What if custody, not market demand, is the real gatekeeper for crypto ETFs?
ETF approvals hinge on custody rules: how assets are held, audited, and legally separated.
Regulators want proof that private keys, segregation, and internal controls can stop theft or misappropriation.
My thesis: custody regulations set the pass/fail test for spot crypto ETFs by defining minimum security standards and the documentation sponsors must show at filing.
Clear custodian rules speed approvals; gaps in audits, contracts, or controls delay or kill applications.
Core Regulatory Relationship Between Custody Rules and Crypto ETF Approvals
Custody is the gating factor for crypto ETF approval. Digital assets need safeguards against theft, loss, and misappropriation that traditional securities custody frameworks weren’t built to handle. The SEC has to confirm whether an ETF sponsor can prove that investor assets will be held by a qualified custodian meeting standards under the Investment Company Act of 1940 and the Investment Advisers Act. Without verifiable proof that crypto assets are safeguarded through solid custody arrangements, the SEC won’t approve a spot crypto ETF. This isn’t negotiable. Custody regulations influence crypto ETF approvals by setting the baseline test for investor protection.
Historically, the SEC delayed or denied spot crypto ETF applications because of custody risk concerns. Regulators questioned whether existing custodians had the operational controls, legal clarity, and financial stability needed to safeguard digital assets. The No-Action Letter issued by the SEC Division of Investment Management on September 30, 2025 changed that. It clarified conditions under which state-chartered trust companies could be treated as qualified custodians for crypto assets. By recognizing entities like Coinbase Custody Trust Company, BitGo Trust Company, Paxos Trust Company, and Anchorage Digital Bank N.A. as acceptable custodians (provided they meet six enumerated conditions), the SEC expanded the universe of custodians available to ETF sponsors and removed a structural barrier.
ETF applicants now have to provide verifiable proof before approval can happen. That proof includes audited GAAP financial statements confirming the custodian’s solvency, recent SOC-1 or SOC-2 reports showing effective internal controls over safeguarding digital assets, and custody agreements with explicit prohibitions on lending or transferring assets without written consent. Applicants must also document segregation of client assets from the custodian’s proprietary holdings and provide risk disclosures to investors. Under the generic listing standards adopted by the SEC in January 2026, approval timelines dropped from as long as 270 days to 75 days or less. But only if custody evidence is sufficient and submitted at the outset.
How Qualified Custodian Requirements Shape ETF Approval Outcomes
Qualified custodian criteria define the minimum standards an entity must meet to be trusted with investor assets. The SEC relies on these when evaluating ETF filings because custody is the control mechanism that prevents theft, fraud, and operational failures from harming investors. Under Sections 17(f) and 26(a) of the Investment Company Act of 1940 and Rule 206(4)-2 under the Investment Advisers Act, ETF sponsors and registered investment advisers must place client assets with custodians satisfying specific legal, operational, and financial conditions. The SEC’s interpretation of what constitutes a “bank” or qualified custodian for crypto assets was unclear until the September 2025 No-Action Letter provided concrete guidance. That clarity allowed ETF applicants to structure custody arrangements with confidence that regulators would accept them.
Failing to meet any single condition triggers delays or outright denials. If an applicant uses a custodian lacking state authorization, the SEC will reject it. If audited GAAP financial statements are outdated or missing, the SEC can’t verify the custodian’s financial stability. If no SOC-1 or SOC-2 report is available, the SEC has no independent assurance that internal controls over digital asset safeguarding are effective. Each missing piece of documentation extends the review process and increases the likelihood of a request for additional information or conditional approval. The SEC uses these requirements as a filtration mechanism to ensure only well-structured, low-risk custody arrangements underpin approved ETFs.
The No-Action Letter identifies six explicit conditions that RIAs and regulated funds must confirm before relying on state trust companies as qualified custodians:
Authorization and policies: The state trust company must be authorized by the relevant State Banking Authority to provide custody for crypto assets and maintain policies safeguarding assets, with emphasis on private key management and cybersecurity.
Financial and control reports: The RIA or fund must review the state trust company’s most recent audited financial statements and internal control reports (SOC-1 or SOC-2) to confirm effective controls.
