The SEC Proposed a Path for Crypto Custody

The Securities and Exchange Commission’s account posted it as a same-day alert: the Commission had proposed new rules and amendments for the custody of crypto assets by registered investment advisers and by regulated funds, meaning registered investment companies and business development companies. A follow-up post the same evening said the proposal would modernize custody rules and expand investor choice by removing barriers that inhibit an adviser’s ability to give crypto-related advice. Those posts are the announcement. The specification is Release 2026-100, the chairman’s statement, the fact sheet, and the proposing release.

This is not legal advice, and it is not a note on the price of any token. It is the operator reading of a proposal that tells a fiduciary, for the first time in the Commission’s own words, that a compliant custody path is supposed to exist.

What the release actually proposes

The press release says the rules and amendments sit under the Investment Advisers Act of 1940 and the Investment Company Act of 1940. They are meant to match current industry practice and to update requirements that include financial-statement audits for registered investment advisers and broker-dealer custodial services for regulated funds. Two permissions are named in the release itself. Crypto assets could be held in self-custody under certain circumstances. State trust companies could be used as custodians for client assets and for regulated-fund crypto assets.

The release does not, in the pages this briefing uses, spell out those circumstances in a sentence a compliance officer can paste into a manual. That work is in the proposing release and the fact sheet. Read those before anyone tells a client that self-custody is now allowed. “Under certain circumstances” is the Commission’s phrase. It is not a yes.

Chairman Paul S. Atkins, in the statement dated October 1, describes the gap the proposal is aimed at. Custody rules were written to protect client and fund assets from loss, theft, misuse, and misappropriation, and they contemplate traditional assets. A key protection is the required use of permitted custodians. Atkins says custodial capability for a newly developed crypto asset can lag the asset’s deployment by many months. The proposal is the Commission’s attempt to close that lag, plus what he calls long-needed updates to adviser and fund custody rules that have not been amended for decades.

A permitted custodian that does not exist yet is not a control. It is a waiting period with a client’s assets in it.

What he placed this next to

Atkins’s statement puts the custody proposal in a sequence, and the sequence is his account of the Commission’s year, not a finding by this desk. He cites a December 2025 staff no-action letter to the Depository Trust Company on a voluntary securities-tokenization pilot. A January 2026 staff statement on tokenized securities. An interpretation of which crypto assets are securities and when they may cease to be subject to investment contracts. An April staff statement on broker-dealer registration for certain user interfaces used to prepare transactions in tokenized securities. An August proposal, Regulation Crypto Assets, for a tailored offering regime for certain investment contracts involving crypto assets. And an Innovation Exemption he describes as a cabined pathway for trading tokenized NMS stock.

He also says the market has grown from a niche into a multi-trillion-dollar asset class. The statement does not give a precise total. Do not put a round number in a board pack off that adjective. The useful sentence is the one about the rules: he says advisers and funds have been guessing how to effect lawful custody of an asset their clients want, and that the proposal is meant to replace that uncertainty.

The clock is the Federal Register

The press release says the public comment period stays open for 60 days after the proposing release is published in the Federal Register. October 1 is the day of the posts and the press release. It is not, on the page, day one of a 60-day count. Anyone drafting a comment should wait for the Federal Register date, then count. A comment filed against the wrong clock is a comment that misses the record.

Who should care before that date arrives. A registered adviser whose clients already hold crypto, or want to. A fund that would offer a strategy and cannot name a custodian the current rule recognizes. A state trust company that wants to be that custodian. A software vendor selling “custody” or “wallet” infrastructure into any of those three. The vendor’s demo is not the rule. The question for the contract is which of the proposal’s permissions the product depends on, and what happens to the service if the final rule narrows them.

What to write down this week

Are we an adviser, a regulated fund, a custodian, or a vendor selling to one of those? The proposal does not land on all four the same way.
Where do client or fund crypto assets sit today, and which of those places would the proposal recognize?
Does anyone inside the firm plan to rely on self-custody? If yes, the “certain circumstances” have to be copied from the proposing release, not from a summary.
Would a state trust company be the custodian? Name it. “A trust company” is not a control.
Who owns the comment, and what is the Federal Register date once it exists?

None of this changes the cybersecurity clock on Form 8-K. A custody proposal and an incident disclosure are different rules from the same agency. The incident note remains The SEC clock starts when you decide it matters.

Sources

Emilio Santos writes and edits every piece on Circuit & Capital.

circuit50capital@circuits.fit