The Vault Rule Got Rewritten the Day Before She Left

OCTOBER 1, 2026

The SEC published a real rule proposal today, not a tweet about one, and it's about the single question that has quietly blocked your financial advisor from holding bitcoin for you since the industry started asking in earnest: where is it supposed to sit? Release 2026-100, out this afternoon, would amend the custody rule that governs every registered investment adviser and regulated fund in the country. Two things in it are worth your actual attention, and one piece of timing around it is the kind of detail that makes a story out of a rulemaking: the vote closed the agency's crypto-friendliest commissioner's business the week before she walked out the door for good.

The Rule Exists Because of a Lie

Start with why there's a custody rule at all. An investment adviser isn't supposed to just tell you your money's fine — the Advisers Act requires your assets to sit with an independent qualified custodian: a bank, a broker-dealer, a futures commission merchant, a few categories of foreign institution. The point is structural, not decorative. If the adviser also holds the assets, the adviser can show you whatever account statement it wants. Bernie Madoff ran his own back office for exactly that reason, and the rule in its modern form is the regulatory scar tissue from finding out what that costs.

Which is what makes today's proposal genuinely notable rather than just crypto-flavored housekeeping: it opens a path for an adviser to hold a client's crypto itself — the thing the rule was built to prevent — provided it clears a specific, conditioned bar. Chair Paul Atkins framed the underlying problem plainly in his own statement: "with newly developed crypto assets, custodial capabilities may lag an asset's deployment by many months." Translate that out of agency prose: a brand-new token can trade before any bank or broker-dealer has built a way to hold it, which leaves an adviser legally stuck — unable to buy something for a client because nobody qualified knows how to keep it safe yet. The proposal's answer isn't "wait for the custodians to catch up." It's "let the adviser hold it, with a lot of paperwork attached."

What "With a Lot of Paperwork" Actually Means

The self-custody option isn't a shrug. An adviser that wants to hold a client's crypto itself has to clear real, specific conditions, and they read like a checklist someone wrote after imagining exactly how this goes wrong:

• Prove there's no alternative, on a schedule. A written determination — made before taking self-custody, and then redone every quarter — that no qualified custodian is actually available for that asset. Not a one-time box to check and forget; a standing obligation to keep looking for an exit.
• Prove you know what you're doing. Documented expertise safeguarding that specific crypto asset, with systems covering private-key management and joint authorization by at least two people for any transaction — reviewed no less than once a year. One person with one key is exactly the failure mode this is written to rule out.
• Get checked by someone outside the building. At least annual reviews of cybersecurity controls, plus an internal-control report from an independent public accountant within six months of starting self-custody and every year after.

The second piece of the proposal is quieter but probably matters more in practice: it would let state-chartered trust companies count as qualified custodians for crypto. This sounds like a technicality and isn't one. Coinbase Custody, Anchorage Digital Bank, Fidelity Digital Assets, BitGo Trust — most of the firms institutions already trust to hold crypto are structured as state trust companies specifically because it was never settled whether that structure actually satisfied the federal definition of "bank" the custody rule has always used. The industry built its custody stack on an answer nobody had officially given yet. Today's proposal gives it.

The Timing Nobody Scripted

Here's the part that turns a rulemaking into a story. The commissioner most associated with crypto policy at the SEC, Hester Peirce — eight years on the Commission, the one people actually call by a nickname ("Crypto Mom"), director of the agency's Crypto Task Force since February 2025 — leaves the SEC tomorrow, October 2, for a law-professor post at Regent University. This proposal is one of the last things she'll have had a hand in. Her own statement on it reads less like routine commissioner boilerplate and more like a closing argument for a position she's held the whole time she's been there: "Regulators should zealously protect investors' right to self-custody and not attempt to force investors to custody their assets with someone else." She's careful to draw the line the proposal itself blurs for a casual reader — the "self-custody" in this rule is an adviser acting as its own custodian for a client's assets, not you personally holding your own keys — but the sentiment behind both is the same one she's been making in public for years, and it shipped days before she stopped being able to make it from inside the building.

