SEC Proposal Expands Options for Crypto Custody
If the SEC proposal is adopted, RIAs and regulated funds that custody crypto assets will need an independent internal control report.
On Oct. 1, 2026, the Securities and Exchange Commission (SEC) proposed new rules that would allow registered investment advisers (RIAs) and regulated funds (that is, registered investment companies and business development companies) to custody crypto assets in two ways beyond current options. Both options require an internal control report related to custody of crypto assets prepared by an independent public accountant.
To start, the proposal would change what counts as custody, adding a new term, “self-custody,” meaning possession of any portion of a crypto asset’s key materials. It also would amend the first prong of the existing custody definition so that possession of client crypto assets through self-custody would count as custody. Subject to a limited exception, an RIA holding even a noncontrolling portion of the key materials would be considered to have self-custody. Authority to obtain the keys without possessing them is not considered self-custody.
Subscribe to Take Into Account knowledge hub
New provisions
Self-custody, as a last resort. Under the proposal, RIAs could self-custody crypto assets only when no qualified custodian is available for a specific asset. The proposal builds in guardrails, including dual approval of transfers and ongoing reviews of whether a qualified custodian has become available. An RIA that takes self-custody would need an internal control report within six months and then annually thereafter.
State-chartered trust companies. The proposal would recognize state trust companies authorized by their state regulator to provide crypto custody as eligible custodians. Here the timing is stricter. Before engaging a state trust company, an RIA or regulated fund would need to obtain and review the custodian’s internal control report and repeat that review annually.
Why this matters now
The rule is still a proposal, and comments are due Dec. 7, 2026. The details might change, but the direction is clear: Regulators are opening the door to more custody options and addressing the heightened risks associated with custody of crypto assets through requiring an internal control report from an independent public accountant.
For state-chartered trust companies, that means preparing for internal control assurance readiness before launch, because there’s no grace period. For RIAs considering self-custody, it means establishing a system of internal controls related to custody that will be subject to attestation by an independent accountant, which often takes longer than the six months permitted.
Questions leaders should be asking today
- Do the organization’s existing custody controls address what would be required to support an independent controls attestation relating to custody of crypto assets?
- If not, what steps should be taken today to prepare the organization to provide custody services for these assets?
- If the organization serves as a regulated fund or RIA, how will it evaluate the reliability of its selected custodians for customer crypto assets and assess whether internal control attestation reports adhere to requirements and the organization’s expectations?
Looking ahead
Firms that start these conversations during the comment period will be best positioned to support custody of crypto assets when the rule becomes final.
Contact us
Related insights