Custodial services agreement: A written agreement must prohibit the trust company from lending or pledging crypto assets without prior consent and must ensure segregation of client or fund assets from the custodian’s own assets.
Risk disclosure: Material risks of using state trust companies as custodians must be disclosed to clients or fund boards.
Best interest determination: The RIA or regulated fund must determine that using the state trust company’s custody services is in clients’ or shareholders’ best interests.
Adequate technology and operations: The custodian must demonstrate operational capacity to protect digital assets from misappropriation, including private key controls and cybersecurity processes.
Custody Weaknesses That Trigger SEC Rejections or Delays for Crypto ETFs
The SEC rejects or delays crypto ETF filings when custody controls are insufficient, opaque, or unverifiable. Common causes for rejection include the absence of SOC-1 or SOC-2 attestations, unclear or missing segregation policies, inadequate cybersecurity frameworks, and the inability to verify how private keys are managed and protected. If a custodian allows lending or pledging of client assets without explicit written consent, the SEC views that as a material risk to investor protection. Commingling client assets with the custodian’s proprietary holdings raises red flags because it exposes investors to the custodian’s credit risk and operational failures. Missing disclosures about custody risks (particularly regarding technology failures, cyber threats, or jurisdictional uncertainties) are seen as failures to meet basic fiduciary duties.
Weak operational controls are a frequent source of delays. If a custodian can’t demonstrate that private keys are stored securely, backed up, and subject to multisignature governance, the SEC questions whether the custodian can prevent internal fraud or external attacks. If reconciliation processes are infrequent or undocumented, the SEC can’t verify that reported holdings match actual custody balances. If the custodian’s disaster recovery and business continuity plans are generic or untested, the SEC sees heightened risk that a system failure or cyber incident could leave investors unable to access their assets. These operational gaps don’t necessarily result in outright denial, but they trigger requests for supplemental information and extend approval timelines well beyond the 75-day benchmark.
Applicants correct these issues by upgrading custodian relationships, obtaining recent SOC reports, negotiating custody agreements with explicit segregation and no-lending clauses, and preparing detailed risk disclosure sections for prospectuses and Form ADV. They document due diligence processes, including written evidence of reviewing audited financials and control reports, and they prepare best-interest determinations that explain why the chosen custodian arrangement benefits investors. Many sponsors engage law firms specializing in securities regulation to structure custody agreements and disclosure language that align with SEC expectations, reducing the likelihood of follow-up questions or conditional approvals.
Comparing Approved vs. Rejected Custody Arrangements in Crypto ETF Filings
Approved custody arrangements meet all six conditions outlined in the No-Action Letter and provide complete, verifiable documentation at the time of filing. Rejected or problematic arrangements fail on one or more dimensions, leaving the SEC unable to confirm that investor assets are adequately protected.
| Custody Feature | Approved ETF Standards | Rejected ETF Patterns |
|---|---|---|
| Authorization | State Banking Authority authorization verified; custodian supervised by regulator (e.g., NYDFS, Texas Department of Banking) | No state authorization; offshore or lightly regulated custodian; no evidence of supervisory oversight |
| Audits and SOC Reports | Recent audited GAAP financials and current SOC-1 or SOC-2 report reviewed and documented | Outdated or missing audited financials; no SOC report; or SOC report doesn’t cover crypto custody controls |
| Segregation Rights | Custody agreement mandates segregation of client assets from custodian’s proprietary holdings | Commingling permitted; unclear or silent on segregation; client assets at risk if custodian fails |
| Contract Restrictions | Express prohibition on lending or pledging without written consent; client retains control over asset transfers | Contract allows lending, pledging, or rehypothecation without client consent; assets subject to custodian’s creditors |
| Cybersecurity Controls | Documented private key management, multisignature governance, cold storage, HSM use, incident response plan | Weak or undocumented key management; single-signature control; limited or no cold storage; no SOC attestation on cybersecurity |
Meeting all approved standards increases the probability of expedient SEC approval because it removes uncertainty. When the SEC can verify that a state-authorized custodian holds audited financial strength, maintains effective controls attested by an independent auditor, and operates under a contract that protects client assets from lending and commingling, the regulatory review focuses on other ETF mechanics (pricing, liquidity, surveillance-sharing) rather than custody risk. Gaps in any of the five features listed above prompt requests for supplemental information, legal opinions, or alternative custodian arrangements, extending approval timelines and raising the risk of conditional or denied applications.
