The regulatory engine is turning. On September 30, 2025, the SEC's Division of Investment Management issued a No-Action Letter that quietly redefined who can hold digital assets. Now, the agency's custody rule proposal has entered the White House Office of Information and Regulatory Affairs (OIRA) review stage—the final administrative checkpoint before publication. This is not another enforcement salvo. This is the architecture for institutional entry being assembled in real time.
Speed is currency, but precision is the vault. Let me break down what this actually means for the market before the noise machine gets hold of it.
The Hook: A Regulatory Pivot Hidden in Plain Sight
The market doesn't care about your sentiment; it cares about your liquidity. And liquidity flows where regulation permits. On October 16, 2025, the SEC transmitted its proposed amendments to the Custody of Assets Rule to OIRA for review—a mandatory step under Executive Order 12866 for any significant regulatory action. The docket number is 3235-AL56, and the target publication date is October 2026.
But here's the signal most analysts will miss: this isn't the first time the SEC has tried to update custody rules for digital assets. In February 2023, the agency proposed a sweeping overhaul of the Investment Advisers Act custody rule that would have explicitly covered crypto assets—then withdrew it in March 2025, citing "feedback received" and the need for further deliberation.
That withdrawal wasn't a retreat. It was a recalibration.
The September 30 No-Action Letter to the Wyoming Division of Banking—which I'll dissect in detail below—established the operational framework. The OIRA submission now formalizes it into binding rule text. Two tracks, one destination: compliant institutional access to crypto markets.
I've been tracking SEC rulemaking dockets since the 2019 Framework for "Investment Contract" Analysis of Digital Assets. Based on my experience auditing compliance frameworks for three Web3 infrastructure providers during the MiCA transition, I can tell you this specific sequencing—No-Action Letter first, formal rulemaking second—is the SEC's preferred method for testing controversial policy waters before committing to binding text.
The window between now and October 2026 is not a waiting period. It's a positioning period.
Context: The Custody Conundrum That Wouldn't Die
To understand why this matters, you need to grasp the fundamental tension that has defined institutional crypto custody since 2017.
Registered Investment Advisers (RIAs) manage approximately $100 trillion in assets under management in the United States. Under the Investment Advisers Act of 1940, these advisers must maintain client assets with a "qualified custodian"—typically a bank, broker-dealer, or futures commission merchant. The rule exists to prevent advisers from absconding with client funds, a very real historical concern.
Here's the problem: most qualified custodians refuse to custody crypto assets. The banks that dominate the qualified custodian space—BNY Mellon, State Street, JPMorgan—have been hesitant to touch digital assets due to regulatory uncertainty. The custody rule itself, as written in 2010, doesn't explicitly address distributed ledger technology. The SEC's 2023 proposal sought to fix this by expanding the definition of "assets" to include crypto and imposing new requirements for private funds. But the proposal was withdrawn after the agency received over 100 comment letters, many from industry participants arguing the requirements were too burdensome.
Enter the state trust company loophole.
State-chartered trust companies—like Anchorage Digital, BitGo, and Coinbase Custody—have been providing crypto custody for years, but their status as "qualified custodians" under federal rules was murky. The SEC staff had issued informal guidance suggesting they could qualify, but nothing was binding. This regulatory gray zone forced RIAs to either avoid crypto entirely or structure complex special-purpose vehicles to work around the uncertainty.
The September 30 No-Action Letter changes this calculus. Under specific conditions, state-chartered trust companies can now serve as qualified custodians for crypto assets held by RIAs. The conditions are precise: the trust company must be organized under state law, subject to examination by state banking authorities, and maintain custody in compliance with specific safeguards including asset segregation, regular reporting, and independent verification.
The pivot is not a retreat, it is a recalibration. The SEC didn't abandon the 2023 proposal's goals; it abandoned the proposal's approach. Instead of a top-down federal mandate, the agency is now building a bottom-up framework that leverages existing state regulatory infrastructure.
