What is qualified custody for institutional crypto?

A custodian and a qualified custodian are not interchangeable terms. Both describe an entity holding assets on behalf of a client, but only the second carries a specific legal status: recognition, under enforceable rules, as an institution eligible to keep those assets for investors, funds, and advisers.

In the United States, the concept sits inside the Investment Advisers Act of 1940 and the Investment Company Act of 1940, and it moved twice during 2025. An accounting rule that had discouraged banks from touching crypto assets was rescinded in January, and a narrower category of state-chartered institution was cleared to serve as a qualified custodian for the first time in September.

A qualified custodian is an entity a regulator recognizes as eligible to hold client funds or securities for a registered investment adviser or a regulated fund. In the United States, that generally means a bank, a registered broker-dealer, a futures commission merchant, or, since September 2025, a state-chartered trust company meeting specific conditions. The status follows from meeting defined requirements, not from a custodian describing its own services that way.

The term comes from Rule 206(4)-2 of the Investment Advisers Act of 1940, known as the Custody Rule, which makes it unlawful for a registered adviser to have custody of client funds or securities unless a qualified custodian maintains them in a segregated account.

The rule dates to 1962 in an earlier form built for paper securities and was substantially rewritten in 2003 to define custody itself and formalize the qualified custodian concept for the account structure it still uses today.

Not every entity that holds crypto assets on a client's behalf meets this bar. An exchange, a wallet provider, or a trading platform can custody assets in a plain operational sense while sitting entirely outside the rule's definition.

Qualified custody exists to make client assets survive the failure of the entity holding them. Three protections attach to the status: segregation of client assets from the custodian's own balance sheet, a degree of bankruptcy remoteness so a custodian's creditors cannot reach client holdings, and independent verification through statements or audits. Registered advisers with custody of client assets, and most regulated funds, are required by rule to use one.

Under the Investment Advisers Act and the Investment Company Act, an entity qualifies if it meets the statutory definition of a bank, is a registered broker-dealer, is a futures commission merchant for commodity-related assets, or is certain foreign financial institutions. Since a September 2025 SEC no-action letter, state-chartered trust companies meeting specified conditions can also be treated as banks for the purpose of custodying crypto assets.

National banks reach the same activity by a separate route. An Office of the Comptroller of the Currency interpretive letter from March 2025 reaffirmed that national banks may provide crypto-asset custody services under their existing statutory authority, without new legislation.

State-chartered trust companies sat in a less settled position until the September letter, because the Advisers Act and the 1940 Act define a qualified custodian by reference to the term "bank," and state trust companies do not always meet the federal banking definitions that term was written around.

Non-US frameworks reach a similar destination by a different design. Under the EU's Markets in Crypto-Assets Regulation, a crypto-asset service provider is authorized to offer custody directly once licensed, rather than needing to separately qualify as a bank or broker-dealer. The US approach sorts custodians into pre-existing eligibility categories. The EU approach licenses the custody activity itself.

The SEC Custody Rule, formally Rule 206(4)-2 under the Investment Advisers Act of 1940, makes it unlawful for a registered investment adviser to have custody of client funds or securities unless the assets are held with a qualified custodian in a segregated account, the custodian sends account statements directly to clients, and, in most cases, an independent accountant performs an annual surprise examination.

A parallel framework applies to registered funds through Sections 17(f) and 26(a) of the Investment Company Act of 1940, which is why the September 2025 no-action letter addresses advisers and funds together rather than advisers alone. The rule defines custody broadly. Holding client funds directly, having authority to withdraw them, or serving as a general partner or trustee with access to them can all trigger the requirement, even where an adviser never physically touches an asset.

The rule describes a process, not a technology. It does not specify how a qualified custodian must store a private key or structure a signing workflow, only that the custodian meets the eligibility definition and the segregation, statement, and verification requirements attached to it.

Not straightforwardly. Rule 206(4)-2 is built around a qualified custodian holding assets for a client, a role designed for a third party rather than the adviser managing the account. The September 2025 no-action letter that opened custody to state trust companies left a separate question untouched: whether an adviser can custody its own clients' crypto directly. That question remains open.

A comment letter submitted to the SEC's crypto task force put the industry disagreement plainly: advisers should not be permitted to self-custody client crypto assets without full compliance with the Advisers Act's custody framework, because doing so removes the independent party the rule is designed to insert between an adviser and the assets it manages.

A small number of arrangements already sit close to this line without technically crossing it. An adviser that is also a registered broker-dealer, for instance, can meet the qualified custodian definition itself and hold client securities directly, because the entity satisfies the rule's own eligibility test rather than being exempted from it.

Some advisers have proposed narrower technical routes, including multi-party computation arrangements that split signing authority across several parties so no single key sits with the adviser alone. Whether that satisfies a rule written before such techniques existed is not settled by any current SEC guidance.

The more precise version of the question is not whether an adviser's key management is good enough. It is whether removing the independent custodian from the relationship removes the exact protection the Custody Rule exists to provide, and on that question, splitting a key differently does not change who is holding it.