SEC Proposes Modernization of Adviser and Fund Custody Rules Including Crypto Custody Framework

On October 1, 2026, the Securities and Exchange Commission (the “SEC” or “Commission”) proposed new rules and rule amendments (the “Proposed Rules” and, the release proposing them, the “Proposing Release”) that would modernize the existing custody rules under the Investment Advisers Act of 1940, as amended (the “Advisers Act”), and the Investment Company Act of 1940, as amended (the “Investment Company Act”), including a new framework for the custody of crypto assets. The Proposed Rules would affect investment advisers registered with the SEC (“RIAs”), as well as registered management investment companies and business development companies regulated under the Investment Company Act (“BDCs” and, together with registered management investment companies, “Regulated Funds”).

RIAs

Under the current framework, Rule 206(4)-2 under the Advisers Act (the “Custody Rule”) generally requires an RIA that has “custody” of client funds or securities to maintain them with a qualified custodian (a “Qualified Custodian”), subject to specified exceptions. The Custody Rule also generally requires an RIA with custody to, among other things, obtain an annual surprise examination by an independent public accountant to verify those assets, although an adviser to pooled investment vehicles¹ may instead satisfy this, and certain related client notice and account statement requirements, by distributing audited financial statements to investors (the “Audit Provision”). The Proposed Rules would modernize the Custody Rule to better reflect current industry practices and respond to industry feedback, in certain cases codifying or modifying previously issued SEC and staff guidance. Among other things, the Proposed Rules would clarify or add new exceptions for discretionary trading authority, standing letters of authorization (meaning a written arrangement among the RIA, the client and the client’s Qualified Custodian under which the RIA is authorized to direct the Qualified Custodian to transfer funds or securities to a third party on a specified schedule or from time to time, “SLOAs”) and inadvertent custody, and would revise the Audit Provision, including by eliminating the requirement that the respective auditor be registered with, and subject to inspection by, the Public Company Accounting Oversight Board (the “PCAOB”), and by addressing “stub period” audits under certain circumstances.

Discretionary Trading Authority: In the 2003 Custody Rule adopting release, the SEC stated that an adviser’s authority to effect or settle trades does not constitute custody, noting that “delivery versus payment” (“DVP”) arrangements minimize the risk of misappropriation. Market participants have since been uncertain whether trading authority over assets that do not settle on a DVP basis, such as loans and certain derivatives, gives rise to custody; this cloud of uncertainty was deepened in 2017 when the SEC staff issued guidance regarding inadvertent custody, which suggested that authority beyond mere DVP trading could give rise to custody, and in 2019 when the SEC staff specifically solicited industry comments on non-DVP custodial practices.² The Proposed Rules would address this uncertainty by adding an express exception from the Custody Rule in its entirety for RIAs with custody solely due to authorized discretionary trading (regardless of whether the trading is DVP or not). The exception would be available only if the RIA: (1) executes, and is authorized to execute, trades solely from and into designated accounts in the client’s name, or the transfer is recorded in the client’s name on the issuer’s books; (2) has no authority to transfer client funds or securities to itself, to an account it or a related person controls or to any other non-client account, other than transfers directed by the client in connection with the trading, and no authority to have a transfer recorded in its own name or that of a related person; and (3) otherwise complies with the Custody Rule, including any applicable exception, for any other activity, right, or authority that separately gives it custody. The SEC also indicated that an RIA relying on the exception should adopt written policies and procedures reasonably designed to ensure that its discretionary trading practices satisfy these conditions.

SLOAs: The Proposed Rules would except an RIA solely from the surprise examination requirement with respect to client funds and securities over which it has custody solely due to the existence of an SLOA. The exception would be available only if: (1) the Qualified Custodian is not the RIA or a related person; (2) the client’s authorization includes the client’s signature, the third-party recipient’s name, and either the recipient’s address or its account number at the receiving custodian; and (3) the RIA has no ability or authority to designate or change any information about the third-party recipient.

This approach is a modestly streamlined version of the relief previously granted by SEC staff in a 2017 no-action letter; and if the Proposed Rules are adopted, the amended rule would supersede any inconsistency with the prior staff relief. An RIA relying on the exception would still have custody of the relevant assets and would remain subject to the Custody Rule’s other requirements, as well as a new corresponding recordkeeping obligation. For purposes of Item 9 of Form ADV Part 1A, an RIA relying on the exception would continue to report that it has custody and would disclose its reliance on the exception, but would exclude the client assets, and clients, over which it has custody solely because of an SLOA from its reported custody totals.

