Advisers Act crypto custody proposal opens a self-custody path

The Securities and Exchange Commission (SEC) on October 1, 2026 proposed rules under the Investment Advisers Act of 1940 (Advisers Act) and the Investment Company Act of 1940 that would let advisers and regulated funds self-custody certain crypto assets when no permitted custodian is available, and would admit state trust companies on written conditions.

Releases IA-7023 and IC-36353, file S7-2026-35, would redesignate the Advisers Act custody rule under Section 223. Comments stay open for 60 days after Federal Register publication, and the October 1 papers set no compliance date. Below: the self-custody test, state trust companies, the securities-only limit, and the contrast with Britain, the European Union and Singapore.

Key facts

• October 1, 2026: Releases IA-7023 and IC-36353, file S7-2026-35, RIN 3235-AN46. Comments run 60 days after Federal Register publication. No compliance date. Source: press release 2026-100 and the rulemaking page.
• Self-custody only if no permitted custodian is available, before the holding and quarterly thereafter. Source: the IA-7023 fact sheet.
• Joint authorisation by two people, an accountant's report within six months then annually, and quarterly client statements. Source: the fact sheet.
• A state trust company needs annual due inquiry on crypto-asset custody authority, plus segregation from proprietary assets. Source: the fact sheet.
• The Advisers Act amendments would apply only to crypto assets that are funds or securities. Source: Commissioner Hester M. Peirce, citing proposed rule 223-1(a).
• September 3, 2024: a $225,000 civil penalty against Galois Capital Management LLC. Assets at FTX Trading Ltd. were not with a qualified custodian. About half the fund's assets in early to mid-November 2022 were lost. Source: press release 2024-111.
• United Kingdom full cryptoasset perimeter: October 25, 2027. Singapore trust-account duty: October 4, 2024. EU Article 75: December 30, 2024.

Methodology and sources

The US record is Chairman Paul S. Atkins's October 1 statement, press release 2026-100, the fact sheet, the S7-2026-35 rulemaking page, and the statements of Commissioners Mark T. Uyeda and Hester M. Peirce. Peirce's footnotes cite Release No. 7023 and the February 15, 2023 proposal, Release No. IA-6240. Enforcement is the September 3, 2024 announcement. Related work sits on the regulation desk.

Related:FCA cryptoasset gateway opens against a February 28 deadline

Britain is the Financial Conduct Authority (FCA) overview of Policy Statement 26/11 and the Client Assets Sourcebook (CASS) 17. The European Union source is Regulation (EU) 2023/1114, the Markets in Crypto-Assets Regulation (MiCA), Articles 75 and 149. Singapore is regulations 18B and 18J of the Payment Services Regulations 2019, commenced on October 4, 2024, and the Monetary Authority of Singapore (MAS) notice of July 3, 2023.

What Release IA-7023 would actually require

The rulemaking page titles the project "Adviser and Regulated Fund Custody Rules; Crypto Custody Rules". The fact sheet adds "Investment Adviser and" at the front. Both are Releases IA-7023 and IC-36353. The fact sheet, not the shorter press release, is the condition list.

The October 1, 2026 proposal would permit an adviser to hold a client's crypto asset in self-custody only where the adviser determines that a permitted custodian is not available, before the adviser takes the asset and again every quarter. The fact sheet issued with Release No. IA-7023 requires the adviser to document safeguarding expertise, to keep systems that cover private-key management, and to require joint authorisation of any crypto-asset transaction by at least two people. Client assets must be kept at addresses that store only that client's crypto assets. An independent public accountant must report on control objectives within six months of the adviser taking self-custody, and then each year. Clients must receive statements at least quarterly and must agree in writing that the crypto asset will be treated as a financial asset under applicable state law. Commissioner Hester M. Peirce quotes the proposing release for a further limit: the Advisers Act amendments would apply only to crypto assets that are funds or securities.

A regulated fund could use that route only through its adviser. The board would review, initially and quarterly, why no qualified custodian was available, and would decide each year that the asset would receive reasonable care. The fact sheet says "permitted custodian" for the adviser and "qualified custodian" for the board. A state trust company would need annual due inquiry that the relevant state banking authority had authorised crypto-asset custody, a review of the latest audited accounts, and segregation from proprietary assets.

The same release would redesignate the custody rule under Section 223. Uyeda says a discretionary-trading exception would limit executions to designated client accounts and bar transfers to accounts the adviser or related persons control. Public Company Accounting Oversight Board (PCAOB) registration would drop for the custody-rule accountant, and a standing letter of authorisation would no longer force a surprise examination. Business development companies could use the Investment Company Act custody rules.

"The 2023 Proposal would have required advisers to maintain crypto assets with a qualified custodian, while simultaneously casting doubt on whether any qualified custodian could demonstrate exclusive control over those assets."