Operational Custody Controls That Improve ETF Approval Likelihood
Operational safeguards are the technical and procedural controls that translate custody agreements into actual asset protection. ETF sponsors must document how private keys are generated, stored, accessed, and backed up; how transactions are authorized and executed; and how the custodian detects and responds to cyber threats or operational failures. The SEC scrutinizes these details because digital assets are uniquely vulnerable to theft via compromised keys, insider fraud, or external hacking. Unlike traditional securities, where a custodian can reverse unauthorized transfers through legal processes, stolen crypto assets are often irrecoverable. This irreversibility makes operational controls a material factor in approval assessments.
Technical practices accelerate SEC approval when they’re documented, independently attested, and aligned with industry best practices. If a custodian’s SOC-2 report explicitly covers private key management, multisignature transaction approval, and cold storage air-gapping, the SEC gains confidence that operational risks are mitigated. If the ETF sponsor can demonstrate that the custodian reconciles on-chain balances daily and maintains disaster recovery procedures tested within the past year, the SEC views the arrangement as operationally resilient. These practices reduce enforcement exposure because they address the core risks (theft, loss, and misappropriation) that custody rules aim to prevent.
Key operational controls include:
Private key governance: Policies defining who can generate, access, and use private keys; role-based access controls; key rotation schedules; and audit trails for every key access event.
Multisignature custody solutions: Requirement that multiple authorized parties approve transactions, reducing single-point-of-failure risk from compromised keys or rogue insiders.
Cold storage best practices: Majority of assets held offline in air-gapped environments, with only operational liquidity kept in hot wallets; cold storage vaults physically secured and geographically distributed.
Hardware security modules (HSM): Use of tamper-resistant hardware devices to generate, store, and manage cryptographic keys, preventing software-based key extraction.
Reconciliation frequency: Daily or continuous comparison of internal ledger balances against on-chain blockchain records to detect discrepancies or unauthorized transfers immediately.
Disaster recovery for custodial systems: Documented backup procedures, redundant infrastructure, and tested recovery plans ensuring continuity after system failures, cyber incidents, or natural disasters.
Regulatory Frameworks Governing Crypto Custody for ETF Sponsors
Core custody provisions for ETFs are found in Sections 17(f) and 26(a) of the Investment Company Act of 1940 and Rule 206(4)-2 under the Investment Advisers Act. Section 17(f) requires investment companies to place securities in the custody of banks, members of national securities exchanges, or the company itself under specific conditions. Section 26(a) restricts unit investment trusts from depositing securities except with banks or member firms meeting defined standards. Rule 206(4)-2 imposes parallel custody obligations on registered investment advisers, making it fraudulent for an adviser to have custody of client funds or securities unless assets are maintained with a qualified custodian. The statutory definition of “bank” under Section 2(a)(5) of the 1940 Act and Section 202(a)(2) of the Advisers Act historically referred to institutions chartered under federal or state banking laws and supervised by banking authorities. The ambiguity around whether state trust companies conducting primarily fiduciary rather than deposit-taking business qualified as “banks” created uncertainty until the No-Action Letter clarified that custodians meeting the six enumerated conditions would be treated as qualified custodians for enforcement purposes.
CFTC and FINRA oversight intersects with SEC custody standards when ETF sponsors use CFTC-regulated crypto futures to satisfy one of the three qualification paths under the SEC’s January 2026 generic listing framework. If an ETF relies on the existence of CFTC-regulated futures trading for at least six months to meet approval criteria, the sponsor must coordinate custody and operational practices across differing regulatory regimes. Futures commission merchants (FCMs) acting as custodians for crypto derivatives are subject to CFTC customer protection rules, which require segregation of customer funds and assets from the FCM’s proprietary holdings. FINRA guidance applies when broker-dealers provide custody services for crypto assets, requiring compliance with the Customer Protection Rule (Rule 15c3-3), which mandates possession or control of fully paid and excess margin securities. These multi-agency custody standards don’t conflict, but they do require ETF sponsors to document compliance with overlapping requirements and maintain custody agreements that satisfy SEC, CFTC, and FINRA expectations simultaneously.