Inadvertent Custody Via Custody Agreements:In its 2017 guidance update, the staff took the position that broadly drafted custody agreements between clients and their custodians sometimes grant an RIA authority it did not seek or agree to take on in its advisory agreement with its client, or of which it was not even aware (such as the ability to withdraw client assets), with the result that the RIA would be deemed to have custody inadvertently. The Proposed Rules would except from the Custody Rule in its entirety those client funds and securities over which an RIA has custody solely because of such a custodial agreement, provided that: (1) the RIA did not recommend, request, or require that the client select the Qualified Custodian; and (2) either (a) the RIA does not have a copy of the custodial agreement and has no actual knowledge or reason to know that it confers custody on the RIA, or (b) if the RIA knows or has reason to know of such authority, it promptly notifies the client and the Qualified Custodian in writing, repudiates the authority, and requests in writing that it be removed from the agreement or superseded by a new agreement that does not confer custody. Notably, this latter condition would be satisfied by merely making the request, whether or not the client and custodian actually amend their agreement to remove such authority. The SEC indicated that RIAs relying on the exception should maintain policies and procedures for identifying, disavowing, and seeking removal of such unwanted authority.

Audit Provision: The Proposed Rules would make several changes to the Audit Provision. Among other things, the Proposed Rules would:

• Eliminate the requirement that the independent public accountant performing the audit (or, where applicable, the surprise examination and internal control report) be registered with, and subject to regular inspection by, the PCAOB, without changing the requirement that the accountant be independent;
• Require that audited financial statements be prepared in accordance with US GAAP, while incorporating existing SEC positions that permit a pooled investment vehicle organized outside the United States, or whose general partner or other manager has its principal place of business outside the United States, to use other accounting principles if its financial statements contain information substantially similar to US GAAP financial statements, including a reconciliation of material differences that is delivered to US investors in the vehicle;³
• Extend the current 120-day deadline for delivering audited financial statements to 180 days for funds of funds and 260 days for funds of funds of funds, in line with existing SEC staff guidance (although, unlike that guidance, the Proposed Rules do not define either type of structure, including by reference to the staff’s definition in that guidance that a fund of funds is a pooled investment vehicle that invests 10% or more of its total assets in unaffiliated pooled investment vehicles);⁴ and
• Permit a pooled investment vehicle formed within 90 days of its fiscal year-end to postpone the audit of that initial short period until the following year’s audit, provided that financial statements (which may be unaudited) for the stub period are delivered within 90 days after the end of that fiscal year, and that audited financial statements covering both the first and second fiscal years are delivered after the end of that second fiscal year. Notably, the SEC declined to propose (or even specifically seek public comment on) any relief for pooled investment vehicles in the end-of-life stages, where, in practice, annual audited financial statement expenses can amount to material expenses for late-stage funds with dwindling assets.

While not addressed directly in the rule text, the Proposing Release provides that, in the Commission’s view, an adviser’s failure to distribute audited financial statements within the applicable timelines generally would not be considered a violation, provided that the adviser reasonably believed that the pooled investment vehicle’s audited financial statements would be distributed within 120 days of the fiscal year-end (or otherwise applicable required timeline) but failed to have them distributed in time due to reasonably unforeseeable circumstances and ensures that the audited financial statements are promptly delivered upon resolution of the reasonably unforeseeable circumstances. This would formally bring the Commission’s stated views into alignment with views previously taken by SEC staff.⁵

Other Changes: The Proposed Rules would also: (1) require the notice an RIA sends to a client upon opening an account with a Qualified Custodian to include the client’s account number; (2) require accountants to send notices of material discrepancies identified during a surprise examination to the SEC’s Division of Examinations electronically; (3) permit certain required records to be maintained on a crypto network, provided they can be produced promptly to the SEC in a human-readable and reasonably usable electronic format; (4) significantly amend Form ADV to, among other things, collect information regarding crypto asset self-custody and the use of state trust companies for crypto assets (see below), add questions regarding tokenized private funds, and collect a great deal of additional information in response to Item 9 (the custody reporting item) of Form ADV Part 1A, including the various exceptions under the Custody Rule being relied upon by the registrant; and (5) redesignate the current Custody Rule from Rule 206(4)-2 to Rule 223-1 to align with the specific statutory authority in the Dodd-Frank Act relating to custody of client assets.

Regulated Funds

Section 17(f) of the Investment Company Act and the rules thereunder (currently, Rules 17f-1 through 17f-7) require Regulated Funds to maintain their securities and similar investments with certain specified custodians (these custodians are referred to collectively as “Permitted Custodians”), subject to certain conditions or other requirements. The Proposed Rules would modernize these rules by, among other things, clarifying that BDCs may rely on the Investment Company Act custody rules, expanding the types of broker-dealers eligible to serve as custodians for Regulated Funds pursuant to Rule 17f-1, and rescinding Rule 17f-3, which governs the use of free cash accounts. The SEC also requested comment on whether and how to further modernize the Investment Company Act custody rules, including Rule 17f-2 governing fund self-custody arrangements.