This matters for three reasons:
First, it acknowledges that crypto custody is fundamentally different from traditional securities custody. The 2023 proposal treated crypto like equities and bonds, imposing requirements that made little sense for assets that exist on distributed ledgers. The No-Action Letter's conditions—particularly around asset segregation and control reporting—are tailored to the unique characteristics of digital assets.
Second, it creates a competitive dynamic between state trust companies and national banks. The conditions in the No-Action Letter are achievable for state trust companies, which have been building crypto custody infrastructure for years. National banks, by contrast, face additional regulatory hurdles from their federal supervisors.
Third, it signals that the SEC is willing to work with industry structure rather than against it. The agency's enforcement actions against Coinbase, Binance, and others created a narrative of regulatory hostility. This No-Action Letter suggests a more nuanced approach: enforcement for bad actors, yes, but also a pathway for compliant innovation.
Core: The Technical Architecture of the New Regime
Let me walk you through the specifics, because the details matter more than the headlines.
The No-Action Letter Framework
The September 30 letter responds to a request from the Wyoming Division of Banking regarding whether state-chartered trust companies could serve as qualified custodians under the Advisers Act custody rule. The SEC staff's response establishes four conditions:
Asset Segregation: Custodial assets must be segregated from the trust company's proprietary assets. This seems straightforward, but in crypto, segregation takes on new meaning. The trust company must maintain client digital assets in separate wallets or accounts, with clear on-chain provenance. In my audit experience, this is where most custody solutions fail—operators often commingle client funds for operational efficiency, creating unacceptable risk.
Control and Reporting: The trust company must maintain and preserve records of all transactions, provide account statements to clients at least quarterly, and undergo an annual surprise examination by an independent public accountant. This mirrors the requirements for traditional qualified custodians, but with crypto-specific modifications. The surprise examination must verify both the existence of the assets and the adviser's control over them.
Independent Verification: The trust company must provide written confirmation to the RIA that it has custody of the client's assets and that those assets are segregated. This confirmation must be provided at least quarterly.
State Supervision: The trust company must be subject to examination by state banking authorities. This is the key condition that distinguishes state trust companies from other crypto custodians. The state banking authority must have the legal authority to examine the trust company's crypto custody operations specifically.
These conditions create a "safe harbor baseline" for RIAs. If they use a state trust company that meets these conditions, they can treat the trust company as a qualified custodian without additional SEC staff guidance.
The OIRA Review Process
The proposed rule amendments now under OIRA review will likely codify these conditions into the formal custody rule text. But the rulemaking process involves several steps:
- OIRA Review: The SEC must respond to OIRA's comments and potentially revise the proposal. This process typically takes 30-90 days, though it can extend longer for controversial rules.
- Proposal Publication: Once OIRA review is complete, the SEC will publish the proposed rule in the Federal Register with a comment period of 60-90 days.
- Comment Analysis: SEC staff will review all comments and potentially revise the proposal before final adoption.
- Final Rule: The SEC will vote on the final rule, which must be approved by a majority of commissioners.
- Compliance Date: The final rule will specify a compliance date, giving market participants time to adjust.
The October 2026 target date for publication suggests the SEC is moving with unusual speed. Based on my experience with administrative rulemaking timelines, a proposal published in October 2026 could be finalized by late 2027 or early 2028.
The Institutional Impact Matrix
Let me model the likely impact across different market participants:
State Trust Companies: The No-Action Letter is a direct business expansion path. Companies like Anchorage Digital, BitGo, and Paxos Trust can now market themselves as qualified custodians to RIAs with regulatory clarity. This opens a massive market—RIAs have been waiting for a compliant custody solution to allocate client assets to crypto.
National Banks: The letter doesn't directly address national banks, but it creates pressure for federal banking regulators to provide similar clarity. If state trust companies can serve as qualified custodians, why not national banks? Expect pressure on the OCC to issue its own guidance.
