The SEC’s Crypto Custody Proposal Could Shape Which Strategies Managers Can Run

A custodian can be available for an asset and unavailable for the strategy. It may hold ETH without supporting the staking arrangement a fund wants to use. It may custody a vault receipt without resolving the treatment of the deposited assets. A manager’s wallet provider may hold a key share because that arrangement improves security, yet the share itself could prevent reliance on the SEC’s proposed self-custody exception.

These are consequential limits for a proposal intended to make crypto custody more workable. The SEC’s October 1, 2026 proposal would establish new routes for adviser self-custody and custody through eligible state trust companies. Its practical value will depend on whether the conditions accommodate how investment strategies actually use assets.

For managers, custody could determine which products they can offer, which providers they need and whether the returns justify the operating costs. Custodians and infrastructure providers face a corresponding question about which services and technical configurations their clients will require.

The proposal has not been adopted. Existing requirements and applicable relief continue to govern. Comments are due December 7, 2026.

When custody constrains the investment

The proposed self-custody exception requires an adviser to determine in writing, after due inquiry, that no qualified custodian will maintain the particular crypto asset. That determination must be made before taking self-custody and revisited at least quarterly. Cost does not establish unavailability. If a custodian becomes available, the adviser must transfer the asset as soon as reasonably practicable.

The test does not expressly accommodate a custodian’s inability to support functions necessary to the investment strategy. The SEC considered a broader alternative tied to the client’s investment objective and best interests but did not propose it.

Consider a registered fund that intends to stake ETH. A permitted custodian will hold the ETH but cannot support the proposed staking arrangement. That service limitation would not itself establish eligibility for self-custody. The fund may have to find another provider, accept a different staking arrangement or revise its strategy.

Custodian selection therefore belongs early in product development. A supported-asset list says little about validator arrangements, withdrawal credentials, rewards, governance rights or exit procedures. Managers need to establish what a provider will support under contract, including which functions depend on future development.

Self-custody also carries migration risk. A manager may invest in infrastructure only to become obligated to move the asset when a custodian becomes available. Staking exit queues, unbonding periods and vendor commitments could complicate that transfer. The cost of establishing self-custody should be evaluated alongside the cost of leaving it.

These concerns depend on the client and asset involved. For private funds and separately managed accounts, the Advisers Act custody rule generally reaches funds and securities. Native BTC and ETH generally fall outside that rule, assuming the relevant holding is not subject to an investment contract. Registered funds and BDCs face a broader custody framework covering securities and similar investments.

The Release identifies payment stablecoins within specified GENIUS Act issuer categories, and tokenized deposits, as funds. Other stablecoins require separate analysis. Tokenized securities remain securities, while receipts and vault interests must be assessed according to their rights and structure. A private fund can therefore move from an asset outside the custody rule into a position subject to it within the same strategy. Fiduciary and other obligations remain relevant throughout.

A wallet-based rule for a protocol-based market

The proposal provides detailed conditions for holding keys while leaving important questions about deploying assets through protocols unresolved.

A smart-contract deposit must leave the asset maintained by an adviser complying with the proposed self-custody conditions or by another permitted custodian, unless an exception applies. The Release asks how continued ownership and control, third-party authority, decentralization and contract governance should affect that analysis.

Staking presents two separate hurdles. A manager must establish eligibility for self-custody, if that is its intended route, and assess whether the staking arrangement leaves the assets maintained by the adviser. Satisfying the first does not answer the second. Question 171 seeks input on the treatment of staking arrangements; it does not approve every staking model.

Vaults expose the same uncertainty in a different form. Suppose a private fund deposits covered stablecoins into a lending vault and places the resulting receipt with a qualified custodian. Custody of the receipt does not automatically establish compliant custody of the deposited assets.

Question 174 asks whether exclusive custody of a receipt should suffice where redemption restrictions are limited, enforced by code and outside anyone’s discretion. It separately asks about vault tokens representing a share of pooled assets. Those are possible approaches under consideration, not exceptions supplied by the proposed rule text.

The commercial analysis turns on the actual rights. A receipt may entitle its holder to recover the deposited asset, receive a variable share of a portfolio or assert a claim against an operator. Who can redeem it, pause withdrawals, upgrade the contract or change the destination matters more than the label. A restriction implemented in code may still be changed through an administrator key.

Transferability is not a complete answer. A receipt’s secondary-market liquidity may deteriorate precisely when redemption becomes difficult. A fixed lockup also differs materially from an operator’s discretionary withdrawal veto.

The client-specific address requirement raises another issue when assets enter a shared contract. It would be too broad to conclude that every pooled arrangement fails. A receipt may remain in the fund’s own address, and whether that should suffice is part of the SEC’s inquiry. The fund is ordinarily the advisory client, rather than each individual investor.

Before launching, the manager, custodian, administrator and legal team should agree on the position the fund owns, how it will be recorded and valued, and the basis for its custody treatment. A strategy that depends on the SEC adopting a favorable answer to Question 174 has a regulatory dependency that belongs in the launch decision.

Security architecture and product economics

The proposal could also require changes to arrangements adopted to make assets safer.

Assume an adviser otherwise qualifies for self-custody and uses a two-of-three multiparty computation arrangement. Two designated employees hold shares; a wallet infrastructure provider holds the third. The provider cannot independently transfer assets.

That limitation does not resolve the proposed rule’s conditions. Possession of any portion of key materials is treated as self-custody, and access is restricted to designated supervised persons. The Release explains that sharing key materials outside the adviser would violate the condition. MPC can support joint authorization, but the participants still matter.

