On October 1, 2026, the U.S. Securities and Exchange Commission (the "SEC") proposed a comprehensive new custody framework for crypto assets. Subject to significant conditions, the proposal would permit SEC-registered investment advisers to self-custody certain client crypto assets when no qualified custodian is reasonably available for the particular asset. It also would permit registered investment companies and business development companies ("BDCs," and together with registered investment companies, "regulated funds") to maintain certain crypto assets with their investment advisers, subject to additional requirements and board oversight, rather than with a bank or broker-dealer custodian. The proposal would further permit certain state trust companies meeting specified conditions to serve as custodians of crypto assets and related cash or cash equivalents.  Finally, numerous amendments unrelated to crypto assets would modernize the custody frameworks under the Investment Advisers Act of 1940 (the "Advisers Act") and the Investment Company Act of 1940 (the "1940 Act").

1. Crypto Custody and Self-Custody

Under the existing Advisers Act custody rule, registered investment advisers generally must maintain client funds and securities with a “qualified custodian.” The proposal would create a new provision allowing an adviser to self-custody client crypto assets for which it provides investment advice when specified conditions are satisfied. The proposal reflects the SEC's recognition that the limited number of qualified crypto custodians may increase concentration risk, limit investment opportunities, and raise costs for investors.

For advisory clients other than registered funds, the proposed self-custody provision would apply only to crypto assets that are client funds or securities. For these purposes, “self-custody” would mean possession of any portion of a client crypto asset’s “key materials,” which are the cryptographic private keys, or any part of them, necessary to access and effectuate transactions in the asset.  Self-custody would be available only if the adviser first determines in writing, after due inquiry, that it has a reasonable basis for believing that no qualified custodian will maintain the particular crypto asset. The determination must be made separately for each crypto asset and reassessed at least quarterly. If a qualified custodian subsequently becomes available, the adviser would be required to place the crypto asset with that custodian as soon as reasonably practicable.

Advisers relying on self-custody also would be subject to significant operational safeguards, including:

• Safeguarding expertise and systems. Have and document appropriate expertise to safeguard each relevant crypto asset and maintain systems designed to protect against loss, theft, misuse and misappropriation, including private-key management and joint authorization of crypto asset transfers by two or more designated persons, at least one of whom must be a management person;
• Client asset separation. Maintain each client’s crypto assets in one or more crypto asset addresses storing only that client’s crypto assets;
• Cybersecurity. Mitigate cybersecurity risks and review safeguarding systems and cybersecurity controls, and the effectiveness of their implementation, at least annually;
• Internal controls. Obtain an internal control report from an independent public accountant within six months of taking self-custody and annually thereafter;
• Client reporting. Provide prescribed account information to clients at least quarterly; and
• Financial asset treatment. Agree with the client in writing to treat each self-custodied crypto asset as a “financial asset” under State law adopting UCC Article 8.  According to the SEC, the UCC Article 8 election is intended to strengthen a client's property rights in self-custodied crypto assets and enhance protections in the event of adviser insolvency.

2. State Trust Companies as Permitted Custodians for Crypto Assets

The proposal also would permit certain state trust companies that satisfy specified conditions to serve as custodians of crypto assets and related cash or cash equivalents.  Before relying on a state trust company as a crypto custodian, an adviser or regulated fund would be required to satisfy specified diligence and oversight requirements, including:

• State authorization. Having a reasonable basis, after due inquiry, for believing that the State trust company is authorized by the relevant State banking authority to provide crypto asset custody;
• Safeguarding policies and procedures. Having a reasonable basis, after due inquiry, for believing that the State trust company maintains and implements written policies and procedures reasonably designed to safeguard crypto assets and related cash or cash equivalents from theft, loss, misuse and misappropriation;
• Audited financial statements. Receiving and reviewing the State trust company’s most recent annual audited financial statements;
• Internal controls. Receiving and reviewing the State trust company’s most recent internal control report; and
• Asset segregation. Ensuring that client and regulated fund crypto assets are segregated from the State trust company’s proprietary assets, with regulated funds entering into custodial services agreements providing for that segregation.

The applicable determinations and reviews generally would be required initially and annually thereafter.

3. Regulated Funds, BDCs and Custody Modernization

The proposal also would revise the 1940 Act custody framework as it pertains to crypto assets. Proposed Rule 17f-9 would permit a regulated fund to maintain crypto assets that are securities or similar investments through its investment adviser if the adviser satisfies the proposed self-custody requirements and the regulated fund meets additional conditions, including board oversight. The proposal also would amend the existing 1940 Act custody rules to address their application to BDCs.

