SEC Some funds are proposed to be allowed to hold encryption keys on their own. Who will verify the custody?

The U.S. Securities and Exchange Commission (SEC) proposed a new custody framework on October 1st, which would allow investment advisors and regulated funds to hold crypto assets on their own under certain circumstances. This is merely a proposal and is still in the feedback collection stage. Moreover, it changes more than just who holds the private keys. It also stipulates that when transactions are irreversible and keys can be copied without leaving a trace, and the party supervising the assets is also the same party controlling them, what evidence should the fund provide.

• SEC proposed changes to encrypted custody on October 1st, which apply to registered investment advisors and regulated funds.
• Conditional self-hosting and state trust company hosting both appear in the same proposal, but they involve different regulatory issues.
• The public will have a 60-day comment period after the publication in the Federal Register, and not from the date of release of the SEC press release.
• Once the private key is copied, assets can be transferred without leaving any traces of physical intrusion or a custody receipt.
• The key inspection lies in how the independent party verifies the control on the chain, the ledger, and the customer's rights and interests.

The announcement of SEC describes a customized framework that applies to the 'Investment Advisors Act' and the 'Investment Companies Act'. Some reports have simplified it as 'institutions have been approved for self-hosting', but this ignores a key qualifier: only under specific circumstances. The announcement also covers advisor audits as well as brokerage dealer hosting services for regulated funds. The press release is merely a roadmap for the proposed rules and cannot replace the conditions outlined within them.

What investors see are their account statements and the net asset values of their funds. The assets that underlie these numbers may be held in a wallet with multiple signatories, in an account of a trust company, or within a system operated by a consultant. Public blockchains can display wallet balances, but they are unable to identify the legal beneficiaries, cannot prove that any signatory has not copied the private keys, nor can they show whether off-chain pledges have imposed any burdens on the tokens. This missing link is what is referred to as the custody issue.

What the committee has truly brought to the forefront

The proposal dated October 1st applies to registered investment advisors and regulated funds, including registered investment companies and business development companies. According to SEC, it will allow for the self-management of crypto assets under specified circumstances and permit the use of state trust companies as custodians for clients' and funds' crypto assets. The comment period is 60 days after the publication in the Federal Register. As of October 2nd, this announcement alone does not establish a final compliance date nor grant unconditional self-custody rights.

There are two old systems involved here. The advisor custody rules focus on clients whose assets advisors have access to; the fund system, on the other hand, imposes additional requirements for the secure keeping of portfolio securities and similar investments. To broadly refer to both as "funds," or to suggest that state trust companies automatically address these two types of issues, would obscure the differences that the proposal is intended to address. According to the schedule for rule formulation from SEC10 month, the institutions also propose to amend the audit of advisors' financial statements as well as the content related to fund brokerage dealer custody services.

The timeline is also important. In 2025, SEC staff issued a conditional stance of not taking enforcement action against certain state chartered trust companies, a path that crypto.news had previously reported on. The staff's stance differs from the committee's rules. The proposed framework now invites the public to comment on a broader framework, which includes self-hosting. The White House's previous review of the hosting proposals was merely a procedural milestone and does not mean that the rules have taken effect.

Therefore, the issues regarding eligibility are conditional: who is qualified to use the wallet directly, what safeguards are required, and how regulatory agencies or auditors can verify these safeguards—all these answers must be sought in the proposals, comments, and the final text. Advisors cannot treat a press release as an exception to these rules.

Wallet balance is not subject to custodial audit.

Assume that a fund claims to hold 10,000 units of tokens. Auditors can check whether a specific address contains 10,000 units in a particular block. This proves that such a balance existed at a certain point in time, but it does not prove that the fund has exclusive control over that address, nor does it prove that these 10,000 units belong solely to that fund and not to multiple clients with overlapping claims. Nor does it prove that the address was not temporarily filled just for the purpose of taking a snapshot.

One type of control test is a signature challenge: the custodian signs a unique message from that address, but does not transfer any tokens. This can prove the ability to sign at the time of the challenge, but it cannot prove that the right to sign is exclusive, that the key storage is secure, or that the customer's claim to such rights is enforceable. On-chain test transfers can provide additional evidence regarding transaction permissions, but they also carry risks of transfer and operational issues. Neither of these can replace the verification between the ledger, the customer’s account details, wallet listings, and third-party confirmations.

