Crypto Custody Disclosure Rules: SEC Requirements

Crypto custody disclosure requirements depend on who holds the assets and whether the crypto assets are securities. Registered investment advisers remain subject to the SEC’s existing custody framework under Rule 206(4)-2, while a separate October 1, 2026 SEC proposal would create additional rules for crypto self-custody, custodians and risk disclosure if adopted. This distinction matters to advisers, regulated funds and investors evaluating how client assets are safeguarded.

Key Takeaways

• Rule 206(4)-2 generally requires registered investment advisers with custody of client funds or securities to maintain them with a qualified custodian and meet client-notification, account-statement and verification requirements.

• Form ADV requires registered investment advisers to disclose whether they or related persons have custody and provide information about their custodial practices.

• The SEC’s October 1, 2026 crypto custody framework is a proposal, not a final rule; proposed self-custody conditions such as quarterly custodian-availability determinations should not be described as current law.

• SEC staff separately stated in December 2025 how broker-dealers may establish physical possession of customer crypto asset securities under Rule 15c3-3, including controls protecting private keys.

• A September 2025 SEC staff no-action position permits certain state trust companies to be treated as banks for crypto custody when specified due-diligence, segregation, control and disclosure conditions are satisfied.

What Are the Current SEC Crypto Custody Disclosure Requirements?

The current adviser framework begins with Rule 206(4)-2 under the Investment Advisers Act. An investment adviser with custody generally must maintain applicable client funds and securities with a qualified custodian in separately identified client accounts or accounts containing only client assets.

Under the SEC custody rule, an adviser opening a custodial account for a client must notify the client in writing of the qualified custodian’s name, address and how the assets are maintained. The adviser also generally must have a reasonable basis for believing that the qualified custodian sends statements to clients at least quarterly.

Form ADV adds regulatory reporting. Item 9 asks whether the adviser or related persons have custody of client cash or securities and requests information about qualified custodians, quarterly statements, independent audits and surprise examinations.

These requirements are especially relevant where investors actively seek exposure to crypto assets that may constitute crypto asset securities, including tokenized versions of an equity or debt security.

Qualified Custodians, Account Statements and Audits

A qualified custodian can include certain banks, registered broker-dealers, futures commission merchants and qualifying foreign financial institutions. The precise status of a crypto custodian depends on the applicable legal structure rather than simply whether the company describes itself as a custody provider.

The existing custody rule generally requires quarterly account statements from the qualified custodian. Advisers subject to the surprise-examination requirement must arrange an annual examination by an independent public accountant, subject to applicable exceptions.

For pooled investment vehicles, audited financial statements can satisfy certain custody-rule requirements when the applicable conditions are met.

A September 2025 SEC staff no-action letter also addressed state-chartered trust companies. Under specified conditions, registered investment advisers and regulated funds may treat a State Trust Company as a bank for crypto assets. Conditions include reviewing audited financial statements and SOC reports, assessing private-key management and cybersecurity controls, requiring asset segregation, and disclosing material risks associated with the custodian.

Private Keys and Material Crypto Custody Risks

Crypto custody introduces operational risks that do not arise in exactly the same form with traditional securities. Private keys can permit irreversible transactions, while smart contracts, protocol updates, distributed ledger technology and associated network failures can affect continued safekeeping.

For broker-dealers, the SEC’s Division of Trading and Markets stated in December 2025 that a broker-dealer directly possessing customer crypto asset securities should maintain reasonably designed written policies and controls protecting private keys from theft, loss, and unauthorized or accidental use.

The same staff statement calls for periodic assessments of the distributed ledger technology and associated network, including security, resilience, scalability and significant weaknesses or operational issues. It also addresses continued safekeeping during unexpected disruptions such as hard forks or blockchain malfunctions. The staff statement has no independent legal force and does not create additional obligations beyond applicable federal securities laws.

These controls illustrate why wallet architecture, key management, incident history, cybersecurity risks and the custodian’s legal protections can constitute material information when evaluating a custody arrangement.

What Changed in the SEC's 2026 Crypto Custody Proposal?

