SEC Plans Formal Crypto Custody Rules for Investment Advisers
The US Securities and Exchange Commission is targeting October 2026 for a formal proposed rulemaking on how registered investment advisers and investment companies must hold crypto assets in custody. The proposal, which was submitted to the White House Office of Management and Budget as a draft regulatory entry, addresses a gap that has troubled compliance and accounting teams since digital assets first appeared on institutional balance sheets: there is currently no durable, codified framework telling RIAs exactly how to satisfy the existing custody rule when the underlying asset is a crypto token rather than a traditional security. That gap is about to get a lot smaller, and accounting firms, auditors, and CFOs serving advisory clients should be positioning now.
What the SEC Has Said and Why It Matters Now
The Office of Management and Budget's regulatory agenda entry, which was the mechanism that signalled the October timeline, quotes the SEC's own rationale directly. Advisory firms and investment companies have raised questions about how to hold crypto assets in compliance with current Commission custody requirements, and the planned rulemaking would clarify the framework for both RIAs and investment companies. The entry also notes that the rule would make broader modernisations to remove provisions that are no longer necessary given how markets, security trading, and holding practices have evolved.
That final point is easy to overlook but is important. This is not purely a crypto rule. It is a broader modernisation of the custody framework, with crypto asset custody as a central and explicitly named component. Any firm that advises on or audits entities holding crypto under an investment adviser registration needs to track the full rulemaking, not just the digital-asset sections.
The route from no-action letters to formal rule
Since the start of the current administration, the SEC has taken two interim steps to give industry some room to operate. In September 2025, the Commission issued a no-action letter that effectively blessed state-chartered trusts as qualified custodians for crypto assets held by investment advisers. Then in December 2025, SEC staff issued a statement laying out how broker-dealers could custody crypto asset securities themselves, giving that side of the market its own parallel path.
Neither of those paths is what regulators call a "durable" solution. No-action letters and staff statements reflect the enforcement posture of the current staff; they do not have the force of law, cannot be relied upon in litigation with the same weight as a promulgated rule, and can be withdrawn or reinterpreted. The practical consequence is that any RIA or broker-dealer that has structured its custody arrangements around the 2025 guidance carries residual litigation risk even while operating within what the regulator has described as acceptable. A formal rule eliminates that uncertainty in a way that informal guidance simply cannot.
Accounting and Audit Implications for Advisory Firms
For accounting teams and auditors, the shift from informal guidance to codified regulation changes several things at once. Custody arrangements that were designed to satisfy a no-action letter may not automatically satisfy the conditions of a final rule. That means the period between the proposed rule's publication in October 2026 and any eventual effective date is exactly when firms should be running gap analyses, revisiting custodian agreements, and reviewing how crypto holdings are classified and disclosed in financial statements.
Balance sheet classification and the qualified custodian question
Under the existing Investment Advisers Act custody rule, assets managed by an RIA generally must be held by a "qualified custodian." For traditional securities, the definition is well established. For crypto, the no-action letter created a workable but legally thin answer by naming state-chartered trusts. If the forthcoming rule defines qualified custodians for crypto assets differently, or adds conditions around segregation, proof-of-reserves attestations, or insurance, then the accounting treatment of client assets held away from a compliant custodian could come into question.
Firms using digital asset accounting software to track positions will want to ensure their systems can capture custodian-level metadata, specifically which entity holds each position and under what legal structure, because auditors will need that granularity to sign off on custody compliance once a formal rule is in place.
Audit procedures and internal controls
For auditors signing off on RIA financial statements or surprise custody examinations, the current no-action landscape creates a documentation challenge. The auditor must assess whether the custodian arrangement satisfies the applicable standard, but the standard itself is currently a patchwork of informal guidance. A formal rule gives auditors a concrete checklist against which to test controls. Until that rule is finalised, audit teams should be explicit in their workpapers about the basis on which they are evaluating custody compliance, and should flag the pending rulemaking as a subsequent event or contingency where the timeline and potential operational impact are material.
This is also a moment to assess whether existing crypto bookkeeping software and reconciliation workflows are capable of producing the audit trail a formal custody rule is likely to require. Regulators designing custody rules for crypto assets typically want evidence of segregation, daily reconciliation against on-chain records, and clear identification of beneficial ownership. Firms whose current systems cannot produce that evidence should treat the rulemaking timeline as a technology implementation deadline, not just a compliance calendar date.