This is precisely the calculation that inspectors will first request: for each asset, add up the customer's and fund's equity; then compare this total with all controlled addresses, outstanding receivables, and transfers that have been promised but not yet completed. This process is then repeated on multiple randomly selected dates, and changes before and after the cut-off point are checked. Equal amounts on a single day can be artificially created. Repeated ledgers with authorization records and abnormal logs are much harder to forge. What the blockchain provides is the external quantity of assets, while institutions provide the allocation information, and independent parties must test this information.

There are also differences between key control and asset availability. A wallet may require hardware devices, multiple approval processes, and recovery procedures. Signers may not be available during times of significant market volatility; a single signer for recovery could become a single point of failure; upgradable contracts may change transfer rules. Auditors need to examine governance structures, access logs, backup policies, change control mechanisms, and emergency response drills, not just screenshots of account balances.

The private key can be copied, and as a result, the evidence changes accordingly.

Bank vaults have doors, while encrypted private keys represent information. Employees can copy the signature secrets without reducing the original. The first observable abuse could be that very transfer itself. Hardware security modules and multi-party computing can reduce exposure and distribute the authority to generate signatures, but they shift the focus of auditing from the “keys” themselves to checking the devices, software, threshold policies, and management permissions that generate those signatures.

Taking a 3/5 signature arrangement as an example, it sounds more secure than having one person hold the key, but this label alone doesn’t reveal much information. If all three key shards are stored with the same cloud tenant, or are controlled by administrators who share recovery permissions, then a breach in one of those boundaries could still authorize a transaction. If the signers have the ability to change the thresholds or allowlists, then the importance of the change process is no less than that of the signature itself. Independent reviews should inquire: Who can approve? Who can change the approval rules? Who can recover the key shards? Who can view these events in real-time?

Self-management also changed the economic consequences of errors. Traditional intermediaries might be able to reverse an incorrect internal accounting entry before settlement, but a transfer that has been signed on the blockchain and become final cannot usually be reversed by the intermediary. Recovering such funds may depend on the rights of the recipient or the token issuer to freeze assets, or on legal proceedings. These are different remedies, each with its own time limits. A policy that simply states "the manager will attempt to recover the assets" is not equivalent to an enforceable commitment from an isolating account or an insurance company.

The strongest argument in favor of direct control is its practicality. Some assets are inherently digital and require timely staking, governance, redemption, or contract interactions. Forcing all such operations to go through inappropriate third parties could increase latency and introduce new centralization risks. The proposal for SEC is precisely a response to this mismatch. However, once the fund gains operational freedom, it must also explain to the auditing parties how it will exercise that freedom responsibly.

State trust options have changed the boundaries.

The self-hosting conditions outlined in the proposal are more restrictive than the brief description in the press release. According to the statement on the proposed hosting rules from Commissioner Hester Peirce, advisors are first required to determine whether there is no available eligible host for a particular crypto asset, and this determination is to be repeated quarterly. This represents an exception to the usual freedom of choice regarding how to hold such assets, rather than allowing for a free selection among different hosting options for the same popular coin. The proposal also includes qualified service providers in the compliance testing process: if a host becomes available for that asset later on, the advisors' initial assumptions may change.

This kind of repetitive evaluation needs to be documented. Which hosting providers were contacted, what assets and network versions were provided, what services were requested, and why were none of the providers available? Perhaps one hosting provider can store ERC-20 tokens, but they are unable to handle staking rewards or cross-chain bridge withdrawals; whether this meets the specific requirements of the combination may vary in the final outcome. Consultants should not quietly redefine "availability" as convenience or price. Quarterly records allow inspectors to compare the so-called obstacles with the actual market supply at that time.

The comparison between quarters is more stringent than that in the initial memorandum. Suppose a consultant starts self-hosting a newly issued token in January because there is no authorized host that supports its blockchain. By March, a service provider begins to offer support. For the next assessment, the consultant should document the actual services provided by this service provider, whether they can ensure the same level of asset protection, and any reasons why migration is not feasible. According to the final rules, a written plan for migrating the position may also be required. Migration costs, tax implications, transaction consequences, and operational risks are all real considerations, but these factors cannot be assumed to be exempted from the proposal without reviewing the relevant documentation.

Another scenario is where a fund holds tokens through a certain contract, and while a qualified custodian can view that contract, they are not able to independently withdraw the assets. Here, what does “availability” refer to—does it mean being able to hold the receipt tokens, operate the contract, or only store the assets after a redemption? The answer determines whether self-custody is an exception for the assets or an exception for the investment strategy. Commentators could clarify this point with specific asset and workflow examples, rather than making general requests for flexibility. What inspectors need are repeatable standards, not different definitions for each profitable transaction.

