Crypto custody is no longer an emerging concern. It's a core compliance issue for any investment adviser touching digital assets. CoinDesk's recent analysis of the custody landscape highlights just how much has changed, and how much uncertainty remains for RIAs trying to do this right.
The Qualified Custodian Problem Hasn't Gone Away
The SEC's custody rule, Rule 206(4)-2 under the Investment Advisers Act, requires RIAs to maintain client assets with a qualified custodian. For traditional securities, that's straightforward. For crypto, it's anything but.
Receive future blog posts by email.
The SEC has been clear that most crypto custodians don't meet the qualified custodian standard. State-chartered trust companies operating under specific regulatory frameworks can qualify. Most crypto-native custodians cannot. That gap creates real operational problems.
If you're holding client crypto through an entity that isn't a qualified custodian, you're in violation of the custody rule. Full stop. The fact that the industry is still sorting this out doesn't give you cover.
Segregation and Proof of Reserves
One area where crypto custody has genuinely improved: segregation and transparency. After the FTX collapse, institutional custodians got serious about proving they actually hold what they claim to hold.
Proof of reserves audits have become standard for serious custodians. Segregated wallet structures, where client assets are held separately from the custodian's own holdings, are now table stakes. If your custodian can't demonstrate both, that's a red flag.
But here's the compliance nuance: proof of reserves is a risk management tool, not a regulatory safe harbor. An attestation doesn't make a non-qualified custodian qualified. It just means they're less likely to disappear with your clients' bitcoin.
Insurance Coverage Remains Thin
Traditional custody arrangements come with SIPC protection. Crypto custody does not. Some custodians offer private insurance coverage, but the limits are typically far below what you'd see in traditional finance.
This matters for your Form ADV disclosures. If you're recommending crypto allocations, your Part 2A needs to accurately describe the custody risks, including the lack of SIPC protection and the limitations of any private insurance. Generic risk language won't cut it.
What This Means for Your Firm
If you're an RIA with crypto exposure, your custody due diligence checklist needs to include:
- Verification that the custodian meets the SEC's qualified custodian standard
- Documentation of segregation practices and proof of reserves
- Review of insurance coverage and its limitations
- Clear disclosure language in your Form ADV Part 2A
The crypto custody landscape is maturing. Regulatory clarity is not. Until the SEC provides more definitive guidance on which custodians qualify and under what conditions, the burden is on you to get this right.
Subscribe to Regulated Intelligence Brief
Get new compliance intelligence delivered to your inbox.
Key Takeaways
Can my RIA use a crypto-native custodian for client digital assets?
Only if that custodian meets the SEC's qualified custodian standard under Rule 206(4)-2. Most crypto-native custodians do not. State-chartered trust companies operating under specific regulatory frameworks may qualify, but you need to verify this with documentation, not assumptions.
Does proof of reserves make a crypto custodian compliant with custody rules?
No. Proof of reserves is a risk management tool that demonstrates the custodian actually holds claimed assets. It doesn't change their regulatory status. A custodian with excellent proof of reserves can still fail to meet the qualified custodian standard.
What disclosures do I need if I recommend crypto to clients?
Your Form ADV Part 2A must accurately describe custody risks including the lack of SIPC protection, limitations of any private insurance coverage, and the regulatory uncertainty around crypto custodians. Generic risk language is insufficient.
The content in this blog is for informational purposes only and does not constitute legal advice, regulatory guidance, or an offer to sell or solicit securities. GiGCXOs is not a law firm. Compliance program requirements vary based on business model, customer base, and regulatory classification.