For the first time, the SEC has proposed a clear, compliant path for investment advisers and funds to hold crypto for their clients, including holding it themselves. That path runs through an independent accountant. An adviser that self-custodies crypto would need an annual internal control report, an on-chain reconciliation and an annual surprise examination. Advisers and funds that use a state trust company instead would need to review that custodian's controls report and audited financial statements every year.
In this article, we explain what the proposal says, who it covers and what the accountant must deliver. We then look at what the SEC left out, and where we think the final rule should go further
The Proposal at a Glance
The proposal is set out in Release No. IA-7023. Here are the key facts:
| Item | Detail |
|---|---|
| Proposed | October 1, 2026 |
| Published in Federal Register | October 6, 2026 |
| Comments Due | December 7, 2026 |
| Adviser Rule | Rule 206(4)-2 is replaced by a rewritten Rule 223-1 |
| New Fund Rules | Rule 17f-8 (custody with state trust companies) and Rule 17f-9 (fund crypto held by the fund's adviser) |
The rules will not take effect until the SEC adopts a final version, which it has no deadline to do, and the effective date will be set in that final release. Even so, firms should not count on a long runway. Under the proposed compliance date, advisers and funds could start relying on the new self-custody and state trust company rules as soon as they take effect. The only condition is that they can already meet the rules' requirements. In other words, the firms that are ready on day one will be the ones that start preparing now.
Who this Rule Applies To
The proposal directly affects three groups:
SEC-registered investment advisers, meaning advisers registered or required to be registered under Section 203 of the Advisers Act, that hold client crypto they advise on.
Registered investment companies and business development companies (BDCs) that hold crypto, along with their boards of directors.
State trust companies that want to serve as crypto custodians for those advisers and funds.
Beyond these three groups, the proposal will also matter to crypto custodians, fund administrators, auditors and the technology providers behind wallet infrastructure.
The partial-key trap. Under the proposed definition, an adviser has self-custody if it holds any portion of the private keys to a client's crypto. The SEC makes clear that this includes even a non-controlling portion, such as a key share that cannot move assets on its own. As a result, advisers that hold one key share in a multi-party computation (MPC) or co-signing setup could be treated as self-custodians and would have to meet every requirement below. The only exception is when an adviser or its affiliate holds keys solely in its capacity as a qualified custodian.
What the Self Custody Requirements Say
Under the proposal, self-custody is a last resort rather than a way to save money. Proposed Rule 223-1(b)(7) sets out seven conditions:
No qualified custodian is available. Before taking self-custody of an asset, and at least quarterly after that, the adviser must document a reasonable basis for believing that no qualified custodian will hold it. Cost is not a valid reason. If a custodian later becomes available, the adviser must move the asset there as soon as reasonably practicable.
Safeguarding expertise and systems. The adviser must document its expertise and maintain systems that protect keys against loss and unauthorized access. Access to keys must be limited to people the adviser designates. In addition, every transfer must be approved by at least two of those people, and one of them must be a member of management.
One address per client. Each client's crypto must be held in addresses that store only that client's assets, so pooled wallets are not allowed.
Cybersecurity. The adviser must complete a written cybersecurity risk assessment at least annually. It must also have measures to detect, respond to and recover from incidents.
Annual internal review. At least once a year, the adviser must review its safeguarding systems and cybersecurity controls and document that review in writing.
Quarterly client statements. Each statement must show the client's wallet address and network, the balance and every transaction. It must also urge the client to compare the statement against the blockchain.
Accountant engagements. The adviser needs an internal control report and an annual surprise examination, which we cover in the next section.
Regulated funds face an extra layer of oversight. Under proposed Rule 17f-9, the fund's board, including a majority of its independent directors, must review the adviser's finding that no qualified custodian is available. The board must also determine, before self-custody starts and annually after, that the assets will receive reasonable care. In addition, the board must designate by resolution who can access the keys.
Finally, advisers should disclose to clients that self-custodied crypto lacks the backstops available at banks and broker-dealers, such as FDIC insurance and SIPC protection. They should also explain what recourse clients would have if assets are lost or stolen.