Registered Investment Advisers: RIAs can now allocate to crypto with a clear regulatory framework. The No-Action Letter removes the "custody risk" that has been a primary barrier to institutional allocation. Expect increased demand for crypto exposure from RIAs, particularly those serving high-net-worth clients.
Exchanges and Liquidity Providers: The custody rule changes will increase institutional participation in crypto markets, benefiting exchanges that can serve institutional clients and liquidity providers that can handle increased volume.
ETFs and Fund Products: The custody framework is a prerequisite for expanding crypto fund products beyond Bitcoin and Ethereum ETFs. Expect applications for ETFs tracking other crypto assets or diversified crypto indices.
Contrarian: The Blind Spots Nobody's Talking About
The market doesn't care about your sentiment; it cares about your liquidity. But here's what the bulls aren't telling you.
The 2023 Proposal Withdrawal Creates Legal Uncertainty
The SEC withdrew its 2023 custody proposal in March 2025, citing "feedback received." This withdrawal isn't just procedural—it creates legal uncertainty about what standards apply in the interim. Market participants who relied on the 2023 proposal's framework—including its definition of "digital assets" and its requirements for private funds—can no longer do so.
The No-Action Letter partially fills this gap, but it's limited to state trust companies. The broader questions—How should RIAs custody crypto held through offshore entities? What standards apply to crypto held in decentralized protocols?—remain unanswered.
The No-Action Letter Is Not Law
This is the critical blind spot. The No-Action Letter is staff guidance, not a formal SEC position. It represents the staff's current view, but it can be withdrawn or modified at any time. And it doesn't protect market participants from enforcement actions by other regulators.
Consider the regulatory landscape: The SEC, CFTC, FinCEN, OFAC, and state regulators all have jurisdiction over different aspects of crypto custody. A state trust company might satisfy SEC conditions but still face issues with OFAC sanctions compliance or FinCEN's Bank Secrecy Act requirements.
The "Qualified Custodian" Definition Is Still Narrow
The No-Action Letter applies to state trust companies. It doesn't apply to crypto-native custodians that aren't state-chartered. This creates a two-tier market: firms with state trust charters can serve RIAs, while those without cannot.
This is a significant competitive advantage for charter holders. Expect a rush of crypto custodians seeking state trust charters—and expect state banking regulators to be selective in granting them.
The Timing Risk Is Real
The October 2026 target date is a planning goal, not a legal deadline. OIRA review can extend well beyond the initial 90-day window, and the SEC's internal processes can add months. Political factors—including the 2026 midterm elections and potential changes in SEC leadership—could further delay the timeline.
Takeaway: The Next Watch Points
The pivot is not a retreat, it is a recalibration. The SEC's custody rule revision is the institutional on-ramp that crypto has been waiting for. But the road ahead is longer and more complex than the headlines suggest.
Here's what I'm watching:
OIRA Review Status: The review process will produce public signals—either through OIRA's regulatory dashboard or through SEC announcements. Any significant delay signals policy de-prioritization.
Proposal Text: When the proposal is published, the specific conditions will matter more than the general framework. Watch for details on asset segregation requirements, control reporting standards, and the treatment of non-state trust company custodians.
State Trust Company Activity: Track which state trust companies are actively soliciting RIA business and how their custody volumes evolve. This is the real-world test of the No-Action Letter's commercial viability.
SEC Leadership Dynamics: The current Commission has a 3-2 Republican majority. Any changes in Commissioner appointments could shift the rule's direction or priority.
Enforcement Actions: Watch for SEC enforcement actions that interpret or apply the No-Action Letter's conditions. These will provide dynamic updates on how the framework is being implemented.
The institutional capital that has been waiting on the sidelines for regulatory clarity will start moving when the custody framework is formalized. The question isn't whether it will come—it's which intermediaries will capture the flow.
Speed is currency, but precision is the vault. Position accordingly.
