SEC proposes letting RIAs self-custody crypto when no permitted custodian is available

The SEC has proposed letting registered investment advisers hold clients' crypto assets themselves — as a fallback, on conditions, and only after the adviser determines that no permitted custodian is available. That finding would not be permanent; advisers would have to check every quarter that it still holds.

The baseline it would carve into is the spine of the advisory model. Advisers have long been required to keep client assets with a regulated qualified custodian, a category that runs from the largest financial institutions, Schwab and Fidelity among them, down to banks. The adviser advises; the custodian holds, and that division is what the proposal would let an adviser cross, in narrow circumstances.

The proposal lands in a gap Congress left after lawmakers failed last month to pass digital-asset legislation, and it reverses the agency's own direction. A 2023 SEC proposal would likely have brought crypto assets under the custody rule's qualified-custodian requirement. The new text instead mirrors the lighter-touch approach touted by Chair Paul Atkins and Commissioner Hester Peirce, who is retiring and said she hoped a "calm end" to regulatory uncertainty was imminent.

The conditions are where the work sits. Under the fact sheet the agency published with the proposal, an adviser that self-custodies must have "expertise" in safeguarding each crypto asset, review cybersecurity systems no less frequently than annually, manage private keys, require at least two people to authorize any transaction, and send account statements at least quarterly to clients whose crypto it holds.

The expertise requirement is measured per asset, so a dozen tokens means a dozen judgments about key handling and every asset a client asks to add reopens the file. The other conditions come with two clocks — the security review annual, the availability check quarterly — and both belong to a firm with someone whose job is to keep them.

As a list, those are ordinary controls; as an operating model, they describe a small operations and compliance department, and departments are what small advisers do not have. The firms with the headcount to satisfy the conditions will be the firms with the least trouble finding a custodian; the four-person shop with a part-time compliance consultant — the one the availability test appears to imagine — is also the firm for whom documenting expertise in an unfamiliar token is hardest. If the conditions bite that way, self-custody becomes a capability of scale, and the small RIA is left running the search the fallback was meant to end.

The reactions split accordingly. An advisor advocacy group praised the "positive framework" for crypto custody; an investor protection group said the proposal "subjects investors to the very high risk of loss the SEC exists to prevent." Both are describing the same shift — of a duty the custody rule assigns to an institution onto the adviser's own controls — and disagreeing about whether the adviser is a better place for it.

The agency's stated reason for wanting the fallback is coverage. Typical custodians, it argued, may be unwilling or unable to hold certain crypto assets, and even custodians that offer the service may not be able to support "the large and continuously growing number of crypto assets in the market," novel assets included. The two custodians advisers know best already do part of this: Fidelity provides crypto custody and trading through Fidelity Digital Assets, and Schwab introduced direct Bitcoin and Ethereum trading earlier this year with Schwab acting as client custodian. Two assets from the largest custodian, set against an asset class the agency calls continuously growing, suggest the proposal is less about bitcoin than about everything that never makes a custodian's approved list.

Custody is two products sold as one: safekeeping, and the client record that rides along with it. The fight over who owns the client record is the one platforms have been having all year, and the custody handoff is where that fight gets settled. Self-custodied crypto would push a slice of the record onto the adviser's own systems, where there is no service desk to call and no custodian's books to reconcile against.

It also runs against the direction the custodian business has been moving: the floor. As this publication has argued, Fidelity's $100 million minimum is a hard price on a small RIA's client record, and below it the custodian would rather not do the work. The crypto proposal takes that same preference and applies it to assets instead of advisers, with one difference: the agency would write the preference into the rule and attach a quarterly obligation to test whether the answer has changed.

The proposal's terms leave unsettled the definition doing the most work: as described, the conditions cover expertise, annual review, two-person authorization and quarterly statements, but the coverage does not say what evidence an adviser must retain to show that a custodian was unavailable, what counts as permitted, or how the quarterly search is documented. Until the agency fills that in, the fallback is an option an adviser takes by asserting something about a custodian market it cannot see. Whether the final rule defines "permitted custodian" tightly enough to test — or leaves the answer to the adviser's judgment, filed four times a year — is the thing to watch.