— Mark T. Uyeda, Commissioner, Securities and Exchange Commission (SEC, October 1, 2026)

Uyeda dates that attempt as Release No. IA-6240 of February 15, 2023, at 88 FR 14672 on March 9, 2023. He says Staff Accounting Bulletin No. 121, of March 31, 2022, had already deterred safeguarding through on-balance-sheet treatment. The text is not yet law.

How the United States, Britain, the EU and Singapore divide custody

The comparison is who may hold the means of access, from which date, and what follows a loss. The US column is a proposal. The other three columns are dated duties.

Sources: SEC fact sheet; SEC press release 2024-111; FCA cryptoasset regime overview; Regulation (EU) 2023/1114; Payment Services Regulations 2019, regulations 18B and 18J. Last updated: October 2, 2026.

Crypto custody for a regulated firm is not one global rule. Under the SEC fact sheet of October 1, 2026, self-custody is a fallback that exists only while no permitted custodian is available, and that fallback is still a proposal with no compliance date. Regulation (EU) 2023/1114 already applies Article 75 from December 30, 2024: a crypto-asset service provider that custodies for clients must keep a register of positions, must segregate clients' crypto-assets on the ledger from its own, and is liable for a loss attributable to it, capped at the market value of the lost crypto-asset when the loss occurred. Singapore's regulation 18B, in force on October 4, 2024, requires a digital payment token licensee to place customer assets in a trust account, or return them, no later than the next business day, with a fine not exceeding S$250,000 under regulation 18J(1). The United Kingdom's full cryptoasset perimeter, including CASS 17 safeguarding in Policy Statement 26/11, opens on October 25, 2027.

Recital 83 leaves non-custodial wallet software outside Article 75, and the fact sheet states no market-value damages cap. Regulation 18H requires a daily trust-balance computation. MAS said on July 3, 2023 that a statutory trust should arrive before the end of that year, while the draft was still out for comment. The commenced text is October 4, 2024. Industry Spread has covered the October 2027 gateway and the saving provision in front of it.

"To that end, today's proposal would provide a clear regulatory framework for the custody of crypto assets, giving investment advisers and funds a compliant pathway where none existed before—and replacing the grey of uncertainty created by custody rules crafted for a bygone era."

— Paul S. Atkins, Chairman, Securities and Exchange Commission (SEC, October 1, 2026)

A pathway that opens only after a written finding that nobody else will hold the asset, and only for funds or securities, is a narrow door.

Why the Galois order still bounds the proposal

The proposal does not clear the enforcement record. Until a final rule is in force, the Custody Rule the Commission has actually charged is the rule that binds. The illustration is Galois Capital Management LLC, a Florida adviser to a private crypto fund.

Press release 2024-111, dated September 3, 2024, says that from July 2022 Galois failed to keep certain fund crypto assets with a qualified custodian. The assets sat in online accounts at trading platforms, including FTX Trading Ltd., that were not qualified custodians. Approximately half of the fund's assets under management from early to mid-November 2022 were lost in the FTX collapse. The order also found that some investors had to give at least five business days' notice, while others redeemed on shorter notice. Galois agreed to a $225,000 civil penalty for harmed fund investors, a cease-and-desist order and a censure, without admitting or denying the findings.

"By failing to comply with Custody Rule provisions, Galois Capital exposed investors to risks that fund assets, including crypto assets, could be lost, misused, or misappropriated."

— Corey Schuster, Co-Chief of the Asset Management Unit, SEC Division of Enforcement (SEC press release 2024-111)

The fact sheet still describes custody rules as protection against loss, theft, misuse and misappropriation. It does not treat a trading venue as a permitted custodian. The new doors are a state trust company after due inquiry, or the adviser under the two-person and accountant-report conditions. FTX Trading Ltd. was neither. The quarterly finding is the line examiners will test if it survives comment. Galois would not have been saved where a qualified custodian was available and unused. Release IA-7023 adds paths. It does not drop the qualified-custodian idea where a custodian will hold the asset. That record still binds advisers.

What this means for advisers, funds, custodians and counsel

For registered advisers, a final rule tracking the fact sheet would be a file, not a permission slip. The availability finding, the expertise note, two-person authorisation, the six-month accountant's report and the quarterly statements would all have to exist before anyone called the arrangement compliant. None of that is in force on October 2, 2026. For funds, the board's quarterly review and its annual reasonable-care determination sit on the adviser's file. Business development companies may use the Investment Company Act custody rules. That change is not a waiver of board review.

Banks that already meet the "bank" definition do not need the state-trust limb. A state trust company would, and only with authorisation, policies, audited accounts and an internal-control report that the adviser actually reviews. Trading venues do not become permitted custodians by listing the asset. FTX Trading Ltd. is the case. For counsel, Section 223 and the discretionary-trading and standing-letter exceptions will change questionnaires for advisers that never touch crypto. Neighbouring regimes are separate. See the Financial Industry Regulatory Authority (FINRA) outside-business rule for brokers who also advise and how a Commodity Futures Trading Commission (CFTC) exemption treats SEC advisers.