Managers need the actual signing and recovery design, including who can access key materials, reset credentials, change signing policies or redirect recovery. Describing the service as noncustodial does not answer those questions.

Possible responses include confining key access to the adviser’s designated supervised persons or using a qualified custodian while retaining no share. Moving a share to an affiliate is not an automatic solution. A redesign may change staffing, incident response and business continuity, so its security consequences deserve as much attention as its legal treatment.

Even an eligible arrangement may be expensive. The SEC estimates certain adviser self-custody compliance costs at $173,499 initially and $433,833 annually, including $376,000 annually for an independent internal control report. The annual estimate equals approximately 434 basis points on $10 million, 87 basis points on $50 million and 43 basis points on $100 million.

Those calculations apply the same adviser-level estimate to different assumed asset bases. They are not vendor quotes, a prediction of fund expenses or a complete operating budget. They nevertheless illustrate how fixed compliance costs can absorb a meaningful portion of a smaller strategy’s return.

Managers should obtain an accountant’s scope and quote, budget technology and personnel, and confirm who bears the expense under the governing documents. A conventional fund audit would not substitute for the proposed internal control report.

The other conditions include safeguarding systems, joint transfer authorization, cybersecurity assessments, annual reviews, account reporting subject to exceptions and an Article 8 agreement treating the assets as financial assets and the adviser as a securities intermediary. Registered funds and BDCs would also require board reviews and designated personnel, including a fund officer participating in transfer authorization. These requirements affect both launch timing and ongoing economics.

What to negotiate and what to seek from the SEC

The proposed state trust company route would provide an express basis for eligible entities to custody crypto assets and related cash and cash equivalents. Advisers and funds would need specified diligence on authorization, safeguarding policies, financial statements and internal controls. The separate bank route would remain available where its requirements are met.

For clients, regulatory status is the beginning of provider diligence. The contract should identify the custody entity, supported activities and responsibility for losses. Managers should evaluate access to updated control reports, notice of lost authorization or discontinued asset support, and assistance with withdrawals and migration. These protections should reflect the strategy’s actual dependencies.

Trading requires similar attention. The SEC has not proposed a general exception for leaving assets on platforms that are not permitted custodians, but it discusses arrangements separating execution from custody. Managers should establish where assets and collateral sit, who can move them and which entity owes their return. If available arrangements cannot provide the necessary liquidity or financing, that limitation should be documented.

The strongest comments will connect these operating facts to specific changes. The custodian-availability test could account for functions reasonably necessary to a documented investment objective, with comparative risk assessment and periodic review. Receipt-token treatment could turn on enforceable redemption rights, liquidity and administrative powers. Limited external participation in key management could be evaluated through controls addressing collusion, recovery and unauthorized transfers.

The SEC’s concern about misappropriation deserves a concrete response. A manager seeking broader permission should show the transaction, identify the condition that prevents it, quantify the consequence and explain how its proposed safeguards protect clients.

That work also informs decisions before the rule is final. Managers can distinguish strategies supported by available providers from those requiring a technical redesign, a different expense structure or a change in the proposal. Those distinctions should guide what they build and what they commit to now.

Securities and Exchange Commission, Adviser and Regulated Fund Custody Rules; Crypto Custody Rules, Release Nos. IA-7023 and IC-36353, File No. S7-2026-35 (Oct. 1, 2026), pp. 2, 25–38, 398–401 (the “Release”), https://www.sec.gov/files/rules/proposed/2026/ia-7023.pdf. All page references are to the conformed release, rather than Federal Register pagination.

Release, pp. 80–88, especially pp. 83–84; proposed Rule 223-1(b)(7)(i). For regulated funds, the availability inquiry concerns custodians permitted under Section 17(f) and its rules. See also pp. 166–174 and proposed Rule 17f-9.

Release, pp. 86–87, Question 38, and pp. 615–616 (alternative based on the client’s investment objective and best interests).

Release, pp. 43–47, 51–54, including p. 53 and pp. 128–132. The specified stablecoin categories include permitted payment stablecoin issuers and foreign payment stablecoin issuers registered under Section 18 of the GENIUS Act.

Release, pp. 203–208, especially Questions 172–173. The discussion concerns assets subject to the applicable custody requirements.

Release, pp. 206–207, Question 171.

Release, p. 209, Question 174. The receipt-token and vault-token examples are illustrative arrangements, not assessments of particular providers.

Release, pp. 117–120 and 209; proposed Rule 223-1(b)(7)(ii)(C); Question 174.

Release, pp. 58–68, especially pp. 63–65, and pp. 105–111; proposed Rule 223-1(b)(7)(ii)(A)–(B) and definitions in Rule 223-1(d). The MPC example assumes an adviser otherwise eligible for the exception.

Release, pp. 466–470, 486 and Table 8 at p. 595. Basis-point illustrations equal $433,833 divided by the assumed asset base, multiplied by 10,000, and rounded to the nearest whole basis point.

Release, pp. 89–165 and 166–174; proposed Rules 223-1(b)(7) and 17f-9. See pp. 134–145 for the internal control report, pp. 146–158 for account statements and exceptions, and pp. 159–165 for the Article 8 election.

Release, pp. 179–199, especially pp. 183–184; proposed Rules 17f-8 and 223-1(d)(13)(v). The contractual protections discussed in the following paragraph are commercial recommendations, not a statement that each term is mandated.

Release, pp. 212–216, especially pp. 214–215 and Questions 181–182.