediary” under the state law governing their agreement (proposed Rule 223-1(b)(7)(viii)). This election draws on UCC Article 8. When combined with crediting the asset to the client’s securities account, it is designed to give the client a UCC “security entitlement” and thereby protect the client’s property interest, including on the adviser’s insolvency.

G. Distributed Crypto Assets

Proposed Rule 223-1(b)(11) would deem the receipt of a “distributed crypto asset” (i.e. an asset received for no or nominal consideration in connection with a client crypto asset in the adviser’s custody) not to violate the Rule. To rely on this provision, the adviser would be required, as soon as reasonably practicable, either to bring the asset into compliance with paragraph (b)(7) or place it with a qualified custodian. Proposed Rule 17f-9(c), discussed below, contains a parallel provision for regulated funds.

III. Regulated Fund Self-Custody of Crypto Assets (Proposed Rule 17f-9)

Proposed Rule 17f-9 under the 1940 Act would permit a regulated fund to custody a crypto asset with its investment adviser if the adviser complies with proposed Rule 223-1(b)(7) for that crypto asset and the fund satisfies board oversight conditions. A crypto asset maintained in this manner is deemed to be in the fund’s custody under proposed new Rule 17f-9 (in lieu of Rule 17f-2).¹ The Release states that permitting a regulated fund’s adviser to maintain the regulated fund’s crypto assets pursuant to the proposed Rule 223-1(b)(7) “would allow the regulated fund, like other clients of the adviser, to invest in crypto assets where a qualified custodian is unavailable and the adviser maintains the assets in self-custody subject to” conditions specified in proposed Rule 223-1(b)(7). (Emphasis added).

The regulated fund’s board, including a majority of its independent directors, would be required to satisfy certain requirements:

• Before the adviser takes custody, and quarterly thereafter, the board would be required to review the adviser’s written report documenting the basis for the investment adviser’s determination for believing that no qualified custodian will maintain the crypto asset.
• Before the adviser takes custody, and annually afterward, the board, including a majority of directors who are not interest persons of the regulated fund, would be required to determine that the crypto asset will be custodied with reasonable care while maintained with the investment adviser, after considering the factors relevant to the safekeeping of the crypto asset. To facilitate the board’s assessment, the investment adviser must furnish, and the fund’s board of directors must evaluate, such information as may reasonably be necessary for the board to evaluate the fund’s custody arrangement, including at a minimum: (i) a written report on the adviser’s safeguarding expertise and systems, (ii) the adviser’s most recent annual review of safeguarding systems and cybersecurity controls, and (iii) the adviser’s most recent internal control report. Items not yet available at the initial determination must be provided at the next regularly scheduled board meeting after the materials become available. For the internal control report, if the adviser has not yet held any client crypto asset in self-custody for six months, the report would be due at the first regularly scheduled meeting after the six-month period ends.

A regulated fund relying upon proposed Rule 17f-9 should be aware of the following:

• The board must designate key holders by resolution, and a fund officer must be one of the co-signers on every transfer.
• Regulated fund accounts are carved out of the adviser account statement requirement.
• Registered funds other than BDCs would report self-custody on Form N-CEN.
• Proposed Rule 17f-9(c) deems receipt of a distributed crypto asset compliant with section 17(f) if the regulated fund places the asset, as soon as reasonably practicable, with its adviser under proposed Rule 17f-9 or with a permitted custodian.