Advisors should also retain the rejected quotes and service descriptions. If the hosting party provides support but the advisor declines due to high costs, this should be clearly recorded. If the hosting party lacks a key withdrawal feature, the advisor should also highlight this limitation. These distinctions help independent reviewers determine whether exceptions are triggered by unavailability of the hosting service or by commercial preferences. They also protect institutions that make defensible decisions in rapidly changing markets.

The statement of Peirce also clarifies the scope of self-managed disputes: under limited conditions, both advisory client assets and regulated fund assets are within the scope of attention. However, this does not erase their respective governance structures. For funds, the board of directors and service providers need to understand why exceptions apply and when they should be terminated. For clients with separately managed accounts, there needs to be clear and understandable disclosure indicating who is signing and where the rights of claim lie. The same company may manage both at the same time, but the chain of evidence should indicate which legal asset pool each wallet belongs to.

State trust companies may specialize in wallet operations and asset isolation, while introducing regulatory agencies, inspection mechanisms, and external corporate entities. crypto.news has previously reported on the conditional pathways for such institutions by SEC personnel. The proposal in October will address this issue through rule-making. Neither a license nor the label of “trust company” can prove the operational control of a particular provider; a license only indicates the regulatory system it is subject to and the company responsible for its obligations.

Advisors using trust companies should inquire: to whom does the wallet belong, who is the registered customer, whether the company uses mixed addresses, and how the bankruptcy administrator will identify the customer's assets. Even if the web page dashboards look exactly the same, the answers may differ. The contract may state that the assets are held for the customer, but the operating ledgers may make it difficult to determine which tokens belong to which customer. This is a legal and evidential issue, not a problem of blockchain throughput.

If a trust company outsources its signature technology, this point also needs to be questioned. Platform providers may offer wallet software, recovery services, or transaction screening. The trust company can still act as the nominal custodian, but the outsourcing party may have sufficient authority to interrupt withdrawals or change transaction policies. Regulators and advisors should map out the actual control pathways that go through sub-contractors. The location of the private key may not be the same as the location of legal responsibility.

However, there are also opposite benefits. Independent custodians can provide auditors with independent reports and confirmations. But if the custodian relies on the advisor's own position files and never tests the underlying wallets, this independence is not automatically established. Robust external confirmations should identify addresses or verifiable lists, customer equity, liabilities/mortgages, as well as the scope of the custodian's knowledge. Vague balance proofs cannot answer the most difficult questions.

There are two layers between fund shareholders and assets.

In the registration of funds, shareholders hold fund shares, rather than a direct claim to a specific Bitcoin output or token address. The fund holds or controls the investment portfolio in accordance with its governance documents, while service providers maintain records for custody, accounting, and transfer agency. If shareholders wish to inquire about the whereabouts of their assets, they must go through these layers. The blockchain itself can only answer the last part of this process.

This is also why a custody error can become a pricing event before the loss is confirmed. If a fund cannot confirm its inventory or its rights to transfer it, it may face uncertainties in calculating net asset value, meeting redemption requirements, and disclosing holdings. The liquidity of exchanges cannot restore lost keys or disputed property rights. The audit and fund custody changes proposed should be read in conjunction with the wallet terms, as they determine how errors will be discovered and communicated.

Imagine a token that is traded around the clock, while the fund calculates its net value on a daily basis. Between the pricing cut-off and the audit confirmation, assets may move, smart contracts may change, and custodians may also suspend transfers. Control measures require a defensible cut-off point and subsequent review of events. Connecting daily wallet snapshots with the daily ledger, and explaining any anomalies, is better than making reserve statements only once a month. If the strategy itself involves transferring tokens between trading venues, verifiers, or contracts, then the amount of evidence required will be even greater.

crypto.news Previous reports on Franklin's tokenization of funds in the money market relief illustrate why this category is important: a registered fund can access assets recorded on the blockchain without requiring each shareholder to own a wallet. This does not mean that SEC has approved every custody model for every type of token. The relief measures for specific products and the proposed general rules have different scopes of application.

The control over tokens may also be stipulated in the contract.

Private keys do not grant complete control. Token issuers may sometimes freeze or reissue balances. Bridge administrators may change how assets are represented on another chain. Lending protocols may hold collateral that could be liquidated. In terms of custody, the address holding tokens is merely a line in the asset control diagram.

Assume that a fund deposits tokens into a smart contract and receives a receipt token in return. At this point, the wallet no longer holds the original assets. The ledger must explain this exchange, as well as the fund's enforceable claims against that contract. Auditors need to know whether redemption is permissionless, whether a third-party administrator can terminate redemption, and whether the fund counts both the original tokens and the receipt tokens as two separate assets. If incompatible units are combined, double-counting may occur.