BDCs: Under Section 59 of the Investment Company Act, Section 17(f) applies to BDCs in the same way it applies to registered closed-end funds, but none of the existing Investment Company Act custody rules expressly refer to BDCs. The Proposed Rules would add references to BDCs throughout these rules, clarifying that BDCs, like registered investment companies, may rely on them to use all Permitted Custodians, consistent with current industry practice.

Relatedly, the Proposed Rules would extend the Custody Rule’s existing exception for accounts of registered investment company clients to accounts of BDC clients, which the SEC explained would prevent advisers to BDCs from being subject to overlapping or inconsistent custody regimes. However, for registered investment company clients and BDC clients alike, this exception would not cover crypto assets that the RIA holds in self-custody; those assets would instead be subject to the proposed adviser self-custody requirements (but not the Custody Rule’s other requirements), as discussed below.

Broker-Dealer Custody: Rule 17f-1, which was first adopted in 1940, currently permits registered management investment companies to use as custodians only those broker-dealers that are members of a national securities exchange, subject to a number of enumerated conditions, including a written contract requiring segregation and prohibiting the broker-dealer custodian from pledging or otherwise disposing of fund assets, as well as periodic verification (including a surprise verification) by an independent public accountant. The Proposed Rules would expand Rule 17f-1 to permit any registered investment company or BDC to use any broker-dealer registered with the SEC that carries customer accounts, and replace the rule’s current conditions with a single requirement that the broker-dealer’s custody of the relevant securities or similar investments be subject to the requirements of Rule 15c3-3 under the Securities Exchange Act of 1934 (the “Customer Protection Rule”) or another rule that the SEC determines provides similar customer protections.⁶ Since SEC registration as a broker-dealer by itself would not satisfy the proposed conditions, registered investment companies and BDCs would need to confirm that the particular assets held with the SEC-registered broker-dealer are covered by the Customer Protection Rule or a comparable rule, which may limit the use of broker-dealer custody for certain investments that are not securities. The SEC acknowledged this limitation, noting that a number of the broker-dealer protections it discussed apply only to customer securities and funds, and that unless the SEC determines that another rule provides similar customer protections, registered investment companies and BDCs may be unable to custody “similar investments” that are not securities with a broker-dealer.

Free Cash Accounts: The Proposed Rules would rescind Rule 17f-3, which permits a registered investment company to hold a limited amount of cash in an account that is not part of its bank custody arrangement. The SEC stated that it understands funds are no longer using the rule and does not perceive a need for such accounts in modern markets.

Other Changes and Requests for Comment: The Proposed Rules would make technical amendments to Rules 17f-4 and 17f-7, which govern the use of domestic and foreign securities depositories, respectively, to update an outdated address and correct a cross-reference. They would also amend Form N-CEN to require reporting on the use of adviser self-custody or state trust companies for crypto assets, as well as disclosure of whether a Regulated Fund (or any series or class) is tokenized and, if so, the names of the crypto networks on which its ownership is recorded.

In addition, the SEC requested comment on further modernization of the Investment Company Act custody rules, including whether Rule 17f-2, the fund self-custody rule, should be updated to address (i) the use of custodians affiliated with a Regulated Fund’s adviser, and (ii) custody of uncertificated assets not held through a securities depository (such as shares of other Regulated Funds, privately offered securities, and loans). The SEC also requested comment on whether Rule 17f-6 (which permits registered investment companies to custody certain assets with registered futures commission merchants (“FCMs”), subject to certain conditions) should be amended to address cleared swap collateral held with FCMs.

Crypto Assets

Because the existing custody rules were designed for traditional assets, the Proposed Rules would establish a tailored framework for crypto assets, which the SEC describes as designed to enhance investor protection while expanding investor choice. RIAs would be permitted to self-custody client crypto assets, including those of Regulated Funds, where no Permitted Custodian is available, and state trust companies would be added as a new category of Permitted Custodian for crypto assets.

Adviser Self-Custody: The Proposed Rules would create an exception from the Custody Rule’s Qualified Custodian requirement, permitting an RIA to hold client crypto assets in self-custody, subject to specified conditions. The framework would cover only crypto assets that are client “funds or securities” under the Advisers Act or, for Regulated Funds, “securities and similar investments” under the Investment Company Act. As a result, according to the SEC, native digital commodities such as bitcoin, ether, and solana generally would fall outside the Custody Rule for advisory clients other than Regulated Funds, but would be covered where an RIA self-custodies them for a Regulated Fund.⁷ Under proposed Rule 17f-9, a Regulated Fund could maintain crypto assets with its adviser if the adviser satisfies the self-custody conditions and the fund’s board oversees the arrangement.

