Crypto Custody Rule Revived as SEC Adds State Trust Custodians

A rule that failed once is back in a friendlier form

The Securities and Exchange Commission has proposed a new framework for crypto custody. It addresses the problem behind the Gensler-era safeguarding rule, which never became final. On October 1, 2026, the agency proposed rules covering how registered investment advisers, registered investment companies and business development companies may hold crypto assets for clients.26 The package appeared in the Federal Register on October 6 under File No. S7-2026-35, and public comments are due by December 7, 2026.1

The proposal has two main parts. First, state-chartered trust companies would be named as permitted crypto custodians. Second, advisers could hold client crypto themselves, but only as a closely limited fallback.24 SEC Chair Paul Atkins said the plan would give advisers and funds a compliant way to hold crypto where none existed before. He also said it would end the uncertainty created by custody rules written for an earlier era.18

This was not a surprise. In late August, the SEC sent a preliminary custody concept to the White House Office of Management and Budget. Coverage at the time called it a revival of a rulemaking the previous administration had failed to finish.2322 According to crypto.news, OMB received the draft on August 25.25 The agency's regulatory agenda listed October as the target date. Several outlets warned that the SEC often misses its own timelines, noting that Regulation Crypto Assets arrived four months behind schedule.2228 This time the agency met its estimate.

Why the 2023 version failed

The new plan makes more sense when set against the old one. Former Chair Gary Gensler introduced his safeguarding proposal in 2023 and warned that advisers could not rely on crypto trading platforms as qualified custodians.23 That rule would have required advisers to keep client crypto with a short list of custodians. In practice, that meant chartered banks or trust companies, SEC-registered broker-dealers, or futures commission merchants overseen by the CFTC.2322

Opposition came from many directions. Lawyers at the Small Business Administration said the SEC had seriously underestimated the cost to smaller advisers, and Andreessen Horowitz called the plan "illegal, infeasible, and dangerous."23 The core problem was practical. Many crypto custodians did not fit the proposed definition of a qualified custodian, so advisers would have had fewer places to hold digital assets.25 Critics also said the rule would have made banks even less willing to serve crypto firms. Then-acting Chair Mark Uyeda paused the proposal in March 2025. The commission formally withdrew it in June 2025, along with 13 other unfinished proposals.2926 At the time, the SEC said any future action in these areas would need a new proposal.25

The dates differ slightly across reports. Some say the Gensler proposal was announced in February 2023, while others date it to March 2023.2225 The usual explanation is the gap between the announcement and publication in the Federal Register. Either way, the story is the same: the rule was widely opposed, never adopted and then withdrawn.

The banking angle: state trust companies get named

For custody banks and trust firms, the most important change is a definition. Under the current Advisers Act rule, qualified custodians are limited to banks and savings associations, registered broker-dealers, futures commission merchants and certain foreign institutions.13 State trust companies have become major crypto custodians, but they are not on that list. Whether one counts as a "bank" now depends on a case-by-case review of its fiduciary business.13

The proposal would replace that review with an explicit category. A state trust company could serve as a qualified custodian under new Rule 223-1, and as a permitted fund custodian under new Investment Company Act Rule 17f-8. This would apply only to crypto assets and related cash, and no finding that the firm is a "bank" would be needed.11 Before hiring one, and every year after, an adviser would have to confirm in writing several things. The trust company must be authorized by its state banking regulator to hold crypto. It must have written safeguarding policies covering private keys and cybersecurity. It must also provide audited financial statements and an internal control report.13 Client assets would have to be kept separate from the trust company's own.4

This turns earlier staff guidance into a formal rule. On September 30, 2025, the SEC's Division of Investment Management issued a no-action letter to Simpson Thacher & Bartlett. It said that, under certain conditions, a state-chartered trust company could count as a "bank" for custody purposes.27 That letter applied only to its specific facts, and staff could withdraw it at any time.27 A final rule would put the arrangement on much firmer legal ground.9

