On February 15, 2023, the U.S. Securities and Exchange Commission published File No. S7-04-23, a proposal to rewrite Rule 206(4)-2 — the custody rule under the Investment Advisers Act of 1940. The operative phrase was three words: 'any assets.' Crypto was the target. The comment file filled with hundreds of letters, most of them from advisers who had never before written to the Commission. Then, in June 2025, the SEC deleted the proposal from its regulatory agenda. No vote. No final text. One line in a PDF.
The market read the withdrawal as relief. I read it as a data point. In a sideways tape, where directional bets pay nothing, structural obligations are the only thing that compounds. The number of advisers disclosing digital-asset exposure on Form ADV keeps climbing. The number of qualified custodians able to serve them has not moved. And the obligation the 2023 proposal described is already being priced into every adviser that touches client keys — rule or no rule.
Trust is a variable, verification is a constant.
Rule 206(4)-2 is not new. It dates to 1962 and was last amended in 2010, in the shadow of Madoff. Its logic is narrow and durable: if an adviser has custody of client assets, it must either hold them with a qualified custodian and verify that the custodian sends account statements directly to clients, or submit to an annual surprise examination by an independent public accountant.
For custodial banks and brokerage accounts, that framework held. For crypto, it fractures at two points.
The first is the definition of custody. Under the rule, custody turns on possession or access. In traditional finance, access is an account at a bank. In crypto, access is a private key — or a shard of one, or an MPC share, or a smart-contract permission that can move funds. The 2023 proposal tried to name this. It defined custody to include the ability to 'possess or control' crypto assets, which drags MPC wallets, multi-sig quorums, and certain protocol admin roles into scope. It also proposed that an adviser could not escape the rule by delegating key management to a third party it controlled.
The second fracture is verification. The rule assumes the custodian issues statements that mean something. Crypto custodians issue attestations. An attestation is a snapshot: here are the addresses, here are the balances at block N. It carries no opinion, no materiality threshold, no testing of internal controls, no negative assurance. An attestation is not an audit. It is a photograph of a ledger with no chain of custody. I have reviewed three such attestations in the past eighteen months. None would survive a surprise examination.
What replaced the proposal is not a rule. It is a patchwork. The SEC's Crypto Task Force has signaled a preference for engagement over rulemaking. State regulators — New York's trust charter regime, Wyoming's SPDI framework — fill the gap with their own definitions of custody. For an adviser operating across three states and two protocols, the compliance surface is now larger, not smaller.
That gap — between what the rule assumes and what the industry produces — is the whole story. Everything else is commentary.
Strip the press language and the proposal demanded three things. A written agreement with a qualified custodian, with enumerated terms: indemnification, liability for sub-custodians, and a duty for the custodian to notify the adviser of any material event — including a change in control or a breach. A 'reasonable belief' standard: the adviser must believe, after inquiry, that the custodian sends account statements to clients. Not hope. Not rely on a dashboard. Believe, after inquiry, with documentation behind the belief. This is a records requirement disguised as a state of mind. And surprise examinations extended to all assets, conducted by an accountant registered with the PCAOB, with the report filed on Form ADV-E within 120 days of the examination.
Start with the definition, because that is where the design actually bites. In crypto, a qualified custodian is almost always a state-chartered trust company or a limited-purpose trust charter — New York, Wyoming, South Dakota. That structure exists because a trust can hold assets in a fiduciary capacity. It is not a technology standard. It is a legal container. An adviser that runs its own MPC key infrastructure does not qualify, no matter how good the cryptography is, unless the adviser itself holds a trust charter — which almost none do. The rule would have forced a choice: surrender key control to a legal entity you do not own, or accept the surprise-examination burden on infrastructure you cannot document to PCAOB standards.
The examination itself is where the rule grows teeth, and where most people misread it. It is not an examination of the asset. It is an examination of the adviser's controls over the asset. The auditor does not verify that the BTC exists on-chain. The auditor verifies that the adviser's process for confirming it exists is sound — that keys are segregated, that reconciliation is performed on a defined cadence, that the access log is complete and immutable.
The code does not lie, only the whitepaper does. The audit does not test the chain. It tests the human layer that claims to control it.
In 2024, while mapping a tokenization framework for a Frankfurt fintech under MiCA, I traced their on-chain governance votes to their off-chain legal entities. The votes were real. The entity legally bound by them did not exist in the same jurisdiction. Four months of review, and the flaw was never in the Solidity. It was in the assumption that code execution equals legal control. The ledger remembers what the founders forget. A custody rule does not care what your smart contract does. It cares who is liable when it does something else.
Apply the same lens to DeFi. An adviser holding client crypto through a protocol has access to those assets through an admin key or a governance vote. Under the rule's logic, that is custody. The adviser must then either find a qualified custodian willing to hold a position in a non-custodial protocol — a category that does not exist — or accept the surprise-examination burden, which requires control documentation that DeFi, by design, does not produce.
That is the structural trap. Not that the rule was harsh. That it exposed the fact that most crypto custody arrangements have no auditable control layer at all.
The audit market confirms it. The proposal required a PCAOB-registered accountant. In crypto, the firms that understand key management are not PCAOB-registered, and the firms that are PCAOB-registered do not understand key management. I watched this same mismatch in 2020, when I flagged a reentrancy pattern in a Balancer contract two weeks before the July exploit. The memo cited line numbers. Senior developers dismissed it — speed over security. The exploit confirmed the memo, and the team's credibility rose 15%. The lesson was not that I was right. The lesson was that the review layer was absent, and its absence was the vulnerability.
I read the implementation, not the intent.
The bulls got one thing right, and it deserves a fair hearing.
The argument for withdrawal was never that custody rules are unnecessary. It was that a rule drafted by people who equate access with a bank account would funnel every compliant adviser into a handful of custodians — the large exchanges, the trust-chartered banks. Concentration risk, dressed as investor protection. If three custodians hold most institutional crypto, the failure of one is a systemic event, and the surprise-examination framework does not prevent it. It documents it, afterward, in a filing nobody reads until the loss is booked.
That critique is correct. The proposal's qualified-custodian definition would have frozen the market into incumbents, because only they could meet the capital and control thresholds. Smaller custodians with genuinely stronger architectures — real MPC, real segregation, real key ceremonies — would have been priced out by compliance cost, not by incompetence.
Europe did not wait. MiCA's custody provisions took effect in stages through 2024 and 2025, with explicit requirements for segregated wallets, liability for lost assets, and a formal custody authorization. A U.S. adviser with EU clients now runs two standards: a MiCA-authorized custodian for one book, an undefined U.S. standard for the other. That is not a lighter regime. It is a heavier one, split in two.
But withdrawal did not fix the concentration problem. It removed the concentration risk and the investor protection together. What remains is Rule 206(4)-2 in its 2010 form, applied to crypto by analogy, enforced case by case. The advisers who wanted clarity did not get it. The custodians who wanted a moat did not get it either. What got created is a gray zone where the standard is whatever the examiner decides on the day.
Silence is not agreement, it is data. The Commission's silence on custody is not a policy. It is a deferral of liability onto the adviser's legal budget.
The practical consequence, for anyone managing client crypto today, is that the absence of a rule is not the absence of an obligation. The 2010 framework still applies. Surprise examinations still get requested. Form ADV still gets filed. The only thing that changed is that the adviser no longer knows which standard the examiner will use.
My advice to the three funds that asked me this quarter was identical. Document your control layer as if the 2023 proposal had passed. Written agreements. Segregated keys. Reconciliation logs. An auditor who will sign an opinion, not a screenshot.
The rule never passed. The liability arrived anyway.
