Who Can Custody a Tokenized Security for an Adviser?
Rule 206(4)-2 under the Investment Advisers Act requires a registered adviser with custody of client funds and securities to maintain them with a qualified custodian that sends account statements directly to clients at least quarterly. The rule predates tokenized assets entirely. The SEC proposed a replacement safeguarding rule in February 2023 that would have expanded coverage to substantially all client assets including crypto, withdrew it in June 2025, and scheduled a custody modernization Notice of Proposed Rulemaking for April 2026 with explicit crypto provisions covering key management, segregation, insurance and attestation. In the interval, advisers holding tokenized securities apply a framework built for certificates and book-entry positions. This guide covers where the rule stands, what the modernization is expected to change, and what advisers and issuers should do before it lands.
TL;DR — Key Takeaways
- ✓The Rule in Force: Rule 206(4)-2: client funds and securities held with a qualified custodian, quarterly statements sent directly to clients, no commingling, correct agency notation.
- ✓The Proposal That Died: The February 2023 safeguarding rule would have covered substantially all client assets including crypto. It was formally withdrawn in June 2025.
- ✓What Is Coming: A custody modernization NPRM was scheduled for April 2026 with explicit crypto provisions — key management, segregation, insurance, attestation.
- ✓The Live Gap: Advisers holding tokenized securities today apply a framework drafted for certificates. The hardest case is an asset no qualified custodian will support.
- ✓Why Issuers Care: An instrument no qualified custodian will hold is one advised money cannot easily buy. Custodial supportability is a distribution constraint, not an afterthought.
A Rule Written Before the Assets Existed
Rule 206(4)-2 requires a registered investment adviser with custody of client funds and securities to maintain those assets with a qualified custodian, which must deliver account statements directly to clients at least quarterly. The rule contemplates certificates, book-entry positions and bank custodians. It does not contemplate a token in a wallet secured by a private key.
The mismatch is not a technicality. Custody regulation is fundamentally about who can move an asset and what stops them from moving it wrongly, and a private key is a much more direct form of that power than a custodial account entry. A framework built to separate an adviser from assets held elsewhere has to be rethought when the asset is controlled by whoever holds a secret — which the SEC has acknowledged, proposed a fix for, withdrawn the fix, and scheduled another attempt.
Advisers holding or managing digital assets “should begin evaluating their custodial frameworks now” — with the modernization expected to bring requirements around key management, segregation, insurance and attestation.
— Practitioner guidance on the SEC custody rule ahead of the 2026 rulemaking
That is the correct instruction and worth acting on, because custody arrangements take months to change and a new rule will not grant anyone extra time. The firms that will struggle are those treating the unfinished rulemaking as permission to defer.
Proposed, Withdrawn, Rescheduled
The SEC proposed an enhanced safeguarding rule in February 2023 that would have amended and redesignated Rule 206(4)-2, extending it beyond client funds and securities to substantially all types of client assets held in an advisory account — crypto assets explicitly included. The proposal was formally withdrawn in June 2025, leaving the original rule in force.
| When | What |
|---|---|
| February 2023 | Safeguarding rule proposed — would cover substantially all client assets, including crypto |
| June 2025 | Proposal formally withdrawn; Rule 206(4)-2 remains in force unchanged |
| April 2026 | Custody modernization NPRM scheduled, with explicit crypto asset provisions |
| Now | The existing rule governs; advisers apply a pre-tokenization framework to tokenized assets |
Key Insight
A withdrawal is not a neutral event, and reading it as one leads firms astray. The 2023 proposal, whatever its flaws, told the market what the Commission thought good custody looked like for these assets, and firms had begun designing against it. Withdrawing it removed that signal without replacing it — so the period since June 2025 has been one where the only binding rule is the old one and the only guidance about the future rule is that it will probably be narrower. Firms that built to the 2023 proposal are not wrong, but they are holding a forecast, not a requirement.
What the Rule Requires Today
The obligations in force are concrete and testable, which makes them a better planning basis than speculation about the NPRM. A qualified custodian must hold the assets and send quarterly statements directly to clients; assets must not be held in the adviser's name without proper agency notation; and client assets must not be commingled with employee assets.
