SEC Proposes Crypto Custody Rules and Broader Custody Reforms for Registered Investment Advisers and Regulated Funds

On October 1, 2026, the U.S. Securities and Exchange Commission (SEC or Commission) proposed new rules, amendments, and form changes (Release Nos. IA-7023; IC-36353) that would create a custody framework tailored to crypto assets held for clients of SEC-registered investment advisers (advisers) and for registered investment companies and business development companies (BDCs) (collectively, regulated funds), demonstrating the SEC’s continued focus on crypto asset initiatives. Chairman Paul S. Atkins framed the proposal as necessary updates to the existing custody regulatory regime that contemplated only traditional assets.

The proposal is aimed to alleviate some of the challenges facing advisers and related regulatory confusion in providing crypto-related investment advice and to allow regulated funds to offer clients access to a wider range of crypto-related investment strategies. The proposal would permit advisers and regulated funds to self-custody crypto assets and to maintain certain crypto assets with state trust companies in certain circumstances. The proposal is limited, however, to crypto assets that constitute “client funds or securities” under the Investment Advisers Act of 1940 (Advisers Act) custody rule or, for regulated funds, “securities and similar investments” under the Investment Company Act of 1940 (Investment Company Act) custody rules. The proposal would also update a range of noncrypto rules and interpretations under the Advisers Act and the Investment Company Act, including private fund audit requirements, the use of broker-dealers as fund custodians, and advisers’ use of standing letters of authorization with clients and their account custodians.

Our Take

A workable path, with self-custody as a fallback. Some advisers have avoided crypto asset strategies or passed on new token allocations because no permitted custodian would maintain the asset. Those advisers would gain a custody-rule-compliant route to invest client assets in these instruments. However, the framework requiring asset-by-asset quarterly testing and review and the duty to move assets once a permitted custodian emerges means the self-custody option is designed to fill gaps, particularly for newly launched assets, rather than replace third-party custody. While this creates a path to compliance where none previously existed, we expect it would entail significant administrative burdens and new compliance risks. Firms considering it should plan for meaningful investment in key management, two-person controls, cybersecurity, accountant, and other vendor support relationships. They should also expect examiners to conduct detailed reviews testing the written determination executed and maintained by advisers.

State trust companies would gain firmer footing. On September 30, 2025, the staff of the SEC Division of Investment Management issued a no-action letter providing limited relief for registered advisers and regulated funds that treat a state trust company as a “bank” for custody of crypto assets and the cash or cash equivalents reasonably necessary to effect those transactions. The no-action letter required that before engaging the trust company and annually afterward, the adviser or fund has a reasonable basis, after due inquiry, to believe the company is authorized by its state banking authority to provide crypto custody and maintains written policies reasonably designed to safeguard the assets, along with other conditions such as segregating client assets from the company’s own and concluding that the arrangement is in the best interest of clients or shareholders. The proposal would build a similar state trust company framework into the custody rule providing greater certainty for registered advisers and regulated funds seeking to rely on state trust companies for crypto asset custody. Firms relying on the current staff no-action letter should compare their diligence files and custody agreements to the proposed conditions now rather than waiting for a final rule.

All registered advisers affected, even those without crypto exposure. This custody rule proposal also includes changes affecting all registered investment advisers. The proposal removes the existing 206(4)-2 Custody Rule framework and reproposes much of the existing rule under Section 223 as Rule 223-1. This will have implications for policies and procedures, private fund side letter reporting, advisory agreements, and service and vendor agreements tied to the existing 206(4)-2 framework, Trading authority interpretations would require advisers to review their investment management agreements with clients and account custody agreements for delegated authority to confirm access controls. Removing the audit oversight board requirement could widen accountant choice for private fund audits. The audit timing, standing instruction, and inadvertent custody changes address longstanding hurdles. Regulated fund complexes may gain broader broker-dealer custody options. Finally, amendments to forms and instructions will affect all registered advisers as they will need to confirm information and responses on the revised forms. The Commission acknowledges the volume of no-action letters and FAQs that have been issued by Commission staff under the existing Rule 206(4)-2 framework. The proposal states that any final rule would control and would supersede any inconsistent prior statements or position taken by the staff. While several no-action letters are referenced by name, dozens of other letters and FAQs are not addressed, leaving to the industry the task of determining which, if any, of these staff positions may be inconsistent with the proposed rule.