What the Auditor has to Deliver
A self-custodying adviser needs two separate engagements from an independent public accountant each year. The self-custody rule exempts these assets from the standard qualified custodian, client notice and account statement requirements. However, it does not exempt them from the annual surprise examination.
| Engagement | Accepted standards | Timing | What it covers |
|---|---|---|---|
| Internal control report | SOC 1 Type 2 (AT-C 320), AT-C 315 compliance attestation, or AT-C 205 examination | Within six months of starting self-custody, then at least annually | An opinion on whether controls were suitably designed, implemented and operating effectively throughout the period, plus verification that client crypto reconciles to the blockchain |
| Surprise examination | AT-C 315 compliance examination | At least once each calendar year, on a date the accountant chooses without notice | Verification of client assets, with Form ADV-E filed within 120 days and any material discrepancy reported to the SEC within one business day |
Four details are worth highlighting:
A SOC 1 Type 1 report won't work. A Type 1 report only describes controls as of a single date and does not test whether they operate over time. The SEC says so directly.
The on-chain reconciliation is an add-on. The SEC notes that a standard SOC 1 Type 2 report "may not necessarily include" procedures to verify crypto balances against the blockchain. For that reason, the accountant must perform that verification and report it as part of the internal control report.
Pooled funds have an alternative. Advisers to pooled investment vehicles can still rely on an annual financial statement audit in place of the surprise examination.
PCAOB registration would no longer be required. The proposal would remove the requirement that accountants performing custody rule audits, surprise examinations and internal control reports be registered with and inspected by the PCAOB. More firms would therefore be eligible to do this work, which makes crypto-specific experience the real differentiator.
If You Use a Custodian, Does it Need a SOC Report?
Not every adviser will self-custody. For those that use a custodian, the answer depends on the type of custodian:
| Custodian type | Controls report required? | What the adviser or fund must do |
|---|---|---|
| State trust company | Yes, before engaging and annually | Review the trust company's most recent internal control report (from the current or prior calendar year) and its audited U.S. GAAP financial statements. Also document why it is reasonable to believe the trust company is authorized by its state banking authority and has written key management and cybersecurity policies (Rule 223-1; Rule 17f-8) |
| Adviser or affiliate acting as custodian | Yes, annually | Obtain an internal control report in which the accountant also verifies that the assets reconcile to an unaffiliated custodian (Rule 223-1(b)(6)) |
| Bank or broker-dealer | No | The proposal does not require a SOC report, consistent with the current rule |
For state trust companies, the report must include an opinion that controls operated effectively "throughout the period," which is Type 2 language. A Type 1 report would therefore not be enough. The release cites a commenter noting that custodians serving institutional clients often already issue SOC 1 Type 2 reports, so some trust companies will be ready. Others will not.
The same passage flags a second issue: a trust company's current accountant may not meet the proposal's independence requirement, which could force it to change firms. For that reason, state trust companies that plan to serve advisers and funds should confirm their accountant's independence now, rather than waiting until an adviser asks for the report.
What the Controls Should Cover
The proposed rule sets out the outcomes but leaves the design of the controls to each adviser. Based on the proposed requirements, we believe a self-custody control environment should address at least these ten objectives:
The availability of a qualified custodian is assessed and documented at least quarterly.
Key generation, storage, backup and recovery are protected against loss and theft.
Access to keys is limited to designated, authorized people.
Every transfer requires approval from at least two designated people.
Each client's assets are held only in that client's own addresses.
Custodial records reconcile to the blockchain.
Cybersecurity risks are assessed at least annually, and incidents are detected, contained and recovered from.
Client statements are complete and accurate, and they show each wallet address and network.
New assets received through airdrops or forks are identified and brought into compliance.
Changes to wallet infrastructure, software and signing policies are authorized and tested.
It is worth noting that a SOC 1 report is designed around controls relevant to financial reporting. Several of these objectives, especially key security and cybersecurity, fit more naturally in a SOC 2 report. In fact, the SEC asks in Question 100 whether it should require a SOC 2-type report as well. Firms should expect their clients and fund boards to ask the same question.