An RIA would have “self-custody” if it holds any portion of the key materials needed to transact in a client’s crypto asset. The principal conditions would require the RIA to:

1) Determine in writing, before taking self-custody of each crypto asset and at least quarterly thereafter, that no Qualified Custodian will maintain it, and transfer the asset to a Qualified Custodian once one becomes available;

2) Document expertise in safeguarding each crypto asset and maintain safeguarding systems, including key management, joint authorization of transactions by at least two persons, and separate crypto asset addresses holding only each client’s assets;

3) Address cybersecurity risks and review its safeguards at least annually;

4) obtain an internal control report from an independent public accountant within six months of taking self-custody of a client crypto asset and at least once each calendar year thereafter;

5) send clients quarterly account statements; and

6) agree in writing with the client to treat each self-custodied crypto asset as a “financial asset” under applicable state law.

An RIA with self-custody would generally remain subject to the surprise examination requirement unless it relies on the Audit Provision. For a Regulated Fund, the board, including a majority of directors who are not interested persons of the fund, would be required to review quarterly the adviser’s written determination that no Qualified Custodian will maintain the crypto asset, and to determine annually that the crypto asset will be subject to reasonable care. The Proposed Rules would also provide relief for airdropped crypto assets, provided that the RIA or Regulated Fund comes into compliance or places the asset with a Permitted Custodian as soon as reasonably practicable. In general, as emphasized by the conditions above and other statements by the SEC in the Proposing Release, this self-custody option should be regarded as something only appropriate for new and emerging crypto assets where no mature custody market yet exists—effectively, a stop-gap measure.

State Trust Company Custodians: The Proposed Rules would add state trust companies as a new category of Permitted Custodian under both the Advisers Act and the Investment Company Act (under proposed Rule 17f-8), limited to crypto assets and related cash and cash equivalents. This would replace reliance on prior, substantially similar SEC staff guidance.

Before engaging a state trust company, and annually thereafter, an RIA or Regulated Fund would need to determine in writing, after due inquiry, that the trust company is authorized by its state banking authority to provide crypto asset custody and maintains written safeguarding policies and procedures. It would also need to review the trust company’s most recent audited financial statements and internal control report, and client and Regulated Fund crypto assets would have to be segregated from the trust company’s proprietary assets.

Conclusion

If adopted, the Proposed Rules would provide a number of welcome clarifications, and formalize or modify prior staff positions, regarding the Custody Rule, as well as grant additional rule-based paths for crypto asset custody arrangements. By addressing a number of positions previously reflected only in SEC staff guidance and no-action letters, the Proposed Rules would give RIAs greater, more permanent regulatory certainty on several longstanding Custody Rule issues, and may prove to be more resilient over time. In addition, the Proposed Rules would provide welcome updates to certain custody rules under the Investment Company Act. Comments on the Proposed Rules are due on or before December 7, 2026.

¹ For purposes of this Legal Update, “pooled investment vehicle” refers to a limited partnership, limited liability company or other type of pooled investment vehicle, consistent with how the Custody Rule describes the vehicles eligible for the Audit Provision.

² See our Legal Update, SEC Staff Seeks Public Comment Regarding Custody Issues Associated with Non-DVP Arrangements and Digital Assets.

³ The Proposed Rules did not address, and thus presumably would not alter, the longstanding SEC and staff positions that would permit an RIA with its principal office outside the United States to not apply certain substantive provisions of the Advisers Act, including the Custody Rule, to its non-U.S. clients.  However, perhaps notably, request for comment #237 provides:

Given the prevalence, for tax and other reasons, of private funds and other pooled investment vehicles being organized outside of the U.S. (even when a substantial portion or majority of the invested assets come from U.S. investors), should we distinguish between foreign [pooled investment vehicles] that have non-U.S. investment advisers and foreign [pooled investment vehicles] that have a primary adviser with a principal office and place of business in the U.S.?

Such a change to the Proposed Rules, if made, could be viewed as having wide-reaching ramifications if it signaled an intentional pull-back from the SEC’s historical approach to how SEC-registered non-US-based advisers deal with their non-US clients.

⁴ Presumably, this means that the fund-of-funds relief would be newly available for funds investing in affiliated underlying funds.

⁵ See also Proposing Release at n.579 and accompanying text.

⁶ The SEC explained that, in light of the comprehensive broker-dealer financial responsibility rules, including the Customer Protection Rule, adopted since Rule 17f-1 was first adopted in 1940, the risks to clients that use broker-dealers for custodial services are very different from those that existed at that time.

⁷ That said, self-custody would presumably not actually be available for these identified types of established crypto assets because another Permitted Custodian would likely be available.