Regulated funds would be subject to a distinct crypto asset custody framework. Regulated funds would gain two express crypto custody pathways, with new diligence, safeguarding, and board-oversight requirements, while receiving broader broker-dealer custody options. At the same time, because the Investment Company Act custody regime reaches nonsecurity crypto assets such as BTC, ETH, and SOL as “similar investments,” regulated funds may remain subject to custody-related limitations on trading and on-chain activity that do not apply under the Advisers Act custody rule to private funds and other advisory clients holding the same assets. The SEC also requests comment on broader changes to regulated fund custody arrangements, including those involving private assets.

Important trading and DeFi questions remain open. Trading and decentralized finance (DeFi) remain important areas of development. Although the SEC declined to propose a general exception for assets held on nonpermitted trading platforms, the release recognizes existing structures that separate execution from custody and discusses smart-contract and other noncustodial trading mechanisms that can permit assets to remain with a permitted custodian. More difficult questions remain where assets are actually deployed into a DeFi protocol. The SEC specifically seeks comment on when a custodian should continue to be viewed as “maintaining” an asset deposited into a smart contract, including structures involving receipt or claim tokens as well as whether additional guidance or relief is warranted. Market participants engaged in staking, lending, liquidity provision, vault strategies, or other on-chain activities should consider whether to comment on these issues.

Significant Elements of the Proposal

Scope and application of the new rules for crypto assets

The marquee change for advisers and funds is the proposed framework for adviser self-custody of crypto assets that are client funds and securities under the custody rule. However, much-needed clarity still remains elusive as the proposal does not attempt to distinguish which crypto assets are “client funds or securities” covered by the custody rule and which fall outside the scope of the rule.

The SEC acknowledges that a crypto asset may or may not be a security under the federal securities laws and, for that analysis, looks to its March 2026 interpretation on the application of the federal securities laws to crypto assets.¹ Instead of moving that interpretation forward and providing additional clarity, the proposal ties coverage to the existing scope of each custody rule (under the Advisers Act and the Investment Company Act). The Advisers Act amendments would cover only crypto assets that are “client funds or securities,” while the Investment Company Act custody rules, which reach a broader set of fund assets, would cover crypto assets that are a regulated fund’s “securities and similar investments.” According to the release, crypto assets that represent funds would include, for example, tokenized deposits and payment stablecoins issued by permitted payment stablecoin issuers or registered foreign payment stablecoin issuers under the GENIUS Act², and tokenized versions of traditional securities would be covered as securities.

That difference in scope matters most for investments in digital commodities such as BTC, ETH, and SOL, among others. For advisory clients generally, including separately managed accounts and private funds, the SEC states that these assets are not funds or securities and therefore would fall outside the Advisers Act custody rule. For regulated funds, however, the release treats the same assets as “securities and similar investments.” As a result, regulated funds would need to include Bitcoin, Ether, and Solana within their crypto asset custody arrangements under the broader asset coverage of the regulated funds custody rules, and an adviser that self-custodies these assets for a regulated fund would be subject to the new self-custody conditions and the fund board’s oversight. The treatment of advisory clients differently than regulated funds is a marked departure from the SEC’s withdrawn 2023 safeguarding proposal. As discussed in our February 2023 Sidley Update, the 2023 release stated that most crypto assets were likely to be funds or crypto asset securities covered by the existing custody rule, and a footnote suggested that even crypto assets that are not securities would be considered “funds,” without explaining why. The 2026 release also requests comment on whether further guidance is needed for nonsecurity crypto assets sold subject to an investment contract and on whether any crypto assets could qualify for the custody rule’s privately offered securities exception.

Adviser self-custody of crypto assets

Under the proposed regime for self-custody, an adviser could maintain client crypto assets itself, meaning it holds the private key materials needed to access and transfer the assets, rather than maintain them with a permitted custodian. Functionally, the proposed adviser self-custody rule would create an exception to the custody rule requirement that client funds and securities be held by a qualified custodian. Holding any portion of the cryptographic private key materials necessary to effectuate transactions in a crypto asset would count as self-custody, but holding keys solely in the capacity of a qualified custodian would not.

