Qualified custody for digital assets: the SEC’s modernization proposal

Rule 206(4)-2 under the Investment Advisers Act, the custody rule, requires a registered adviser with custody of client assets to hold them with a qualified custodian: a bank, a registered broker-dealer, a futures commission merchant or certain foreign institutions. The rule predates digital assets by decades, and applying it to assets that are controlled by whoever holds a key has been one of the most persistent compliance questions for institutional managers in this market.

Where the rulemaking stands

In December 2025 the SEC published a model framework for custody rule modernization that set out how it intended to address digital assets, including the private-key management techniques the industry actually uses: multi-party computation, multi-signature arrangements and hardware-isolated key storage. On 25 August 2026 a proposed rule titled Amendments to the Custody Rules was submitted to the White House Office of Information and Regulatory Affairs for review. As of this writing it remains a proposal. No new custody requirement has taken effect.

What is in scope

The rulemaking is directed at registered investment advisers and registered investment companies. It is not aimed at individual holders or at developers of non-custodial software. Its practical questions are institutional ones: when does an adviser have custody of a digital asset; which entities may act as qualified custodians for it; how must those custodians segregate client assets and protect them in an insolvency; and what does an adviser have to do, on an ongoing basis, to satisfy itself that its custodian is fit.

• Definition of custody where control of a private key is the relevant fact
• Eligibility of state-chartered trust companies and other entities as qualified custodians for digital assets
• Treatment of MPC and multi-signature arrangements where no single party holds a complete key
• Segregation and bankruptcy-remoteness of client digital assets held by a custodian
• Ongoing adviser diligence, including annual assessment of the custodian’s authority and controls

What institutional practice already looks like

The market has not waited for the rule. Institutional custody today is typically MPC-based key management with hardware isolation, a policy engine that enforces approval quorums and whitelisted destinations, segregated accounts per fund, and controls assurance in the form of SOC 1 and SOC 2 reports and information-security certifications. Where an asset class or a fund’s regulatory position requires a qualified custodian, managers use state-chartered trust companies or banks with digital asset authority. Cobo’s 2026 guide for asset managers describes this as the baseline institutional investors now expect regardless of what the rule ultimately requires.

What could change

A final rule could confirm that the structures already in use satisfy the qualified custodian requirement, which would remove a long-standing ambiguity. It could also impose requirements that current arrangements do not meet: specific insolvency protections, specific segregation standards, or limits on which entity types qualify. Advisers with digital asset exposure should expect to document their custody arrangements in more detail, to conduct and record annual diligence on their custodians, and to be able to show that no individual or single provider can move client assets alone.