On October 1, 2026, the SEC proposed a broad overhaul of the Advisers Act custody framework (Release Nos. IA-7023; IC-36353) intended to modernize rules for cryptoassets, market changes, and industry feedback.

The current Custody Rule would be redesignated Rule 223-1, and advisers would be able to self-custody certain cryptoassets when a permitted custodian is not available, subject to prescribed conditions.

State-chartered limited purpose trust companies would also be permitted to serve as custodians for cryptoassets. Latham & Watkins reports the package also includes an audit exception for newly formed investment vehicles and discretionary trading authority exceptions.

This is the surprising part for crypto readers: the Commission — historically hostile to advisers holding client keys themselves — would let an adviser hold client cryptoassets through possession of the private keys, without any qualified custodian at all.

According to Latham & Watkins, self-custody would only be available where a permitted custodian is unavailable and the adviser first determines this in writing, initially and quarterly.

JD Supra similarly characterizes the framework as one that would permit self-custody and state trust company custodians, a significant shift given questions about the pool of custodians able or willing to serve the advisory space.

The proposed self-custody conditions are demanding.

Per Latham & Watkins, advisers must document safeguarding expertise, build systems protecting against loss, theft, misuse and misappropriation, and review them annually; safeguarding systems must address private key management, require joint authorization of transactions by at least two people, and keep each client's assets in addresses holding only that client's crypto.

Advisers would need cybersecurity controls reviewed no less than annually, internal control reports within six months of first maintaining custody and annually thereafter, quarterly client account statements identifying the cryptoasset address and network, a written agreement treating the assets as financial assets under UCC Article 8, and recordkeeping compliance.

The proposal also relaxes surrounding mechanics: the PCAOB registration requirement for accountants would be eliminated, delivery deadlines for funds of funds extended to 180 and 260 days, and inadvertent custody and SLOA exceptions codified.

Form ADV would be amended to collect additional cryptoasset custody information. Latham & Watkins notes the proposal does not cover amendments governing registered investment companies under the 1940 Act, which are proposed separately.

Because the rules are only proposed, advisers cannot rely on them yet; the comment process will determine whether self-custody — with its inherent conflicts and security risks — becomes a lawful, operational reality for the advisory industry.