The SEC wants new rules for how advisers and funds hold crypto. What it means for you, and how to comment by December 7

The SEC has proposed new rules for a question most crypto owners never think about: when a professional money manager or a fund holds crypto for you, who is allowed to keep it safe, and how? The proposal isn't final, and it doesn't touch the coins in your own wallet. The public can weigh in until December 7, 2026.

First, what "custody" means

Custody just means who actually holds an asset and controls it. With stocks, a bank or broker usually holds your shares for you. With crypto, control comes from the private keys, the secret codes that can move the coins. Whoever holds the keys has custody.

SEC custody rules have long required registered investment advisers to keep client assets, and regulated funds to keep their own assets, with an approved custodian such as a bank or broker-dealer. Crypto doesn't fit neatly into those old rules. In its fact sheet, the SEC says a permitted custodian may be hard to come by for some crypto assets, and that custodians often can't support newer ones.

What the SEC proposed

On October 1, 2026, the SEC proposed changes to custody rules under two 1940 laws that govern advisers and funds. It appeared in the Federal Register on October 6 as document 2026-20466, and it runs to 234 pages there. The main pieces, according to the SEC's fact sheet:

• State trust companies as crypto custodians. Advisers and funds could keep client crypto with a state-chartered trust company if they first check that a state banking regulator has authorized it to hold crypto, review its audited financial statements and internal control report, and confirm client crypto is kept separate from the company's own assets. They'd repeat those checks every year. By the SEC's estimate, roughly 19 state trust companies focus on crypto custody today.
• Adviser "self-custody," as a last resort. An adviser could hold a client's crypto itself only after deciding in writing that no qualified custodian will hold that particular asset, and it would have to recheck that every quarter. It would also need documented expertise in safeguarding each asset, controls requiring at least two people to approve any transaction, separate blockchain addresses for each client, yearly cybersecurity reviews, an outside accountant's control report, and statements to clients at least every quarter.
• Funds under board oversight. A regulated fund could hold crypto through its adviser's self-custody only if the fund's board reviews the adviser's reports and signs off on the arrangement.
• Housekeeping for the wider rule. The proposal also updates long-standing custody rules for all advisers, including audit requirements and when trading authority counts as custody.

Note that the SEC uses "self-custody" differently from how crypto users do. Here it means an investment firm holding its clients' keys, not you holding your own. CoinDesk, which reported the proposal the day it came out, quoted an SEC official saying adviser self-custody would likely be unusual, for example a newly launched token custodians don't yet support.

SEC Chairman Paul Atkins said the proposal would give advisers and funds "a compliant pathway where none existed before."

Who it affects

• Directly: SEC-registered investment advisers and regulated funds, meaning registered investment companies such as mutual funds and many ETFs, plus business development companies.
• Indirectly, people who pay an adviser to manage crypto for them. If the rules are adopted, they would shape where your adviser can keep that crypto and what protections and statements you get.
• Spot bitcoin and ether ETF holders, mostly not. The SEC's investor bulletin says these products are commodity trusts and aren't registered under the Investment Company Act, so the fund rules in this proposal aren't written for them. Our crypto ETF guide explains that difference.

Law firm A&O Shearman adds a wrinkle: for adviser clients that aren't funds, the custody rule only reaches crypto that counts as "funds" or "securities," so the firm says the SEC sees digital commodities such as bitcoin as generally outside those requirements. The SEC's own text notes that such coins can still be covered when they're sold as part of an investment contract, and A&O Shearman says that for regulated funds the SEC reads the rules to cover bitcoin, ether and similar coins.

What it doesn't change

• Your own wallet. If you keep crypto in a wallet where you hold the keys, this proposal doesn't apply to you.
• Your own exchange account. The proposal doesn't set up a general custody framework for crypto trading platforms. Law firm Sullivan & Worcester points this out as a notable gap. The lesson from our Datavault and Biconomy story still stands: a balance on an exchange is the exchange's promise to pay.
• Anything today. It's a proposal. The SEC has to review comments and vote again before a final rule, which may look different.

Custody keeps coming up in this month's news. BNY now holds XRP and RLUSD for institutions (our post), and DTCC's new service turns some securities into tokens while DTC keeps the official records (our post).

How to comment by December 7

1. Go to the SEC's page for file number S7-2026-35 (opens in a new tab) and choose "Submit a Comment," or comment through the Federal Register page (opens in a new tab).
2. Or email rule-comments@sec.gov with "File Number S7-2026-35" in the subject line.
3. Send it by December 7, 2026. The SEC asks people to use only one method.

The takeaway

This proposal is about professionals holding crypto for clients: it would let state trust companies act as custodians and allow advisers to hold some crypto themselves under tight conditions. If you hold your own coins, nothing changes. If you use an adviser for crypto, it's worth watching, and anyone can comment until December 7. This is education, not legal or financial advice, and it reflects the SEC's proposal as of October 28, 2026.

Published October 28, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio