SEC Introduces Draft Custody Regulations for Crypto Assets Targeting Investment Advisors and Funds

The U.S. Securities and Exchange Commission (SEC) has unveiled a comprehensive draft rule that seeks to clarify how investment advisers and pooled investment vehicles must handle the custody of crypto‑related assets. This proposal represents a significant step in the regulator’s ongoing effort to bring greater transparency, investor protection, and operational consistency to the rapidly evolving digital‑asset marketplace.

It also arrives as a symbolic farewell to Commissioner Hester Peirce, the inaugural chair of the SEC’s Crypto Task Force, who is slated to leave the commission at the end of the week. ### Background and Rationale Since the rise of Bitcoin and the subsequent explosion of alternative cryptocurrencies, the SEC has grappled with how existing securities laws apply to these novel instruments. While the agency has issued guidance on topics such as registration, fraud, and market manipulation, the question of who may safely hold crypto assets on behalf of clients has remained largely unsettled. Custody—defined as the holding or safeguarding of client assets—carries unique risks in the digital realm, including cyber‑theft, loss of private keys, and the potential for unauthorized transfers.

In response, the SEC’s new rulemaking seeks to align crypto‑asset custody practices with the agency’s longstanding standards for traditional securities. By doing so, the commission hopes to reduce the regulatory arbitrage that can arise when firms treat digital assets as a separate, less‑regulated class. The draft also reflects lessons learned from high‑profile security breaches at exchanges and custodians, which have highlighted the need for robust internal controls, independent verification, and clear reporting obligations.

### Key Provisions of the Proposed Rule 1. **Definition of Custody for Digital Assets**: The rule expands the traditional definition of custody to explicitly include control over private keys, access credentials, and any technology that enables the transfer of crypto tokens. This ensures that entities that merely facilitate transactions but do not retain control over the underlying keys are not automatically classified as custodians. 2.

**Eligibility and Registration Requirements**: Investment advisers and registered investment companies that wish to act as custodians of crypto assets must either be registered as a broker‑dealer or obtain a specific exemption that demonstrates they meet heightened security standards. The SEC emphasizes that only firms with proven operational resilience should be permitted to hold client crypto holdings.

3. **Safeguarding Standards**: The proposal outlines a suite of safeguards, including multi‑factor authentication, hardware security modules (HSMs), cold‑storage solutions, and regular penetration testing.

Custodians must also maintain a detailed inventory of all digital assets under their control, with real‑time reconciliation to client accounts. 4. **Independent Audits and Third‑Party Verification**: To provide investors with confidence, custodians are required to undergo annual audits conducted by independent, qualified accountants who are familiar with blockchain technology.

The audits must verify both the existence of the assets and the adequacy of the security controls in place. 5.

**Record‑Keeping and Reporting**: Custodians must retain comprehensive records of all transactions, key management activities, and any incidents that could affect the integrity of client holdings. They must also file periodic reports with the SEC, disclosing the total amount of crypto assets under custody, the types of assets held, and any material changes to their security posture. 6.

**Client Notification and Disclosure**: Advisors must provide clear, concise disclosures to clients about the risks associated with digital‑asset custody, including the potential for loss due to hacking, technological failures, or regulatory changes. Clients should also be informed about the specific safeguards the custodian employs. 7.

**Transition and Compliance Timeline**: The SEC proposes a phased implementation schedule, giving existing custodians a reasonable period—typically 12 to 18 months—to bring their practices into compliance. The agency also invites public comment on the proposed timelines, recognizing that some firms may need additional time to upgrade their infrastructure. ### Implications for the Industry The draft rule is likely to have a ripple effect across the crypto ecosystem.

For traditional financial firms that have been cautiously entering the digital‑asset space, the clarified custody framework may reduce uncertainty and encourage broader participation. Conversely, pure‑play crypto exchanges and custodians that have operated with minimal oversight may need to invest heavily in compliance infrastructure, potentially consolidating the market around a few well‑capitalized players.

Moreover, the rule could influence how other regulators—both in the United States and abroad—approach digital‑asset custody. By setting a high bar for security and transparency, the SEC may inadvertently shape global best practices, prompting foreign regulators to adopt similar standards to facilitate cross‑border investment. ### Commissioner Hester Peirce’s Role and Legacy Commissioner Hester Peirce has been a vocal advocate for clearer guidance on crypto assets since the SEC’s Crypto Task Force was formed in 2022.

Known for her pragmatic approach, she has frequently emphasized the need for balanced regulation that protects investors without stifling innovation. Her tenure has seen the commission issue several interpretive releases, host public roundtables, and launch enforcement actions that targeted fraudulent crypto schemes.

The proposed custody rule can be seen as a capstone to her work on the task force. While Peirce is departing the commission, the rule reflects many of her core principles: a focus on investor safety, a demand for robust internal controls, and a willingness to integrate digital‑asset considerations into the existing securities framework.

Her departure may raise questions about the future direction of the SEC’s crypto agenda, but the momentum generated by this rulemaking suggests that the agency will continue to pursue a structured, rule‑based approach. ### Public Comment and Next Steps The SEC has opened a 60‑day comment period, inviting stakeholders—including custodians, investment advisers, industry groups, and individual investors—to submit feedback on the proposed provisions.

Commenters can argue for adjustments to the definition of custody, propose alternative compliance timelines, or suggest additional safeguards that may be more appropriate for emerging technologies such as decentralized finance (DeFi) protocols. After reviewing the comments, the SEC will likely issue a final rule, which could incorporate revisions based on industry input. Once finalized, the rule will become enforceable, and firms that fail to meet the new standards could face civil penalties, disgorgement orders, or other enforcement actions. ### Conclusion The SEC’s draft custody rule marks a pivotal moment in the regulatory maturation of the crypto market.

By extending established securities‑custody principles to digital assets, the commission aims to protect investors from the unique risks inherent in blockchain‑based holdings while providing a clear compliance pathway for advisers and funds. As the industry adapts to these requirements, the rule could foster greater confidence among traditional investors, encourage institutional participation, and set a benchmark for global regulators.

Commissioner Hester Peirce’s departure underscores the transitional nature of this effort, but the proposal itself signals a lasting commitment by the SEC to bring order, transparency, and security to the world of crypto custody.