CRYPTO

Shelf-custody is not your keys

· 5 MIN · 1,114 WORDS

The October 1 proposal did not hand you your keys. It handed the phrase self-custody to the adviser who would hold them.

@SECGov posted at 20:05 UTC that the Commission had proposed rules for how registered investment advisers and regulated funds custody crypto assets. In that post, regulated funds means registered investment companies and business development companies. Four minutes later @zerohedge ran the bulletin line: the proposal would permit crypto assets to be held in self-custody under certain circumstances. @SECPaulSAtkins quoted the agency post at 20:13 UTC. His caption is the market, not the keys. He wrote that the crypto asset market “has grown from a niche curiosity into a multi-trillion-dollar asset class,” and that the rules “have not kept pace.” Press release 2026-100, the same afternoon, is where the custody sentence sits. It says the proposal would permit crypto assets to be held in self-custody under certain circumstances, and would allow state trust companies as custodians for client and fund crypto. The permission in that sentence belongs to the adviser.

What she put in quotes

Hester Peirce’s statement is dated October 1. She puts self-custody in quotes and says the quotes are intentional. The proposal, she writes, uses the term in a way that does not reflect true self-custody by investors. It is the adviser acting as custodian for the client’s assets, and the release calls that self-custody. She wanted a different word, shelf-custody, to distinguish the adviser holding client coins from an investor holding their own, with no one in between.

She also writes the sentence the bulletin left off. True self-custody is not the right choice for everyone, but many owners prize holding their own assets, and regulators should protect that instead of forcing the assets onto someone else. Then she writes, “But I digress.” The proposal is the adviser holding the coins.

The threshold is in the same statement. An adviser may take this custody only after determining that no permitted custodian is available for that asset, and it has to make the determination again every quarter. If a bank or a broker-dealer will already hold the coin, this path does not open. It is for an asset no permitted custodian will take. The determination is the adviser’s. The fact sheet does not publish a list you can check. You would have to ask, and then ask again in three months, whether the firm still believes no one else will hold it.

The fact sheet for Release IA-7023, issued the same day, lists what the firm owes once it is holding the coins. It has to document expertise for each asset. It has to keep systems against loss, theft, misuse, and misappropriation, and review those systems at least once a year. The systems have to cover private key management, and joint authorization of any transaction by at least two people. Each client’s coins go to one or more addresses that store only that client’s coins. Cybersecurity controls get their own yearly review. An independent public accountant reports on the controls within six months of the firm starting, then every year after that. Clients get account statements at least quarterly.

Two people have to authorize a send. The fact sheet does not say one of them is the client, and it does not say the client can see the control on the chain. Joint authorization by two people is not a seed only you can move.

A regulated fund can use the same slot only through its adviser, and only if the board oversees the arrangement. The board is not you.

What did not move

The file is S7-2026-35. The releases are IA-7023 and IC-36353. It is a proposal. Comments stay open for 60 days after it is published in the Federal Register. October 1 did not change the keys in a wallet you already run.

Peirce’s third footnote is the scope line. The Advisers Act amendments would apply to crypto assets that are funds or securities, and, for a regulated fund’s account, a security or similar investment. The Investment Company Act rules would apply to crypto assets that are securities or similar investments. A coin that is not a security is outside this draft. So is a wallet that is not an advisory account. This is about an adviser who holds client assets, or who can get hold of them. It is not a new rule for a person who already keeps their own coins.

The other option is a state-chartered trust company. Before an adviser or fund hires one, and again each year, it needs a reasonable basis, after due inquiry, that the state banking authority has authorized the company to custody crypto, and that the company has written policies against theft, loss, misuse, and misappropriation. Peirce says letting eligible state trusts in would add competition and options. It would. The keys would still sit at the company.

She also notes why the no-custodian case exists. Current rules assume a permitted custodian, and few traditional custodians have offered real custody across a wide range of crypto assets, partly because of earlier Commission action and staff statements. Her footnote points at the 2023 safeguarding proposal. That draft said an adviser could already be in violation when a crypto asset security trades on a platform that is not a qualified custodian, because the asset would not sit with one from the transfer through settlement. Mark Uyeda’s statement the same day says the conflict in plain language. When no qualified custodian will hold the asset, custody by the adviser may be the only compliant path, and that path is a conflict. The fiduciary duty still applies while the firm holds the coins. The label does not remove the conflict.

@zerohedge’s bulletin had 90,630 impressions and 500 likes when I read it. Under that post, @xrpl_adam flagged Peirce’s distinction, that this is the adviser acting as custodian and not the investor holding the keys. The reply had 4 likes. People saw the bulletin.

She posted “T minus 7” on September 25. I have not opened the image. TFTC, that day, said her last day is October 2. A cryptoticker piece, citing CoinDesk and American Banker, said the same. I have not read those two papers. The statement from October 1 is the document I am using. It refuses the word. The proposal uses the word.

If an adviser says the SEC just allowed self-custody, ask whose name is on the address, and how many people have to authorize a send. If the answer is the firm, and two of them, the firm has the keys. Yours are the ones nobody else can move, and this proposal does not create that case.