SEC Crypto Custody Rule Advances to White House Review: What Advisers, Funds, and Custodians Should Do Now (2026)

The Securities and Exchange Commission has sent a proposed overhaul of its digital asset custody framework to the White House Office of Information and Regulatory Affairs (OIRA) for interagency review — the gatekeeping step that precedes publication of a significant rule. For registered investment advisers, fund sponsors, and the custodians that serve them, this is the clearest signal yet that the Commission intends to address the structural mismatch between the Investment Advisers Act custody rule and the way digital assets actually exist.

Precision matters here, and most coverage will get it wrong. The SEC has advanced a rule. It has not proposed one, adopted one, or made a single word of text public. No comment period has opened. Nothing about your compliance obligations changed. What follows is an analysis of the framework the rule would modify, the constraints the Commission faces in modifying it, and what practitioners should be doing during the window before text appears.

Key Takeaways

• This is a procedural milestone, not a rule. OIRA review under Exec. Order No. 12866, 58 Fed. Reg. 51735 (Oct. 4, 1993), happens before Federal Register publication. Nothing at OIRA satisfies the notice-and-comment requirements of the Administrative Procedure Act, 5 U.S.C. § 553, or creates any enforceable obligation.
• The operative law is unchanged: Rule 206(4)-2, 17 C.F.R. § 275.206(4)-2, for advisers; Investment Company Act § 17(f), 15 U.S.C. § 80a-17(f), for registered funds.
• The doctrinal problem is the definition of “custody,” which reaches any capability to obtain possession of client assets. Holding a private key is possession — which is why advisers cannot escape the rule by declining to call themselves custodians.
• Loper Bright is the constraint nobody is pricing in. After Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), a custody rule built on the antifraud authority of Advisers Act § 206(4) gets no Chevron deference if challenged — which limits how far the Commission can stretch, in either direction.
• Most institutional crypto sits under state trust charters, not federal ones. NYDFS and Wyoming law will continue to do the real work regardless of what the SEC proposes.

What Happened at OIRA — and Why Does an Independent Agency Need White House Review?

Executive Order 12866 requires agencies to submit significant regulatory actions to OIRA before publication. Independent regulatory agencies like the SEC were historically carved out. That changed with Executive Order 14215, “Ensuring Accountability for All Agencies” (Feb. 18, 2025), which extended centralized review to independent agencies’ significant regulatory actions.

The practical consequence is that SEC rulemaking now clears an executive-branch checkpoint that did not exist in prior crypto rulemaking cycles. A submission to OIRA tells you three useful things: complete rule text exists, the Commission authorized its transmission, and the item carries a Regulation Identifier Number trackable on reginfo.gov. It tells you nothing about substance, because OIRA dockets list only a title, RIN, stage of proceeding, and economic-significance designation.

Under E.O. 12866 § 6(b)(2), review generally runs up to 90 calendar days for a rule not previously reviewed at an earlier stage, and 45 days where OIRA has already reviewed a draft, with one 30-day extension available. In practice, timelines vary considerably, and OIRA can return a rule to the agency for reconsideration.

Why Does the Custody Rule Break for Crypto?

Rule 206(4)-2 was adopted under Advisers Act § 206(4), 15 U.S.C. § 80b-6(4), which makes it unlawful for an adviser to engage in practices the Commission defines by rule as fraudulent or deceptive. Four features of the rule create friction, and the first is the one that matters most.

First, “custody” is defined far more broadly than intuition suggests. The rule’s definitions in paragraph (d) define custody to include holding client assets directly or indirectly, or having any authority to obtain possession of them — the classic example being a general power of attorney. An adviser holding a private key has the practical capability to move the asset. Under the rule’s own logic, that is custody. Advisers who assume that using a third-party wallet provider or an omnibus arrangement avoids the rule are frequently wrong, and this is the single most common analytical error in the space.

Second, the qualified custodian list is closed and predates crypto. Paragraph (d) defines “qualified custodian” as a bounded set: banks and savings associations as defined in the Advisers Act; registered broker-dealers holding assets in customer accounts; registered futures commission merchants; and certain foreign financial institutions. Most crypto-native custodians appear nowhere on that list.

Whether a state-chartered trust company qualifies turns on the “bank” definition at Advisers Act § 202(a)(2), 15 U.S.C. § 80b-2(a)(2), which reaches a trust company doing business under state law where a substantial portion of its business consists of receiving deposits or exercising fiduciary powers similar to those permitted national banks, and which is supervised and examined by a state or federal banking authority. That is a genuine multi-factor analysis, it turns on charter terms and actual business mix, and it has produced inconsistent conclusions across jurisdictions. It is the ambiguity a rewrite is most likely to resolve.