The self-custody conditions would replace certain requirements that otherwise apply under the custody rule, such as the requirement to use of a qualified custodian, distribution to clients of account-opening notices, and confirmation that the custodian sends account statements. Other applicable custody rule requirements, such as the annual surprise examination or, where available, the pooled vehicle audit alternative, would continue to apply. Among key conditions for adviser self-custody:

• No permitted custodian available. Before taking custody of each asset, and at least quarterly afterward, the adviser must determine in writing that after reasonable inquiry, no permitted custodian will hold it. Blanket determinations are not allowed, and cost is not a valid reason for self-custody in place of engaging an available permitted custodian. Once a custodian becomes available, the adviser must transfer the asset to it as soon as reasonably practicable.
• Expertise and safeguards. The adviser must document its expertise in safeguarding each asset and maintain safeguarding systems appropriate for each asset, including to manage its private keys. Access to key materials must be restricted to designated supervised persons. Safeguards adopted by an adviser must require at least two designated people, including a management person, to approve transactions and keep each client’s assets at separate blockchain addresses that hold only that client’s assets. Service providers could support the arrangement but could not access key materials or move assets on their own, and the adviser would remain responsible for compliance.
• Cybersecurity and annual review. The adviser must conduct written cybersecurity risk assessments at least annually and maintain measures for threat and vulnerability management and for incident response and recovery specifically tailored and designed for the adviser’s self-custody practices. It must also review in writing its safeguarding systems, cybersecurity controls, and their effectiveness within one year of taking self-custody of each crypto asset and at least annually afterward.
• Outside verification. The adviser must obtain an internal control report from an independent public accountant within six months of first taking self-custody and at least once each calendar year thereafter while self-custody continues. The report would address the design, implementation, and operating effectiveness of the adviser’s controls and verify reconciliation to the blockchain. A qualifying SOC 1 Type 2 report could satisfy this requirement, but a Type 1 report would not. It must also send clients at least quarterly statements, or qualifying electronic transmissions, that identify the blockchain address and network holding their assets, show balances and transactions, and let them check balances directly on the blockchain. Qualifying audited pooled vehicles and regulated funds would be excepted from this statement requirement.
• Financial asset election. The adviser and client must agree in writing to treat self-custodied crypto assets as “financial assets” and the adviser as a “securities intermediary” under applicable state law, which is intended to support protection of the client’s property.
• Airdropped assets. Receiving distributed (“airdropped”) crypto assets would not violate the custody rule if, as soon as reasonably practicable, the adviser either satisfies the self-custody conditions for the asset or places it with a qualified custodian. No fixed safe-harbor or cure period is proposed, and a parallel provision would apply the same flexibility for the airdropped crypto assets of regulated funds.
• Fund boards. For regulated funds, the adviser self-custody pathway would also be subject to the board-oversight requirements discussed below under proposed Rule 17f-9.

The SEC acknowledges that because of “the rapid pace of innovation in the crypto asset markets, it also is important that the [defined terms under the proposed rule] be both accurate with respect to the current state of the technology and sufficiently flexible to cover potential developments in the market to avoid a need to continually revisit and update the definitions.” One potential operational issue may be the interaction between the proposed transaction-authorization requirements and on-chain trading.

Proposed Rule 223-1(b)(7)(ii)(B) would require joint authorization by at least two designated persons for transfers of self-custodied crypto assets, including at least one management person. It may be useful to consider how that requirement would operate where smart-contract or algorithmic execution results in asset transfers without transaction-by-transaction manual authorization.

State trust company custody

Advisers and regulated funds could use qualifying state trust companies, as a new and separate category of permitted custodian, to hold crypto assets and related cash and cash equivalents, subject to specific conditions. Before engaging the company and annually afterward, they must document in writing a reasonable basis, after due inquiry, to believe it is authorized by its state banking regulator to provide crypto custody as well as maintain and implement written safeguarding policies. The adviser must also receive and review the trust company’s most recent annual financial statements and confirm that they were prepared in accordance with U.S. generally accepted accounting principles (GAAP) and audited by an independent public accountant as well as receive and review its internal control report. Client assets must be kept separate from the company’s own assets. A trust company that independently qualifies as a “bank” under the existing custody rules could continue to be used on that basis. Inconsistent staff positions, including a September 2025 no-action letter on this topic, would be superseded if the proposal is adopted.

Updates to the Advisers Act custody rule

The proposal would redesignate the Advisers Act custody rule, currently Rule 206(4)-2), as proposed Rule 223-1 under Section 223 of the Advisers Act. The move would take the custody requirement out of the antifraud rulemaking authority under Section 206(4) and place it under the custody-specific authority in Section 223, creating an affirmative obligation to safeguard client funds and securities. The proposal also would make several other changes, including