ETF sponsors must align multi-agency custody standards because approval and ongoing compliance depend on satisfying all applicable regulators. An ETF holding spot crypto assets and crypto futures must demonstrate that spot assets are held by SEC-qualified custodians meeting the No-Action Letter conditions, while futures positions are held by FCMs in compliance with CFTC segregation rules. If the ETF uses a broker-dealer for cash management or securities lending, that firm must meet FINRA custody and capital requirements. Failure to align these standards creates regulatory gaps that can trigger enforcement actions, limit product functionality, or result in approval delays.
State Trust Companies as Qualified Custodians
The No-Action Letter reclassified state-chartered trust companies as qualified custodians by providing a framework under which they can be treated as “banks” for custody purposes under the 1940 Act and Advisers Act. Before the letter, the SEC hadn’t definitively stated whether trust companies authorized to exercise fiduciary powers but not engaged primarily in deposit-taking met the statutory definition of “bank.” The September 2025 guidance resolved that ambiguity by articulating six conditions (authorization by state banking authorities, audited financials, SOC attestations, segregation and no-lending contract terms, risk disclosures, and best-interest determinations) that allow RIAs and regulated funds to rely on state trust companies without enforcement risk. This expanded the custodian universe significantly, making it feasible for ETF sponsors to choose from entities like Coinbase Custody Trust Company, BitGo Trust Company, Paxos Trust Company, and Anchorage Digital Bank N.A., all of which are state-chartered and supervised by regulators like the New York Department of Financial Services and the Texas Department of Banking. The expanded pool reduces concentration risk and increases competition, improving custodian service quality and pricing for ETF sponsors.
Impact of Cross-Border and Multi-Jurisdictional Custody on ETF Approval
U.S. crypto ETF approval becomes more complex when custodians or underlying assets operate across multiple jurisdictions. International custody frameworks such as the EU’s Markets in Crypto Assets Regulation (MiCA), the UK Financial Conduct Authority’s rules on custody and operational resilience, and the Monetary Authority of Singapore’s digital payment token custody regime all emphasize segregation, independent audits, and safeguarding obligations similar to U.S. standards. But differences in legal definitions, enforcement mechanisms, and supervisory intensity mean that an ETF sponsor using a foreign custodian must reconcile those differences while satisfying U.S. SEC requirements. MiCA mandates that crypto asset service providers segregate client assets and maintain insurance or comparable guarantees, while the UK FCA requires firms to demonstrate operational resilience through scenario testing and recovery planning. These requirements parallel the SEC’s expectations but are enforced under different legal regimes with varying penalties and supervisory practices.
Cross-border custody heightens complexity because crypto assets are globally fungible and stored on decentralized networks, yet custody arrangements are governed by national regulations. An ETF holding Bitcoin might rely on a custodian domiciled in the United States, but that custodian could use sub-custodians or cold storage facilities located in Switzerland, Singapore, or other jurisdictions. Each jurisdiction imposes its own custody, AML, data privacy, and consumer protection rules. If a foreign sub-custodian suffers a breach or regulatory action, the ETF sponsor and primary custodian can face liability or asset recovery challenges under foreign law. The SEC requires disclosure of these jurisdictional risks in the ETF prospectus, and approval likelihood decreases if the sponsor can’t demonstrate clear legal rights to recover assets held abroad or if foreign custody arrangements lack equivalent safeguards to U.S. standards.
Documentation, Disclosure, and Due Diligence Needed for Crypto ETF Approval
The SEC requires comprehensive documentation and disclosure before approving a crypto ETF. Sponsors must provide audited GAAP financial statements for each custodian to verify solvency and financial stability. Recent SOC-1 or SOC-2 reports are required to independently attest that internal controls over digital asset safeguarding are designed and operating effectively. Risk disclosures must be included in the prospectus and Form ADV, covering custody-related risks like cyber threats, private key loss, custodian insolvency, jurisdictional uncertainties, and the irreversibility of blockchain transactions. Sponsors must document a best-interest determination explaining why the chosen custody arrangement benefits investors, addressing factors like custodian reputation, control environment, cost, and operational capacity.