What Accounting Firms Advising RIA Clients Should Do Now
The October proposed rulemaking date gives firms a rough runway. A proposed rule is followed by a public comment period, typically 60 to 90 days, and then the SEC works toward a final rule. Even in an administration moving at pace on crypto policy, the full cycle from proposed to final rule rarely takes less than six to twelve months. That means a final rule is unlikely before mid-to-late 2027, but the comment period itself is strategically important for practitioners.
Preparing for the comment period
Accounting firms, audit committees, and CFOs with RIA clients have standing to submit comments on a proposed SEC rule. The comment period is the formal mechanism for raising practical implementation concerns, requesting transition periods, or flagging unintended consequences for specific asset types or custodian structures. Firms that engage in the comment process can also signal to their clients that they are tracking the issue at the right level of depth, which is a genuine value-add in a space where regulatory change is constant. Keeping tabs on US compliance priorities for Q3 2026 across AML and digital assets provides useful context for where this rulemaking sits within the broader regulatory queue.
Immediate documentation and gap analysis steps
Before October, advisory firm clients and their accountants should carry out three concrete steps. First, map every crypto asset custody arrangement currently in place to the specific no-action letter or staff statement that provides its regulatory cover. Second, identify any arrangement that is not clearly covered by existing guidance, because those are the highest-risk positions if the final rule draws its boundaries differently than expected. Third, review custodian agreements for provisions that might conflict with a stricter or differently worded custody definition, paying particular attention to rehypothecation rights, segregation language, and termination notice periods.
Firms should also review their staffing and knowledge base. As explored in our analysis of how accounting staff turnover creates financial reporting risk, the combination of a fast-moving regulatory environment and a thin talent pool for digital asset accounting is a genuine operational risk. A custody rulemaking that changes reporting requirements can expose firms whose institutional knowledge sits with one or two individuals.
The Broader Regulatory Signal
It would be a mistake to read this rulemaking as only a technical fix to an outdated custody rule. The SEC's decision to place crypto custody at the centre of a broader Advisers Act modernisation is a signal that the Commission expects crypto assets to remain a permanent and growing component of registered investment adviser portfolios. That has downstream implications for how firms price their compliance services, how audit firms build their digital asset practice groups, and how CFOs at asset management firms plan their technology budgets.
For firms that have been treating crypto custody as a niche or transitional issue, the October proposed rulemaking is a natural forcing function to mainstream it. The custodian relationships, the accounting systems, and the audit procedures that work for a handful of crypto positions in a mostly-traditional portfolio will not scale without deliberate investment. The time to make that investment is before a final rule creates an effective date and a hard compliance deadline.
Frequently Asked Questions
What is the SEC proposing to do on crypto custody for RIAs?
The SEC has submitted a draft regulatory entry to the White House Office of Management and Budget indicating a planned October 2026 proposed rulemaking. The rule would clarify how registered investment advisers and investment companies must hold crypto assets under the existing custody framework, while also modernising other aspects of the custody rule that the Commission considers outdated.
Why are the existing no-action letters and staff statements not enough?
No-action letters and staff statements reflect the enforcement position of current SEC staff, but they do not carry the force of a promulgated regulation. An RIA relying on a no-action letter is protected from SEC enforcement action as long as that letter stands, but it remains exposed to private litigation and to the risk that the letter is withdrawn or reinterpreted. A formal rule resolves those risks in a way informal guidance cannot.
How should auditors treat crypto custody arrangements during the transition period?
Auditors should document the specific basis on which each custody arrangement currently satisfies applicable guidance, identify the pending rulemaking as a regulatory development that may affect future compliance assessments, and flag material custody arrangements in workpapers. Where the rulemaking timeline and potential impact are material to the client, consideration should be given to disclosure as a subsequent event or contingency.
Will existing custody agreements need to be renegotiated when the rule is finalised?
That depends on the final rule's precise conditions. If the rule defines qualified custodians differently, adds segregation or proof-of-reserves requirements, or restricts rehypothecation, then existing agreements may need amendment. Advisory firms and their counsel should review custodian contracts against the proposed rule as soon as it is published and begin negotiations during any transition period the final rule provides.
What should a CFO at an asset management firm do right now?
The most productive steps before October are: map current crypto custody arrangements to the guidance they rely on, identify any gaps, review custodian agreements for provisions that could conflict with a stricter rule definition, and assess whether existing digital asset accounting software can produce the audit trail a formal rule is likely to require. Engaging an adviser with custody rule expertise before the comment period opens is worthwhile, because the comment period is the best opportunity to influence the final rule's practical requirements.
Source: Ledger Insights