The SEC Will Let Advisers 'Self-Custody' Client Crypto. The Keys Are Theirs, and Proving It Costs $433,833 a Year

What Happened

The Securities and Exchange Commission (SEC) voted on Thursday, October 1, to propose a custody framework for crypto assets held by registered investment advisers and regulated funds, meaning registered investment companies and business development companies. The package runs about 760 pages, issued as Release No.

IA-7023 under File No. S7-2026-35, and writes a new Advisers Act custody rule, numbered 223-1, alongside new Investment Company Act rules. It opens 2 pathways. An adviser or fund may hold client crypto itself, with no qualified custodian, if it determines that no permitted custodian is available for the asset and re-makes that finding every quarter.

Or a state-chartered trust company may serve as permitted custodian, provided the adviser has a reasonable basis, checked annually, to believe the company is authorized by its state banking regulator to custody crypto and keeps written policies against theft, loss, and misuse.

The conditions on the first pathway are specific. The adviser must document expertise in safeguarding each asset. Any transfer requires authorization by at least 2 people. Each client's coins must sit in addresses holding only that client's coins. Clients receive quarterly statements.

Within 6 months of taking custody, and every calendar year after, an independent public accountant must report on the controls and verify that client holdings reconcile to the network. Chairman Paul Atkins said the proposal replaces 'the grey of uncertainty created by custody rules crafted for a bygone era.'

Commissioners Hester Peirce and Mark Uyeda issued statements in support. Comments run 60 days from Federal Register publication.

The SEC's self-custody is the adviser's keys with an auditor attached, and the auditor is $376,000 of the bill. Your keys come without the invoice and without the audit. The standard it just wrote is still worth borrowing.

Three Years Ago the Same Agency Proposed the Opposite

In February 2023 the SEC voted 4 to 1, Peirce the lone no, to propose a rule called Safeguarding Advisory Client Assets, which would have required advisers to keep every client asset, crypto included, at a qualified custodian, under a definition the industry warned would shrink the pool of eligible firms.

The Commission withdrew it in June 2025 with 13 other Gensler-era proposals. Staff had already rescinded SAB 121, the accounting bulletin that kept banks out of crypto custody, that January. In September 2025 the Division of Investment Management issued a no-action letter blessing state-chartered trust companies as custodians, and Commissioner Caroline Crenshaw, in a statement titled 'Poking Holes,' objected that a change this large belonged in formal rulemaking.

October 1 is that rulemaking. Peirce's statement, titled 'Roller Coaster Ride,' describes advisers 'gritting their teeth and holding on for dear life.'

The ride is not over. Peirce departed the SEC on October 2, leaving Atkins and Uyeda as the only 2 commissioners, both Republican appointees, with 3 seats vacant; on September 30 the Commission had amended its 31-year-old quorum rule so a single commissioner can act when every other sitting member is disqualified.

The skeptic's case writes itself: a rule finalized by 2 commissioners of 1 party, reversing a proposal made 3 years earlier by 4 of the other, can be reversed again. The counterweight is that this one runs through notice and comment, as Crenshaw asked, and a final rule is harder to undo than the staff letter that has carried state trust companies for a year.

Shelf-Custody: Whose Keys These Are

The word doing the work is self-custody, and Peirce flagged it herself: she wrote that she would have preferred 'shelf-custody,' because the proposal means advisers acting as custodians for client assets, not investors holding their own. Uyeda's statement makes the same point from the other side: adviser self-custody 'creates an inherent conflict of interest,' and fiduciary duty still applies.

Read the conditions as a key-management policy and the shape is familiar. 2-person authorization is a multi-sig spending rule. Per-client addresses are segregation. An accountant reconciling to the chain is proof of reserves with a signature on it. The quarterly search for a custodian is a standing instruction that holding the keys is the exception.

For the client, none of that changes what they own. The coins sit in addresses the adviser controls, moved by 2 of the adviser's people, reported quarterly, audited annually. That is a well-run custodial position, and it may be exactly what a retirement account wants. It is not ownership of the coins.

The UK Financial Conduct Authority put the test plainly in guidance this site covered on Thursday: custody is whoever can bring about a transfer. Here that is the adviser, and the dual-authorization rule exists to stop 1 person at the adviser from acting alone, not to let the client act at all.

The Price of Proof

The most useful number in 760 pages is in the economic analysis. The SEC models the annual cost of its self-custody conditions at $433,833 per adviser: $376,000 for the independent internal control report and $57,833 in recurring compliance, after an initial $173,499, in 2026 dollars and excluding technology, software, and hardware.

Nearly 87% of the recurring figure is the accountant, and the Commission's own analysis expects fixed costs this size to keep smaller advisers out. So the second pathway will do most of the work: advisers that cannot carry a $376,000 report will send client coins to a state trust company, and the trust companies that already hold most spot bitcoin exchange-traded product coins, Coinbase Custody Trust Company among them, get a permanent place in the rulebook.

The contrary view is that this is the right outcome. A few audited custodians with segregated keys are safer for most investors than several thousand advisers each running cold storage, and the proposal seems to agree, which is why it treats adviser custody as a last resort to be re-justified every 90 days.

The point for a reader who holds their own coins is narrower. The SEC has put a price on institutional-grade key handling, and almost none of it is the keys. What costs $376,000 a year is an outside party attesting that the policy was followed and the coins are where the ledger says they are.

What This Means for You

If some of your exposure runs through an adviser or a fund, this proposal is a questionnaire. Ask in writing which pathway your adviser intends to use, which custodian holds the keys today and under what charter, how many people must authorize a transfer, and whether an internal control report exists.

An adviser holding coins itself owes you a quarterly statement and a quarterly reason why no custodian would take the asset; if the reason is that custodians exist but cost more, the rule as proposed does not allow it. A fund that cannot answer is telling you its custody rests on a 2025 staff letter, not a controls regime.

If you hold your own coins, the SEC has handed you a checklist written by people with no interest in flattering you. 2-person authorization becomes a multi-sig quorum, or at minimum a hardware wallet plus a passphrase kept somewhere else, so that 1 device and 1 moment of coercion are not enough.

Segregation means not commingling long-term holdings with spending and trading wallets. The expertise requirement means a written procedure a second trusted person could execute if you cannot. Reconciliation means checking, on a schedule, that the chain shows the balance you believe you hold and that you can still spend it.

The 3-of-6 multisig this site covered in June, with all 6 keys on 1 laptop, and the Coldcard seeds drawn from a weak random number source both looked like the standard and would have failed the audit.

The audit is the part you cannot buy. An adviser under this rule pays $376,000 a year for someone outside the firm to say the keys were handled as promised. You will never pay that, and you will never get it. Exposure through an adviser is a claim on the adviser's keys, audited.

Coins on your own hardware wallet are ownership of the keys, unaudited. Neither is free. The regulator just told you what the first one costs. The second costs the discipline to check your own work, on a calendar, when nobody is making you.

What to Watch

Federal Register publication starts the 60-day comment clock. Whether the final rule keeps the internal control report at an annual cadence and flat scope, or scales it to assets under custody, decides whether the first pathway is real for anyone but the largest advisers. The scope question matters too: the Advisers Act changes reach crypto assets that are funds or securities, and the Commission classed bitcoin as a digital commodity in its March interpretation, so comment letters will test how an adviser holding bitcoin fits.

Whether 2 commissioners finalize a rule this size, or wait for nominees to fill 3 empty seats, will show how much weight the September 30 quorum amendment is meant to carry.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.