Unlike many existing custody arrangements, the proposal would require fund boards to make affirmative determinations regarding adviser self-custody and to review the adviser's qualified-custodian analysis on an ongoing basis. Initially and annually, the board would be required to determine that a fund crypto asset would be subject to reasonable care if self-custodied with the fund’s investment adviser. Initially and quarterly, the board would review the adviser’s determination that no qualified custodian will maintain the asset. The board also would designate the supervised persons permitted to access the relevant key materials.

More broadly, the SEC would modernize the 1940 Act custody rules by expanding the universe of broker-dealers eligible to serve as custodians under Rule 17f-1 to include all registered broker-dealers, subject to conditions tied to the broker-dealer customer protection rule. The proposal also would rescind Rule 17f-3 and make conforming amendments to other custody rules.

Sullivan Observations

• For self-custody, an investment adviser's determination of "custodial availability" is likely to be challenging to implement. Advisers wishing to rely on self-custody would need to establish and document a process for evaluating custodial availability on an asset-by-asset basis and reassessing those determinations at least quarterly. The operational burden associated with ongoing market monitoring may be substantial.
• State trust companies may emerge as the primary beneficiaries of the proposal. Although much attention will focus on adviser self-custody, the proposal may be most consequential for state-chartered trust companies seeking to expand crypto custody offerings under a federally recognized framework.
• The proposal reaches tokenized financial products, not just crypto assets.  Because the proposed definition of "crypto asset" includes tokenized securities and other tokenized financial instruments, the proposal likely would have implications that extend beyond traditional cryptocurrency markets.
• The redesignation of Rule 206(4)-2 to Rule 223-1 may be more consequential than it first appears. The SEC proposes to move the custody rule from Rule 206(4)-2 under the Advisers Act's anti-fraud provisions to proposed Rule 223-1 under Section 223, the statutory provision specifically addressing adviser custody. While presented as a redesignation, the change may signal an evolution in the SEC's view of custody regulation: from a measure designed principally to prevent fraud to a standalone regulatory framework for safeguarding client assets. Advisers should watch closely whether this change affects the future development, interpretation and enforcement of the custody rules.
• Notably absent is a general crypto trading-platform custody framework. Although the proposal addresses adviser self-custody, regulated fund custody and state trust company custodians, it does not provide a broader framework governing how digital assets may be held and transferred through crypto trading venues. As a result, important questions concerning the custody implications of trading-platform structures remain unresolved.
• The proposal gives fund boards a meaningful role in self-custody arrangements. The proposed fund self-custody framework requires board oversight. This raises a practical governance question as to whether fund directors will have the information and resources necessary to oversee the highly technical custody arrangements contemplated by the proposal.
• The proposal provides additional clarity concerning investment adviser discretionary trading authority. The SEC proposes to specify circumstances under which authorized discretionary trading authority would be excepted from application of the Advisers Act custody rule. The industry has long sought greater clarity regarding when trading authority results in custody, and advisers will want to assess whether the proposed framework provides the clarity sought, including with respect to delivery-versus-payment and non-delivery-versus-payment arrangements.
• The PCAOB requirement would be eliminated. The proposal would eliminate the requirement that independent public accountants engaged to perform services under the Advisers Act custody rule be registered with, and subject to regular inspection by, the Public Company Accounting Oversight Board.
• The proposal’s broader modernization amendments also merit attention. Among other changes, the proposal would modify the pooled investment vehicle audit provision, including delivery deadlines for certain funds of funds and pooled investment vehicles formed toward fiscal year-end. It also would provide relief for certain standing letters of authorization and inadvertent custody, add related recordkeeping requirements, amend Form ADV and Form N-CEN to reflect the proposed custody framework and collect additional information, and make conforming amendments to Form ADV-E to reflect the redesignation of the Advisers Act custody rule.

What Comes Next

Public comments are due by December 7, 2026. Advisers, regulated funds and fund boards should consider how the proposed self-custody conditions, the potential use of State trust companies as crypto custodians, and the broader custody-rule modernization amendments could affect existing and potential custody arrangements.

For More Information

This Client Alert has been prepared by Partners John Hunt, Rachael Schwartz, and Stephanie Monaco, and Associate Ida Vanto, each in the Investment Management practice group of the international law firm of Sullivan & Worcester LLP.  For more information, Mr. Hunt may be reached in our Boston office by calling +1 (617) 338-2961 or our London office by calling +44 (0)20 7448 1000, or by email at jhunt@sullivanlaw.com; Ms. Schwartz may be reached in our New York office by calling +1 (212) 660-3069 or by email at rschwartz@sullivanlaw.com; Ms. Monaco may be reached in our Washington, D.C. office by calling +1 (202) 775-1202, or by email at smonaco@sullivanlaw.com; and Ms. Vanto may be reached in our New York office by calling +1 (212) 660-3045, or by email at ivanto@sullivanlaw.com.

This Client Alert is provided for general informational purposes only and does not constitute legal advice.