"The proposal uses the term in a way that does not reflect true self-custody by investors. Rather, it focuses on advisers acting as custodians for their clients' assets and deems that situation to be "self-custody." I would have preferred the term "shelf-custody" to distinguish adviser custody from situations in which investors custody their own assets without intermediation."

— Hester M. Peirce, Commissioner, Securities and Exchange Commission (SEC, October 1, 2026)

Her objection is the label. The fact sheet does not regulate a person holding keys with no adviser in between. It regulates the adviser who takes the keys because no permitted custodian will.

What is open after the Federal Register notice

The next date is Federal Register publication, not a compliance date. Press release 2026-100 and the fact sheet start comments 60 days after that publication. The October 1 papers do not date it, so no calendar deadline exists yet. File S7-2026-35 is the docket, and no final-rule timetable is stated. Atkins says further proposals are still to come. In the same statement he notes an Innovation Exemption for trading tokenised NMS stock, already covered as a cap on tokenised NMS symbols. That action does not amend these custody conditions. Peirce invites comment on the release.

Three disputes are already visible. The label may lead clients to think they hold the keys. The availability test leaves open how thin the custodian market must be, including in a later quarter when a custodian appears. The state-trust limb replaces a fact-specific "bank" analysis with an annual file. The fact sheet also says the Commission expects to revise the 2009 guidance on independent public-accountant engagements, which is where the new control report will be argued. Form ADV and Form N-CEN would add crypto-custody questions.

Same-day context, not a second story: Atkins and Uyeda issued a statement on Commissioner Peirce's departure, noting her service since 2018 and her leadership of the Crypto Task Force. It names no successor and does not change the custody file. Nothing in the October 1 record pauses Custody Rule cases. The forward view is a 60-day comment clock once the Federal Register publishes.

TL;DR

On October 1, 2026 the SEC proposed Releases IA-7023 and IC-36353 under the Advisers Act and the Investment Company Act. Self-custody would require a quarterly finding that no permitted custodian is available, and would cover only crypto assets that are funds or securities. Conditions include two-person authorisation, an accountant's report within six months, and quarterly statements. State trust companies could qualify after annual due inquiry. Comments run 60 days after Federal Register publication, with no compliance date set. The current rule still bites: on September 3, 2024 the Commission announced a $225,000 penalty against Galois Capital Management LLC for assets held at FTX Trading Ltd. Britain's CASS 17 date is October 25, 2027. EU Article 75 has applied since December 30, 2024. Singapore's trust-account rule took effect on October 4, 2024.

FAQ

What did the SEC propose on October 1, 2026?

The Commission proposed Releases IA-7023 and IC-36353, file S7-2026-35, on custody under the Advisers Act and the Investment Company Act. The fact sheet would allow self-custody where no permitted custodian is available, let state trust companies hold those assets on conditions, and place the Advisers Act custody rule under Section 223. Comments run for 60 days after Federal Register publication. It is not a final rule and states no compliance date.

When could an adviser self-custody client crypto assets?

Only if a final rule adopts the fact sheet, and only on its conditions. The adviser would have to find that no permitted custodian is available before taking the asset, and repeat that finding quarterly. The file would also need documented expertise, two-person authorisation, client-only addresses, an accountant's report within six months, and quarterly statements. For a fund, the board reviews the finding quarterly.

Does the proposal cover every crypto asset an adviser might buy?

No. The rulemaking page speaks of client crypto funds and securities, and of similar investments of regulated funds. Peirce quotes the release: the Advisers Act amendments would apply only to crypto assets that are funds or securities, and the Investment Company Act rules only to crypto assets that are securities or similar investments. She cites proposed rule 223-1(a). Anything that is neither a fund nor a security sits outside that scope.

How would state trust companies qualify?

Not by charter alone. Before engagement and each year after that, the adviser or fund needs due inquiry that the state banking authority had authorised crypto-asset custody and that written policies cover crypto assets and related cash. The fact sheet is the test. It would also review the latest audited accounts and internal-control report, and client assets would be segregated from the company's own.

How does this differ from EU and Singapore custody duties?

Article 75 of Regulation (EU) 2023/1114 has applied since December 30, 2024. A provider must keep a position register, segregate client crypto-assets, and is liable for an attributable loss up to market value when the loss occurs. Singapore's regulation 18B, in force on October 4, 2024, requires a trust account or a return of the assets by the next business day. Regulation 18J(1) caps the fine at S$250,000.

What is the comment deadline, and does the Galois case still matter?

There is no calendar deadline yet. The 60 days run from Federal Register publication, which the October 1 papers do not date. The docket is S7-2026-35. Galois still matters because the proposal does not suspend the Custody Rule. On September 3, 2024 the Commission announced a $225,000 penalty for failing, from July 2022, to use a qualified custodian, including at FTX Trading Ltd. That order remains the baseline.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.