What the SEC Did Not Require
The proposal is detailed, but several important protections for crypto are missing:
No proof of reserves. The phrase does not appear anywhere in the 761-page release. Instead, the only on-chain check is a single reconciliation inside the annual internal control report.
No proof of key control. A balance on the blockchain shows that assets exist. However, it does not show that the adviser actually controls the keys, or that no one else can move the assets.
No on-chain check for state trust companies. A self-custodying adviser's report must verify balances against the blockchain, but a state trust company's report does not. In addition, unlike advisers, trust companies only have to keep client crypto separate from their own assets, which means client assets can be pooled together. The SEC asks in Question 159 whether it should require each client's assets to be held separately.
No buffer reserve, capital or insurance requirement for self-custodying advisers. Insurance appears only as a disclosure item and as an optional factor for fund boards to consider.
Safeguards considered and rejected for state trust companies. The SEC considered requiring insurance, capital requirements or posted collateral, but it did not propose them, citing higher costs and fewer available custodians. It does ask in Question 166 whether minimum capital reserves should be required.
Questions, not rules, for DeFi. The SEC asks about crypto deposited into smart contracts, including whether those deposits should be supported by a reserve of liquid crypto assets, but it proposes no specific rules.
Our View
The SEC got the core design right. Requiring one address per client makes self-custodied assets easy to verify on-chain, and requiring an accountant to reconcile those balances is a real step forward.
The problem is frequency and depth. Crypto can leave a wallet in seconds, and the transfer generally cannot be reversed. A once-a-year check, with no proof that the adviser actually controls the keys, leaves clients exposed for the rest of the year. For these reasons, we believe the final rule should:
Permit, and over time expect, periodic or continuous proof of reserves, including proof of key control.
Require a buffer or loss-absorbing reserve for adviser self-custody, verified on-chain.
Pair the SOC 1 Type 2 report with SOC 2-type coverage of key security and cybersecurity.
Require state trust companies to include an on-chain reconciliation in their controls reports, along with proof of reserves where client assets are pooled.
Why The Network Firm
The Network Firm is the largest crypto-focused CPA firm in the United States. Here is why that matters for this rule:
We already do this work. AT-C 205 examinations, one of the three standards the SEC lists for the internal control report, are core to our practice.
We helped write the playbook. TNF contributed to the AICPA's Digital Asset Attestation Working Group.
We cover the full path. We can help from readiness and control design support through to the internal control report and surprise examination, with independence requirements applied throughout.
What to Do Now
Whether you are an adviser, a fund or a state trust company, these steps will help you prepare:
Map your keys. If you hold any part of a private key, including an MPC key share, you likely have self-custody.
Document your custodian search for every crypto asset you hold or plan to hold.
Set up the basics: one address per client, two-person approval and limited key access.
Run a readiness assessment against the ten control objectives above.
Line up your accountant for the internal control report and surprise examination.
Using a state trust company? Request its latest Type 2 controls report and audited financial statements now.
Are you a state trust company? Confirm that your accountant is independent and can deliver a crypto-specific Type 2 report.
Comment by December 7, 2026. Submit comments through the SEC's rulemaking page for File No. S7-2026-35.
Ready to get ahead of the rule? Talk to TNF about a self-custody readiness assessment or your internal control report.
This article is for general information only and is not legal or accounting advice
Author Bio:
Jeremy is a founding member and audit partner at The Network Firm and co-creator of LedgerLens, a suite of digital asset-focused audit and attestation tools. Jeremy holds credentials as a Certified Public Accountant (CPA), Certified Management Accountant (CMA - inactive), and Certified Bitcoin Professional (CBP).
Over his 10-year career, including 7 years focused on digital assets, Jeremy has led audit and attest engagements across various industry niches, including exchanges, custodians, miners, token projects, wallets, payment processors, and stablecoins. Jeremy specializes in “Proof of Reserve” engagements.
Jeremy’s goal is to shape the future of the accounting profession, strengthened by verifiable, transparent, and trusted blockchain ledgers.
Connect with Jeremy Nau on LinkedIn/Twitter for more expert advice.