• eliminating the requirement that accountants performing pooled vehicle audits, and surprise examinations and internal control reports where the adviser or a related person acts as qualified custodian, be registered with and inspected by the Public Company Accounting Oversight Board (PCAOB), although the accountant would still need to be an independent public accountant
• requiring U.S. GAAP for audited fund financial statements, with an exception for qualifying foreign funds that provide substantially similar information and a reconciliation of material differences from U.S. GAAP
• extending audit delivery deadlines for funds of funds and funds of funds of funds to 180 and 260 days, respectively (retaining the standard 120-day deadline for other pooled vehicles), and permitting delivery to investors’ independent representatives, with the release also describing limited accommodation for short, reasonably unforeseeable delivery delays
• allowing a pooled vehicle formed within 90 days before its fiscal year end to defer, but not waive, the audit of that initial short fiscal year, provided that stub-period financial statements (which may be unaudited) are delivered to investors or their independent representatives within 90 days after that fiscal year end and the following year’s audited statements cover both periods
• extending the custody rule’s exception for registered investment company accounts to BDCs that have not withdrawn their election, while still applying the crypto self-custody requirements to those accounts
• requiring the client’s account number in the notice sent when an adviser opens a custodial account, and requiring accountants to notify the SEC Division of Examinations electronically of any material discrepancies found during a surprise examination
• adding a conditional exception for certain discretionary trading authority, without distinguishing between delivery-versus-payment and other settlement, where trading occurs through designated client accounts or issuer records in the client’s name and the adviser’s transfer authority is restricted to prevent diversion of assets to the adviser, accounts controlled by its related persons or other nonclient accounts, other than permitted client-directed transfers (other custody triggers, such as fee deduction or broader withdrawal authority, would still require compliance with the rule or another exception)
• adding an exception for inadvertent custody, meaning unwanted custody authority arising solely from a client’s agreement with its custodian, where the adviser does not recommend, request, or require the client’s selection of that custodian and either does not have the agreement and does not know, or have reason to know, of the authority or, upon discovering it, promptly notifies the client and custodian, repudiates the authority, and requests in writing that it be removed or replaced (the exception addresses unwanted contractual authority, not the inadvertent receipt of client assets)
• adding an exception (for surprise examinations only) for standing client instructions to transfer money, known as standing letters of authorization (SLOAs), where custody arises solely from a qualifying SLOA involving the client, the adviser, and a qualified custodian that is neither the adviser nor a related person; the client’s signed authorization identifies the third-party recipient and its address or receiving account number; and the adviser has no ability or authority to designate or change the recipient information (the adviser would still have custody and remain subject to the rule’s other requirements and to related recordkeeping and would report custody on Form ADV, although assets and clients attributable solely to qualifying SLOAs would be excluded from the reported custody totals)

The release also provides the SEC’s views on several custody rule topics. Client assets would need to be segregated from the proprietary assets of the adviser, its related persons, and the custodian, although client cash could still be held as ordinary bank deposits. Commingled seller escrows in connection with a pooled investment vehicle’s sale or merger of a portfolio company would be permitted where the vehicle relies on the audit provision and includes its escrow interest in its financial statements, the escrow amount and duration result from bona fide negotiations, a qualified custodian holds the escrow, and the sellers’ representative is contractually required to distribute remaining proceeds promptly under a predetermined formula. For “accommodation reporting,” where an adviser asks a custodian to include externally held assets on its statements, the statement should make clear that the custodian does not hold or control those assets, that the information comes from outside sources for which the custodian is not responsible, and that customary custodial protections may not apply.

Separately, the SEC expects to update its 2009 guidance for accountants performing custody rule engagements, including by revising the definition of “material discrepancy,” adding information technology and crypto-specific control objectives, updating reconciliation testing, and specifying the applicable professional standards. A single internal control report could cover both crypto- and noncrypto assets where the same party is responsible for the controls and the report addresses all relevant objectives.

Updates to the Investment Company Act custody rules

The proposal would make significant changes to the custody framework applicable to regulated funds. In addition to creating new custody pathways for crypto assets, the proposal would modernize several existing Investment Company Act custody rules that extend beyond crypto, including the rules governing broker-dealer custody and BDCs. The SEC also requests input on a broad range of questions relating to Investment Company Act Rule 17f-2, which is referred to as the Investment Company Act’s self-custody rule but also extends to using affiliated custodians and certain third-party custodians where fund personnel can access to the custodied assets upon “mere receipt” of instructions.

Expanded crypto custody options for regulated funds. The proposal would establish two new pathways for regulated funds to custody crypto assets: custody with qualifying state trust companies under proposed Rule 17f-8 and custody through a fund’s investment adviser under proposed Rule 17f-9. As discussed above, these pathways would apply to crypto assets that constitute “securities and similar investments” under the Investment Company Act. Unit investment trusts and face-amount certificate companies would not be eligible to rely on either proposed rule.

