The U.S. Securities and Exchange Commission (SEC) proposed new changes to crypto custody rules on October 1, creating a framework that could allow registered investment advisers and regulated funds to use self-custody for crypto assets under certain circumstances. The proposal also addresses the use of state trust companies as custodians, while raising important questions about how regulators, auditors and investors can verify actual control over digital assets.
The SEC’s announcement describes a tailored custody framework under both the Investment Advisers Act and the Investment Company Act. However, the proposal does not simply provide unconditional approval for funds or advisers to hold crypto assets themselves. Instead, self-custody would be available only when specific conditions are satisfied.
The public will have 60 days to submit comments after the proposal is published in the Federal Register. The SEC’s October 1 announcement itself does not establish a final compliance date or create an unconditional right to self-custody.
What the SEC Proposal Covers
The October 1 proposal applies to registered investment advisers and regulated funds, including registered investment companies and business development companies. According to the SEC, the framework would permit crypto assets to be held through self-custody in defined circumstances and would also allow state trust companies to serve as custodians for certain client and fund crypto assets.
The proposal also includes changes related to financial statement audits for investment advisers and broker-dealer custodial services for regulated funds.
This distinction is important because the adviser custody framework and the fund custody regime address different regulatory responsibilities. Treating all crypto custody arrangements as identical could overlook the different requirements that apply to client assets and fund portfolios.
The proposal follows earlier regulatory developments involving state-chartered trust companies. In 2025, SEC staff issued a conditional no-action position involving certain state-chartered trust companies. The latest proposal moves the discussion toward a broader Commission rulemaking process that includes both trust-company custody and limited self-custody.
Why a Blockchain Wallet Balance Is Not Enough
One of the biggest issues surrounding crypto custody is the difference between proving that assets exist and proving who legally controls them.
For example, a fund may report that it holds 10,000 units of a particular cryptocurrency. An auditor can inspect a blockchain address and confirm that the address contains 10,000 tokens at a particular point in time. However, that does not automatically prove that the fund exclusively controls the wallet.
A blockchain balance also does not establish whether those tokens belong entirely to one fund, whether another party has a claim over them, or whether the assets have been pledged through an off-chain agreement.
This creates a bridge between onchain information and traditional financial records.
A stronger custody review would need to reconcile the institution’s general ledger, customer subledger, wallet inventory and third-party confirmations. The total customer and fund entitlements should be compared against controlled addresses, unsettled receivables and committed transfers.
Repeating this reconciliation across multiple dates can provide stronger evidence than checking a wallet balance only once.
The Challenge of Private-Key Control
Crypto custody introduces another problem that does not have a direct equivalent in traditional physical custody: private keys are information.
A private key can potentially be copied without the original disappearing. An employee or administrator could theoretically duplicate a signing secret without creating an obvious physical sign of compromise. The first visible evidence might only appear when an unauthorized transaction is attempted or completed.
Technologies such as hardware security modules and multiparty computation can reduce certain risks by separating signing authority. However, these systems also create additional controls that need to be examined.
For example, a three-of-five signing structure may require three approvals before a transaction can be authorized. But the structure itself does not explain how secure the five signing environments are. If several signing shares are stored under the same administrative system, the apparent separation could be weaker than expected.
Auditors therefore need to examine who can approve transactions, who can change approval rules, who can restore signing credentials and who can access administrative logs.
Self-Custody Would Be Conditional
The proposal’s self-custody framework is narrower than the simple phrase “SEC allows self-custody” might suggest.
Commissioner Hester Peirce’s statement on the proposed custody rules says an adviser would first need to determine that no permitted custodian is available for a particular crypto asset and repeat that determination quarterly.
This means the exception could depend on the availability of qualified custody services.
For example, an adviser could determine that no permitted custodian supports a newly issued token in January. If a qualified provider begins supporting that token in March, the adviser may need to reassess the situation during the next review period under the eventual rules.
That makes documentation particularly important. Advisers would need records showing which custodians were contacted, what services they offered, which asset and network were involved, and why a particular provider was considered unavailable.
The distinction between “unavailable” and “expensive” could become especially important. If a custodian offers the required service but charges higher fees, that could present a different regulatory question from a provider that genuinely cannot safeguard or process the relevant asset.
State Trust Companies Add Another Layer
The proposal also addresses state trust companies as potential custodians for crypto assets.
A state trust company can introduce an external organization and regulatory oversight into the custody structure. However, the existence of a trust-company charter alone does not prove that a particular provider has strong operational controls.
Advisers and funds may still need to understand who owns the wallet, who is the customer of record, whether assets are segregated, how client property would be identified during insolvency and which third parties have access to signing infrastructure.
Outsourcing can make this structure more complicated. A trust company might remain the named custodian while another technology provider operates wallet infrastructure, recovery systems or transaction controls.
As a result, regulators and auditors may need to examine the complete control path rather than simply identifying the company named in a custody agreement.
Why This Matters for Investors
For shareholders of regulated funds, crypto custody can involve several layers between the investor and the underlying blockchain assets.
A shareholder generally owns shares in a fund rather than a direct claim to a specific bitcoin output or token address. The fund manages the portfolio while custodians, accounting providers and transfer agents maintain different parts of the financial and operational records.
The blockchain can show where assets are held and what balances exist. It cannot independently establish every legal entitlement represented by those assets.
That is why the SEC proposal could make the reconciliation between onchain control, financial books and client entitlements an important part of future crypto custody practices.
The proposal is still subject to public comment and does not represent a final unconditional self-custody rule. The eventual requirements will depend on the final regulatory text and the SEC’s responses to comments.
For the crypto industry, the central issue is therefore not simply whether an adviser can hold its own private keys. The larger question is whether an independent party can verify who controls the assets, who owns the economic interest in them and whether the institution’s records accurately match what exists onchain.