The market has also changed since 2023. A wave of new federal trust bank charters has increased the number of institutions able to hold crypto under banking rules.2321 Today the main custodians include Coinbase Custody Trust Company, which holds a New York limited-purpose trust charter, and BitGo, which has trust charters in South Dakota and New York. Anchorage Digital Bank holds a national trust bank charter from the OCC.20 The proposal says firms that already qualify as banks can still be used without relying on the new state trust company rules.12

The package also affects ordinary bank custody. The SEC expects to confirm that a custody bank may hold client cash as a general deposit, recorded on its balance sheet as a liability to the client, without breaking the custody rule.1213 It would also let all registered broker-dealers act as fund custodians, not just exchange members.1314

Self-custody is narrower than it sounds

The self-custody provision drew the most headlines, and some of them overstate it. It refers to advisers holding client assets. It does not cover individual investors holding their own keys.19 An adviser could take self-custody only after deciding in writing, after reasonable inquiry, that no qualified custodian will hold that specific asset. That decision must be made one asset at a time and repeated at least every quarter.1114 Cost is not an acceptable reason. Once a custodian becomes available, the asset must be moved to it as soon as reasonably practicable.11

There are further conditions. Advisers must have proven expertise in safeguarding the asset, and any transfer needs approval from at least two authorized people. They must also maintain cybersecurity controls, send clients quarterly statements and obtain internal control reports from an independent accountant.614 Advisers and clients must also agree in writing to treat each self-custodied asset as a "financial asset" under state commercial law.1 For funds, the board would oversee the arrangement, and a majority of independent directors would review the adviser's custody decision every quarter.11

One detail has drawn little attention but could cause real disruption. Under the proposal, holding any share of an asset's private keys counts as self-custody. Because self-custody is allowed only when no qualified custodian is available, an adviser using a custodian could not keep a share of the keys.11 Advisers that now split keys with a custodian, a client or a technology vendor would have to restructure those arrangements.11 Law firm analysis expects the self-custody option to apply less often than it first appears. Adding state trust companies to the custodian list will reduce the number of assets with no willing custodian, and the most liquid tokens are generally already supported.11

Where the coverage diverges

News outlets broadly agree on what the proposal says, but they differ in emphasis. Crypto-focused outlets mostly present it as a breakthrough that opens a clear path for institutions.8 Legal analysis spends more time on the costs of complying.1113 At least one consumer explainer gave the comment deadline as around October 20. That date belongs to the separate Regulation Crypto Assets proposal, not to this custody rule, which closes on December 7.1691 The same explainer said the SEC's own footnotes partly blame earlier Commission actions for keeping traditional custodians away from crypto.7

One commentator identified what may be the real point of contention. If the final definition of a qualified custodian effectively favors large bank custodians, the old bottleneck would return under friendlier wording.15 The proposal moves in the other direction by giving state trust charters a clear legal basis. Bank custodians may still use the comment period to argue for stricter conditions.

The bigger picture

The SEC is moving ahead partly because Congress has not. The proposal came weeks after the Clarity Act, a broad crypto market-structure bill, stalled in the Senate on September 15. That left regulators to write rules under the authority they already have.28 Atkins has called custody one of three pillars of a single framework, alongside Regulation Crypto Assets and the modernization of transfer agent rules.9 The SEC also granted an exemption for some tokenized stock trading on September 17, and Atkins has said more proposals are coming.3

In this writer's view, the main achievement is the treatment of state trust companies. Self-custody received most of the attention. But writing state trust charters into the custodian list removes the legal uncertainty behind much of the industry's complaints in 2023. Unlike staff guidance, a final rule cannot be quietly withdrawn. The proposal is still not final, and the Commission must review comments and vote before advisers can rely on it.3

If the final rule tracks the proposal, the 2023 dispute over which firms count as qualified custodians would largely be resolved in favor of crypto-focused trust companies. Self-custody would remain available, but only as a heavily documented, short-term option. Advisers would face more compliance work rather than less, but they would finally have clear instructions to follow.