Third, the account architecture does not fit. Rule 206(4)-2(a)(1) contemplates assets held in a client-name or adviser-name account, with quarterly account statements from the custodian under (a)(3) and client notice under (a)(2). Staked positions subject to unbonding periods, assets deployed in DeFi protocols, and assets in transit across chains do not map cleanly onto that structure.

Fourth, verification is hard. Rule 206(4)-2(a)(4) requires an annual surprise verification by an independent public accountant, reported on Form ADV-E, with an additional internal control report under (a)(6) where the custodian is a related person of the adviser. Confirming exclusive control of a private key is a materially different audit procedure than confirming a securities position with a depository, and a signed message proving control at a point in time does not prove control was never shared.

Two further wrinkles are worth flagging. The rule by its terms reaches “funds or securities” — so a digital asset that is neither cash nor a security arguably falls outside it, a reading advisers have relied on with varying comfort. And the privately offered securities exception at Rule 206(4)-2(b)(2) is narrow: it requires securities that are uncertificated, transferable only with issuer consent, and not the subject of a public market. Freely transferable tokens fail that test, so the exception rarely rescues a crypto position.

Which Custody Regime Actually Applies to You?

Practitioners routinely conflate four distinct regimes. Mapping your product to the right one is the necessary first step before any of this rulemaking matters.

Vehicle	Governing authority	Affected by this rulemaking?
Registered investment adviser	Rule 206(4)-2, 17 C.F.R. § 275.206(4)-2	Directly — this is the likely target
Registered investment company	ICA § 17(f), 15 U.S.C. § 80a-17(f); Rules 17f-1, 17f-2, 17f-5, 17f-7	Possibly, if the rule reaches funds
Spot crypto ETP (’33 Act commodity trust)	Trust agreement, exchange listing standards, state trust law	Likely not — not a registered fund
Broker-dealer	17 C.F.R. § 240.15c3-3 (customer protection rule)	Unknown from the docket alone

The third row deserves emphasis. The spot bitcoin and ether ETPs approved beginning January 10, 2024 are not registered investment companies. Section 17(f) does not apply to them. Their custody protections come from private contract, exchange rules, and state trust company supervision — a materially thinner regulatory floor than most retail investors assume when they buy a product with a ticker symbol.

The broker-dealer row carries a timing issue practitioners should confirm. The Commission’s 2021 statement on special purpose broker-dealers holding digital asset securities, 86 Fed. Reg. 11627 (Feb. 26, 2021), was framed as a five-year position running from its April 2021 effective date — meaning it appears to have lapsed by its own terms in spring 2026 absent extension or replacement. Separately, in May 2025 the Division of Trading and Markets and FINRA withdrew their 2019 joint staff statement on broker-dealer custody of digital asset securities. Firms relying on either position should confirm its current status directly rather than from secondary sources.

What Happened to the 2023 Safeguarding Proposal?

In February 2023 the Commission proposed “Safeguarding Advisory Client Assets,” Release No. IA-6240, File No. S7-04-23, which would have replaced Rule 206(4)-2 with a new Rule 223-1 and expanded coverage from “funds or securities” to substantially all client assets, explicitly including crypto. It drew sustained criticism — including from then-Commissioner Hester Peirce — on the ground that it broadened the universe of assets requiring a qualified custodian without meaningfully broadening who could be one, making crypto custody effectively impossible rather than merely difficult.

Under Chairman Paul Atkins, sworn in April 21, 2025, the Commission withdrew that proposal in mid-2025 as part of a batch withdrawal of pending Gensler-era rulemakings. The Crypto Task Force launched January 21, 2025 under Commissioner Peirce identified custody as a priority workstream. Related deregulatory movement includes Staff Accounting Bulletin No. 122 (Jan. 23, 2025), rescinding SAB 121 and its on-balance-sheet liability treatment for custodied crypto, and OCC Interpretive Letters 1183 (Mar. 7, 2025) and 1184 (May 7, 2025), reaffirming national bank authority to provide crypto custody and to use sub-custodians.

Read against that record, a custody rule arriving at OIRA in 2026 most plausibly represents the constructive replacement for the withdrawn proposal — an attempt to widen the qualified custodian gate rather than narrow it.

What Could the Rule Do — and What Can’t It Do?

Without text, specific predictions are speculation. But the policy levers are finite, and these are the candidates worth modeling: expanding the qualified custodian definition to admit state-chartered trust companies meeting specified capital, segregation, and audit standards; creating a purpose-built digital asset custodian category with conditions tailored to key management rather than forcing crypto into the bank/broker-dealer taxonomy; permitting cryptographic proof-of-control procedures to satisfy or supplement the surprise examination; carve-outs for staking and on-chain settlement where temporary loss of exclusive control is inherent to the transaction; and resolving the “funds or securities” scope question for non-security digital assets.