1. Qualified custodian holds the assets
The central requirement, and the one tokenized assets strain hardest. The custodian must actually be able to hold the specific instrument, which is a question of operational support rather than willingness in principle.
2. Statements direct to clients, quarterly
The custodian sends them, not the adviser. This is a control against an adviser misreporting positions, and it requires the custodian's systems to recognise and report the tokenized holding correctly.
3. No holding in the adviser's name without agency notation
Titling matters. A wallet or account that does not make the client's beneficial ownership evident on its face creates exactly the ambiguity the rule prohibits.
4. No commingling with employee assets
Segregation at the account level. In a wallet-based context this means the address structure has to keep client and firm holdings genuinely distinct, not merely accounted for separately.
Each of these translates into a question about wallet architecture that the rule does not answer directly. Who holds the keys, how a beneficial owner is evidenced on-chain, and whether segregation is enforced or merely recorded are engineering decisions with regulatory consequences — the same territory covered in institutional RWA custody solutions and compliance.
The Case With No Good Answer: No Custodian Will Hold It
The hardest situation under the current rule is an instrument that no qualified custodian supports. The requirement is not satisfied by good intentions, and an adviser cannot conjure custodial capability that does not exist — which is why the modernization is expected to address assets that cannot readily be maintained by a traditional custodian as a distinct category.
Until that provision exists, the practical options are narrow and each has a cost. Restrict the strategy to instruments with custodial support, which shapes the portfolio around operational availability rather than investment merit. Work with a custodian to add support, which takes time and usually scale to justify. Or structure the exposure through a vehicle that changes what the client actually holds — a fund interest rather than the token itself — which moves the custody question rather than solving it.
| Option | What it costs |
|---|---|
| Only hold instruments custodians support | The investable universe is set by custodial roadmaps rather than by strategy |
| Sponsor custodial support for an instrument | Time and commercial scale; not available to smaller advisers |
| Hold via a fund or SPV structure | Client holds an interest, not the asset; adds structure and cost |
| Self-custody and document the analysis | Reproduces the concentration of control the rule exists to prevent |
The last row is listed for completeness rather than as a recommendation. An adviser holding client tokens under its own keys has the practical ability to move them, which is the condition the qualified custodian requirement is designed to eliminate — and explaining that to an examiner afterwards is a materially worse position than declining the exposure.
Why Issuers Should Care About Someone Else's Rule
Custodial supportability determines which investors can buy an instrument. An asset no qualified custodian will hold is effectively closed to regulated advised capital, however attractive its economics — which makes custody a distribution question that belongs in the issuance design rather than in post-launch operations.
Design for support
- Standard token interfaces custodians already integrate
- Clear, documented asset definition and rights
- Transfer mechanics a custodian can operate
- Corporate actions that resolve predictably
Warning signs
- Bespoke token logic no custodian has seen
- Admin functions that can move holder positions
- Upgradeability with no disclosed governance
- No named custodian at launch
Out of scope here
- Broker-dealer custody under separate rules
- Bank custody regimes
- Non-US adviser regimes
- Retail self-directed holdings
The second column is worth reading as a custodian would. Every item on it is a reason for a custody committee to decline support — not because the feature is illegitimate, but because a custodian asked to hold an asset whose behaviour it cannot fully predict is being asked to accept an unquantified operational risk on a client's behalf.
How Blockmaze Supports Custodial Requirements
Custody rules turn on who can move an asset, under what authority, and whether that can be evidenced. Those are properties a protocol layer can make explicit rather than leaving a custodian to infer them from contract bytecode during a due diligence review.
Segregation Enforced, Not Reported
Client and firm positions are distinguishable at the protocol level, so the no-commingling requirement is a property of the holding rather than an accounting convention layered on top.
Privileged Functions Declared
Any admin or governance power capable of affecting a holding is disclosed, so a custody committee can assess what it is accepting rather than discovering it later.