Inspectors can test this through transaction tracing: starting from the purchase of funds, they can track the tokens as they enter the contract, check the current status of the contract, and verify the receipts against the portfolio accounting entries. Block browsers make such tracing possible, but they do not determine whether the accounting classification or legal characterization is correct. crypto.news Regarding the reports on the advisory role of Securitize, it is explained that advisors, tokenization, and custody roles can coexist, but they are not equivalent to each other.

The same principle applies to staking. Verifier operators can run the infrastructure, but they may not necessarily hold the withdrawal credentials; custodians can hold the withdrawal credentials, yet they may delegate the operational signing rights. If assets are reduced or locked, the actual economic loss may not stem from the theft of keys. Recognizing the custody rules for cryptoassets should prompt institutions to keep separate records of each type of permission.

The first check should start with a failed transfer.

A dry run test can often reveal more issues than a well-crafted control memorandum. Select a standard withdrawal instruction and simulate scenarios such as the signature holder becoming invalid, the device being suspected of being compromised, and the recipient address being changed at the last moment. At which level of approval will the payment be stopped? Who has the authority to switch the signature holder? How long will it take for the fund to be unable to fulfill its own redemption or settlement obligations? The answers can be measured in minutes, access rights, and signing records. This makes it a useful check question, whether the custodian is an external institution or the advisor themselves.

Let's test the opposite scenario: an unauthorized transfer has already been recorded on the blockchain. The event log should display the time of discovery, the affected transactions, the wallets that are still at risk, as well as the entities that are authorized to notify the board of directors, customers, and regulatory authorities. If a fund holds the same asset across three networks, all of them must be identified, not just the address that triggered the alert. If the token contract has a feature for the issuer to freeze assets, who would contact the issuer, and on what basis would such a freeze be authorized? If there is no such freezing feature, then the recovery plan cannot promise to carry out any freezes.

The key recovery plan is also questionable. The recovery path may allow for the regain of control after a device is lost, but those who have access to this path could also seize control from the legitimate holder. A meaningful test should cover the authorization for the recovery process itself, independent notifications, and a period of time during which controversial changes can be prevented. It is not enough to merely claim that the wallet uses multi-signature; actual results of the drills, including any failed steps, must also be recorded.

These programs all require investment, and they may make it seem that such limited exceptions are not worth it for small advisors. This is a completely reasonable concern in the comments. However, the appropriate comparison should be the cost of providing secure storage for financial clients' assets, rather than the price of consumer-grade hardware wallets. For certain assets or structures, a lighter regime might be appropriate, but the boundaries of this need to be clearly justified to both clients and auditors.

The opposing view is regulatory friction.

SEC indicates that the existing rules were established before this asset class emerged, and they have hindered advisors from providing crypto-related advice. Chairman Paul Atkins described this proposal as offering a compliance path when the current framework is unable to keep up. This is very important. Investors may wish to choose an advisor who assumes fiduciary responsibilities, has written controls, and makes public fund disclosures, yet the current ambiguity is pushing risks towards less transparent arrangements.

An overly narrow list of qualified custodians can also lead to an excessive concentration of assets in the hands of a few service providers. If a service fails or a widespread freeze is implemented, many funds could be affected simultaneously. If companies are able to meet clear and testable standards, a conditional direct custody pathway might be able to diversify operational risks. Even if no single design suits all combinations, the benefits of having a wider range of choices are indeed real.

The answer is not that assuming the addition of entities will necessarily reduce risk, but rather a more comprehensive analysis of the potential loss pathways. Specialized custodians may fail due to cyberattacks, bankruptcy, accounting errors, or technical failures of outsourced services; advisors may fail due to weak isolation measures, conflicts of interest among personnel, or insufficient recovery capabilities. Regulations can require both parties to provide evidence and allow customers to see what kind of arrangements they are purchasing. Public commentary should focus on testing burdens and disclosure requirements, as these determine whether the custodian's claims can be independently verified.

A certain institution may use an insurance policy to prove the safety of its assets. However, an insurance policy is a contract with boundaries, exclusions, and conditions; it is not a copy of the lost tokens. Investors need to know the insured entity, the wallets covered by the policy, the events it covers, and the total maximum payout limit. An insurance policy that protects the service provider's own losses may only grant the fund an indirect right to claim compensation. If the maximum payout limit is shared among many customers, it could be exhausted before the losses of a single fund have even been fully compensated. Insurance can mitigate the impact of an incident, but it cannot verify daily custodial practices, nor can it rectify failed claims to property rights.

