What Crypto Custody Rules Cover and Why the Scope Matters
Crypto custody does not fall under one blanket SEC rule. The rules depend on the type of firm holding the assets, the service it provides, and the legal framework that applies. In 2025, the SEC withdrew a broad proposal that would have extended investment-adviser custody requirements to all client assets, including crypto.
- The existing SEC custody rule covers registered investment advisers holding client funds and securities.
- A 2023 proposal would have expanded the rule to cover all client assets, not just funds and securities.
- The SEC withdrew the proposal in 2025, so it is not a custody requirement in force.
- Control of private keys matters, but does not settle legal custody or customer protections on its own.
What the SEC proposed
The SEC’s existing Custody Rule, Rule 206(4)-2 under the Investment Advisers Act, sets requirements for registered investment advisers that hold client funds or securities. Depending on the circumstances, advisers may need to use a qualified custodian, provide account statements, and undergo an independent surprise examination.
In 2023, the SEC proposed replacing the rule with a broader Safeguarding Rule. It would have covered client assets held by registered investment advisers, including assets that are not securities. That broader language could have brought crypto assets under the rule even when a particular token was not a security.
The proposal also would have required advisers, in most cases, to keep client assets with a qualified custodian, subject to proposed exceptions. It never became a final rule. The SEC withdrew it in 2025, so its proposed requirements are not obligations currently in force.
Why “asset coverage” matters
Coverage determines which assets and services fall under a particular rule. Under the existing Custody Rule, it matters whether a client’s property is a fund or security. The 2023 proposal sought to expand the rule to cover all client assets held by an adviser. That distinction is at the heart of the SEC’s fight over crypto asset coverage.
The proposed expansion would have mattered because not every digital asset is legally a security. But classification is only one part of the picture. A firm’s status, its role in handling customer property, and the relevant regulatory framework matter too. The SEC rule does not automatically apply to every crypto exchange, wallet provider, or token.
Other requirements may apply to specific businesses or services, including rules for broker-dealers and obligations under state or federal law. Crypto custody and transfers may also fall under separate regulatory frameworks. “Crypto custody” describes an activity, not one regulatory category with a single set of requirements.
Private keys are only part of custody
A private key is the cryptographic information used to authorize transactions. Holding a key can give a person or company significant control over the associated assets, but that alone does not determine who has legal custody or what duties apply.
Some arrangements split control among multiple parties using multisignature technology or other authorization systems. A custodian might hold one key but lack the power to move funds alone, while another party shares control. The contract, operational setup, and applicable law all help determine who can act and what protections customers have.
What customers should check
Ask who can authorize withdrawals and whether the provider can move assets without your approval. If the arrangement uses shared keys or multisignature controls, find out which parties must approve a transaction and what happens if one is unavailable.
Check how the provider records customer assets and separates them from its own property. On-chain separation or clear account records can help show which assets belong to customers, but neither guarantees customers will recover them if the provider fails. The custody agreement and the legal treatment of assets in insolvency matter too.
Regulatory compliance can provide safeguards, but it cannot replace a clear understanding of the provider’s controls, contracts, and financial condition. The SEC withdrew its 2023 proposal, so firms and customers should not treat its proposed protections as requirements that took effect.
Key questions and answers
-
Does the SEC custody rule cover every crypto asset?
No. The existing rule applies to registered investment advisers’ custody of client funds and securities. The SEC’s 2023 proposal would have extended coverage to all client assets, but the SEC withdrew it in 2025.
-
Does holding a private key make a company a custodian?
Not necessarily. Key control matters, but shared authorization, contractual rights, the service provided, and applicable law matter too.
-
What should customers ask a crypto custodian?
Ask who can authorize transfers, how the provider records and separates customer assets, and what legal rights customers would have if the provider became insolvent.