IV. State Trust Companies as Crypto Custodians (Proposed Rules 223-1(d)(13)(v) and 17f-8)

State trust companies could become qualified custodians under proposed Rule 223-1 under the Advisers Act and permitted custodians under proposed Rule 17f-8 under the 1940 Act, in each case for crypto assets and “related cash and/or cash equivalents” only. A “state trust company” is an entity organized under state law that is supervised and examined by a state authority having supervision over banks and is permitted to exercise fiduciary powers. A state trust company that independently qualifies as a “bank” as defined in Section 2(a)(5) of the 1940 Act would continue to be a permitted custodian outside the Rule 17f-8 conditions. Before engaging the state trust company in reliance upon Rule 17f-8, and annually thereafter, the adviser or regulated fund would be required to:

• determine in writing that it has a reasonable basis, after due inquiry, for believing that the trust company is authorized by the relevant state banking authority to provide custody services for crypto assets and related cash and/or cash equivalents, and that it maintains and implements written safeguarding policies and procedures addressing, at a minimum, private key management and cybersecurity,
• receive and review the trust company’s most recent annual financial statements and confirm that they are prepared under U.S. GAAP and audited by an independent public accountant, and
• receive and review an internal control report from the current or prior calendar year and confirm that it contains an opinion on design, implementation, and operating effectiveness.

Client crypto assets must be segregated from the state trust company’s proprietary assets. For regulated funds, Rule 17f-8(b) would require a custodial services agreement providing for this segregation. Where a client engages the state trust company directly, the adviser would be required to satisfy the proposed conditions prior to the adviser having custody of those client crypto assets that are maintained at the state trust company as custodian.

V. 1940 Act Custody Rule Modernization

A. BDCs

Section 17(f) applies to BDCs by statute as if they were registered closed-end funds, but none of the rules thereunder mentions BDCs. Consistent with existing industry practice, the Release would amend Rules 17f-1, 17f-2, 17f-4, 17f-5 and 17f-6 (and, through cross-reference, Rule 17f-7) to make clear that BDCs may rely on them on the same terms as registered funds. It would also define “investment company” in Rules 31a-1 and 31a-2 (required records) to include BDCs. Rule 31a-1(a) would be amended to recognize that a BDC’s financial statements are filed under Section 13 of the Exchange Act rather than Section 30 of the 1940 Act.

B. Rule 17f-1: Broker-Dealer Custody

As proposed in the Release, a fund would be permitted to place its securities and similar investments with any broker-dealer registered under Section 15(b)(1) of the Exchange Act, not only exchange members, if the broker-dealer’s custody of those assets “is subject to the requirements of Rule 15c3-3 [i.e., the Customer Protection Rule] . . . or such other rule that the Commission determines provides similar customer protections.” Rule 17f-1’s existing conditions would be eliminated: physical segregation and marking, the rehypothecation and lien conditions, the examination condition (with Form N-17f-1 rescinded), the inspection and possession conditions, and the board-approved, annually ratified written contract filed with the SEC.

C. Rule 17f-3: Free Cash Accounts

Rule 17f-3, which permits a fund with a bank custodian to maintain a petty cash account, would be rescinded in its entirety. The Release states that no regulated funds rely on this rule.

VI. Advisers Act Custody Rule Modernization (Proposed Rule 223-1)

A. Redesignation

As noted above, the Advisers Act custody rule would be redesignated as Rule 223-1 from Rule 206(4)-2. The introduction to proposed Rule 223-1, unlike Rule 206(4)-2, would not characterize noncompliance as a fraudulent, deceptive or manipulative act. Instead, it would state that the adviser “must take the following steps to safeguard client funds and securities.” Rule 206(4)-2 would be removed and reserved, and conforming changes would run through Rule 204-2 and Forms ADV and ADV-E.

B. Discretionary Trading Authority Exception

Proposed Rule 223-1(b)(9) would resolve the long-running question, prompted by the 2017 inadvertent custody guidance² and a 2019 staff letter,³ concerning whether trading on a non-DVP basis gives an adviser custody. Rather than turn on the settlement mechanism, the exception focuses on the adviser’s ability to divert assets. Proposed Rule 223-1(b)(9) provides that an adviser need not comply with proposed Rule 223-1 as to funds and securities over which it has custody due to discretionary trading authority, provided that:

• the adviser executes, and only has authority to execute, trades from and into designated client accounts in the client’s name, or the transfer is recorded in the client’s name by the issuer;
• the adviser has no authority, under the trading arrangement or otherwise, to transfer client assets to an account in its own name, an account it or a related person controls, or any non-client account (unless the transfer is client-directed in connection with the trading), and cannot have transfers recorded by the issuer in its own or a related person’s name; and
• the adviser complies with proposed Rule 223-1, and with the conditions of any corresponding exception, for any separate source of custody.