The same applies to reserve certification ( proof-of-reserves ). It may verify whether a set of assets observed at a certain point in time match the declared balance, but it does not necessarily test liabilities, controls during the period, off-chain obligations, or client-level allocations. The scope of the verification is just as important as that large figure. If the auditor only tests a portion of the addresses provided by management, this should be clearly stated in the report; if they test all the entries in the independent ledger, then that constitutes stronger evidence. However, in either case, it does not automatically become an audit of financial statements.

For fund investors, there are at least four layers of protection. The assets displayed in the on-chain holding addresses; signature challenges or independent custody records link a particular entity to control rights; fund ledgers allocate these assets to investment portfolios and reflect payable amounts or obligations; legal documents define the beneficiaries and the rights in the event of service provider failures. A defect in any one of these layers cannot be compensated for by relying on additional evidence from another layer. Even two more screenshots from a blockchain browser will not fix a missing isolation protocol.

This is the significance of the advisory audit mentioned in the proposal. If the audit obligations are adjusted while changing the custody boundaries, it may strengthen the chain of evidence, but it may also create gaps among those testing it. Commentators should inquire: which independent professionals confirmed which statements, and which statements are not within their scope of work. Before regarding the report's seal as a guarantee, investors have the right to know the scope of its coverage.

As of October 2nd, there is still no definitive conclusion.

SEC has proposed the rules, but they have not yet been approved. A 60-day comment period will only begin after they are published in the Federal Register; the final rules may change the conditions, effective date, and transition provisions. Litigation or subsequent actions by regulatory agencies could also alter the framework. Markets should not interpret a press release as an authorization for a fund to immediately transfer assets out of its current custodian.

Federal custody rules will not eliminate state property laws, bankruptcy claims, contract terms, fund governance, or insurance exclusions. The technical evidence of control by institutions is only meaningful when combined with these legal facts. There is no public evidence in the announcement indicating that any particular trust company or advisor failed to properly manage the assets. This is a design issue concerning the proposed system.

The most revealing disclosure might be quite simple: a table that matches customer rights with verifiable wallets and indicates who can change the signatories. If the final framework allows such records to be independently tested, it will expand access without requiring investors to trust an unreviewed black box; if it still makes the verification process opaque, then moving the private keys inside the fund merely shifts the same problem to another location.

Matters of note

• Federal Register announcement: The actual release date will initiate a 60-day comment period for SEC. Please pay attention to the final deadline for comments.
• Self-hosting requirements: Check which advisors or funds are eligible, as well as whether third-party reviews, isolation, and recovery tests are required.
• State trust handling methods: Pay attention to the final definitions, inspection standards, and the handling of outsourced wallet operations.
• Fund Disclosure: Pay attention to the specific details regarding signatories, liabilities, withdrawal thresholds, and significant custody events.
• Independent verification: Ask auditors whether they can match customer equity with controlled addresses over time, including assets within the contracts.

Frequently Asked Questions

SEC Has it already authorized funds to self-manage encrypted assets?

No. On October 1st, a conditional change was proposed. The final requirements will depend on the rule-making process, and until the final rules and any transitional arrangements come into effect, the existing obligations will still apply.

What is a qualified custodian?

It is an entity that complies with specific custody rule standards and can hold assets on behalf of advisory clients. Whether a certain state trust company will be eligible under future rules depends on the text of those rules and the specific circumstances of that company.

Can a public wallet address prove that a fund owns these crypto assets?

It can only prove the balance observed in a certain block. Legal ownership, exclusive signing rights, customer allocation, and liens all require additional evidence.

If the tokens haven't been transferred yet, why is it still important to copy the keys?

Because copies may be used for unauthorized signatures later on, and no visible traces are left during the copying process, institutions need control measures that allow them to restrict, detect, and recover from such possibilities.

Can multi-signature wallets (3/5) solve the risk of custody?

It can distribute permissions, but the storage locations of key shards, the ability to restore authority, and the capability to change signature rules determine just how independent these five signatories truly are.

Is a state trust company necessarily safer than a consultant?

They have established independent legal entities and regulatory systems, but the isolation of each institution, audit trails, outsourcing processes, and recovery procedures still need to be tested.

SEC When will the comment period end?

SEC indicates 60 days after the publication in the Federal Register. The date of the press release on October 1st is not the starting point of the comment period itself.

What crypto custody questions should investors ask the fund?

It is necessary to inquire who holds the signing authority, how the positions held are verified against shareholder records, which assets are locked or pledged, and who will independently test these claims. This is an educational analysis and does not constitute investment advice.