The more interesting question is what the Commission cannot do. Rule 206(4)-2 rests on § 206(4)’s authority to define and prescribe means reasonably designed to prevent fraudulent or deceptive practices. The 2023 proposal drew comments questioning whether that antifraud hook supports a comprehensive asset-safeguarding regime covering assets that are not securities at all. After Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), abrogating Chevron deference, a reviewing court will decide that statutory question independently rather than deferring to the Commission’s reading.

That cuts in an underappreciated direction. It constrains an expansive rule, but it also constrains a permissive one: if the Commission relaxes custody protections in a way a challenger frames as inconsistent with § 206(4)’s protective purpose, the agency defends that choice without deference too. Combined with the reasoned-decisionmaking and economic-analysis obligations that produced Business Roundtable v. SEC, 647 F.3d 1144 (D.C. Cir. 2011), the litigation risk here is bidirectional. Firms should not assume a favorable rule, once adopted, is stable.

Where Does State Law Fit — and Why Does Bankruptcy Remoteness Matter More?

Whatever the SEC does, the operational custody of most institutional crypto is supervised by state banking regulators. In New York, virtual currency business activity requires licensure under 23 NYCRR Part 200, and NYDFS has issued guidance addressing custodial structures for virtual currency entities, including expectations around segregation and the avoidance of debtor-creditor relationships with customers. Wyoming created the special purpose depository institution charter, Wyo. Stat. § 13-12-101 et seq., expressly to provide a bank-charter path for digital asset custody. An SEC rule expanding the qualified custodian definition would sit on top of these regimes, not replace them.

The stake is not regulatory box-checking. It is whether client assets are property of the customer or property of a bankruptcy estate. In In re Celsius Network LLC, 647 B.R. 631 (Bankr. S.D.N.Y. 2023), the court held that assets deposited into the platform’s Earn program became property of the estate under the governing terms of use, leaving depositors as unsecured creditors. That outcome turned on contract terms and the structure of the arrangement — precisely the variables custody regulation exists to control. Any custody analysis that stops at “is this entity a qualified custodian” without asking “who owns these assets in an insolvency” is incomplete.

Practical Implications

Registered investment advisers. Nothing has changed. Qualified custodian, client notice, quarterly statements, surprise examination and Form ADV-E, and Form ADV Item 9 reporting all remain fully in force. Advisers relying on the “funds or securities” scope limitation, or on the theory that key-sharing arrangements avoid custody, should document that analysis now — a rewrite may foreclose it prospectively while focusing examination attention on it retrospectively.

Custodians and qualified custodian applicants. Any expansion of the definition will attach conditions: capital, segregation, bankruptcy-remoteness, insurance, SOC reporting, key management controls. Firms that can document those controls when the proposal drops will be positioned to comment credibly and qualify quickly.

Fund sponsors and ETP issuers. Confirm which row of the table above governs your product, and audit marketing materials for language that implies registered-fund protections a ’33 Act commodity trust does not provide. That disclosure risk exists independent of this rulemaking.

Retail investors. A spot crypto ETP is not a registered mutual fund and does not carry Investment Company Act custody protections. That is not a defect — it is a structural feature worth understanding before assuming the exchange listing implies a particular level of asset protection.

What to Do Now

• Track the docket. Monitor reginfo.gov under SEC agency code 3235 for the RIN and watch for the “Concluded” action, which precedes publication.
• Run a custody-trigger audit. For every client digital asset position, document who can move the asset, under what authority, and whether that constitutes custody under paragraph (d). Do this before an examiner does.
• Confirm your custodian’s legal status in writing. If you are relying on a state trust company as a qualified custodian, obtain the charter analysis under Advisers Act § 202(a)(2) rather than the custodian’s marketing claim.
• Read your custody agreement for insolvency terms. Ask the Celsius question: in a custodian bankruptcy, are these assets the client’s or the estate’s?
• Stress-test the surprise examination. Confirm your accountant can actually perform verification procedures on key-controlled assets and file Form ADV-E on schedule.
• Prepare comment infrastructure now. Identify your two or three highest-cost compliance frictions and gather quantitative support, so a 60-day window is sufficient. Cost data is the most persuasive material a commenter can supply.
• Do not restructure in anticipation. Rules change materially between OIRA and adoption. Build to current law; preserve optionality for the next one.

Conclusion

The SEC crypto custody rule reaching OIRA is a real signal: text exists, the Commission authorized it, and the current Commission’s deregulatory posture is being converted from staff statements into binding rulemaking. It is also only a signal. The operative law remains Rule 206(4)-2 as written, Investment Company Act § 17(f) for registered funds, and the state trust charters that carry far more institutional crypto than most market participants realize. The firms that benefit most from the next twelve months will be the ones that use this window to fix the custody analysis they already have — not the ones waiting to be rescued by a rule nobody has read.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.