Position Evidence for Statements
Holdings and their history are retrievable in a form a custodian can reconcile and report from, which is what the quarterly statement obligation actually requires operationally.
Policy Versioned Against Dates
When custody requirements change, the rule set can be staged with an effective date rather than rebuilt — the same property needed for every pending rulemaking.
The pattern is the one running through every unfinished rulemaking this year: the obligations that will apply are not yet fully specified, the structural work has long lead times, and the firms in the best position are those whose infrastructure can absorb a change in requirements without a migration. The parallel case is set out in what happens now the GENIUS Act rulemaking deadline passed.
Designing a Token Custodians Can Actually Hold?
Blockmaze provides the compliance layer that enforces segregation at the protocol level, declares privileged functions, and produces position evidence a custodian can reconcile and report from.
Frequently Asked Questions
What is the custody rule, and why does it matter for tokenized assets?
Rule 206(4)-2 under the Investment Advisers Act requires a registered investment adviser with custody of client funds and securities to maintain them with a qualified custodian, which must send account statements directly to clients at least quarterly. Client assets must not be held in the adviser's name without proper agency notation, nor commingled with employee assets. It matters for tokenized assets because the rule was built around a world of certificates, book-entry positions and bank custodians, and a tokenized security held in a wallet does not map onto those categories cleanly.
What happened to the 2023 safeguarding rule proposal?
It was proposed in February 2023 and formally withdrawn in June 2025. The proposal would have amended and redesignated Rule 206(4)-2, expanding its scope beyond client funds and securities to cover substantially all types of client assets held in an advisory account, explicitly including crypto assets. Its withdrawal left the existing custody rule in force unchanged — which means advisers holding tokenized assets today are applying a framework that was never drafted with them in mind, and that the Commission has acknowledged needs modernising.
What is planned, and when?
A Notice of Proposed Rulemaking on custody rule modernization was scheduled for April 2026, including explicit provisions for crypto assets, with expected requirements around key management, segregation, insurance and attestation. Commentary anticipates a narrower framework than the withdrawn 2023 proposal, given the current Commission's deregulatory orientation, with more specific rules for crypto assets, tokenized securities, privately offered securities, and assets that cannot readily be maintained by a traditional custodian.
Can a tokenized security be self-custodied by the adviser?
Not comfortably under the existing rule. The qualified custodian requirement exists precisely to separate the adviser from the assets, and holding client tokens in a wallet the adviser controls reproduces the concentration of control the rule was written to prevent. The harder question is what happens when no qualified custodian will support a particular tokenized instrument — a real constraint for newer assets — which is one of the gaps the modernization is expected to address through provisions for assets that cannot readily be maintained by a traditional custodian.
What should an adviser do while the rule is unsettled?
Evaluate custodial frameworks now rather than waiting for the NPRM, because the structural decisions are slow and the rule change will not extend anyone's timeline. That means establishing which qualified custodians support the instruments actually held, documenting the analysis where an instrument is not supported, confirming that quarterly statements reach clients directly, and ensuring segregation and agency notation are correct. None of this is contingent on the new rule, and all of it will be examined against whatever the new rule says.
Does this affect the issuer of a tokenized asset, or only the adviser?
Both, through the distribution channel. An instrument that no qualified custodian will hold is an instrument that regulated advisers cannot easily allocate client capital to, regardless of its merits. Custody support is therefore a distribution constraint as much as an operational one, and issuers who treat it as someone else's problem discover late that their addressable investor base excludes the advised money. Designing for custodial supportability — standard interfaces, clear asset definition, workable key and transfer mechanics — is an issuance decision.
Related Articles
Institutional RWA Custody Solutions and Compliance
The operational custody stack for tokenized assets and what institutions require of it.
How Do Custodians Ensure Compliant RWA Transfer?
How custody and transfer controls interact once an asset is held.
Who Is the Transfer Agent for a Tokenized Security?
The register side of the same architecture — who records ownership versus who holds it.
What Happens Now the GENIUS Act Rulemaking Deadline Passed?
The other rulemaking timeline that slipped, and how to build against rules that have not landed.