Due diligence evidence must be preserved in written form and made available to SEC examiners on request. This includes correspondence with custodians, copies of custody agreements, summaries of SOC report findings, and board or investment committee minutes approving the custody selection. Vendor risk management processes must be documented, demonstrating how the sponsor evaluated the custodian’s financial health, operational controls, insurance coverage, and regulatory standing before execution.
Required documentation includes:
Audited GAAP financial statements from the custodian’s most recent fiscal year.
SOC-1 or SOC-2 reports covering controls relevant to digital asset custody, typically issued within the past 12 months.
Risk disclosures in the prospectus and adviser disclosure documents detailing custody-related threats to investor assets.
Best-interest analysis documenting the rationale for selecting the custodian and how the arrangement aligns with investor interests.
Due diligence evidence including written reviews of custodian authorization, financials, controls, and operational capacity, along with governance meeting records approving the custody structure.
How Custody Structures Influence ETF Liquidity, Market Integrity, and Investor Protection
Strong custody arrangements improve ETF liquidity by ensuring that authorized participants can create and redeem shares efficiently. If a custodian can rapidly verify holdings, process transfers, and reconcile blockchain transactions, authorized participants face lower operational friction when executing large creation or redemption orders. Custody transparency (demonstrated through proof-of-reserves reporting, real-time on-chain verification, and regular audits) enhances market confidence, attracting institutional investors and tightening bid-ask spreads. Opaque or unreliable custody reduces liquidity because market participants demand higher risk premiums and authorized participants hesitate to commit capital when asset safeguarding is uncertain.
Custody structures also influence market integrity and manipulation risk. The SEC noted in its 2026 guidance that manipulation risk increases when ETFs hold large portions of thin crypto markets. If an ETF custodian doesn’t provide detailed transparency into holdings and transaction flows, regulators and market participants can’t detect whether the ETF sponsor or custodian is engaging in manipulative trading. Surveillance-sharing agreements between custodians, exchanges, and ETF sponsors improve manipulation defense by allowing regulators to cross-check trading data and identify coordinated wash trading or spoofing. Custody visibility (such as public disclosure of wallet addresses or participation in blockchain analytics platforms) enables independent verification that reported holdings match on-chain balances, reducing information asymmetry and supporting investor protection.
Key dimensions include:
Liquidity: Fast, reliable custody operations reduce friction in ETF creation/redemption, tightening spreads and supporting price discovery.
Transparency: Proof-of-reserves disclosures and on-chain verification build market confidence and attract institutional capital.
Manipulation defense: Surveillance-sharing agreements and custodian transparency enable regulators to detect wash trading, spoofing, and coordinated manipulation.
Investor protection: Strong custody controls and clear legal rights to segregated assets reduce theft risk and improve recovery prospects in the event of custodian failure or fraud.
Final Words
Custody was the real gate. We showed why qualified custodians, audited GAAP, SOC reports, segregation, and strong private-key controls are what the SEC is checking now.
We walked through common flaws that trigger delays and how the 2025 No‑Action Letter broadened acceptable custodians while keeping tight safeguards.
Understanding how custody regulations influence crypto ETF approvals gives sponsors a clear, practical checklist: fix custody gaps, document controls, and you materially boost the chance of a faster, cleaner approval.
FAQ
Q: Who approves crypto ETFs?
A: The Securities and Exchange Commission (SEC) approves crypto ETFs. It reviews custody, market surveillance, and disclosures; CFTC and FINRA rules can matter, and the 2025 No‑Action Letter expanded acceptable custodians.
Q: Can I lose my crypto with a custodian?
A: You can lose crypto with a custodian if they lack controls, suffer theft, insolvency, or rehypothecate assets. Choose custodians with audited financials, SOC reports, segregation, and clear insurance to lower risk.
Q: What is the crypto custody rule?
A: The crypto custody rule is the SEC’s requirement that funds use qualified custodians and robust controls—rooted in the 1940 Act and Advisers Act—covering segregation, audits, SOC attestations, and no‑lending clauses.
Q: Did SEC approve XRP ETF?
A: The SEC has not approved a spot XRP ETF; approvals hinge on legal clarity and custody evidence. Some issuers have filed, but final SEC approval hasn’t been granted.