There's a second layer under that. As of this week the SEC's five-seat Commission is running on three people — Atkins, Peirce, Uyeda — all Republican appointees, with both Democratic seats vacant since Caroline Crenshaw's term lapsed in January. A rule meant to balance competing interests just got voted on by a panel that currently has no one in the room arguing the other side. That's not a knock on this specific proposal, which genuinely does tighten some things (the two-person signoff, the mandatory outside audit) while loosening others — it's just worth knowing that "the SEC voted" right now means three people who already agree with each other on the basic premise that crypto custody rules need loosening, not a contested 3-2 the way most of this rule's predecessors were.

This Isn't the First Attempt, and the Last One Died for a Reason

Worth remembering before anyone treats this as crypto's custody problem finally solved: the SEC tried a custody overhaul before, under the previous chair, and it went the opposite direction. The February 2023 "Safeguarding" proposal would have widened the custody rule to cover essentially every client asset, crypto included, under the existing bank/broker-dealer-only definition of qualified custodian — which for crypto specifically would have meant most assets had nowhere compliant to live at all, since almost nothing cleared that bar. The industry's objection wasn't abstract: it would have made a large share of institutional crypto exposure effectively illegal to hold through an adviser. The SEC formally withdrew that proposal in June 2025, along with several other unfinished Gensler-era rulemakings, saying any future action would need a fresh proposal. This is that fresh proposal, and it solves the 2023 version's actual problem by widening who counts as qualified rather than widening what has to be qualified for. Same underlying rule, opposite lever.

The industry's early read, for what it's worth: NovaDius president Nate Geraci called the pace "moving quickly and aggressively," the kind of comment that reads as a compliment from someone who spent the last few years watching this exact rulemaking die once already.

What Happens Next, and Over What Timeline

None of this is law. It's a proposal, with a public comment period running 60 days from Federal Register publication — realistically into early December before the window even closes, and no fixed deadline after that for a final rule. If you're a crypto investor waiting for this to change anything about your own account tomorrow, it won't. If you're an adviser who's been stuck behind the custody gap Atkins described, the realistic timeline is "maybe sometime in 2027," not "maybe sometime next month." The vault door shown above is from 1908, back when "custody" meant a steel door and a combination dial two people had to be present to turn. The mechanism this proposal is actually arguing about — who's allowed to hold the key, and how many people have to agree before they turn it — hasn't changed as much as the asset behind the door has.

Where I Could Be Wrong

• The self-custody conditions are summarized from the SEC's own press release and fact sheet language as reported; I haven't read the full proposing release's rule text (typically 200+ pages for a release like this), which is where the precise legal conditions — and any exceptions I haven't seen described yet — actually live. Treat the bullet list above as the accurate shape of the requirement, not a verbatim legal quote.
• The vote count and whether it was unanimous among the three sitting commissioners is not something either the press release or Chair Atkins' statement states outright; I'm inferring "no internal dissent reported" from the absence of one, which is weaker than a stated 3-0.
• Peirce's statement is quoted from reporting on her remarks rather than a primary document I pulled and read in full myself; the self-custody distinction she draws (adviser self-custody vs. an individual holding their own keys) is accurately described as far as the reporting shows, but I'd treat the exact wording as close paraphrase until I can cite her own posted statement directly.
• The 2023-to-2026 history (the Safeguarding proposal's scope, its 2025 withdrawal, and why) is drawn from contemporaneous reporting on both events, not the SEC's own rule text for either.
• I hold Bitcoin and Strategy Inc. through my own trading system, and I have no stake in, and no relationship with, any custodian named here — Coinbase, Anchorage, Fidelity, or BitGo. None of this is investment advice, and nothing here changes what anyone should do with their own account before the rule is actually final.