The U.S. Securities and Exchange Commission has officially unveiled a highly anticipated, comprehensive regulatory proposal aimed at modernizing digital asset custody. Released on October 1, 2026, the newly drafted framework introduces tailored custody pathways for Registered Investment Advisers (RIAs) and regulated funds—including registered investment companies and business development companies—under the Investment Advisers Act of 1940 and the Investment Company Act of 1940. According to SEC Chairman Paul Atkins, this paradigm shift seeks to erase the “grey of uncertainty” left by historical compliance structures crafted for a bygone era, replacing the heavily scrutinized 2023 “Safeguarding Rule” proposal that was withdrawn in June 2025. Legal professionals and institutional asset managers must now evaluate how these systemic updates will rewrite compliance protocols across the digital asset industry.
The cornerstone of this proposal is the creation of a structured, conditional “self-custody” exception designed to solve a persistent roadblock for institutional fund managers. Previously, investment advisers struggled to find traditional, qualified institutional infrastructure willing or technologically equipped to hold specialized digital assets. Under the new framework, an adviser can legally hold client private keys directly, provided they fulfill stringent operational mandates. Crucially, as Commissioner Hester Peirce clarified, this definition of self-custody describes an investment firm acting as an internal custodian rather than a personal retail wallet strategy. To leverage this fallback, an adviser must determine and document in writing that no qualified third-party custodian is available to maintain the specific crypto asset—a finding that must be reassessed on a strict quarterly basis. If a viable third-party option emerges in the broader market, the assets must be moved to that institution as soon as reasonably practicable.
Key Procedural and Security Safeguards
To prevent the loss, theft, or commingling of self-custodied client assets, the SEC has proposed explicit, dual-authorization infrastructure requirements:
- Multi-Signature Approvals: Every single digital transaction or outward transfer from an internally custodied pool requires the formal approval of at least two distinct authorized personnel.
- Segregated Blockchain Addresses: Advisers must maintain completely isolated cryptographic wallet addresses for each unique client, prohibiting any blending or commingling of separate accounts.
- Independent Cybersecurity Reviews: Mandated deployment of advanced private key management networks subject to strict, independent cybersecurity audits on an annual schedule.
- Fiduciary Continuity: As Commissioner Mark Uyeda emphasized, these allowances explicitly recognize the inherent conflicts of interest tied to adviser-managed custody, meaning strict fiduciary duties apply unremittingly.
Beyond the narrow avenue of conditional self-custody, the proposed rule significantly widens the traditional circle of external qualified custodians by explicitly standardizing the eligibility of state-chartered trust companies and certain regulated broker-dealers. This update formally anchors previous ad-hoc no-action letters into permanent federal administrative text, providing clear criteria for state trusts to operate as legitimate custodians. To qualify under the new rules, these institutions must implement specialized written safeguarding systems and routinely open their internal books to annual, independent audited financial statement requirements. Furthermore, the SEC proposal seeks to update financial statement audit requirements for RIAs while simultaneously modernizing broker-dealer customer protection standards. This opens the door for regulated funds to significantly broaden their tokenized security and native cryptocurrency strategies without fear of regulatory enforcement traps.
From a strategic legal perspective, this custody framework does not stand in isolation but serves as a vital component of the SEC’s evolving, proactive digital asset roadmap. It directly complements the agency’s recently introduced Regulation Crypto Assets initiatives, which seek to streamline offering exemptions for token issuers and clarify tokenization principles for the capital markets. By establishing predictable guardrails for wallet security, record-keeping, and account transparency, the SEC intends to curb the legal incentive for domestic funds to seek offshore infrastructure, simultaneously inviting greater institutional participation. The public comment period will remain open for 60 days following the formal publication of the release text within the Federal Register. Market participants and compliance counsel should immediately begin assessing their technical capacity to satisfy these dual-control, address-segregation, and written-determination criteria ahead of final implementation.