Considerations For Proposed Crypto Custody Rules
On October 1, 2026, the U.S. Securities and Exchange Commission issued a statement proposing a rule change with respect to custody of crypto assets within the existing Investment Advisor and Investment Company Acts, respectively.
With the statement, SEC Chairman Atkins argues that existing custody rules, generally designed in the 1930s and 1940s, were intended for traditional assets and not new asset classes, such as digital assets. As such, his proposal would provide investment advisors and their managed funds a path to custody crypto holdings beyond the existing cohort of ever increasing banks and other qualified custodians offering related services, and update other parts of current advisor and custody regulation. These proposed amendments follow a list of other recent initiatives to update U.S. financial regulation, which include the August 2026 proposal for a new “Regulation Crypto Assets,” and the September 2026 issuance of an “Innovation Exemption” to the Securities Exchange Act.
As a proponent of advancing clear crypto regulation (as has been an ongoing matter for the industry and certain political proponents for some time), and as an advocate of innovation (one of the reasons why I was drawn to working with digital assets and within the broader blockchain space), the matter of amending current custody regulation is a subject of interest for me, as being a crypto due diligence professional often puts me in the center of conversations between allocators and investment managers regarding the everpresent qualified custody versus self-custody debate, and related operational risks.
However, in reviewing the proposed rule changes, there are elements which, although, may be well intentioned, are somewhat impractical, and at times potentially lay the groundwork for new operational risks and expense to a still emerging industry.
Rather than going over every detail of a 761 page document, I would like to highlight two particular proposed rule changes that flagged “caution” based upon my experience, backed with relevant information from Crypto Insights Group’s proprietary data.
Enhancing Self-Custody
Within the proposal, advisor self-custody would be permitted only where third-party custody is unavailable. Here, fund managers would need to document if a custodian is unavailable for a particular digital asset before taking self-custody, and transfer assets to a qualified custodian if one becomes available. In addition, advisors would also need to establish related enhanced operational controls and compliance arrangements.
Taking a step back and evaluating this aspect of the proposal, this potential requirement would create additional operational burden to nearly all digital asset advisors, and specifically the vast majority of crypto hedge fund managers. To be specific, such a rule would enhance the existing element of counterparty oversight and risk management, an ongoing area of risk-related importance for crypto investment strategies (least we forget Binance being hacked less than a week ago, resulting in the largest crypto theft in history, with over $6 billion of assets being stolen - a likely post for another time).
As has been written about in past CIG operational due diligence pieces, most managers find it challenging to maintain the standards and expectations of institutional investors with respect to consistent counterparty risk management, let alone those managers that are registered investment advisors (RIAs) with the SEC, and have an existing regulatory requirement to maintain such policies.
In short, while attempting to provide a practical way for digital asset advisors to perform their services and not be in violation of existing regulation, such revisions would create the knock-on effect of putting more pressure on managers to not only maintain current counterparty risk standards, but force managers to constantly search for, and sign agreements with, new custodians and exchanges that can custody certain digital assets, which create an ongoing and costly (i.e., legal review) process. Not an ideal proposition where many crypto managers remain emerging operators, keeping to tight expense budgets.
Taking the above further, when analyzing CIG’s data across hundreds of crypto managers, and of those utilizing our proprietary FirmIQ™ tool, this could potentially impact 24% of the CIG manager universe, who are self-identified as being registered with the SEC, the CFTC/NFA or both. And of those registered with a U.S. regulator, all three groupings currently maintain managers which self-custody assets.
See the following chart for further details.
Independent Control Verification
Another aspect of the proposed revisions which can also present adverse impacts to crypto advisors is where managers would be required to obtain an internal control report prepared by an independent public accountant within six months of commencing self-custody, and annually thereafter. For those not familiar, internal controls reports are those such as Systems and Organization Controls (SOC) reports, or International Standard of Assurance Engagement (ISAE) reports.
Here to, with the intention of regulating advisors to maintain proper self-custody controls, there exists a potentially new obligation of increased operational process and expense, by requiring self-custody be accompanied with a particular type of audit most crypto managers have not undertaken, and in fact most managers of other asset classes have not undertaken.
Although there is built-in relief to this described rule revision via exceptions for audited pooled investment vehicles and regulated funds, this does not, however, resolve examples where DeFi assets are being traded by an advisor on behalf of their clients. For example, the amendments do not propose specific rules addressing arrangements such as staking and lending through smart contracts. Until this matter is addressed, such a gap in the proposed self-custody regulation may find some advisors in the unfortunate instance of being required to audit both their managed funds and their operational controls, in instances where they are servicing funds, separately managed accounts and/or sub-advising client accounts.
Keeping Up With Crypto
It should be acknowledged that a major factor of the SEC taking the step of proposing such changes to existing regulations is due to the U.S. Congress not passing legislation to keep up with the changes digital assets are having on modern financial markets. The failure of passing the Digital Asset Market Clarity Act (the CLARITY Act) over recent months is a related example.
However, with the inability of codifying laws to keep up with new industries, regulators have determined to step in to advance the needs of a changing financial landscape. As such, and as I’ve interpreted certain elements of the SEC’s current self-custody proposals, there appears to be a bit of a band-aid approach to updating rules, which to Chairman Atkins’ ultimate point are overdue for some changes. But in an effort to bridge what is old and what is new, therein lies the risk of negatively impacting the very cohort they are trying to assist.
For this reason, the expertise, data and research of Crypto Insights Group provides valuable analysis for crypto managers, institutional investors and the digital assets industry to consider, be informed of, and respond to, the investing environment of a still emerging, but maturing, asset class.
Reach out to learn more about how CIG can support your crypto allocation goals.
--
Source 1: https://www.sec.gov/newsroom/speeches-statements/atkins-crypto-custody-100126-statement-proposal-address-custody-crypto-assets-under-investment-advisers-act-investment-company
Source 2: https://www.sec.gov/files/rules/proposed/2026/ia-7023.pdf
Source 3: https://www.bloomberg.com/news/articles/2026-10-29/binance-founder-says-possible-hack-of-exchange-bitcoin-falls
Source 4: https://www.cryptoinsightsgroup.com/insights/lessons-from-the-crypto-counterparty-front-lines