Custody with state trust companies. Proposed Rule 17f-8 would permit regulated funds to maintain crypto assets and related cash or cash equivalents with qualifying state trust companies, subject to specified diligence, review, and segregation conditions. A qualifying state trust company would be an entity organized under state law, supervised and examined by a state authority having supervision over banks, and permitted to exercise fiduciary powers under applicable state law. Before engaging the custodian and annually thereafter, a fund would need to determine in writing, based on reasonable inquiry, that the company is authorized to provide the relevant custody services and maintains and implements appropriate safeguarding policies and procedures, including at a minimum private-key management and cybersecurity. The fund also would need to review the custodian’s most recent annual audited financial statements and written internal control report, and its custody agreement would need to provide for segregation of fund crypto assets and related cash or cash equivalents from the custodian’s proprietary assets.

The proposed rule would provide a separate basis for using a state trust company without requiring the fund to establish that the entity meets the Investment Company Act definition of “bank.” A state trust company that independently qualifies as a bank under the Investment Company Act would not need to rely on the new rule. The proposed pathway would be limited to crypto assets and related cash or cash equivalents rather than extending generally to other asset classes.

Crypto custody through the fund’s adviser. Proposed Rule 17f-9 would permit a regulated fund to maintain crypto assets through its investment adviser if the adviser complies with the proposed adviser self-custody requirements and the fund’s board provides prescribed oversight. This pathway would be available only when the adviser has a reasonable basis, after due inquiry, for determining that no custodian permitted under the Investment Company Act will maintain the particular crypto asset. The adviser would need to document that determination initially and at least quarterly. Custodian cost would not provide a basis for the determination, and the adviser would need to transfer the asset to a permitted custodian as soon as reasonably practicable if one becomes available.

The adviser also would need to satisfy requirements addressing safeguarding expertise, private-key management, joint transaction authorization, client-specific crypto addresses, cybersecurity, annual reviews, internal control reports, account statements, and written treatment of the assets under applicable state law implementing Article 8 of the Uniform Commercial Code. The fund’s board, including a majority of independent directors, would be required to review the adviser’s written custodian-availability determination before the arrangement begins and quarterly thereafter and, before the arrangement begins and annually thereafter, determine that the crypto asset would receive reasonable care, considering information concerning the adviser’s safeguarding expertise and systems, annual reviews, and internal control reports. If the relevant annual review or internal control report is not available when the board makes its determination, the adviser would need to furnish it for board evaluation by the next regularly scheduled board meeting after it becomes available. The proposal also includes conditional relief for receipt of airdropped or otherwise distributed crypto assets.

Modernization beyond crypto assets, including broker-dealer custody. The proposal also would amend the existing Investment Company Act custody framework in several respects that extend beyond crypto assets. BDCs would be expressly included throughout the custody rules, clarifying their ability to rely on permitted custody arrangements other than bank custody. Amended Rule 17f-1 would permit custody with a registered broker-dealer without requiring membership in a national securities exchange, provided that custody of the relevant assets is subject to Exchange Act Rule 15c3-3 (the customer protection rule) or another rule the SEC determines provides similar customer protections. The proposal would replace the rule’s existing enumerated conditions with this customer-protection requirement and rescind Form N-17f-1. Broker-dealer registration alone therefore would be insufficient; funds would need to assess whether custody of the particular assets is subject to Rule 15c3-3 or another Commission-designated rule providing similar customer protections. The SEC also would rescind Rule 17f-3, which the SEC describes as a legacy rule governing free cash accounts, and make technical amendments to other custody rules.

The release requests comment on further modernization, including potential revisions to traditional fund self-custody under Rule 17f-2. The SEC specifically discusses whether its historical guidance for how to treat affiliated custodian arrangements under the Investment Company Act should be updated to correspond to more modern affiliated custodian rules under the Advisers Act. The SEC also discusses whether the “privately offered and uncertificated securities” arrangements under the Advisers Act might be carried over to the Investment Company Act. These and other changes, the SEC acknowledges, have special significance for a variety of private assets. The SEC discussion treats custody of loans at some length. These requests for comment are not proposed amendments.

