The rewrite starts a fresh rulemaking after the agency withdrew its 2023 safeguarding proposal. Until then, US institutional crypto custody runs on a staff letter with no legal force.
The SEC sent its rewrite of the custody rules governing investment advisers and funds to the White House on 25 August, starting a review that must finish before the proposal can be published or voted on.
The Office of Information and Regulatory Affairs, the arm of the Office of Management and Budget that vets federal regulations before publication, lists the measure as "Amendments to the Custody Rules" at the proposed-rule stage with no legal deadline attached. The agency's own entry in the Unified Agenda targets October 2026 for a notice of proposed rulemaking, which is a planning date rather than an obligation. Neither record contains a word of operative rule text.
The SEC has said what the rewrite is for, if not what it says. "This rulemaking would clarify the framework for the custody of crypto assets for investment adviser and investment companies, as well as make other modernizations needed to remove burdens from certain outdated provisions that are no longer needed to provide investor protection given the evolution in the markets and security trading and holding practices," the agency said, adding that advisers had been asking how they can hold crypto for clients and stay compliant at the same time. Bloomberg reported the filing first.
That question has been unanswered for longer than most people realise. In June 2025 the SEC withdrew the safeguarding proposal it had put forward in 2023, closing off any path to a final rule from that measure and stating that further action would require starting again. The draft now sitting at OIRA is that fresh start, not a revival.
What has held the market together in the meantime is a staff letter. On 30 September 2025 the SEC's Division of Investment Management said it would not recommend enforcement against registered advisers or regulated funds that treat certain state trust companies as banks for the purpose of crypto custody, provided a list of conditions is met. Those conditions run to authorisation status, safeguarding policies, audited financial statements, independent control reports, custody contracts, risk disclosures and best-interest determinations. The custody agreement itself must segregate client or fund assets and prohibit lending, pledging or rehypothecation without prior written consent.
A staff no-action position carries no legal force. It binds nobody, it can be withdrawn, and it does not amend a rule. Every registered adviser and fund currently holding digital assets in the United States is operating on that footing, and so are the banks and state trust companies taking the assets in. The commercial stakes reach well past the advisers themselves: whichever institutions the eventual rule deems eligible custodians will inherit a market that has grown for a year on nothing sturdier than a letter from staff.
Chair Paul Atkins has spent his tenure clearing this kind of underbrush. Since his confirmation by the Senate the agency has issued guidance stating that memecoins are not securities, set out which staking activities fall outside securities law, and in March joined the Commodity Futures Trading Commission in a joint statement on how federal securities law applies to digital assets. Ten days ago it went further and proposed Regulation Crypto Assets, a tailored offering regime with $5 million and $75 million tiers, after Congress failed to move the CLARITY Act.
Custody is a harder problem than offerings, because it is where the abstraction stops. An offering regime governs paperwork. A custody rule governs who is allowed to hold the private keys to several billion dollars of client assets, under what audit regime, and with what recourse when the keys are lost. Bankruptcy courts have spent the years since the 2022 exchange failures working out who owns what when a custodian collapses, and the answer has usually turned on contract language rather than on securities law.
The rulemaking's timing is not entirely in the SEC's hands either. OIRA sets its own pace on economically significant proposals, and the agency has already missed self-imposed dates this year. It cancelled a scheduled meeting on Regulation Crypto in mid-August without naming a replacement, then published the proposal days later. Publication is only the start in any case: a comment period follows, then a final rule, then a compliance date. Advisers wanting certainty about where they can put client bitcoin are looking at a horizon measured in years rather than months.
Atkins has also promised an innovation exemption to fast-track crypto products issued on decentralised or novel platforms, and that framework has yet to appear. The SEC has meanwhile been willing to move quickly where the plumbing already exists, granting yield-bearing crypto ETFs a 15 per cent buffer earlier this month.
Until the OIRA review ends, the text stays sealed. The public record shows a title, a stage, a target month and nothing about eligibility, controls or safeguards.