On October 1, 2026, the Securities and Exchange Commission proposed new adviser and regulated-fund custody rules specifically addressing crypto assets. The proposal would modernize Rule 206(4)-2, redesignate it as Rule 223-1 and establish circumstances in which advisers could self-custody client crypto assets.

Under the proposal, self-custody would require an adviser to determine initially and quarterly thereafter that no permitted custodian is available for the crypto asset. The proposal also contemplates documented safeguarding systems and joint authorization by two or more designated persons for crypto asset transactions.

These are proposed requirements, not current SEC requirements as of October 6, 2026. The older 2023 safeguarding proposal should likewise not be treated as current law: the SEC formally withdrew that proposal in June 2025.

The 2026 proposal also addresses Form ADV reporting, state trust companies, crypto self-custody, account statements and risk disclosures. Its final requirements may change following the Federal Register comment process.

Broker-Dealer Custody and Customer Asset Segregation

Broker-dealer custody is governed separately from the Advisers Act custody rule. Exchange Act Rule 15c3-3, the Customer Protection Rule, requires broker-dealers to obtain and maintain physical possession or control of customers’ fully paid and excess margin securities.

SEC staff confirmed that Rule 15c3-3(b) applies to crypto assets only when they are securities. For qualifying crypto asset securities, the broker-dealer must establish possession or an acceptable control location under the rule.

The December 2025 staff framework further emphasizes exclusive access, private-key controls and procedures designed to prevent unauthorized transfers. These requirements should not be generalized to every digital asset held by every crypto business.

For comparison, Gate’s security architecture describes cold/hot wallet separation, multi-signature controls and MPC technology. Those operational safeguards illustrate common crypto key-management techniques but do not by themselves establish compliance with SEC adviser or broker-dealer custody requirements.

How Gate Can Help

Custody structure should be distinguished from ordinary wallet security. Gate Vault, for example, uses a 2-of-3 MPC architecture in which private-key material is distributed across separate parties rather than existing as one complete key.

Such technology can help users understand practical concepts such as distributed authorization and protection against a single key compromise. It should not be interpreted as a substitute for a registered investment adviser’s duties under Rule 206(4)-2, Form ADV, the federal securities laws or any future SEC crypto custody rule.

Conclusion

Current crypto custody disclosure requirements for registered investment advisers remain grounded primarily in Rule 206(4)-2, Form ADV, qualified-custodian arrangements, client statements and independent verification requirements. Crypto-specific staff positions additionally address state trust companies and broker-dealer possession of crypto asset securities.

The SEC’s October 1, 2026 proposal could substantially change that framework by establishing explicit crypto self-custody and reporting requirements, but those provisions remain proposed until the Commission adopts a final rule.

FAQ

What are the current SEC requirements for crypto custody disclosure rules for investment advisers?

Registered investment advisers with custody generally must disclose custody information through Form ADV, maintain applicable client funds and securities with qualified custodians, provide required client notices and ensure clients receive periodic account statements. Depending on the custody arrangement, annual surprise examinations or audited financial statements may also apply.

What should a crypto fund disclose to comply with SEC crypto custody rules?

The required disclosure depends on the fund structure and the assets involved. Relevant information can include the identity and status of the custodian, custody arrangements, material conflicts, asset-segregation practices and material risks associated with the custodian or crypto assets. Regulated funds must also comply with applicable Investment Company Act custody provisions.

Does the SEC currently allow investment advisers to self-custody crypto assets?

The SEC proposed an explicit crypto self-custody framework on October 1, 2026, but the proposal is not yet a final rule. Its proposed conditions include determining that an appropriate permitted custodian is unavailable, documenting that determination and reassessing custodian availability quarterly.

Does the SEC require two people to approve every crypto transfer?

Not under the existing custody rule as a universal requirement. A two-or-more-person joint authorization requirement appears in the SEC’s October 2026 proposed self-custody framework. It should therefore be described as a proposed safeguard rather than a current SEC mandate.

Can a state-chartered trust company be a crypto qualified custodian?

SEC staff issued a September 30, 2025 no-action position allowing registered advisers and regulated funds, subject to detailed conditions, to treat qualifying State Trust Companies as banks for custody of crypto assets and related cash. Required conditions include due diligence, audited financial statements, internal-control reports, segregation provisions and disclosure of material custody risks.