Fund reporting, records, and disclosure. Related amendments would require records supporting the new custody arrangements and permit required records to be maintained on crypto networks if they can be produced promptly to the SEC in a human-readable, reasonably usable electronic format. Form N-CEN would add reporting concerning adviser crypto self-custody and state trust company custody and would require applicable registered funds to identify tokenized funds, series, or classes and the crypto networks used to record ownership. BDCs do not file Form N-CEN; the SEC requests comment on whether additional custody reporting should be required for BDCs. The release also discusses disclosure of material custody facts and risks under existing requirements, including Forms N-1A and N-2, such as operational safeguards, potential conflicts, insolvency protections, insurance, and investor recourse, as applicable.

Recordkeeping, forms, and what was not proposed

Advisers would need to keep new records supporting self-custody determinations, designated key-access personnel, cybersecurity assessments, internal control reports, annual reviews, client reporting, and financial asset elections as well as records needed to reconstruct crypto positions and transactions and records of state trust company diligence and SLOAs, generally under the existing five-year retention framework. The proposal also would expand existing relief from duplicate recordkeeping. Regulated funds would need to keep board materials supporting self-custody and state trust company diligence records for at least six years consistent with Investment Company Act recordkeeping requirements. Required records could be kept on a blockchain if they can be promptly produced in a readable format, although information not available on the blockchain would still need to be maintained separately. In addition, the SEC considered, but did not propose, reduced safeguards for smaller advisers and funds.

New public reporting questions would cover crypto custody arrangements and tokenized funds. Notably, the SEC considered and declined to propose rules allowing assets to be held on crypto trading platforms that are not permitted custodians. In doing so, however, the release describes existing market practices that separate execution from custody, including arrangements in which assets remain with a permitted custodian while execution occurs elsewhere as well as smart-contract and other noncustodial trading mechanisms that can avoid the need to prefund a trading venue. The SEC staff indicates that market participants described practices of this type that are consistent with the existing custody rules and also would be consistent with the proposed rules.

The proposal also does not include a new general exception for DeFi activity. Instead, the release discusses when smart contract and DeFi activity can remain consistent with the custody requirements and seeks comment on circumstances in which assets deployed through a smart contract could continue to be “maintained” by a permitted custodian, including potentially where the custodian retains ownership and control through a receipt or claim token.³ In addition, the SEC considered, but did not propose, a general exemption or reduced safeguards for smaller advisers and funds.

Form Amendments

Form ADV and Form N-CEN would be amended to collect additional information regarding the custody of crypto assets and tokenized fund shares. On Form ADV, new questions would cover crypto self-custody, including amounts, client and address counts, statements, audits, and internal control reports (with separate managed account and private fund information) as well as the use of state trust companies. Item 9 would be revised to distinguish having custody from relying on an exception, including revised treatment of fee deduction and operationally independent related-person custody, and to revise direct and indirect custody reporting, addressing longstanding confusion regarding the appropriate way to disclose custody arrangements and deemed custody practices. New tokenized private fund questions would also apply to exempt reporting advisers, and PCAOB-related questions would be removed. Form N-CEN would add reporting of crypto self-custody, state trust company custody, and tokenized funds, including the applicable series, classes, and networks, and Form ADV-E would receive conforming amendments reflecting the rule redesignation. The release also explains how existing disclosure obligations apply to self-custody conflicts, cybersecurity and DeFi risks, recourse and insolvency risks, and state trust company custody.

Timeline and Next Steps

The comment period closes 60 days after publication in the Federal Register. The release poses more than 300 specific questions. A number of those questions address matters on which current market practice is still developing, including smart-contract interactions, DeFi, receipt tokens, trading-platform arrangements, and the circumstances in which a custodian continues to “maintain” a crypto asset, giving market participants an opportunity to shape the Commission’s approach before adoption

As proposed, the SEC would make the new custody rule, including the crypto asset self-custody options available immediately, meaning advisers and funds could use the new crypto custody options once a final rule is adopted and takes effect, provided they meet the conditions imposed by a final rule. Most other changes would apply as of the effective date, although the SEC asks whether additional time is needed.

Etherial Edetan and Claudia Woodfield contributed to this Sidley Update.

---

¹ See Sidley’s Securities Enforcement and Regulatory Update, SEC Releases Landmark Interpretation on Application of U.S. Securities Laws to Crypto Assets, in Coordination With CFTC.

² Sections 2(6) and 2(23) of the GENIUS Act, Pub. L. No. 119-27, 139 Stat. 419 (2025).

³ This custody analysis is distinct from whether a receipt token is itself a security. The SEC’s March 2026 crypto interpretation separately addressed staking receipt tokens and redeemable wrapped tokens, including circumstances in which such tokens merely demonstrate ownership of an underlying nonsecurity crypto asset.