C. PCAOB Registration Requirement Eliminated

The requirement that the independent public accountant performing the pooled vehicle audit, the surprise examination for related-person custodians, or the internal control report be registered with, and subject to regular inspection by, the PCAOB would be eliminated in proposed Rule 223-1. Each would still need to be an “independent public accountant” meeting Regulation S-X Rule 2-01(b) and (c).

D. Pooled Investment Vehicles Subject to Annual Audit

Proposed Rule 223-1(b)(4) would make the following changes:

• U.S. GAAP. Audited financial statements must be prepared under U.S. GAAP. Foreign pooled investment vehicles (those organized under non-U.S. law or with a general partner or manager whose principal place of business is outside the United States) may use other accounting principles if the statements contain substantially similar information and a reconciliation of material differences to U.S. GAAP, and the reconciliation is delivered to U.S. investors.
• Extended deadlines. The audited financial statements distribution deadline would remain 120 days generally and would be extended to 180 days for funds of funds and 260 days for funds of funds of funds.
• Stub-period pools. For a pool formed within 90 days before its fiscal year end, the first-year requirement would be satisfied by distributing financial statements (which may be unaudited) within 90 days after that year end, followed by audited financial statements covering both the stub period and the second fiscal year.
• Independent representatives. Delivery to investors’ independent representatives would be expressly permitted.

E. Standing Letters of Authorization

Proposed Rule 223-1(b)(8) would codify an exception from the surprise examination requirement where the adviser has custody solely because of a standing letter of authorization (“SLOA”). A qualifying SLOA is an arrangement among the adviser, the client and the client’s qualified custodian under which the adviser is authorized in writing to direct transfers to a third party on a specified schedule or from time to time. Three conditions would apply: (i) the custodian is not the adviser or a related person, (ii) the client’s authorization includes the client’s signature, the recipient’s name, and either the recipient’s address or its account number at a custodian, and (iii) the authorization must provide that the adviser has no ability to designate or change any recipient information.

F. Inadvertent Custody

Proposed Rule 223-1(b)(10) would except custody arising solely from client-custodian agreements where the adviser did not recommend, request or require the client’s selection of the custodian, and either (i) the adviser lacks a copy of the agreement and has no actual knowledge or reason to know that it confers custody, or (ii) on learning that it does, the adviser promptly notifies the client and the custodian in writing, repudiates the authority, and requests in writing that the authority be removed or superseded by a new agreement.

VII. Recordkeeping

The Release would affect various required records. Proposed Rule 204-2(a)(26) would require self-custodying advisers to keep various records, including memoranda describing the basis for an adviser’s required qualified custodian determinations under proposed Rule 223-1(b)(7)(i) and safeguarding expertise determinations under proposed Rule 223-1(b)(7)(ii), records identifying designated key holders, and cybersecurity assessments. For regulated funds, proposed Rule 31a-2(a)(10) would cover the Rule 17f-9 board materials.

Amended Rule 204-2(g) under the Advisers Act and proposed Rule 31a-1(b)(14) under the 1940 Act would permit required records relating to a crypto asset to be maintained on a crypto network, provided they can be produced promptly to the SEC in a human-readable and reasonably usable electronic format throughout the retention period.

VIII. Comment Deadline

The Release states that comments should be received by the SEC no later than December 7, 2026.

* * *

If you would like to learn more about the developments in this Alert, please contact your usual Ropes & Gray attorney contacts.